Separate producer checks from attended audit readback

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_factory_native_acceptance.py

@@ -9,6 +9,7 @@ import sys
 import tempfile
 import threading
 import unittest
+from unittest.mock import patch
 from wsgiref.simple_server import make_server, WSGIRequestHandler
 
 sys.path.insert(0,str(Path(__file__).resolve().parents[1]/'scripts'))
@@ -16,6 +17,14 @@ import native_factory_acceptance as native
 
 
 class Contracts(unittest.TestCase):
+    def test_jobs_do_not_read_operator_credentials_and_refuse_additive_egress(self):
+        result=subprocess.CompletedProcess([],0,b'{"items":[{"metadata":{"name":"existing-allow"}}]}',b'')
+        with patch.object(native,'receiver_check',return_value={}),patch.object(native,'command',return_value=result) as cmd,patch.object(native,'bao',side_effect=AssertionError('no OpenBao call permitted')):
+            with self.assertRaisesRegex(native.LaneError,'existing_egress_policy_requires_review'):
+                native.jobs({},['kubectl'],{},lambda:None)
+            self.assertEqual(cmd.call_count,1)
+            self.assertNotIn('create',cmd.call_args.args[0])
+
     def test_existing_independent_reader_must_be_unambiguous_and_read_only(self):
         reader={'name':'operator','may_read':True,'may_write':False,'tenants':['*']}
         self.assertEqual(native.operator_identity([reader]),reader)