ORGREF-WP-0002-T02: first anonymous-consumer inventory

40 cluster workloads pull forge images without imagePullSecrets, 6 ArgoCD
applications read forge Git; local clones are SSH. Live credential checks and
per-entry review remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

tests/test_access_consumers.py

@@ -0,0 +1,43 @@
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools"))
+from access_consumers import classify, runtime_consumers, target_repo  # noqa: E402
+
+
+class ClassifyTest(unittest.TestCase):
+    def test_kinds(self):
+        cases = [
+            ("posts/x.yaml", "/coulomb/pr-hall-of-helix/raw/branch/main/a.png", "url: x", "raw-fetch"),
+            ("src/client.py", "/api/v1/repos/coulomb/x", "u = ...", "api-client"),
+            (".forgejo/workflows/image.yaml", "/coulomb/x", "uses: x", "ci-action"),
+            ("go.mod", "/coulomb/x", "require x", "package-consumer"),
+            ("k8s/app.yaml", "/coulomb/x.git", "  repoURL: https://...", "gitops-source"),
+            ("chart/values.yaml", "/coulomb/x", "  repository: forgejo...", "image-pull"),
+            ("README.md", "/coulomb/x", "see", "doc-link"),
+            ("docs/evidence/run.json", "/coulomb/x", "x", "record"),
+            ("Makefile", "/coulomb/x", "push", "build-tooling"),
+        ]
+        for f, p, line, want in cases:
+            self.assertEqual(classify(f, p, line), want, f)
+
+    def test_target_repo(self):
+        self.assertEqual(target_repo("/coulomb/key-cape.git"), "coulomb/key-cape")
+        self.assertEqual(target_repo("/api/v1/repos/coulomb/state-hub/issues"), "coulomb/state-hub")
+        self.assertEqual(target_repo("/v2/coulomb/flex-auth/manifests/x"), "coulomb/flex-auth")
+        self.assertEqual(target_repo("/coulomb/activity-core@sha256:ab"), "coulomb/activity-core")
+        self.assertIsNone(target_repo("/user/login"))
+
+    def test_runtime_anonymous_pull(self):
+        rt = {"applications": [], "workloads": [{
+            "namespace": "ns", "kind": "Deployment", "name": "api", "image_pull_secret_names": [],
+            "images": ["forgejo.coulomb.social/coulomb/x@sha256:00"]}]}
+        (c,) = runtime_consumers(rt)
+        self.assertEqual(c["class"], "cluster-image-pull")
+        self.assertTrue(c["credential"].startswith("anonymous"))
+        self.assertEqual(c["target"], "coulomb/x")
+
+
+if __name__ == "__main__":
+    unittest.main()