Seeded repo with intent and initial content.

tests/test_default_envelope.py

@@ -0,0 +1,75 @@
+"""The default envelope is valid data and faithfully encodes canon A6."""
+
+from __future__ import annotations
+
+from emergent_security.constitution import RULE_IDS
+from emergent_security.model import Outcome
+
+# Every A6 row of canon v0.8, by decision class id.
+A6_CLASSES = {
+    "code.edit", "test.add", "test.weaken", "dependency.add", "code.fetch_execute",
+    "data.egress", "git.commit_feature", "git.push_feature", "git.merge_protected",
+    "git.history_rewrite", "ci.add_check", "ci.weaken", "checks.bypass", "policy.edit",
+    "secrets.read", "secrets.write", "credential.reuse_broader", "env.disposable",
+    "agent.delegate", "deploy.internal", "deploy.relied_upon", "iam.change",
+    "data.sensitive", "tenant.cross", "data.delete_irreversible",
+    "tenant.governance_change", "tenant.platform_envelope_change", "audit.disable",
+    "platform.root",
+}
+
+# Rows whose base mode is a constitutional deny (canon A6 "DENY" rows).
+CONSTITUTIONAL_DENY = {
+    "checks.bypass", "policy.edit", "secrets.write", "credential.reuse_broader",
+    "agent.delegate", "tenant.cross", "tenant.governance_change",
+    "tenant.platform_envelope_change", "audit.disable",
+}
+
+
+def test_envelope_validates_cleanly(default_envelope, scales):
+    assert default_envelope.validate(scales) == []
+
+
+def test_envelope_covers_every_a6_row(default_envelope):
+    assert set(default_envelope.class_ids) == A6_CLASSES
+
+
+def test_constitutional_denies_are_the_base_mode(default_envelope):
+    denied = {cid for cid in default_envelope.class_ids if default_envelope.row(cid).mode is Outcome.DENY}
+    assert denied == CONSTITUTIONAL_DENY
+
+
+def test_root_row_only_requests_root_authorization(default_envelope):
+    assert default_envelope.row("platform.root").mode is Outcome.ROOT_AUTHORIZATION_REQUIRED
+
+
+def test_every_cited_rule_exists(default_envelope):
+    cited = {rule for cid in default_envelope.class_ids for rule in default_envelope.all_rules(cid)}
+    assert cited <= RULE_IDS
+
+
+def test_applies_only_to_hot_build_l0_outside_tenants(default_envelope):
+    base = {"level": "L0", "temperature": "hot", "phase": "build", "tenant": "none"}
+    assert default_envelope.applies_to(base)
+    for key, other in [("level", "L1"), ("temperature", "warm"), ("phase", "production"), ("tenant", "tenant://acme")]:
+        assert not default_envelope.applies_to({**base, key: other})
+
+
+def test_validation_reports_broken_rows(scales):
+    from emergent_security.envelope import DefaultEnvelope
+
+    broken = DefaultEnvelope.from_dict(
+        {
+            "id": "envelope://broken",
+            "applies_when": {},
+            "risk_envelope": {"blast_radius": "galaxy"},
+            "classes": [
+                {"id": "a", "mode": "sometimes", "rules": ["C99"]},
+                {"id": "a", "mode": "autonomous", "rules": []},
+            ],
+        }
+    )
+    errors = broken.validate(scales)
+    assert any("duplicate class id: a" in e for e in errors)
+    assert any("unknown mode" in e for e in errors)
+    assert any("unknown rule C99" in e for e in errors)
+    assert any("unknown value for blast_radius" in e for e in errors)