fix(cases): expose explicit versioned type roots in Mason CLI

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

tests/test_case_version_source.py

@@ -0,0 +1,84 @@
+"""Actual NetKingdom 1.2 source selection; no accepted/native case fixture."""
+import json
+from pathlib import Path
+
+import pytest
+import yaml
+
+from ops_mason import case_plan, cli
+
+NK = case_plan.DEFAULT_NK_ROOT
+TYPES = NK / "security-case-type-revisions/1.2"
+CASE = TYPES / "oidc-browser-relying-party/examples/forgejo.yaml"
+pytestmark = pytest.mark.skipif(not CASE.is_file(), reason="NetKingdom 1.2 source absent")
+
+
+def test_explicit_source_root_renders_actual_six_object_draft(tmp_path, capsys):
+    output = tmp_path / "plan.md"
+    assert cli.main(["plan", "--case", str(CASE), "--types-root", str(TYPES),
+                     "--no-live", "--allow-unimplemented", "--out", str(output)]) == 0
+    plan = output.read_text()
+    front = yaml.safe_load(plan.split("---\n", 2)[1])
+    assert front["status"] == "draft"
+    assert front["case_acceptance"] is None
+    assert front["derived_from_type"] == "oidc-browser-relying-party@1.2"
+    assert front["reference_case"] is True
+    case, doc, rendered = case_plan.render(CASE, types_root=TYPES, allow_unimplemented=True)
+    assert case["spec"]["status"] == "proposed"
+    assert "acceptance" not in case["spec"]
+    assert doc["spec"]["status"] == "acknowledged"
+    assert len(rendered["materialization"]) == 6
+    role = next(item for item in rendered["materialization"]
+                if item["id"] == "consumer-eso-role")
+    body = yaml.safe_load(role["body"])
+    assert body["bound_service_account_namespaces"] == ["forgejo"]
+    assert body["bound_service_account_names"] == ["forgejo-keycape-forgejo-eso"]
+    assert front["render_digest"] == rendered["digest"]
+    assert json.loads(capsys.readouterr().err)["ok"] is True
+
+
+def test_explicit_root_does_not_waive_implemented_gate(tmp_path, capsys):
+    output = tmp_path / "plan.md"
+    assert cli.main(["plan", "--case", str(CASE), "--types-root", str(TYPES),
+                     "--no-live", "--out", str(output)]) == 2
+    assert not output.exists()
+    assert "only implemented types" in capsys.readouterr().err
+
+
+def test_missing_explicit_root_never_falls_forward_to_12(tmp_path, capsys):
+    output = tmp_path / "plan.md"
+    assert cli.main(["plan", "--case", str(CASE), "--no-live",
+                     "--allow-unimplemented", "--out", str(output)]) == 2
+    assert not output.exists()
+    assert "not 1.2" in capsys.readouterr().err
+
+
+def test_proposed_case_cannot_build_even_with_selected_acknowledged_source(tmp_path, capsys):
+    output = tmp_path / "bundle"
+    assert cli.main(["build", "--case", str(CASE), "--types-root", str(TYPES),
+                     "--allow-unimplemented", "--plan", str(tmp_path / "absent-plan.md"),
+                     "--out", str(output)]) == 2
+    assert not output.exists()
+    assert "case is not accepted" in capsys.readouterr().err
+
+
+def test_historical_bundle_cannot_attest_12_inventory(tmp_path, capsys):
+    owner = Path("/home/worsch/ops-mason")
+    assert cli.main(["structure-request", "--case", str(CASE), "--types-root", str(TYPES),
+                     "--allow-unimplemented", "--plan", str(owner / "plans/case-forgejo-netkingdom-oidc.md"),
+                     "--bundle", str(owner / "builds/case-forgejo-netkingdom-oidc")]) == 2
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert json.loads(captured.err)["error"] == "structural-source-preparation-refused"
+
+
+def test_actual_validator_refuses_invalid_consumer_namespace(tmp_path, capsys):
+    case = yaml.safe_load(CASE.read_text())
+    case["spec"]["parameters"]["consumer_namespace"] = "../../other"
+    source = tmp_path / "case.yaml"
+    source.write_text(yaml.safe_dump(case))
+    assert cli.main(["plan", "--case", str(source), "--types-root", str(TYPES),
+                     "--no-live", "--allow-unimplemented"]) == 2
+    captured = capsys.readouterr()
+    assert captured.out == ""
+    assert "consumer_namespace" in captured.err