feat(AUDIT-WP-0008): add T02 synthetic load driver

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

tests/test_t02_synthetic_load_driver.py

@@ -0,0 +1,129 @@
+import importlib.util
+import sys
+from pathlib import Path
+
+import pytest
+
+
+SCRIPT = Path(__file__).parents[1] / "scripts" / "t02_synthetic_load_driver.py"
+SPEC = importlib.util.spec_from_file_location("t02_synthetic_load_driver", SCRIPT)
+assert SPEC and SPEC.loader
+DRIVER = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = DRIVER
+SPEC.loader.exec_module(DRIVER)
+
+
+def environment(tmp_path):
+    token = tmp_path / "token"
+    token.write_text("opaque-test-value\n", encoding="utf-8")
+    token.chmod(0o600)
+    return {
+        "AUDIT_T02_BASE_URL": "http://audit-core.test:8080",
+        "AUDIT_T02_TOKEN_FILE": str(token),
+        "AUDIT_T02_TENANT": "tenant:trial:recovery-20260822",
+        "AUDIT_T02_SOURCE": "audit-core-recovery",
+        "AUDIT_T02_FIXTURE_ID": "audit-t02-recovery-20260822",
+        "AUDIT_T02_OCCURRED_AT": "2026-08-22T18:30:00Z",
+        "AUDIT_T02_MAX_ATTEMPTS": "4",
+        "AUDIT_T02_RETRY_INTERVAL_SECONDS": "0",
+    }
+
+
+def test_baseline_returns_exact_value_safe_shape(tmp_path):
+    result = DRIVER.run_phase(
+        "baseline",
+        DRIVER.CONTRACT_ID,
+        env=environment(tmp_path),
+        requester=lambda config: (202, "accepted"),
+    )
+    assert result == {
+        "contract_id": DRIVER.CONTRACT_ID,
+        "fixture_id": "audit-t02-recovery-20260822",
+        "status": "ready",
+        "secret_values_observed": False,
+    }
+
+
+def test_unavailable_retries_only_retryable_statuses(tmp_path):
+    replies = iter([(500, None), (503, None)])
+    result = DRIVER.run_phase(
+        "expect-unavailable",
+        DRIVER.CONTRACT_ID,
+        env=environment(tmp_path),
+        requester=lambda config: next(replies),
+    )
+    assert result["status"] == "retryable_unavailable"
+    assert result["http_status"] == 503
+    assert result["attempts"] == 2
+    assert set(result) == {
+        "contract_id", "fixture_id", "status", "http_status", "attempts",
+        "secret_values_observed",
+    }
+
+
+@pytest.mark.parametrize("status", [400, 401, 403, 409])
+def test_terminal_status_is_never_retried(tmp_path, status):
+    attempts = 0
+
+    def terminal(config):
+        nonlocal attempts
+        attempts += 1
+        return status, None
+
+    with pytest.raises(DRIVER.DriverError, match="terminal HTTP status"):
+        DRIVER.run_phase(
+            "expect-unavailable",
+            DRIVER.CONTRACT_ID,
+            env=environment(tmp_path),
+            requester=terminal,
+        )
+    assert attempts == 1
+
+
+def test_recovered_reports_duplicate_after_retry(tmp_path):
+    replies = iter([(503, None), (200, "duplicate")])
+    result = DRIVER.run_phase(
+        "expect-recovered",
+        DRIVER.CONTRACT_ID,
+        env=environment(tmp_path),
+        requester=lambda config: next(replies),
+    )
+    assert result["status"] == "duplicate"
+    assert result["http_status"] == 200
+    assert result["attempts"] == 2
+
+
+def test_cleanup_needs_no_bearer_and_retains_immutable_fixture(tmp_path):
+    env = {"AUDIT_T02_FIXTURE_ID": "audit-t02-recovery-20260822"}
+    result = DRIVER.run_phase("cleanup", DRIVER.CONTRACT_ID, env=env)
+    assert result == {
+        "contract_id": DRIVER.CONTRACT_ID,
+        "fixture_id": "audit-t02-recovery-20260822",
+        "status": "clean",
+        "secret_values_observed": False,
+    }
+
+
+def test_private_mounted_bearer_is_required(tmp_path):
+    env = environment(tmp_path)
+    Path(env["AUDIT_T02_TOKEN_FILE"]).chmod(0o644)
+    config = DRIVER.load_config(env)
+    with pytest.raises(DRIVER.DriverError, match="private and regular"):
+        DRIVER.request_event(config)
+
+
+def test_payload_is_synthetic_and_never_contains_bearer(tmp_path):
+    env = environment(tmp_path)
+    config = DRIVER.load_config(env)
+    payload = DRIVER.event_payload(config)
+    assert payload["data"] == {
+        "exercise": "RAILIANCE-WP-0024-T02",
+        "synthetic": True,
+    }
+    assert "opaque-test-value" not in repr(payload)
+
+
+def test_wrong_contract_is_refused_without_reading_token(tmp_path):
+    env = {"AUDIT_T02_FIXTURE_ID": "audit-t02-recovery-20260822"}
+    with pytest.raises(DRIVER.DriverError, match="not approved"):
+        DRIVER.run_phase("cleanup", "some-other-contract", env=env)