feat(runtime): enforce governed mutation boundaries

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9

tests/test_fi_research_brief.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import json
+import subprocess
+from datetime import date
+from pathlib import Path
+
+from rein_aharness import fi_research_brief
+
+
+def _repo(tmp_path: Path) -> Path:
+    repo = tmp_path / "freedom-intelligence"
+    repo.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True)
+    (repo / "README.md").write_text("baseline\n", encoding="utf-8")
+    subprocess.run(["git", "add", "."], cwd=repo, check=True)
+    subprocess.run(
+        [
+            "git",
+            "-c",
+            "user.email=test@example.invalid",
+            "-c",
+            "user.name=test",
+            "commit",
+            "-qm",
+            "baseline",
+        ],
+        cwd=repo,
+        check=True,
+    )
+    return repo
+
+
+def test_fi_brief_never_pushes_even_when_legacy_env_requests_it(
+    tmp_path: Path,
+    monkeypatch,
+) -> None:
+    repo = _repo(tmp_path)
+    monkeypatch.setenv("FI_RESEARCH_BRIEF_PUSH", "1")
+    original_git = fi_research_brief._git
+    calls: list[tuple[str, ...]] = []
+
+    def observed_git(target: Path, *args: str) -> str:
+        calls.append(args)
+        return original_git(target, *args)
+
+    monkeypatch.setattr(fi_research_brief, "_git", observed_git)
+    result = fi_research_brief.run_fi_research_brief(
+        repo,
+        day=date(2026, 9, 4),
+        report_to_hub=False,
+        complete_fn=lambda _prompt: json.dumps(
+            {
+                "headline_deltas": ["No material delta after allowlist review."],
+                "axis_a": [],
+                "axis_b": [],
+                "axis_c": [],
+                "axis_d": [],
+                "collection_candidates": [],
+                "lab_implications": ["Recheck tomorrow."],
+            }
+        ),
+    )
+
+    assert result.ok is True
+    assert result.committed is True
+    assert not any(args and args[0] == "push" for args in calls)