Activate expanded portal integration gate

tests/test_user_engine_platform_expansion.py

@@ -0,0 +1,30 @@
+from pathlib import Path
+import unittest
+
+
+ROOT = Path(__file__).parents[1]
+
+
+class UserEnginePlatformExpansionContractTests(unittest.TestCase):
+    def test_contract_keeps_authorization_fail_closed(self):
+        text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
+        self.assertIn("fail closed", text)
+        self.assertIn("decision ID", text)
+        self.assertIn("USER_ENGINE_FLEX_AUTH_URL", text)
+
+    def test_contract_requires_idempotent_bounded_delivery(self):
+        text = (ROOT / "docs/user-engine-platform-expansion-contract.md").read_text()
+        self.assertIn("Idempotency-Key", text)
+        self.assertIn("bounded attempts", text)
+        self.assertIn("dead-letter", text)
+        self.assertIn("OpenBao", text)
+
+    def test_live_manifest_does_not_enable_partial_integration(self):
+        manifest = (ROOT / "sso-mfa/k8s/user-engine/runtime.yaml").read_text()
+        self.assertNotIn("USER_ENGINE_FLEX_AUTH_URL", manifest)
+        self.assertNotIn("USER_ENGINE_EVENT_URL", manifest)
+        self.assertNotIn("USER_ENGINE_MAIL_URL", manifest)
+
+
+if __name__ == "__main__":
+    unittest.main()