feat(AUDIT-WP-0008): enforce temporary sender expiry

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a025c2-407a-7a32-b40a-f37a52f03f62

tests/test_ingestion.py

@@ -1,5 +1,6 @@
 import io
 import json
+from datetime import datetime, timezone
 
 import pytest
 
@@ -239,6 +240,7 @@ def bound_app(tmp_path, **kw):
         tenants=frozenset(kw.get("tenants", {"tenant:friendly:binky"})),
         may_read=kw.get("may_read", False),
         secret_policy=kw.get("secret_policy", "redact"),
+        expires_at=kw.get("expires_at"),
     )
     # An unrestricted operator sits alongside the scoped sender. The
     # instance-wide read surfaces — stats, dead letters, secret findings,
@@ -281,6 +283,16 @@ def test_rotation_accepts_both_tokens(tmp_path):
     assert invoke(app, event(id="evt-3"), key="evt-3", token="retired")[0].startswith("401")
 
 
+def test_expired_sender_is_unauthorized_at_http_boundary(tmp_path):
+    app, _ = bound_app(
+        tmp_path,
+        expires_at=datetime(2000, 1, 1, tzinfo=timezone.utc),
+    )
+    status, body = invoke(app, event())
+    assert status.startswith("401")
+    assert body["error"] == "unauthorized"
+
+
 def test_sender_credential_cannot_read_the_trail_back(tmp_path):
     app, _ = bound_app(tmp_path, may_read=False)
     assert invoke(app, event())[0].startswith("202")