Refuse explicit policy authentication and binding denials before side effects

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_proxy.py

@@ -234,6 +234,28 @@ def test_cli_proxy_requires_caller_auth(monkeypatch, tmp_path):
     assert r.exit_code == 3
 
 
+@pytest.mark.parametrize("status", [401, 403])
+def test_cli_explicit_policy_refusal_never_fetches_or_starts_child(monkeypatch, tmp_path, status):
+    import httpx
+
+    _proxy_env(monkeypatch, tmp_path)
+    cfg = tmp_path / "warden.yaml"
+    cfg.write_text(cfg.read_text() + "policy:\n  flex_auth_url: http://pdp.test\n")
+    monkeypatch.setenv("VAULT_TOKEN", "caller-test-value")
+    monkeypatch.setattr(
+        "warden.policy.httpx.post",
+        lambda *a, **k: httpx.Response(status, request=httpx.Request("POST", "http://pdp.test/v1/check")),
+    )
+    calls = []
+    for name in ("proxy_exec", "proxy_fetch", "proxy_fetch_to_file", "proxy_fetch_wrapped"):
+        monkeypatch.setattr("warden.proxy." + name, lambda *a, **k: calls.append(True))
+    result = runner.invoke(app, ["access", "forgejo-admin-api-token", "--exec", "--field", "API_TOKEN", "--", "true"])
+    assert result.exit_code == 4
+    assert f"HTTP {status}" in result.output
+    assert "fail_open applied" not in result.output
+    assert calls == []
+
+
 def test_cli_proxy_rejects_retired_no_policy_bypass(monkeypatch, tmp_path):
     _proxy_env(monkeypatch, tmp_path)
     monkeypatch.setenv("VAULT_TOKEN", "caller")