Gate reef web ports on exposure grants

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

tests/test_reef_exposure.py

@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+import importlib.util
+import copy
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SPEC = importlib.util.spec_from_file_location("reef_exposure", ROOT / "scripts" / "validate-reef-exposure.py")
+assert SPEC and SPEC.loader
+module = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(module)
+GrantError = module.GrantError
+validate = module.validate
+
+
+VALID = {
+    "kind": "substrate-reef",
+    "reef_id": "reef-example",
+    "primary_rail": "rail-kubernetes",
+    "exposure": {
+        "posture": "public",
+        "grants": [
+            {"port": 80, "reason": "redirect", "approved_on": "2026-08-22", "residual_risk_owner": "infra"},
+            {"port": 443, "reason": "tls", "approved_on": "2026-08-22", "residual_risk_owner": "infra"},
+        ],
+    },
+}
+
+
+class ReefExposureTests(unittest.TestCase):
+    def test_valid_public_web_grants(self) -> None:
+        self.assertEqual([80, 443], validate(VALID, [80, 443])["validated_ports"])
+
+    def test_private_reef_fails(self) -> None:
+        payload = {**VALID, "exposure": {"posture": "private"}}
+        with self.assertRaisesRegex(GrantError, "must be public"):
+            validate(payload, [443])
+
+    def test_missing_port_fails(self) -> None:
+        payload = copy.deepcopy(VALID)
+        payload["exposure"]["grants"] = payload["exposure"]["grants"][:1]
+        with self.assertRaisesRegex(GrantError, "port 443"):
+            validate(payload, [443])
+
+    def test_kubernetes_api_is_never_grantable(self) -> None:
+        with self.assertRaisesRegex(GrantError, "operator-only"):
+            validate(VALID, [6443])
+
+    def test_provider_delegated_reef_fails(self) -> None:
+        payload = {key: value for key, value in VALID.items() if key != "primary_rail"}
+        with self.assertRaisesRegex(GrantError, "provider-delegated"):
+            validate(payload, [443])
+
+
+if __name__ == "__main__":
+    unittest.main()