feat: publish custodian fleet standards batch

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

tests/test_fetch_sources.py

@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+from pathlib import Path
+import sys
+import unittest
+
+
+ROOT = Path(__file__).parents[1]
+sys.path.insert(0, str(ROOT / "tools"))
+from fetch_sources import _archive_url, _request
+
+
+class FetchSourcesAuthenticationTest(unittest.TestCase):
+    def test_same_origin_request_carries_forgejo_token(self) -> None:
+        request = _request(
+            "https://forgejo.coulomb.social/api/v1/repos/coulomb/policy-nexus",
+            token="test-secret",
+            token_origin="https://forgejo.coulomb.social",
+        )
+
+        self.assertEqual("token test-secret", request.get_header("Authorization"))
+        self.assertNotIn("test-secret", request.full_url)
+
+    def test_cross_origin_request_refuses_source_token(self) -> None:
+        with self.assertRaisesRegex(ValueError, "refusing to send source credential"):
+            _request(
+                "https://example.invalid/coulomb/policy-nexus/archive/main.tar.gz",
+                token="test-secret",
+                token_origin="https://forgejo.coulomb.social",
+            )
+
+    def test_token_and_origin_must_be_configured_together(self) -> None:
+        with self.assertRaisesRegex(ValueError, "must be provided together"):
+            _request(
+                "https://forgejo.coulomb.social/coulomb/policy-nexus",
+                token="test-secret",
+            )
+
+    def test_anonymous_request_has_no_authorization_header(self) -> None:
+        request = _request("https://forgejo.coulomb.social/public/repository")
+
+        self.assertIsNone(request.get_header("Authorization"))
+
+    def test_archive_uses_full_resolved_revision(self) -> None:
+        revision = "a" * 40
+
+        self.assertEqual(
+            f"https://forgejo.coulomb.social/coulomb/policy-nexus/archive/{revision}.tar.gz",
+            _archive_url(
+                "https://forgejo.coulomb.social/coulomb/policy-nexus.git",
+                revision,
+            ),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()