diff --git a/docs/START_HERE.md b/docs/START_HERE.md index d7459a1..e8c616c 100644 --- a/docs/START_HERE.md +++ b/docs/START_HERE.md @@ -99,6 +99,10 @@ iamscope why --help Examples that operate on scenario, report, or diff files require existing local fixture or sanitized scenario files. They should not perform live collection. +### Local Demo + +Local demo: [Path Overcounting and Shared Uncertainty](case-studies/path-overcounting-shared-uncertainty.md) shows how IAMScope separates naive path-shaped rows from validated, blocked, precondition-only, and inconclusive fixture verdicts without making live AWS or replay-equivalence claims. + ### Live AWS Collection Live `iamscope collect` is not the default path. It is advanced/authorized only. diff --git a/tests/test_path_overcounting_shared_uncertainty_runner.py b/tests/test_path_overcounting_shared_uncertainty_runner.py index b60ff39..5885e9b 100644 --- a/tests/test_path_overcounting_shared_uncertainty_runner.py +++ b/tests/test_path_overcounting_shared_uncertainty_runner.py @@ -42,7 +42,7 @@ def test_runner_defaults_output_under_tmp() -> None: shutil.rmtree(DEFAULT_OUT, ignore_errors=True) -def test_runner_writes_to_temp_output_directory(tmp_path: Path) -> None: +def test_documented_runner_command_smoke_writes_expected_outputs(tmp_path: Path) -> None: output_dir = tmp_path / "demo-output" result = _run_runner("--out", str(output_dir)) assert result.returncode == 0, result.stderr @@ -62,6 +62,19 @@ def test_runner_writes_to_temp_output_directory(tmp_path: Path) -> None: assert verdict_summary["aws_calls_made"] == 0 assert verdict_summary["live_aws_used"] is False + groups = json.loads((output_dir / "uncertainty-groups.json").read_text()) + assert groups["report_only"] is True + assert groups["groups"] == { + "shared_passrole_target_resource_scope_unknown": 8, + "shared_boundary_context_unresolved": 2, + "session_policy_context_missing": 1, + } + assert groups["non_claims"]["does_not_mutate_findings"] is True + assert groups["non_claims"]["does_not_change_verdicts"] is True + assert groups["non_claims"]["does_not_infer_exploitability"] is True + assert groups["non_claims"]["does_not_claim_replay_equivalence"] is True + assert groups["non_claims"]["requires_aws_credentials"] is False + def test_runner_uncertainty_group_counts(tmp_path: Path) -> None: output_dir = tmp_path / "demo-output"