Prepare bounded telemetry runtime jobs and activity definitions

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

tests/test_runtime.py

@@ -0,0 +1,65 @@
+from datetime import datetime, timezone, timedelta
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'scripts'))
+from receiver import Receiver
+from runtime import ingest_report, private_directory, snapshot, watchdog_health
+
+NOW = datetime(2026, 9, 6, tzinfo=timezone.utc)
+
+
+class RuntimeTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(); self.addCleanup(self.temp.cleanup)
+        self.directory = Path(self.temp.name)
+        self.contract = dict(schema='railiance-telemetry.stream.v1', stream='platform',
+            producer='railiance-platform', recipient='test-operator', signals=['db.restore'],
+            max_event_age_seconds=900, heartbeat_seconds=900, retention_days=30)
+        self.receiver = Receiver(self.directory / 'receiver.db', self.contract)
+        self.addCleanup(self.receiver.close)
+        self.report = dict(schema='railiance-platform.assurance-signal.v1',
+            cluster_uid='a553c742-0115-43d4-99a4-a5ca56fe0786', evaluated_at=NOW.isoformat(),
+            signals={'db.restore': {'state': 'failed', 'owner': 'railiance-platform'}},
+            transport='unmonitored', guarantees='unsupported', threshold_status='local-diagnostic-only', healthy=False)
+
+    def test_report_retry_survives_receiver_restart(self):
+        first = ingest_report(self.receiver, self.report, NOW)
+        second = Receiver(self.directory / 'receiver.db', self.contract)
+        try:
+            retry = ingest_report(second, self.report, NOW + timedelta(seconds=100))
+            self.assertEqual(first['id'], retry['id'])
+            self.assertEqual(retry['status'], 'duplicate')
+            self.assertEqual(len(second.inbox()['notices']), 1)
+            self.assertEqual(second.check(NOW + timedelta(seconds=901))['state'], 'missing-emission')
+        finally: second.close()
+
+    def test_old_report_is_not_renewed(self):
+        with self.assertRaises(ValueError):
+            ingest_report(self.receiver, self.report, NOW + timedelta(seconds=901))
+
+    def test_snapshot_restores_pending_notice_and_contract_binding(self):
+        ingest_report(self.receiver, self.report, NOW)
+        path = self.directory / 'snapshot.db'
+        proof = snapshot(self.receiver, path)
+        self.assertEqual(proof['pending_notices'], 1)
+        self.assertFalse(proof['off_host'])
+        restored = Receiver(path, self.contract)
+        try: self.assertEqual(restored.inbox(), self.receiver.inbox())
+        finally: restored.close()
+        with self.assertRaises(FileExistsError): snapshot(self.receiver, path)
+
+    def test_shared_or_symlink_directory_refused(self):
+        shared = self.directory / 'shared'; shared.mkdir(mode=0o755)
+        with self.assertRaises(ValueError): private_directory(shared)
+        link = self.directory / 'link'; link.symlink_to(self.directory, target_is_directory=True)
+        with self.assertRaises(ValueError): private_directory(link)
+
+    def test_watchdog_check_does_not_renew_its_receipt(self):
+        receipt = dict(state='receiving', recipient='test-operator', delivery='local-inbox-only', pending_notices=0, checked_at=NOW.isoformat())
+        self.assertEqual(watchdog_health(receipt, NOW)['state'], 'watchdog-current')
+        self.assertEqual(watchdog_health(receipt, NOW + timedelta(seconds=181))['state'], 'watchdog-stale')
+        self.assertEqual(receipt['checked_at'], NOW.isoformat())
+        with self.assertRaises(ValueError): watchdog_health(receipt, NOW - timedelta(seconds=1))