Enforce bounded operation guardrails

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

tests/test_api_admission.py

@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+import pytest
+from fastapi import HTTPException
+
+from activity_core.api import _validate_context_admission
+
+
+def test_basic_rest_administration_refuses_unknown_shell_query() -> None:
+    with pytest.raises(HTTPException) as exc_info:
+        _validate_context_admission(
+            [{"type": "shell", "query": "run_from_request", "params": {}}]
+        )
+
+    assert exc_info.value.status_code == 422
+    assert "not registered" in str(exc_info.value.detail)
+
+
+def test_basic_rest_administration_accepts_registered_read_only_query() -> None:
+    _validate_context_admission(
+        [
+            {
+                "type": "shell",
+                "query": "discover_kaizen_projects",
+                "params": {},
+            }
+        ]
+    )