Jeremie Fraeys
61660dc925
refactor: co-locate security, storage, telemetry, tracking, worker tests
...
Move unit tests from tests/unit/ to internal/ following Go conventions:
Security tests:
- tests/unit/security/* -> internal/security/* (audit, config_integrity, filetype, gpu_audit, hipaa_validation, manifest_filename, path_traversal, resource_quota, secrets)
Storage tests:
- tests/unit/storage/* -> internal/storage/* (db, experiment_metadata)
Telemetry tests:
- tests/unit/telemetry/* -> internal/telemetry/* (telemetry)
Tracking tests:
- tests/unit/reproducibility/* -> internal/tracking/* (config_hash, environment_capture)
Worker tests:
- tests/unit/worker/* -> internal/worker/* (artifacts, config, hash_bench, plugins/jupyter_task, plugins/vllm, prewarm_v1, run_manifest_execution, snapshot_stage, snapshot_store, worker)
Update import paths in test files to reflect new locations.
2026-03-12 16:37:03 -04:00
Jeremie Fraeys
a8180f1f26
feat(security): HIPAA compliance mode and PHI denylist validation
...
Add compliance_mode field to Config with strict HIPAA validation:
- Requires SnapshotStore.Secure=true in HIPAA mode
- Requires NetworkMode="none" for tenant isolation
- Requires non-empty SeccompProfile
- Requires NoNewPrivileges=true
- Enforces credentials via environment variables only (no inline YAML)
Add PHI denylist validation for AllowedSecrets:
- Blocks secrets matching patterns: patient, ssn, mrn, medical_record,
diagnosis, dob, birth, mrn_number, patient_id, patient_name
- Prevents accidental PHI exfiltration via secret channels
Add comprehensive test coverage in hipaa_validation_test.go:
- Network mode enforcement tests
- NoNewPrivileges requirement tests
- Seccomp profile validation tests
- Inline credential rejection tests
- PHI denylist validation tests
Closes: compliance_mode, PHI denylist items from security plan
2026-02-23 19:43:19 -05:00
