cayu.testing.verify_provider_credential_isolation
Part of cayu.testing.base. Read the Python API overview and install the required extra.
from cayu.testing import verify_provider_credential_isolationProbe that provider credentials are absent from an execution boundary.
Provider canaries are comparison-only trusted inputs: they are never passed
to the runner. operational_env and workload_env are positive
controls which must be observable in the guest so an empty or broken probe
cannot produce a false success. Raw stdout, stderr, artifacts, the complete
guest environment, and the presence of Cayu auth files are inspected before
content-free evidence is returned. Auth-file contents are never read.
local_environment proves only default environment minimization. It does
not claim filesystem or process isolation for LocalRunner.
async verify_provider_credential_isolation(runner: Runner, *, adapter: str, scope: Literal['isolated_guest', 'local_environment'], provider_canaries: Mapping[str, str], operational_env: Mapping[str, str], workload_env: Mapping[str, str] | None=None, guest_cwd: str | None=None, guest_auth_search_paths: Mapping[str, str] | None=None, timeout_s: int=30) -> ProviderCredentialIsolationVerification