mirror of
https://github.com/hanzoai/ci.git
synced 2026-10-27 09:19:34 +00:00
zeekayandHanzo Dev
66ff0c46ea
certclaims read a report as something other than a claim, so "our SOC 2 report is available under NDA" passed while "SOC 2 certified" did not. Possessing a report is the same statement: an audit produced it. Offering the document we do write stays sayable through the request shapes, which now cover demand as well — asking for it is what makes going to get it honest. The suite expected a denial and two hedges to pass. They are flagged now. A page that says what we do not hold, or what is underway, has answered a question nobody asked and dates itself the day it ships. Co-authored-by: Hanzo Dev <[email protected]>
34 lines
1.7 KiB
Bash
Executable File
34 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# certclaims_test.sh — the cases certclaims exists for, and the ones it must not
|
|
# fire on. Every FAIL case below is a sentence that was live on a Hanzo surface.
|
|
# A public page says what we hold. It does not deny, hedge, or date itself with
|
|
# what is underway, so those are flagged for deletion like any other claim.
|
|
set -euo pipefail
|
|
here="$(cd "$(dirname "$0")" && pwd)"
|
|
tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
|
|
cd "$tmp"; git init -q .
|
|
|
|
want() { # want <expect-exit> <name> <line>
|
|
local expect="$1" name="$2" line="$3"
|
|
rm -f ./*.tsx; printf '%s\n' "$line" > "case.tsx"; git add -A >/dev/null 2>&1
|
|
set +e; "$here/certclaims" . >/dev/null 2>&1; local got=$?; set -e
|
|
if [ "$got" != "$expect" ]; then echo "FAIL($name): want exit $expect, got $got"; echo " $line"; exit 1; fi
|
|
echo " ok: $name"
|
|
}
|
|
|
|
echo "must FAIL (claims we cannot produce):"
|
|
want 1 "certified" 'SOC 2 Type II certified, GDPR compliant, and ISO 27001 certified'
|
|
want 1 "third-party" 'audited and certified by independent third-party auditors'
|
|
want 1 "report under NDA" 'Our SOC 2 report is available to enterprise customers under NDA.'
|
|
want 1 "maintains" 'We maintain SOC 2 Type II certification'
|
|
want 1 "completed" 'has completed SOC 2 Type II certification'
|
|
|
|
echo "must PASS (nothing to answer for):"
|
|
want 1 "denial" 'We do not hold SOC 2 Type II, ISO 27001 or HIPAA certification today.'
|
|
want 0 "controls" 'Controls aligned to the SOC 2 Type II control set.'
|
|
want 1 "in progress" 'SOC 2 Type II audit in progress.'
|
|
want 1 "planned" 'SOC 2 Type II — controls aligned; assessment planned'
|
|
want 0 "no framework" 'Encryption at rest with per-tenant keys.'
|
|
|
|
echo "certclaims: all cases pass"
|