Harden SBOM retries and align hub evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

tests/test_ops_evidence_sinks.py

@@ -367,6 +367,90 @@ def test_core_hub_interaction_event_sink_posts_and_verifies_compact_event(monkey
     assert "token=secret" not in serialized
 
 
+def test_hub_core_interaction_port_posts_and_verifies_sanitized_event(monkeypatch) -> None:
+    posts: list[dict[str, Any]] = []
+
+    def fake_post(url: str, **kwargs: Any) -> DummyResponse:
+        assert url == "http://hub-core.test/ports/events/interaction"
+        assert "Authorization" not in kwargs["headers"]
+        posts.append({"url": url, **kwargs})
+        return DummyResponse(
+            {
+                "id": "event-port-1",
+                "status": "accepted",
+                "correlation_id": _run_id(),
+            },
+            status_code=202,
+        )
+
+    def fake_get(url: str, **kwargs: Any) -> DummyResponse:
+        assert url == "http://hub-core.test/ports/projections/interaction_events"
+        return DummyResponse(
+            {
+                "id": "interaction_events",
+                "data": {"items": [{"id": "event-port-1"}]},
+                "provenance": {},
+            }
+        )
+
+    monkeypatch.setattr(httpx, "post", fake_post)
+    monkeypatch.setattr(httpx, "get", fake_get)
+
+    result = persist_ops_inventory_evidence(
+        _payload([
+            {
+                "type": "hub-core-interaction-event",
+                "hub_core_url": "http://hub-core.test",
+                "event_type": "ops-endpoint-verified",
+            }
+        ])
+    )
+
+    assert result == [
+        {
+            "type": "hub-core-interaction-event",
+            "status": "posted",
+            "event_type": "hub.interaction.recorded",
+            "reported_event_type": "ops-endpoint-verified",
+            "event_id": "event-port-1",
+            "correlation_id": _run_id(),
+            "verified": True,
+            "context_key": "ops_probe",
+        }
+    ]
+    body = posts[0]["json"]
+    assert body["schema_version"] == "0.1.0"
+    assert body["correlation_id"] == _run_id()
+    assert body["event_type"] == "hub.interaction.recorded"
+    assert body["payload"]["reported_event_type"] == "ops-endpoint-verified"
+    assert body["payload"]["endpoint"]["url"] == "http://state-hub.test/health"
+    assert body["subject_refs"]["endpoint"] == "state-hub-health"
+
+    serialized = json.dumps(body, sort_keys=True)
+    assert "secret response body" not in serialized
+    assert "Authorization" not in serialized
+    assert "user:pass" not in serialized
+    assert "token=secret" not in serialized
+
+
+def test_hub_core_interaction_port_skips_when_base_url_missing(monkeypatch) -> None:
+    monkeypatch.delenv("HUB_CORE_BASE_URL", raising=False)
+
+    result = persist_ops_inventory_evidence(
+        _payload([{"type": "hub-core-interaction-event"}])
+    )
+
+    assert result == [
+        {
+            "type": "hub-core-interaction-event",
+            "status": "skipped",
+            "reason": "missing_hub_core_config",
+            "missing": ["HUB_CORE_BASE_URL"],
+            "context_key": "ops_probe",
+        }
+    ]
+
+
 def test_core_hub_sink_skips_cleanly_when_config_missing(monkeypatch) -> None:
     monkeypatch.delenv("CORE_HUB_BASE_URL", raising=False)
     monkeypatch.delenv("CORE_HUB_RUNTIME_TOKEN", raising=False)