Enforce readiness tiers and reconcile blocked workplans

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e75a-fc5c-7913-9dba-9846210c766d

tests/test_custody_inventory.py

@@ -0,0 +1,40 @@
+"""Inventory failures must not be reported as a healthy empty store."""
+import importlib.util
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+spec = importlib.util.spec_from_file_location("inventory", Path(__file__).parents[1] / "scripts/custody-inventory.py")
+inventory = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(inventory)
+
+
+def test_no_scoped_grant_refuses_instead_of_using_operator_token(monkeypatch):
+    monkeypatch.delenv("BAO_TOKEN", raising=False)
+    monkeypatch.setattr(inventory.os.path, "exists", lambda _: False)
+    with pytest.raises(inventory.InventoryError, match="No scoped"):
+        inventory.walk("operators")
+
+
+@pytest.mark.parametrize("rc,output", [(1, ""), (0, "not-json"), (0, '{}')])
+def test_listing_errors_never_become_empty_success(monkeypatch, rc, output):
+    monkeypatch.setenv("BAO_TOKEN", "synthetic-token")
+    monkeypatch.setattr(inventory.subprocess, "run", lambda *a, **kw: SimpleNamespace(returncode=rc, stdout=output))
+    with pytest.raises(inventory.InventoryError):
+        inventory.walk("operators")
+
+
+def test_inventory_reads_only_metadata_and_reports_incomplete(monkeypatch, capsys):
+    calls = []
+    responses = {("kv", "list", "operators"): ["example/"],
+                 ("kv", "list", "operators/example"): ["admin"],
+                 ("kv", "metadata", "get", "operators/example/admin"): {"data": {"custom_metadata": {}}}}
+    def bao(*args):
+        calls.append(args)
+        return responses[args]
+    monkeypatch.setattr(inventory, "bao", bao)
+    monkeypatch.setattr(inventory.sys, "argv", ["inventory", "operators", "--undescribed"])
+    assert inventory.main() == 1
+    assert "1 credential path(s), 1 missing" in capsys.readouterr().out
+    assert all(c[:2] == ("kv", "list") or c[:3] == ("kv", "metadata", "get") for c in calls)