Prepare canonical custody for audit E2 third attempt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

tests/test_wp0025_broker_readiness.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
 import importlib.util
+import json
 import subprocess
+import stat
 import sys
 import tempfile
 import unittest
@@ -84,6 +86,29 @@ class BrokerReadinessTests(unittest.TestCase):
         with self.assertRaises(module.ReadinessError):
             module.build_change_request(contract, "whitehat-owner", "")
 
+    def test_receipt_export_is_raw_canonical_document_with_private_mode(self) -> None:
+        contract = projection_contract()
+        verification = {
+            "passed": True,
+            "adapter": {
+                "repo": "whitehat-security",
+                "revision": "a" * 40,
+                "path": str(module.DEFAULT_ADAPTER),
+                "sha256": "b" * 64,
+                "tests_passed": True,
+            },
+            "secret_values_observed": False,
+        }
+        receipt = module.build_approval(contract, "whitehat-owner", verification)
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "nested" / "broker.json"
+            module.write_receipt(path, receipt)
+            observed = json.loads(path.read_text(encoding="utf-8"))
+            mode = stat.S_IMODE(path.stat().st_mode)
+        self.assertEqual(receipt, observed)
+        self.assertNotIn("submitted", observed)
+        self.assertEqual(0o600, mode)
+
 
 if __name__ == "__main__":
     unittest.main()