@raishin/vanguard-frontier-agentic 1.9.0 → 2.0.1

package/tests/integration/rbac-pre-flight/lib/common.sh

@@ -0,0 +1,252 @@
+#!/usr/bin/env bash
+# lib/common.sh — shared helpers for RBAC pre-flight integration tests.
+# Guard scripts source this file; do NOT set -e here since denied checks
+# intentionally return exit code 1 from kubectl.
+
+# ---------------------------------------------------------------------------
+# Color output (suppressed when not a TTY)
+# ---------------------------------------------------------------------------
+if [ -t 1 ]; then
+  _GREEN='\033[0;32m'
+  _RED='\033[0;31m'
+  _YELLOW='\033[0;33m'
+  _CYAN='\033[0;36m'
+  _RESET='\033[0m'
+else
+  _GREEN=''
+  _RED=''
+  _YELLOW=''
+  _CYAN=''
+  _RESET=''
+fi
+
+# ---------------------------------------------------------------------------
+# Global counters (reset per guard via report_guard)
+# ---------------------------------------------------------------------------
+GUARD_PASS=0
+GUARD_FAIL=0
+GUARD_SKIP=0
+
+TOTAL_PASS=0
+TOTAL_FAIL=0
+TOTAL_SKIP=0
+
+# ---------------------------------------------------------------------------
+# require_kubectl — abort early if kubectl is not on PATH
+# ---------------------------------------------------------------------------
+require_kubectl() {
+  if ! command -v kubectl &>/dev/null; then
+    printf '%bFATAL: kubectl not found in PATH. Install kubectl >= 1.28 and retry.%b\n' \
+      "$_RED" "$_RESET" >&2
+    exit 1
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# _run_can_i — internal helper
+#   Usage: _run_can_i <verb> <resource> [extra kubectl flags...] --as=<SA>
+#   Returns the raw output of kubectl auth can-i (yes/no) in CANI_OUTPUT.
+#   Returns 0 on success, non-zero on kubectl error (distinct from denied).
+# ---------------------------------------------------------------------------
+_run_can_i() {
+  # kubectl auth can-i exits 0 for "yes" and 1 for "no".
+  # We capture output regardless of exit code.
+  CANI_OUTPUT=$(kubectl auth can-i "$@" 2>&1)
+  CANI_EXIT=$?
+  # Propagate real errors (not the normal denied exit) to the caller.
+  # kubectl prints "yes\n" or "no\n"; anything else is an error.
+  case "$CANI_OUTPUT" in
+    yes*|no*) return 0 ;;
+    *) return 2 ;;   # unexpected output / server error
+  esac
+}
+
+# ---------------------------------------------------------------------------
+# assert_cannot — check that an SA does NOT have a permission
+#   Usage: assert_cannot <verb> <resource> [kubectl-flags...] (SA must be in flags)
+# ---------------------------------------------------------------------------
+assert_cannot() {
+  local description="$*"
+  _run_can_i "$@"
+  local rc=$?
+
+  if [ $rc -eq 2 ]; then
+    printf '  %b[SKIP]%b cannot %-60s  (kubectl error: %s)\n' \
+      "$_YELLOW" "$_RESET" "$description" "$CANI_OUTPUT"
+    (( GUARD_SKIP++ )) || true
+    return
+  fi
+
+  if [ "$CANI_OUTPUT" = "no" ]; then
+    printf '  %b[PASS]%b cannot %s\n' "$_GREEN" "$_RESET" "$description"
+    (( GUARD_PASS++ )) || true
+  else
+    printf '  %b[FAIL]%b cannot %-60s  (got: %s — binding is over-scoped)\n' \
+      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+    (( GUARD_FAIL++ )) || true
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# assert_can — check that an SA DOES have a permission
+#   Usage: assert_can <verb> <resource> [kubectl-flags...] (SA must be in flags)
+# ---------------------------------------------------------------------------
+assert_can() {
+  local description="$*"
+  _run_can_i "$@"
+  local rc=$?
+
+  if [ $rc -eq 2 ]; then
+    printf '  %b[SKIP]%b can    %-60s  (kubectl error: %s)\n' \
+      "$_YELLOW" "$_RESET" "$description" "$CANI_OUTPUT"
+    (( GUARD_SKIP++ )) || true
+    return
+  fi
+
+  if [ "$CANI_OUTPUT" = "yes" ]; then
+    printf '  %b[PASS]%b can    %s\n' "$_GREEN" "$_RESET" "$description"
+    (( GUARD_PASS++ )) || true
+  else
+    printf '  %b[FAIL]%b can    %-60s  (got: %s — binding is under-scoped)\n' \
+      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+    (( GUARD_FAIL++ )) || true
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# assert_can_or_skip — like assert_can but treats "NotFound" CRD errors as SKIP
+#   Use for Gateway API / Cilium / Istio / Argo CD / Velero / Kyverno CRDs that
+#   may not exist in a vanilla kind cluster.
+# ---------------------------------------------------------------------------
+assert_can_or_skip() {
+  local description="$*"
+  _run_can_i "$@"
+  local rc=$?
+
+  if [ $rc -eq 2 ]; then
+    # CRD not installed — skip rather than fail
+    printf '  %b[SKIP]%b can    %-60s  (CRD not found — install CRDs to test)\n' \
+      "$_YELLOW" "$_RESET" "$description"
+    (( GUARD_SKIP++ )) || true
+    return
+  fi
+
+  if [ "$CANI_OUTPUT" = "yes" ]; then
+    printf '  %b[PASS]%b can    %s\n' "$_GREEN" "$_RESET" "$description"
+    (( GUARD_PASS++ )) || true
+  else
+    printf '  %b[FAIL]%b can    %-60s  (got: %s — binding is under-scoped)\n' \
+      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+    (( GUARD_FAIL++ )) || true
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# assert_cannot_or_skip — like assert_cannot but treats "NotFound" as SKIP
+#   Use for domain-specific must-not checks on CRDs that may not be installed.
+# ---------------------------------------------------------------------------
+assert_cannot_or_skip() {
+  local description="$*"
+  _run_can_i "$@"
+  local rc=$?
+
+  if [ $rc -eq 2 ]; then
+    printf '  %b[SKIP]%b cannot %-60s  (CRD not found — install CRDs to test)\n' \
+      "$_YELLOW" "$_RESET" "$description"
+    (( GUARD_SKIP++ )) || true
+    return
+  fi
+
+  if [ "$CANI_OUTPUT" = "no" ]; then
+    printf '  %b[PASS]%b cannot %s\n' "$_GREEN" "$_RESET" "$description"
+    (( GUARD_PASS++ )) || true
+  else
+    printf '  %b[FAIL]%b cannot %-60s  (got: %s — binding is over-scoped)\n' \
+      "$_RED" "$_RESET" "$description" "$CANI_OUTPUT"
+    (( GUARD_FAIL++ )) || true
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# run_universal_must_not — runs the 21 universal must-not-be-yes checks
+#   Usage: run_universal_must_not <SA>
+# ---------------------------------------------------------------------------
+run_universal_must_not() {
+  local SA="$1"
+  printf '%b  -- universal must-not-be-yes --%b\n' "$_CYAN" "$_RESET"
+
+  assert_cannot '*' '*' --all-namespaces "--as=$SA"
+  assert_cannot delete namespaces "--as=$SA"
+  assert_cannot delete pods -n kube-system "--as=$SA"
+  assert_cannot create pods/exec -n kube-system "--as=$SA"
+  assert_cannot create pods/portforward --all-namespaces "--as=$SA"
+  assert_cannot delete daemonsets -n kube-system "--as=$SA"
+  assert_cannot delete deployments -n kube-system "--as=$SA"
+  assert_cannot create customresourcedefinitions "--as=$SA"
+  assert_cannot delete customresourcedefinitions "--as=$SA"
+  assert_cannot get secrets --all-namespaces "--as=$SA"
+  assert_cannot create clusterrolebindings "--as=$SA"
+  assert_cannot create mutatingwebhookconfigurations.admissionregistration.k8s.io "--as=$SA"
+  assert_cannot delete mutatingwebhookconfigurations.admissionregistration.k8s.io "--as=$SA"
+  assert_cannot create validatingwebhookconfigurations.admissionregistration.k8s.io "--as=$SA"
+  assert_cannot create apiservices.apiregistration.k8s.io "--as=$SA"
+  assert_cannot update certificatesigningrequests.certificates.k8s.io --subresource=approval "--as=$SA"
+  assert_cannot create serviceaccounts/token --all-namespaces "--as=$SA"
+  assert_cannot delete priorityclasses.scheduling.k8s.io "--as=$SA"
+  assert_cannot delete ingressclasses.networking.k8s.io "--as=$SA"
+  assert_cannot delete leases.coordination.k8s.io -n kube-node-lease "--as=$SA"
+  assert_cannot update namespaces/finalize "--as=$SA"
+}
+
+# ---------------------------------------------------------------------------
+# begin_guard — print guard header and reset per-guard counters
+# ---------------------------------------------------------------------------
+begin_guard() {
+  local guard_name="$1"
+  GUARD_PASS=0
+  GUARD_FAIL=0
+  GUARD_SKIP=0
+  printf '\n%b=== Guard: %s ===%b\n' "$_CYAN" "$guard_name" "$_RESET"
+}
+
+# ---------------------------------------------------------------------------
+# report_guard — print per-guard summary and accumulate totals
+#   Returns 1 if this guard had any failures (for run-all.sh to track).
+# ---------------------------------------------------------------------------
+report_guard() {
+  local guard_name="$1"
+  local status_color="$_GREEN"
+  local status_word="PASS"
+
+  if [ "$GUARD_FAIL" -gt 0 ]; then
+    status_color="$_RED"
+    status_word="FAIL"
+  fi
+
+  printf '%b  %s: %d passed, %d failed, %d skipped%b\n' \
+    "$status_color" "$status_word" \
+    "$GUARD_PASS" "$GUARD_FAIL" "$GUARD_SKIP" \
+    "$_RESET"
+
+  (( TOTAL_PASS += GUARD_PASS )) || true
+  (( TOTAL_FAIL += GUARD_FAIL )) || true
+  (( TOTAL_SKIP += GUARD_SKIP )) || true
+
+  [ "$GUARD_FAIL" -eq 0 ]  # returns 1 when there are failures
+}
+
+# ---------------------------------------------------------------------------
+# report_total — print final summary across all guards
+# ---------------------------------------------------------------------------
+report_total() {
+  printf '\n%b========================================%b\n' "$_CYAN" "$_RESET"
+  if [ "$TOTAL_FAIL" -eq 0 ]; then
+    printf '%bALL GUARDS PASSED%b  (%d passed, %d skipped)\n' \
+      "$_GREEN" "$_RESET" "$TOTAL_PASS" "$TOTAL_SKIP"
+  else
+    printf '%bFAILURES DETECTED%b  (%d passed, %d failed, %d skipped)\n' \
+      "$_RED" "$_RESET" "$TOTAL_PASS" "$TOTAL_FAIL" "$TOTAL_SKIP"
+  fi
+  printf '%b========================================%b\n' "$_CYAN" "$_RESET"
+  [ "$TOTAL_FAIL" -eq 0 ]
+}

package/tests/integration/rbac-pre-flight/run-all.sh

@@ -0,0 +1,229 @@
+#!/usr/bin/env bash
+# tests/integration/rbac-pre-flight/run-all.sh
+#
+# Regression harness for all 7 live-guard least-privilege RBAC manifests.
+# Creates a kind cluster, applies all RBAC manifests, runs every guard's
+# pre-flight assertion matrix, tears down the cluster, and reports totals.
+#
+# Usage:
+#   ./run-all.sh                         # full run (creates + destroys cluster)
+#   ./run-all.sh --skip-cluster-create   # use an existing cluster
+#   ./run-all.sh --guard=network-arch    # run one guard only
+#   ./run-all.sh --skip-cluster-create --guard=rbac-mutation
+#
+# Environment variables:
+#   KIND_K8S_VERSION   kind node image tag (default: v1.30.6)
+#
+# Exit codes:
+#   0  all guards passed (skips do not count as failures)
+#   1  one or more assertions failed
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Resolve paths relative to this script regardless of caller's cwd
+# ---------------------------------------------------------------------------
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+LOG_FILE="/tmp/rbac-preflight-$(date +%Y%m%d-%H%M%S).log"
+
+# ---------------------------------------------------------------------------
+# Defaults
+# ---------------------------------------------------------------------------
+SKIP_CLUSTER_CREATE=false
+ONLY_GUARD=""
+CLUSTER_NAME="vanguard-rbac-test"
+KIND_IMAGE="kindest/node:${KIND_K8S_VERSION:-v1.30.6}"
+
+# ---------------------------------------------------------------------------
+# Parse arguments
+# ---------------------------------------------------------------------------
+for arg in "$@"; do
+  case "$arg" in
+    --skip-cluster-create)
+      SKIP_CLUSTER_CREATE=true
+      ;;
+    --guard=*)
+      ONLY_GUARD="${arg#--guard=}"
+      ;;
+    --help|-h)
+      grep '^#' "$0" | sed 's/^# \?//'
+      exit 0
+      ;;
+    *)
+      printf 'Unknown argument: %s\n' "$arg" >&2
+      exit 1
+      ;;
+  esac
+done
+
+# ---------------------------------------------------------------------------
+# Source the shared library
+# ---------------------------------------------------------------------------
+# shellcheck source=lib/common.sh
+source "$SCRIPT_DIR/lib/common.sh"
+
+require_kubectl
+
+# ---------------------------------------------------------------------------
+# Cluster lifecycle
+# ---------------------------------------------------------------------------
+create_cluster() {
+  if ! command -v kind &>/dev/null; then
+    printf '%bFATAL: kind not found in PATH. Install kind >= 0.22 and retry.%b\n' \
+      "$_RED" "$_RESET" >&2
+    exit 1
+  fi
+
+  printf '%bCreating kind cluster %s (%s)...%b\n' \
+    "$_CYAN" "$CLUSTER_NAME" "$KIND_IMAGE" "$_RESET"
+
+  kind create cluster \
+    --name "$CLUSTER_NAME" \
+    --image "$KIND_IMAGE" \
+    --config - <<'EOF'
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+  - role: control-plane
+EOF
+
+  printf '%bCluster ready.%b\n' "$_GREEN" "$_RESET"
+}
+
+delete_cluster() {
+  if command -v kind &>/dev/null; then
+    printf '\n%bDeleting kind cluster %s...%b\n' "$_CYAN" "$CLUSTER_NAME" "$_RESET"
+    kind delete cluster --name "$CLUSTER_NAME" 2>/dev/null || true
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# Cleanup trap — always remove the cluster on exit unless skipped
+# ---------------------------------------------------------------------------
+cleanup() {
+  local exit_code=$?
+  if [ "$SKIP_CLUSTER_CREATE" = "false" ]; then
+    delete_cluster
+  fi
+  if [ -f "$LOG_FILE" ]; then
+    printf '\nTest output saved to: %s\n' "$LOG_FILE"
+  fi
+  exit $exit_code
+}
+trap cleanup EXIT
+
+# ---------------------------------------------------------------------------
+# Apply RBAC manifests
+# ---------------------------------------------------------------------------
+apply_rbac_manifests() {
+  printf '\n%bApplying RBAC manifests...%b\n' "$_CYAN" "$_RESET"
+
+  # Ensure the vanguard-system namespace exists
+  kubectl create namespace vanguard-system --dry-run=client -o yaml \
+    | kubectl apply -f -
+
+  local manifests=(
+    "skills/kubernetes/kubernetes-live-network-architecture-mutation-guard/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-network-policy-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-admission-policy-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-argocd-sync-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-rbac-mutation-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-velero-restore-guard-agent/references/least-privilege-rbac.yaml"
+  )
+
+  for manifest in "${manifests[@]}"; do
+    local full_path="$REPO_ROOT/$manifest"
+    if [ ! -f "$full_path" ]; then
+      printf '%bWARN: manifest not found, skipping: %s%b\n' \
+        "$_YELLOW" "$full_path" "$_RESET" >&2
+      continue
+    fi
+    printf '  Applying %s\n' "$manifest"
+    kubectl apply -f "$full_path"
+  done
+
+  printf '%bManifests applied.%b\n' "$_GREEN" "$_RESET"
+}
+
+# ---------------------------------------------------------------------------
+# Source guard files and run them
+# ---------------------------------------------------------------------------
+# shellcheck source=guards/network-arch.sh
+source "$SCRIPT_DIR/guards/network-arch.sh"
+# shellcheck source=guards/network-policy.sh
+source "$SCRIPT_DIR/guards/network-policy.sh"
+# shellcheck source=guards/mesh-policy.sh
+source "$SCRIPT_DIR/guards/mesh-policy.sh"
+# shellcheck source=guards/admission-policy.sh
+source "$SCRIPT_DIR/guards/admission-policy.sh"
+# shellcheck source=guards/argocd-sync.sh
+source "$SCRIPT_DIR/guards/argocd-sync.sh"
+# shellcheck source=guards/rbac-mutation.sh
+source "$SCRIPT_DIR/guards/rbac-mutation.sh"
+# shellcheck source=guards/velero-restore.sh
+source "$SCRIPT_DIR/guards/velero-restore.sh"
+
+run_guards() {
+  # Map of guard names to their runner functions
+  declare -A GUARD_FN=(
+    [network-arch]=run_guard_network_arch
+    [network-policy]=run_guard_network_policy
+    [mesh-policy]=run_guard_mesh_policy
+    [admission-policy]=run_guard_admission_policy
+    [argocd-sync]=run_guard_argocd_sync
+    [rbac-mutation]=run_guard_rbac_mutation
+    [velero-restore]=run_guard_velero_restore
+  )
+
+  # Ordered list (bash 3 compat — no associative array ordering guarantee)
+  local GUARD_ORDER=(
+    network-arch
+    network-policy
+    mesh-policy
+    admission-policy
+    argocd-sync
+    rbac-mutation
+    velero-restore
+  )
+
+  if [ -n "$ONLY_GUARD" ]; then
+    if [ -z "${GUARD_FN[$ONLY_GUARD]+_}" ]; then
+      printf '%bUnknown guard: %s%b\n' "$_RED" "$ONLY_GUARD" "$_RESET" >&2
+      printf 'Available guards: %s\n' "${GUARD_ORDER[*]}" >&2
+      exit 1
+    fi
+    "${GUARD_FN[$ONLY_GUARD]}"
+  else
+    for guard in "${GUARD_ORDER[@]}"; do
+      "${GUARD_FN[$guard]}" || true  # failures tracked in counters; don't abort
+    done
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+{
+  printf '%b=== Vanguard RBAC Pre-flight Integration Test ===%b\n' "$_CYAN" "$_RESET"
+  printf 'Cluster: %s | Image: %s\n' "$CLUSTER_NAME" "$KIND_IMAGE"
+  printf 'Log: %s\n' "$LOG_FILE"
+
+  if [ "$SKIP_CLUSTER_CREATE" = "false" ]; then
+    create_cluster
+  else
+    printf '%b(--skip-cluster-create: using current kubeconfig context)%b\n' \
+      "$_YELLOW" "$_RESET"
+  fi
+
+  apply_rbac_manifests
+  run_guards
+
+  # report_total exits 1 if any failures
+  if report_total; then
+    exit 0
+  else
+    exit 1
+  fi
+} 2>&1 | tee "$LOG_FILE"

package/tests/test-copilot-skill-bundling.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Test: --platform copilot bundles companion skills into .github/skills/.
+
+TDD RED/GREEN test for GitHub Copilot skill bundling in the exporter.
+
+Run:
+    python3 tests/test-copilot-skill-bundling.py
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+EXPORTER = ROOT / "scripts" / "export-marketplace-agents.mjs"
+
+# aws-agentcore-agent has a companion skill (aws-agentcore) via name-stripping
+AGENT_ID = "aws-agentcore-agent"
+SKILL_ID = "aws-agentcore"
+
+
+def run_export(repo: Path, platform: str, agents: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [
+            "node",
+            str(EXPORTER),
+            "--platform",
+            platform,
+            "--agents",
+            agents,
+            "--repo",
+            str(repo),
+        ],
+        capture_output=True,
+        text=True,
+        cwd=str(ROOT),
+    )
+
+
+def test_copilot_skill_bundled_to_github_skills() -> None:
+    """Companion skill must land in .github/skills/<skill-id>/SKILL.md."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        repo = Path(tmpdir)
+        result = run_export(repo, "copilot", AGENT_ID)
+
+        if result.returncode != 0:
+            print("STDOUT:", result.stdout)
+            print("STDERR:", result.stderr)
+            raise AssertionError(
+                f"Exporter exited with code {result.returncode}"
+            )
+
+        skill_md = repo / ".github" / "skills" / SKILL_ID / "SKILL.md"
+        if not skill_md.exists():
+            print("STDOUT:", result.stdout)
+            print("STDERR:", result.stderr)
+            raise AssertionError(
+                f"Expected skill file not found: {skill_md}\n"
+                f"Directory tree under .github/skills: "
+                + str(list((repo / ".github" / "skills").rglob("*")) if (repo / ".github" / "skills").exists() else [])
+            )
+
+        # Also verify the agent itself was installed to .github/agents/
+        agent_files = list((repo / ".github" / "agents").rglob("*.agent.md")) if (repo / ".github" / "agents").exists() else []
+        if not agent_files:
+            raise AssertionError(
+                f"Expected agent file in .github/agents/ but found none"
+            )
+
+        print(f"PASS: skill bundled to {skill_md.relative_to(repo)}")
+        print(f"PASS: agent installed to {agent_files[0].relative_to(repo)}")
+
+
+def test_copilot_no_skills_flag_suppresses_bundling() -> None:
+    """--no-skills must suppress companion skill bundling."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        repo = Path(tmpdir)
+        result = subprocess.run(
+            [
+                "node",
+                str(EXPORTER),
+                "--platform",
+                "copilot",
+                "--agents",
+                AGENT_ID,
+                "--repo",
+                str(repo),
+                "--no-skills",
+            ],
+            capture_output=True,
+            text=True,
+            cwd=str(ROOT),
+        )
+
+        if result.returncode != 0:
+            raise AssertionError(
+                f"Exporter exited with code {result.returncode}\n"
+                f"STDERR: {result.stderr}"
+            )
+
+        skill_md = repo / ".github" / "skills" / SKILL_ID / "SKILL.md"
+        if skill_md.exists():
+            raise AssertionError(
+                f"Skill file should NOT exist with --no-skills: {skill_md}"
+            )
+
+        print("PASS: --no-skills suppresses skill bundling for copilot platform")
+
+
+if __name__ == "__main__":
+    failures = []
+    for test_fn in [
+        test_copilot_skill_bundled_to_github_skills,
+        test_copilot_no_skills_flag_suppresses_bundling,
+    ]:
+        try:
+            test_fn()
+        except AssertionError as exc:
+            failures.append(f"FAIL [{test_fn.__name__}]: {exc}")
+            print(f"FAIL [{test_fn.__name__}]: {exc}")
+
+    if failures:
+        sys.exit(1)
+    else:
+        print("All tests passed.")
+        sys.exit(0)