ms-markets 3.0.0.dev40__tar.gz → 3.0.1.dev41__tar.gz

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project follows versioned releases.
 
 ## [Unreleased]
 
+### Removed
+
+- The registry write allow-list of 3.0.0: `apps.v1.policy` and the Main Sequence
+  Constant `MARKETS_REGISTRY_WRITERS`. Which applications may trigger registry
+  writes is the platform's grant: an application reaches the Markets API only
+  when its workflow grants it the `MainSequenceMarkets` branch, and every
+  caller the API admits may write. `registry_write` still records the acting
+  identity of every write. A deployment that created the constant can delete it.
+
 ## [3.0.0] - 2026-10-26
 
 Breaking release 3.0.0. It renames the DataNode vocabulary to the MetaTables

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-markets
-Version: 3.0.0.dev40
+Version: 3.0.1.dev41
 Summary: Financial markets ORM, engines, and application management extensions for Main Sequence.
 Project-URL: Changelog, https://github.com/mainsequence-projects/MainSequenceMarkets/blob/main/CHANGELOG.md
 Project-URL: Source, https://github.com/mainsequence-projects/MainSequenceMarkets

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/docs/ADR/0047-markets-api-application-boundary.md

@@ -154,10 +154,11 @@ Organization admin can enable it: the declaration takes effect only when the
 person who pushes it is an Organization admin, and otherwise the resource fails
 before it deploys. Services enforce
 domain policy: ownership and Team scoping for
-portfolios, accounts, indexes and formula definitions, and application-level
-permissions such as "this application may register accounts". Writes keep
-running as the Markets workload, whose Writer grant is the single place writes
-are allowed; the API's policy decides who may trigger them.
+portfolios, accounts, indexes and formula definitions. Writes keep running as
+the Markets workload, whose Writer grant is the single place writes are
+allowed. Which applications may trigger them is the platform's grant: an
+application reaches the Markets API only when its workflow grants it the
+`MainSequenceMarkets` branch.
 
 ### 4. Provider-owned namespaces and sidecars
 
@@ -393,13 +394,9 @@ Deviations and open items:
 - Ownership and Team scoping policies are not enforced yet; the helper gives
   every service one identity to authorize against, and the platform's own
   grants still apply to requester-bound reads.
-- Application-level permission ("this application may register accounts") is
-  enforced by `apps.v1.policy`: an application (workload identity) triggers a
-  registry write only when the `MARKETS_REGISTRY_WRITERS` constant lists its
-  User uid for that resource or for `"*"`; otherwise the route returns `403`.
-  People, requester-bound calls, Organization admins and calls outside a
-  request are not restricted by it. A missing constant allows no application;
-  an unreadable or malformed one fails closed with `503`.
+- Application-level permission is the platform's grant, not a Markets
+  setting: an application whose workflow grants it the `MainSequenceMarkets`
+  branch reaches the API and may trigger registry writes.
 - `acts_for_requester: true` on the `markets-api` resource is required for a
   requester to be present. It is declared in
   `.mainsequence/workflows/ms-markets-api.yaml`, and it takes effect only when
@@ -419,7 +416,7 @@ route for:
   rebalancing uses, and the instance methods `FormulaIndex.activate()` and
   `retire()`. Schedules now read `CalendarSession.filter` with range bounds;
   activation and retirement go through `FormulaIndex.activate_definition` and
-  `retire_definition`, which are policy-checked writes.
+  `retire_definition`, which are registry writes.
 - Added reads: `filter`/`count` range lookups (`__gte`, `__gt`, `__lte`,
   `__lt`); `AssetSnapshots.latest` by identifier, uid or ticker; `offset` on
   `GET /portfolio/values/`, which `MarketsClient.portfolio_values` uses to page
@@ -484,8 +481,8 @@ application still installs `ms-markets`. Deviations and refinements:
   branch, as the Markets API does for MetaTables.
 - Remote `delete` runs the resource's service delete with its preflight
   checks, and exists only where one exists.
-- Registry writes through these routes are subject to the registry write
-  policy of decision 3.
+- Registry writes through these routes run through `registry_write`, like the
+  service routes.
 
 ### 2026-10-25: step 1, missing routes
 

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/docs/fast_api/v1/index.md

@@ -223,42 +223,11 @@ write and, after a successful write, records resource, action, row uid and the
 acting identity's uid and kind on the `apps.v1.identity` logger. No registry
 table has an author or owner column yet; when one does, the same hook supplies
 its value. Writes keep running as the Markets workload, whose `data_writer`
-role on `mainsequence.markets` is the single place writes are allowed; the API's
-policy decides who may trigger them.
-
-That policy is `apps.v1.policy.authorize_registry_write`, which `registry_write`
-runs before every registry write:
-
-| Acting identity | Registry writes |
-|---|---|
-| none (Markets' own Jobs, scripts, direct service calls) | allowed |
-| a requester-bound call (a person acting through an application) | allowed |
-| an Organization admin | allowed |
-| a person calling directly | allowed |
-| an application (workload identity) listed for the resource | allowed |
-| any other application | `403` |
-
-The allow-list is the Main Sequence Constant `MARKETS_REGISTRY_WRITERS` in the
-Markets deployment's Environment: a JSON object that maps a registry resource,
-as `registry_write` names it (`account`, `asset`, `asset-category`, `calendar`,
-`index`, `portfolio`, `portfolio-group`, `portfolio-signal`, `pricing-curve`,
-`pricing-market-data` and the resources added with the provider write routes), or
-`"*"`, to the User uids of the applications allowed to write it:
-
-```json
-{"asset": ["<provider workload user uid>"], "*": ["<trusted workload user uid>"]}
-```
-
-A missing constant allows no application. A value that is not such an object,
-or a constant the Markets workload cannot read, refuses every application write
-with `503`. Whether a caller is a person or an application is read from its
-User once and cached for ten minutes; the SDK caches the constant for ten
-minutes as well, so an edit takes effect within that time. The Markets workload
-needs `reader` on the constant:
-
-```bash
-mainsequence constants access grant <MARKETS_REGISTRY_WRITERS constant uid> reader --user <markets workload user uid>
-```
+role on `mainsequence.markets` is the single place writes are allowed. Who may
+trigger them is the platform's grant: an application's workload reaches the
+Markets API only when its workflow grants it the `MainSequenceMarkets` branch
+(see the [client guide](../../knowledge/msm/client/index.md)), and every caller
+the API admits, person or application, may trigger registry writes.
 
 A requester is only present when the `markets-api` resource declares
 `acts_for_requester: true` in `.mainsequence/workflows/ms-markets-api.yaml`.

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/docs/fast_api/v1/rows.md

@@ -49,8 +49,7 @@ Writes (`create`, `upsert`, `update`, `delete`, `add`, `bulk_delete`,
 `create_from_pandas_calendar`, `reconcile_dataset_availability`, `upsert_many`,
 `add_many`, `create_index_curve_selection`, `upsert_index_curve_selection`,
 `publish`, `register`, `register_signal`, `unregister`, `unregister_signal`, `reconcile`, `activate_definition`,
-`retire_definition`) run through `registry_write`, so the registry write policy
-applies to applications.
+`retire_definition`) run through `registry_write`, which records who made them.
 A table row class's `delete` runs the resource's service delete with its
 preflight checks and exists only for `asset`, `asset-category`, `calendar`,
 `index`, `portfolio` and `portfolio-group`. Composites that implement `delete`
@@ -67,8 +66,7 @@ the `msm_pricing.api` composites (`curve`, `curve-building-details`,
 | Status | Meaning | `error_type` |
 |---|---|---|
 | 400 | Invalid arguments | `ValueError`, `TypeError` |
-| 403 | The registry write policy refused this application | |
+| 403 | The operation refused the acting identity | `PermissionError` or a subclass |
 | 404 | Unknown resource or operation, or the row was not found | `LookupError` |
 | 409 | The operation conflicted with existing rows | the conflict class name |
 | 501 | The operation is not offered remotely | `NotImplementedError` |
-| 503 | The registry write policy could not be read | |

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/docs/knowledge/msm/client/index.md

@@ -61,14 +61,12 @@ access:
 | `MARKETS_API_RELEASE_UID` | Use this release instead of searching. |
 | `MARKETS_API_RELEASE_NAME`, `MARKETS_API_REPOSITORY_NAME` | Search for another release or repository name. |
 
-## Writes And The Registry Write Policy
+## Writes
 
 Every create, upsert, update and delete runs through the Markets API's
-`registry_write`, so the registry write policy applies: an application may
-write a resource only when the Environment's `MARKETS_REGISTRY_WRITERS`
-constant lists its workload User uid for that resource or for `"*"`. A refused
-write raises `msm.api.remote.MarketsAccessError`, a `PermissionError`. See
-[the FastAPI guide](../../../fast_api/v1/index.md) for the constant's format.
+`registry_write`, which records the acting identity on the API's audit log. Any
+workload the platform admits to the Markets API may write; a refused operation
+(`403`) raises `msm.api.remote.MarketsAccessError`, a `PermissionError`.
 
 A table row class's remote `delete` runs the resource's service delete, with
 its preflight checks, and exists only for `asset`, `asset-category`,
@@ -143,7 +141,6 @@ AssetSnapshots.publish([{"asset_identifier": "ACME", "time_index": as_of, "name"
 current = AssetSnapshots.latest(tickers=["ACME"])
 ```
 
-Their write-policy resources are `account-holdings` and `asset-snapshots`.
 `AssetSnapshots.latest` takes exactly one of `asset_identifiers`, `asset_uids`
 or `tickers` and returns each existing asset with its latest snapshot
 (`AssetSnapshotReference`: name, ticker, exchange code, snapshot time; `None`

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/docs/knowledge/msm/indices/formula_indexes.md

@@ -153,7 +153,7 @@ Activating a successor closes the open predecessor at the successor's
 `valid_from`. Retired versions cannot be reactivated. `activate()` and
 `retire()` call the class methods `FormulaIndex.activate_definition(uid)` and
 `FormulaIndex.retire_definition(uid, valid_to=...)`, so they also run under the
-remote row backend (write-policy resource `formula-index`).
+remote row backend.
 
 ## Preview Persisted Formulas
 

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/docs/knowledge/msm_portfolios/portfolios/index.md

@@ -467,7 +467,7 @@ enters `update_hash`.
 An application on the remote row backend registers and reconciles the catalog
 with `msm_portfolios.api.datasets.PortfolioDatasets.register(...)`,
 `.reconcile(...)` and `.get(...)`, which run the services below on the Markets
-API (write-policy resource `portfolio-datasets`). `register` binds the
+API. `register` binds the
 portfolio's current signal; `PortfolioDatasets.register_signal({"signal_uid":
 ..., "signal_meta_table_uid": ...})` binds any other signal, such as the earlier
 signals of a producer whose signal uid changes each run, after verifying the
@@ -587,8 +587,8 @@ first on a rollback. Calendar events are not copied: the engine rebuilds them.
 run the moves a provider callable returns (it receives `rollback=` when it
 accepts that argument); without `--execute` they only count.
 The operator needs `data_viewer` on the tables read, write access to the tables
-written (a rollback writes the core tables) and the write-policy resource
-`portfolio-datasets`; pause the provider's runs while a move or rollback runs.
+written (a rollback writes the core tables); pause the provider's runs while a
+move or rollback runs.
 
 ## Repair legacy midnight-indexed portfolio values
 

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/docs/planning/implementation_tasks/markets_contracts_package_and_client_plan.md

@@ -4,7 +4,7 @@
 
 Design note, drafted 2026-10-25 for [ADR 0047](../../ADR/0047-markets-api-application-boundary.md)
 decision 2 and migration path step 2. Updated 2026-10-26: the remote row
-backend, `msm.client` and the registry write policy are implemented, with the
+backend and `msm.client` are implemented, with the
 deviations recorded in the ADR's "step 2" implementation note (per-method
 dispatch instead of a `RowBackend` protocol, mixed backends per row class,
 release name `api`). The distribution split (order of work, step 5) is not. Step 1

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-markets"
-version = "3.0.0.dev40"
+version = "3.0.1.dev41"
 description = "Financial markets ORM, engines, and application management extensions for Main Sequence."
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/src/msm/api/remote.py

@@ -75,7 +75,7 @@ WRITE_OPERATIONS = frozenset(
     }
 )
 """Operations that create, update or delete registry rows; the API wraps them in
-``registry_write`` so the registry write policy applies."""
+``registry_write``, which records who made them."""
 
 
 class RemoteBackend(Protocol):

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/tests/conftest.py

@@ -129,20 +129,3 @@ def offline_postgresql_runtime(monkeypatch):
 
     monkeypatch.setattr(metatables.runtime_context, "get_runtime_context", get_runtime_context)
     return runtime
-
-
-@pytest.fixture(autouse=True)
-def offline_registry_write_policy(monkeypatch):
-    """Evaluate the registry write policy without the platform (ADR 0047).
-
-    By default no application is on the allow-list and every caller is a
-    person, which is how the API behaved before the policy. Policy tests replace
-    these with ``monkeypatch``.
-    """
-
-    from apps.v1 import policy
-
-    monkeypatch.setattr(
-        policy, "load_registry_writer_policy", lambda: policy.RegistryWriterPolicy(writers={})
-    )
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "human")

{ms_markets-3.0.0.dev40 → ms_markets-3.0.1.dev41}/tests/msm/client/test_remote_backend.py

@@ -17,7 +17,6 @@ from typing import Any
 import pytest
 from fastapi.testclient import TestClient
 
-from apps.v1 import policy
 from apps.v1.main import app
 from msm.api.accounts import Account
 from msm.api.assets import Asset, AssetCategory, CurrencySpot
@@ -218,28 +217,6 @@ def test_validation_errors_come_back_as_value_errors(remote) -> None:
         Asset.upsert(asset_type="equity")
 
 
-def test_the_write_policy_applies_to_remote_writes(monkeypatch, remote) -> None:
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "workload")
-    monkeypatch.setattr(
-        "msm.repositories.crud.upsert_model",
-        lambda *args, **kwargs: pytest.fail("a refused write must not reach the runtime"),
-    )
-
-    with pytest.raises(MarketsAccessError, match="MARKETS_REGISTRY_WRITERS"):
-        Asset.upsert(unique_identifier="ACME")
-    assert isinstance(MarketsAccessError("x"), PermissionError)
-
-
-def test_reads_are_not_subject_to_the_write_policy(monkeypatch, remote) -> None:
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "workload")
-    monkeypatch.setattr(
-        "msm.repositories.crud.get_model_by_uid",
-        lambda context, *, model, uid: {"rows": []},
-    )
-
-    assert Asset.get_by_uid(uuid.uuid4()) is None
-
-
 def test_start_engine_attaches_nothing_under_the_remote_backend(monkeypatch, remote) -> None:
     monkeypatch.setattr(
         "msm.bootstrap.start_engine",
@@ -410,15 +387,20 @@ def test_holdings_and_snapshots_publish_through_markets(monkeypatch, remote) ->
         ("formula-index", "retire_definition", {"definition_uid": str(uuid.uuid4())}),
     ],
 )
-def test_every_publication_and_catalog_write_is_policy_checked(
+def test_every_publication_and_catalog_write_is_a_registry_write(
     monkeypatch, remote, resource, operation, arguments
 ) -> None:
     from msm.api.remote import WRITE_OPERATIONS
 
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "workload")
+    def resolve() -> None:
+        raise PermissionError("registry_write resolved the acting identity")
+
+    # registry_write resolves the acting identity before the operation runs; the
+    # refusal comes back as the client's PermissionError.
+    monkeypatch.setattr("apps.v1.identity.acting_identity", resolve)
 
     assert operation in WRITE_OPERATIONS
-    with pytest.raises(MarketsAccessError, match="MARKETS_REGISTRY_WRITERS"):
+    with pytest.raises(MarketsAccessError, match="registry_write resolved the acting identity"):
         remote.client.run_row_operation(resource, operation, arguments)
 
 

ms_markets-3.0.0.dev40/tests/msm/fastapi/v1/test_registry_write_policy.py

@@ -1,191 +0,0 @@
-"""ADR 0047, decision 3: who may trigger a registry write.
-
-Applications (workload identities) write registry rows only when the
-``MARKETS_REGISTRY_WRITERS`` constant lists them for the resource; people,
-requester-bound calls, Organization admins and calls without a request keep
-working as before.
-"""
-
-from __future__ import annotations
-
-import uuid
-from types import SimpleNamespace
-
-import pytest
-from fastapi.testclient import TestClient
-from mainsequence.server.caller_assertions import ASSERTION_HEADER
-
-from apps.v1 import policy
-from apps.v1.identity import ActingIdentity, registry_write
-from apps.v1.main import app
-
-# Captured at import, before the autouse fixture in tests/conftest.py stubs them.
-REAL_LOAD_POLICY = policy.load_registry_writer_policy
-REAL_RESOLVE_IDENTITY_TYPE = policy.resolve_identity_type
-
-APPLICATION_UID = "7d0c8e1a-2b3c-4d5e-8f9a-0b1c2d3e4f5a"
-OTHER_APPLICATION_UID = "8e1d9f2b-3c4d-4e5f-9a0b-1c2d3e4f5a6b"
-
-
-def _use(monkeypatch, *, writers: dict, identity_types: dict | None = None) -> None:
-    monkeypatch.setattr(
-        policy,
-        "load_registry_writer_policy",
-        lambda: policy.RegistryWriterPolicy.from_value(writers),
-    )
-    types = identity_types or {}
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: types.get(uid, "human"))
-
-
-def _caller(uid: str, **kwargs) -> ActingIdentity:
-    return ActingIdentity(uid=uid, kind="caller", **kwargs)
-
-
-def test_an_application_needs_an_allow_list_entry(monkeypatch) -> None:
-    _use(
-        monkeypatch,
-        writers={"asset": [APPLICATION_UID]},
-        identity_types={APPLICATION_UID: "workload", OTHER_APPLICATION_UID: "workload"},
-    )
-
-    policy.authorize_registry_write("asset", "create", _caller(APPLICATION_UID))
-    with pytest.raises(policy.RegistryWriteForbidden, match="MARKETS_REGISTRY_WRITERS"):
-        policy.authorize_registry_write("portfolio", "create", _caller(APPLICATION_UID))
-    with pytest.raises(policy.RegistryWriteForbidden):
-        policy.authorize_registry_write("asset", "create", _caller(OTHER_APPLICATION_UID))
-
-
-def test_the_wildcard_entry_covers_every_resource(monkeypatch) -> None:
-    _use(
-        monkeypatch,
-        writers={"*": [APPLICATION_UID]},
-        identity_types={APPLICATION_UID: "workload"},
-    )
-
-    policy.authorize_registry_write("portfolio", "update", _caller(APPLICATION_UID))
-    policy.authorize_registry_write("index", "create", _caller(APPLICATION_UID))
-
-
-def test_people_requesters_admins_and_direct_calls_are_not_restricted(monkeypatch) -> None:
-    _use(monkeypatch, writers={}, identity_types={APPLICATION_UID: "workload"})
-
-    policy.authorize_registry_write("asset", "create", None)
-    policy.authorize_registry_write("asset", "create", _caller("a-person"))
-    policy.authorize_registry_write(
-        "asset", "create", ActingIdentity(uid="a-person", kind="requester")
-    )
-    policy.authorize_registry_write(
-        "asset", "create", _caller(APPLICATION_UID, is_organization_admin=True)
-    )
-
-
-def test_an_allow_listed_caller_needs_no_user_lookup(monkeypatch) -> None:
-    monkeypatch.setattr(
-        policy,
-        "load_registry_writer_policy",
-        lambda: policy.RegistryWriterPolicy.from_value({"asset": [APPLICATION_UID]}),
-    )
-
-    def lookup(_uid):
-        raise AssertionError("an allow-listed caller must not need a User lookup")
-
-    monkeypatch.setattr(policy, "resolve_identity_type", lookup)
-
-    policy.authorize_registry_write("asset", "create", _caller(APPLICATION_UID))
-
-
-@pytest.mark.parametrize(
-    "value",
-    ['{"asset": "not-a-list"}', "[1, 2]", "{not json", '{"asset": 7}'],
-)
-def test_a_malformed_allow_list_fails_closed(value) -> None:
-    with pytest.raises(policy.RegistryWritePolicyError):
-        policy.RegistryWriterPolicy.from_value(value)
-
-
-def test_missing_constant_allows_no_application(monkeypatch) -> None:
-    from mainsequence.client import Constant
-    from mainsequence.client.utils import DoesNotExist
-
-    def missing(_name):
-        raise DoesNotExist("no constant")
-
-    monkeypatch.setattr(Constant, "get_value", classmethod(lambda cls, name: missing(name)))
-
-    assert REAL_LOAD_POLICY().writers == {}
-
-
-def test_an_unreachable_constant_fails_closed(monkeypatch) -> None:
-    from mainsequence.client import Constant
-
-    def unreachable(cls, name):
-        raise ConnectionError("platform unreachable")
-
-    monkeypatch.setattr(Constant, "get_value", classmethod(unreachable))
-
-    with pytest.raises(policy.RegistryWritePolicyError, match="ConnectionError"):
-        REAL_LOAD_POLICY()
-
-
-def test_identity_type_is_read_once_and_cached(monkeypatch) -> None:
-    from mainsequence.client.models_user import User
-
-    calls: list[str] = []
-
-    def get_by_uid(uid):
-        calls.append(uid)
-        return SimpleNamespace(identity_type="workload")
-
-    monkeypatch.setattr(User, "get_by_uid", classmethod(lambda cls, uid: get_by_uid(uid)))
-    policy.clear_identity_type_cache()
-
-    assert REAL_RESOLVE_IDENTITY_TYPE(APPLICATION_UID) == "workload"
-    assert REAL_RESOLVE_IDENTITY_TYPE(APPLICATION_UID) == "workload"
-    assert calls == [APPLICATION_UID]
-    policy.clear_identity_type_cache()
-
-
-def test_registry_write_refuses_before_the_service_runs(monkeypatch) -> None:
-    _use(monkeypatch, writers={}, identity_types={APPLICATION_UID: "workload"})
-    monkeypatch.setattr(
-        "apps.v1.identity.acting_identity", lambda: _caller(APPLICATION_UID)
-    )
-    ran: list[bool] = []
-
-    @registry_write("asset", "create")
-    def create_asset():
-        ran.append(True)
-
-    with pytest.raises(policy.RegistryWriteForbidden):
-        create_asset()
-    assert ran == []
-
-
-def test_a_refused_write_returns_403(monkeypatch, caller_assertions) -> None:
-    _use(monkeypatch, writers={}, identity_types={APPLICATION_UID: "workload"})
-    monkeypatch.setattr(
-        "apps.v1.services.portfolios._get_runtime",
-        lambda: pytest.fail("a refused write must not reach the runtime"),
-    )
-
-    response = TestClient(app).delete(
-        f"/api/v1/portfolio/{uuid.uuid4()}/",
-        headers={ASSERTION_HEADER: caller_assertions.sign(APPLICATION_UID)},
-    )
-
-    assert response.status_code == 403
-    assert "MARKETS_REGISTRY_WRITERS" in response.json()["detail"]
-
-
-def test_an_unreadable_policy_returns_503(monkeypatch, caller_assertions) -> None:
-    def broken():
-        raise policy.RegistryWritePolicyError("constant service unavailable")
-
-    monkeypatch.setattr(policy, "load_registry_writer_policy", broken)
-
-    response = TestClient(app).delete(
-        f"/api/v1/portfolio/{uuid.uuid4()}/",
-        headers={ASSERTION_HEADER: caller_assertions.sign(APPLICATION_UID)},
-    )
-
-    assert response.status_code == 503