Implement attended Railiance Clock host key delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

tests/test_railiance_clock_custody.py

@@ -0,0 +1,44 @@
+import copy
+import importlib.util
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+import yaml
+
+ROOT=Path(__file__).resolve().parents[1]
+spec=importlib.util.spec_from_file_location('clock_custody',ROOT/'scripts/railiance_clock_custody.py')
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+
+class CustodyTests(unittest.TestCase):
+    def setUp(self):self.contract=yaml.safe_load(m.CCR.read_text())
+    def test_valid(self):self.assertEqual(m.validate_contract(self.contract),[])
+    def test_scope_and_approval_drift(self):
+        for change in [lambda c:c['delivery'].update(host='other'),lambda c:c['openbao'].update(runtime_access=True),lambda c:c['review'].update(comments=[]),lambda c:c['openbao'].update(initial_cas=1)]:
+            c=copy.deepcopy(self.contract);change(c);self.assertTrue(m.validate_contract(c))
+    def run_failure(self,reply,expected_stage):
+        with tempfile.TemporaryDirectory() as d:
+            out=Path(d)/'receipt.json'
+            with patch.object(sys,'argv',['helper','--receipt',str(out)]),patch.object(m,'bao',side_effect=reply),patch.object(m,'run_cmd') as cmd:
+                self.assertEqual(m.main(),1);cmd.assert_not_called()
+            receipt=json.loads(out.read_text());self.assertEqual(receipt['stage'],expected_stage)
+            self.assertNotIn('PRIVATE KEY',out.read_text())
+    def test_root_denied(self):
+        self.run_failure([{'data':{'policies':['root','platform-admin'],'path':'auth/netkingdom/login'}}],'attended_identity')
+    def test_wrong_auth_mount_denied(self):
+        self.run_failure([{'data':{'policies':['platform-admin'],'path':'auth/token/create'}}],'attended_identity')
+    def test_audit_required(self):
+        self.run_failure([{'data':{'policies':['platform-admin'],'path':'auth/netkingdom/login'}},{}],'attended_identity')
+    def test_cas_failure_prevents_delivery(self):
+        self.run_failure([{'data':{'policies':['platform-admin'],'path':'auth/netkingdom/login'}},{'file/':{}},m.CustodyError('contained_command_failed')],'custody')
+    def test_receipt_never_overwrites(self):
+        with tempfile.TemporaryDirectory() as d:
+            out=Path(d)/'receipt.json';out.write_text('previous evidence')
+            with patch.object(sys,'argv',['helper','--receipt',str(out)]),patch.object(m,'bao') as b:
+                with self.assertRaises(FileExistsError):m.main()
+                b.assert_not_called()
+            self.assertEqual(out.read_text(),'previous evidence')
+
+if __name__=='__main__':unittest.main()