fix(cases): validate optional exact machine descriptor pins

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

tools/security-case-types/tests/test_descriptor_pins.py

@@ -0,0 +1,64 @@
+"""Owner pin contract parity; synthetic pins never establish native acceptance."""
+import copy
+import json
+from pathlib import Path
+import sys
+
+import jsonschema
+import pytest
+import yaml
+
+TOOL = Path(__file__).resolve().parents[1]
+REPO = TOOL.parents[1]
+sys.path.insert(0, str(TOOL))
+import security_case_validator as v
+import security_case_evidence as e
+
+TYPE = yaml.safe_load((REPO / 'security-case-types/_template/type.yaml').read_bytes())
+SCHEMA = json.loads((REPO / 'canon/schemas/security-case-type_v0.1.schema.json').read_bytes())
+PIN = 'sha256:' + 'a' * 64
+STEP = TYPE['spec']['follow_through'][0]['id']
+
+
+def with_pins(pins):
+    doc = copy.deepcopy(TYPE)
+    doc['spec']['execution_descriptors'] = pins
+    return doc
+
+
+@pytest.mark.parametrize('pins', [{}, {STEP: PIN}])
+def test_optional_partial_pin_contract_has_schema_semantic_parity(pins):
+    doc = with_pins(pins)
+    jsonschema.validate(doc, SCHEMA)
+    assert not v.has_errors(v.validate_type(doc))
+    assert doc['spec']['status'] == TYPE['spec']['status']
+
+
+@pytest.mark.parametrize('pins', [None, [], 'digest', {STEP: True}, {STEP: None},
+    {STEP: 17}, {STEP: 'a' * 64}, {STEP: PIN.upper()}, {STEP: PIN + '\n'},
+    {STEP + '\n': PIN}, {7: PIN}, {'../escape': PIN},
+    {f'step-{i}': PIN for i in range(129)}])
+def test_malformed_descriptor_contract_refused_by_both_validators(pins):
+    doc = with_pins(pins)
+    assert v.has_errors(v.validate_type(doc))
+    with pytest.raises(jsonschema.ValidationError):
+        jsonschema.validate(doc, SCHEMA)
+
+
+def test_well_shaped_unknown_step_is_semantic_refusal():
+    doc = with_pins({'not-a-declared-step': PIN})
+    jsonschema.validate(doc, SCHEMA)
+    assert v.has_errors(v.validate_type(doc))
+
+
+@pytest.mark.parametrize('pins', [None, [], {STEP: 'bad'}, {'undeclared-step': PIN}])
+def test_direct_evidence_api_refuses_bad_map_without_crashing_or_needing_rows(pins):
+    with pytest.raises(e.EvidenceRefused, match='machine descriptor pins'):
+        e.check_steps((), b'case', yaml.safe_dump(with_pins(pins)).encode(), {'follow_through': []})
+
+
+def test_partial_pin_cannot_bypass_ordinary_case_admission():
+    doc = with_pins({STEP: PIN})
+    case = yaml.safe_load((REPO / 'security-case-types/_template/examples/example-operator.yaml').read_bytes())
+    issues = v.validate_case(case, doc)
+    assert any('only implemented types' in issue.message for issue in issues)