Skip to content

The numbers, proven

The headline figures live in the table at the top of this document; this section holds the commands and tests behind them, so every figure is checkable rather than asserted.

The tests, each named for the property it defends. The load-bearing ones:

  • test_matrix.py: every route is either in the role matrix or explicitly public, the documented route enumeration in the route surface section above matches the live route table in both directions, and every matrix row is exercised with a real session per role, allow and refuse both asserted.
  • test_ingest.py, test_ingest_authz.py, and two Hypothesis property suites: hostile, truncated, and mixed-account files are rejected whole; nothing the caller sent is echoed back.
  • test_findings.py and test_privilege.py: the 20 finding codes, each carrying its OWASP Non-Human Identities anchor; admin equivalence judged by capability, not name.
  • test_governance.py: set, supersede, clear, and attest, attributed and audited; an assigned owner answers the unowned finding; a disagreement with the tag is surfaced.
  • test_campaigns.py: the population freezes, a decision is final within its campaign, notes are required where meaning needs them, close refuses gaps, the delta reads what changed.
  • test_reports.py: formula cells arrive neutralized, hostile markup arrives escaped, report figures equal engine figures.
  • test_frontend.py: the page has no markup sink, no inline script, a hostile name survives as data end to end, the script never sets a style property, and every text and background pair in both themes meets the accessibility contrast ratio, computed from the stylesheet's own tokens by scripts/check_contrast.py.
  • test_browser.py: the page proven by use (D-077). A real browser signs in, opens an identity beside the list, writes an authorization and sees it held, decides a campaign item, reads the delta by one class, switches the theme, and signs out, against the application on a throwaway database seeded by the demo; a script error anywhere fails the walk. It runs in the pipeline's browser job from a tree pinned by hash in requirements-browser.txt, and skips wherever that tree is not installed.
  • test_auth.py and test_ratelimit.py: indistinguishable login failures, revocation, expiry, a forged token refused beside a live session, and the write budget holding.

Coverage is 94 percent, floored at 90 in the pipeline. The floor sits under the measured figure to catch erosion without inviting tests written to move a number.

Thirty-four mutations, thirty-four kills. The mutation check breaks one control at a time and requires the tests that claim that control to fail. The table is generated from the check's own list by scripts/check_mutation.py --table, and a test fails the build when the two differ, so the count here is the count the check runs:

| Mutation | Killed by |
|---|---|
| Assumable access is reported as if it were held | the paths, delta tests |
| The doors an identity may cross are not reported | the delta tests |
| The actions a changed definition gained go unnamed | the role_definitions tests |
| A custom definition nobody authorized goes unreported | the role_definitions tests |
| A delta-driven campaign ignores the delta | the campaigns tests |
| A failed delivery is recorded as delivered | the alerts tests |
| A revoked integration token still reads | the api tests |
| The source check accepts a mismatched file | the generic_import tests |
| Authorization check removed | the matrix tests |
| The scope check answers yes for every node | the scope tests |
| The organization's required fields stop being enforced | the authorizations tests |
| An expired authorization still reads as live | the authorizations tests |
| A file import stops naming the mapping that read it | the csv_import tests |
| A date is guessed when the mapping declares no format | the csv_import tests |
| The delta stops noticing access nobody authorized | the delta tests |
| An expired authorization still covers the access it granted | the delta tests |
| Audit rows silently dropped | the governance tests |
| Session tokens no longer hashed uniquely | the auth tests |
| Rate limiter always allows | the ratelimit tests |
| Formula escaping removed from the CSV exit | the reports tests |
| Assigned owners no longer answer the unowned finding | the governance tests |
| Campaigns close with undecided items | the campaigns tests |
| A capability document that administers reads as nothing | the github_import tests |
| A child team's members are not the parent's members | the github_import tests |
| The verbs that hand out roles do not change access | the kubernetes_import tests |
| A namespace binding is recorded at the cluster | the kubernetes_import tests |
| A provider-managed key is recorded as a credential | the google_cloud_import tests |
| A permission that sets policy does not change access | the google_cloud_import tests |
| An eligibility is recorded as standing access | the azure_import tests |
| A guest is recorded as a member of the directory | the azure_import tests |
| A federated user is given an Okta password | the okta_import tests |
| An inactive role assignment is recorded as held | the okta_import tests |
| A disabled account's password is recorded as live | the active_directory_import tests |
| An inherited control right is recorded as obtainable | the active_directory_import tests |

On its first run the token-hashing mutation survived: every test presented a real token or none, so a constant hash matched any fabricated token and nothing noticed. The missing test exists, which is the check doing exactly what it is for.

The decisions, migrations, and required checks the opening table counts. Every merge to main passes secret scanning, writing rules and status-truth gates, workflow lint and audit, link checks, the application job with the coverage floor and mutation check, two static analysis passes, and the container job. Every run also delivers the software bill of materials as a downloadable artifact; the reasoning for delivering it fresh rather than committing it is in How it was built and gated.