Implement lifecycle workspace publication and audit delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

tests/test_deployment_candidate.py

@@ -1,4 +1,5 @@
 import copy
+import json
 import importlib.util
 from pathlib import Path
 
@@ -75,3 +76,24 @@ def test_policy_revision_changes_immutable_configuration_name():
     first=inputs();second=copy.deepcopy(first);second['policy']['version']='v2'
     names=lambda data:[o['metadata']['name'] for o in module.render(data)['items'] if o['kind']=='ConfigMap']
     assert names(first)!=names(second)
+
+
+def test_optional_workspace_requires_distinct_pins_and_exact_policy_network_peer():
+    data = inputs()
+    data['lifecycle_policy'] = {**data['policy'], 'package': 'informed-decision.lifecycle',
+                              'origin': 'http://flex-auth-lifecycle.flex-auth.svc.cluster.local:8080',
+                              'pod_name': 'flex-auth-lifecycle'}
+    with pytest.raises(ValueError):
+        module.render(data)
+    data['lifecycle_delivery'] = True
+    objects = module.render(data)['items']
+    config = json.loads(next(row for row in objects if row['kind']=='ConfigMap')['data']['runtime.json'])
+    assert config['lifecycle_policy']['package']=='informed-decision.lifecycle'
+    assert config['lifecycle_delivery'] is True
+    review_network = next(row for row in objects if row['kind']=='NetworkPolicy' and row['metadata']['namespace']=='informed-decision')
+    assert any(peer.get('podSelector', {}).get('matchLabels', {}).get('app.kubernetes.io/name')=='flex-auth-lifecycle'
+               for rule in review_network['spec']['egress'] for peer in rule.get('to', []))
+    assert any(row['metadata']['name']=='informed-decision-lifecycle-ingress' for row in objects)
+    data['lifecycle_policy']['package'] = data['policy']['package']
+    with pytest.raises(ValueError):
+        module.render(data)