feat(deploy): gate claims on pinned runtime readiness

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9

tests/test_runtime_lock.py

@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from scripts.verify_runtime_lock import verify
+
+
+def _git(repo: Path, *args: str) -> str:
+    return subprocess.check_output(["git", *args], cwd=repo, text=True).strip()
+
+
+def _fixture(tmp_path: Path) -> tuple[Path, Path]:
+    root = tmp_path / "root"
+    worker = root / "rein-aharness"
+    source = root / "dependency"
+    (worker / "deploy").mkdir(parents=True)
+    source.mkdir(parents=True)
+    (source / "pyproject.toml").write_text(
+        '[project]\nname = "example-runtime"\nversion = "1.2.3"\n',
+        encoding="utf-8",
+    )
+    subprocess.run(["git", "init", "-q"], cwd=source, check=True)
+    subprocess.run(["git", "add", "pyproject.toml"], cwd=source, check=True)
+    subprocess.run(
+        [
+            "git",
+            "-c",
+            "user.name=Test",
+            "-c",
+            "user.email=test@example.invalid",
+            "commit",
+            "-qm",
+            "initial",
+        ],
+        cwd=source,
+        check=True,
+    )
+    lock = worker / "deploy" / "runtime-contract-lock.json"
+    lock.write_text(
+        json.dumps(
+            {
+                "schema_version": "1",
+                "contracts": {
+                    "activity_core_contract_commit": "a" * 40,
+                    "activity_core_schema": "0010",
+                    "glas_contract_version": "1.0",
+                },
+                "dependencies": [
+                    {
+                        "distribution": "example-runtime",
+                        "version": "1.2.3",
+                        "source": "../dependency",
+                        "commit": _git(source, "rev-parse", "HEAD"),
+                    }
+                ],
+            }
+        ),
+        encoding="utf-8",
+    )
+    return lock, source
+
+
+def test_runtime_lock_accepts_exact_clean_source(tmp_path: Path) -> None:
+    lock, _source = _fixture(tmp_path)
+
+    report = verify(lock)
+
+    assert report["ok"] is True
+    assert report["dependencies"][0]["distribution"] == "example-runtime"
+    assert report["dependencies"][0]["clean"] is True
+
+
+def test_runtime_lock_rejects_revision_or_dirty_source(tmp_path: Path) -> None:
+    lock, source = _fixture(tmp_path)
+    payload = json.loads(lock.read_text(encoding="utf-8"))
+    payload["dependencies"][0]["commit"] = "0" * 40
+    lock.write_text(json.dumps(payload), encoding="utf-8")
+
+    with pytest.raises(ValueError, match="revision mismatch"):
+        verify(lock)
+
+    payload["dependencies"][0]["commit"] = _git(source, "rev-parse", "HEAD")
+    lock.write_text(json.dumps(payload), encoding="utf-8")
+    (source / "untracked.txt").write_text("dirty\n", encoding="utf-8")
+    with pytest.raises(ValueError, match="source checkout is dirty"):
+        verify(lock)