From 4e5a53cb752a8d36cbdab5a88c75191a8f4fae3a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Samo=20A=C4=8Dko?= Date: Mon, 14 Sep 2026 12:41:42 +0200 Subject: [PATCH 1/2] Open audit overflow test Phase A Delivery #390: publish the proposed one-test clock assertion correction in the draft PR description. This commit intentionally changes no files and does not implement the proposal. From c430cf8140b43d36f041bb92382c7cfdd1481eeb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Samo=20A=C4=8Dko?= Date: Mon, 14 Sep 2026 13:16:06 +0200 Subject: [PATCH 2/2] Check audit overflow observation against query time Keep the existing ordering and closure controls while comparing the final result with PostgreSQL time before and after observation. Permit only the exact result justified by the measured interval, preserving active-bucket exclusion when observed. Delivery #390; approved decision OFARM2-AUDIT-OVERFLOW-CLOCK-TEST-001 version 1. --- .../tests/test_postgresql_audit_operations.py | 24 +++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/kernel/tests/test_postgresql_audit_operations.py b/kernel/tests/test_postgresql_audit_operations.py index f9e09ddd..d14b63ae 100644 --- a/kernel/tests/test_postgresql_audit_operations.py +++ b/kernel/tests/test_postgresql_audit_operations.py @@ -527,9 +527,29 @@ def test_overflow_observation_returns_one_oldest_closeable_bucket( """, (newer,), ).fetchone() - assert control.execute( + observed_before = control.execute( + "SELECT pg_catalog.clock_timestamp()" + ).fetchone()[0] + remaining = control.execute( """ SELECT * FROM ofarm_security.observe_next_closeable_overflow_bucket() """ - ).fetchall() == [] + ).fetchall() + observed_after = control.execute( + "SELECT pg_catalog.clock_timestamp()" + ).fetchone()[0] + timing = (current_bucket, observed_before, observed_after) + assert observed_before <= observed_after, timing + expires_at = current_bucket + timedelta(minutes=1) + expected_remaining = [ + ("REQUEST_ROUTER_BOUNDARY_V1", "REQUEST_ROUTER", current_bucket) + ] + # The setup bucket can expire while the earlier buckets are closed. + if observed_after < expires_at: + assert remaining == [], timing + elif observed_before >= expires_at: + assert remaining == expected_remaining, timing + else: + # Expiry fell inside the call; either exact result is legitimate. + assert remaining in ([], expected_remaining), timing