Implement source-backed NetKingdom agent security knowledge pilot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a101af-e240-7882-a1e3-e37720cbdbea

tests/test_knowledge_tooling.py

@@ -0,0 +1,56 @@
+"""Provider-envelope and pilot installation regressions."""
+from pathlib import Path
+import runpy
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+PROBE = runpy.run_path(str(ROOT / "tools/probe_provider.py"))
+PILOT = runpy.run_path(str(ROOT / "tools/pilot_entrypoints.py"))
+
+
+@pytest.mark.parametrize("key", ["structured_output", "structuredOutput"])
+def test_provider_envelopes_are_unwrapped_before_grading(key):
+    response = {"package_version": "0.1.1", "answers": []}
+    parsed, metadata = PROBE["unwrap_response"]({key: response, "sessionId": "test-session", "modelUsage": {"test-model": {}}})
+    assert parsed == response
+    assert metadata["model_usage"] == ["test-model"]
+
+
+def test_provider_missing_structured_answers_is_not_a_pass():
+    with pytest.raises(ValueError):
+        PROBE["unwrap_response"]({"text": "All tests pass", "stopReason": "done"})
+
+
+@pytest.fixture
+def pilot_root(tmp_path):
+    for repo in PILOT["PILOTS"]:
+        (tmp_path / repo).mkdir()
+        for name in PILOT["FILES"]:
+            (tmp_path / repo / name).write_text("Existing owner guidance\n")
+    return tmp_path
+
+
+def test_pilot_apply_and_rollback_preserve_owner_content(pilot_root):
+    plan = PILOT["plan"](pilot_root)
+    assert (pilot_root / "net-kingdom/AGENTS.md").read_text() == "Existing owner guidance\n"
+    assert PILOT["apply"](plan) == 8
+    p = pilot_root / "net-kingdom/AGENTS.md"
+    p.write_text(p.read_text() + "\nLater unrelated owner guidance\n")
+    assert PILOT["apply"](plan, rollback=True) == 8
+    assert p.read_text() == "Existing owner guidance\n\nLater unrelated owner guidance\n"
+
+
+def test_changed_target_aborts_before_any_write(pilot_root):
+    plan = PILOT["plan"](pilot_root)
+    (pilot_root / "tenant-engine/CLAUDE.md").write_text("New owner edit\n")
+    with pytest.raises(ValueError, match="changed"):
+        PILOT["apply"](plan)
+    assert (pilot_root / "net-kingdom/AGENTS.md").read_text() == "Existing owner guidance\n"
+
+
+def test_pilot_cannot_target_unlisted_repo(pilot_root):
+    plan = PILOT["plan"](pilot_root)
+    plan["targets"][0]["repository"] = "unrelated"
+    with pytest.raises(ValueError):
+        PILOT["apply"](plan)