Complete G8 fleet source-reference sweep with provenance exceptions

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b

tools/test_fleet_references.py

@@ -0,0 +1,50 @@
+from pathlib import Path
+import hashlib
+import json
+import subprocess
+import tempfile
+import unittest
+
+from validate_fleet_references import scan, validate
+
+
+class FleetReferenceTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.repo = self.root / 'example'
+        self.repo.mkdir()
+        subprocess.run(['git', 'init', '-q'], cwd=self.repo, check=True)
+        self.legacy = 'identity' + '-canon'
+        self.ledger = self.root / 'review.json'
+        self.ledger.write_text(json.dumps({'repositories': ['example'], 'exceptions': []}))
+
+    def test_tracked_ignored_and_hidden_files_are_scanned(self):
+        (self.repo / '.gitignore').write_text('ignored.md\n')
+        (self.repo / 'ignored.md').write_text(self.legacy)
+        (self.repo / '.settings').write_text(self.legacy)
+        (self.repo / 'source-link').symlink_to('../' + self.legacy)
+        subprocess.run(['git', 'add', '-f', 'ignored.md'], cwd=self.repo, check=True)
+        _, _, found = scan(self.root)
+        self.assertEqual(set(found), {'example/ignored.md', 'example/.settings', 'example/source-link'})
+
+    def test_new_live_reference_is_rejected(self):
+        (self.repo / 'README.md').write_text('Source: ' + self.legacy)
+        result = validate(self.root, self.ledger)
+        self.assertEqual(result['result'], 'fail')
+        self.assertEqual(result['errors'][0]['reason'], 'unreviewed reference')
+
+    def test_review_is_bound_to_exact_reference_content(self):
+        text = 'Historical source: ' + self.legacy
+        (self.repo / 'README.md').write_text(text)
+        data = {'repositories': ['example'], 'exceptions': [{'file': 'example/README.md',
+                'reason': 'Historical source', 'line_sha256': [hashlib.sha256(text.encode()).hexdigest()]}]}
+        self.ledger.write_text(json.dumps(data))
+        self.assertEqual(validate(self.root, self.ledger)['result'], 'pass')
+        (self.repo / 'README.md').write_text(text + '\nCurrent source: ' + self.legacy)
+        self.assertEqual(validate(self.root, self.ledger)['result'], 'fail')
+
+
+if __name__ == '__main__':
+    unittest.main()