Implement local decision delivery and reconcile blocked workplan requirements

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fcad-7ea3-bf36-361fc8d679e8

tests/stage1.sh

@@ -5,6 +5,7 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
 
 python3 tests/validate_app_toml.py
+python3 tests/test_outbox_chart.py
 
 for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
               values/user-engine.yaml values/tenant-engine.yaml values/ops-warden.yaml; do

tests/test_outbox_chart.py

@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+"""Render the optional outbox with caller auth on/off, without cluster access."""
+import subprocess
+import yaml
+
+
+def render(*settings, succeeds=True):
+    command = ["helm", "template", "flex-auth", "charts/flex-auth", "-f", "values/stage2-canary.yaml"]
+    for setting in settings:
+        command += ["--set", setting]
+    result = subprocess.run(command, capture_output=True, text=True, check=False)
+    if not succeeds:
+        assert result.returncode != 0, "invalid multi-writer configuration was accepted"
+        return []
+    assert result.returncode == 0, result.stderr
+    return list(yaml.safe_load_all(result.stdout))
+
+
+def deployment(documents):
+    return next(d for d in documents if d["kind"] == "Deployment")
+
+
+base = render()
+assert not any(d["kind"] == "PersistentVolumeClaim" for d in base)
+assert "--outbox-dir" not in deployment(base)["spec"]["template"]["spec"]["containers"][0]["args"]
+
+enabled = ("outbox.enabled=true", "outbox.source=flex-auth.test")
+for auth in ((), ("callerAuth.mode=enforce", "callerAuth.binding=test=system:serviceaccount:test:test")):
+    documents = render(*enabled, *auth)
+    pod = deployment(documents)["spec"]["template"]["spec"]
+    container = pod["containers"][0]
+    args = container["args"]
+    assert args[args.index("--outbox-dir") + 1] == "/var/lib/flex-auth/outbox"
+    assert args[args.index("--emission-source") + 1] == "flex-auth.test"
+    assert deployment(documents)["spec"]["strategy"]["type"] == "Recreate"
+    pvc = next(d for d in documents if d["kind"] == "PersistentVolumeClaim")
+    assert pvc["spec"]["accessModes"] == ["ReadWriteOnce"]
+    assert pvc["spec"]["resources"]["requests"]["storage"] == "1Gi"
+    assert any(v.get("persistentVolumeClaim", {}).get("claimName") == pvc["metadata"]["name"] for v in pod["volumes"])
+    assert any(v["name"] == "flex-auth-outbox" and not v.get("readOnly", False) for v in container["volumeMounts"])
+    if auth:
+        assert any(v["name"] == "flex-auth-reviewer" for v in pod["volumes"])
+
+existing = render(*enabled, "outbox.existingClaim=retained-outbox")
+assert not any(d["kind"] == "PersistentVolumeClaim" for d in existing)
+pod = deployment(existing)["spec"]["template"]["spec"]
+assert any(v.get("persistentVolumeClaim", {}).get("claimName") == "retained-outbox" for v in pod["volumes"])
+render(*enabled, "replicaCount=2", succeeds=False)
+render("outbox.enabled=true", succeeds=False)
+print("optional outbox chart checks passed")