MASON-WP-0015: gate CCR evidence and qualify the kube wait

T07 generates a CCR policy through the platform generator and refuses
record-evidence unless the built policy matches the CCR file. T06 stays
wait on the open founder decision after a fresh can-i of yes, yes, yes.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a

tests/test_ccr_gate.py

@@ -0,0 +1,72 @@
+"""The CCR record-evidence gate matches a policy and refuses a different one."""
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+from ops_mason.ccr_gate import EvidenceRefused, draft_from_plan, record_evidence
+
+DECISION_ID = "00000000-0000-4000-8000-000000000001"
+KV_PATH = "platform/workloads/fixture/reader"
+
+
+def _draft(tmp_path: Path) -> dict:
+    return draft_from_plan(
+        kv_path=KV_PATH,
+        plan_ref={
+            "repo": "ops-mason",
+            "path": "plans/fixture.md",
+            "commit": "0123456789abcdef",
+        },
+        decision_id=DECISION_ID,
+        out_dir=tmp_path,
+    )
+
+
+def _evidence(draft: Path) -> list:
+    document = yaml.safe_load(draft.read_text(encoding="utf-8"))
+    return (document.get("verification") or {}).get("evidence") or []
+
+
+def test_record_evidence_accepts_a_trailing_newline_and_refuses_a_different_policy(tmp_path):
+    drafted = _draft(tmp_path)
+    policy_path = Path(drafted["policy_file"])
+    # The platform generator's text, plus one trailing newline, still matches.
+    policy_path.write_text(policy_path.read_text(encoding="utf-8") + "\n", encoding="utf-8")
+
+    completed = record_evidence(
+        drafted["draft"],
+        built_policy=drafted["built_policy"],
+        actor="ops-mason",
+        kind="metadata_apply",
+        result="passed",
+        detail=["built policy matched the CCR policy file"],
+    )
+
+    assert completed.returncode == 0
+    assert "record-evidence" in completed.args
+    assert "sync-decision" not in completed.args
+    recorded = _evidence(drafted["draft"])
+    assert len(recorded) == 1
+    assert recorded[0]["kind"] == "metadata_apply"
+    assert recorded[0]["result"] == "passed"
+    assert "matched the CCR policy file" in recorded[0]["details"][0]
+
+    policy_path.write_text(
+        policy_path.read_text(encoding="utf-8").replace('["read"]', '["create"]', 1),
+        encoding="utf-8",
+    )
+    with pytest.raises(EvidenceRefused, match="record-evidence refused"):
+        record_evidence(
+            drafted["draft"],
+            built_policy=drafted["built_policy"],
+            actor="ops-mason",
+            kind="metadata_apply",
+            result="passed",
+            detail=["built policy matched the CCR policy file"],
+        )
+    assert len(_evidence(drafted["draft"])) == 1
+    stored = drafted["draft"].read_text(encoding="utf-8")
+    assert "sync-decision" not in stored
+    assert DECISION_ID in stored