feat: finish register receiving and authority routing

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d

tests/test_authority.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+import pytest
+
+from repo_manager.authority import (
+    AuthorityError,
+    load_authority_contract,
+    resolve_record_authority,
+)
+
+
+def test_file_derived_route_is_scoped_by_domain_and_repository() -> None:
+    route = resolve_record_authority(
+        "workplans",
+        repo_slug="repo-manager",
+        domain_slug="infotech",
+        claimed_owner="repo-manager",
+    )
+
+    assert route["owner"] == "repo-manager"
+    assert route["authority_key"] == "repository:infotech/repo-manager"
+
+
+def test_hub_native_route_has_one_central_owner() -> None:
+    route = resolve_record_authority("progress_events", claimed_owner="hub-core")
+
+    assert route["owner"] == "hub-core"
+    assert route["authority_key"] == "hub:hub-core"
+
+
+def test_unknown_or_conflicting_owner_is_rejected() -> None:
+    with pytest.raises(AuthorityError, match="unknown record type"):
+        resolve_record_authority("mystery")
+    with pytest.raises(AuthorityError, match="authority mismatch"):
+        resolve_record_authority("progress_events", claimed_owner="repo-manager")
+
+
+def test_every_contract_record_resolves_to_exactly_one_owner() -> None:
+    contract = load_authority_contract()
+
+    for record_type, rule in contract["records"].items():
+        context = (
+            {"repo_slug": "example", "domain_slug": "infotech"}
+            if rule["class"] == "file-derived"
+            else {}
+        )
+        route = resolve_record_authority(record_type, **context)
+        assert route["owner"] == rule["owner"]
+        assert route["authority_key"]

tests/test_dual_run.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import json
 import subprocess
 from pathlib import Path
 

tests/test_e2e_vertical_slice.py

@@ -11,7 +11,6 @@ from repo_manager.gitops import head_sha
 from repo_manager.index_store import default_index_path, load_index
 from repo_manager.observe import observe_repository
 
-
 WORKPLAN = """---
 id: DEMO-WP-0001
 type: workplan

tests/test_sbom.py

@@ -0,0 +1,111 @@
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+from repo_manager.sbom import detect_sources, scan_repository
+
+
+def _git(repo: Path, *args: str) -> None:
+    subprocess.run(["git", *args], cwd=repo, check=True, capture_output=True)
+
+
+def test_scan_derives_snapshot_and_copyleft_report(tmp_path: Path) -> None:
+    repo = tmp_path / "example"
+    repo.mkdir()
+    _git(repo, "init")
+    _git(repo, "config", "user.email", "test@example.com")
+    _git(repo, "config", "user.name", "Test")
+    (repo / "uv.lock").write_text(
+        'version = 1\n[[package]]\nname = "pyyaml"\nversion = "6.0.2"\n',
+        encoding="utf-8",
+    )
+    (repo / "package-lock.json").write_text(
+        json.dumps(
+            {
+                "packages": {
+                    "": {"name": "root", "version": "1.0.0"},
+                    "node_modules/copyleft": {
+                        "name": "copyleft",
+                        "version": "2.0.0",
+                        "license": "GPL-3.0-only",
+                    },
+                    "node_modules/dev-only": {
+                        "name": "dev-only",
+                        "version": "3.0.0",
+                        "license": "AGPL-3.0-only",
+                        "dev": True,
+                    },
+                }
+            }
+        ),
+        encoding="utf-8",
+    )
+    _git(repo, "add", ".")
+    _git(repo, "commit", "-m", "seed")
+
+    result = scan_repository(repo)
+
+    assert result["ok"] is True
+    assert result["schema"] == "repo-manager.sbom-snapshot.v1"
+    assert result["source_revision"]
+    assert result["generated_at"].endswith("Z")
+    assert result["entry_count"] == 3
+    assert result["licence_report"]["copyleft_direct_count"] == 1
+    assert result["licence_report"]["copyleft_direct_prod"][0]["package_name"] == "copyleft"
+
+
+def test_detection_covers_sources_and_skips_dependency_directories(tmp_path: Path) -> None:
+    (tmp_path / "go.sum").write_text("example.test/mod v1.2.3 h1:abc\n", encoding="utf-8")
+    terraform = tmp_path / "infra"
+    terraform.mkdir()
+    (terraform / ".terraform.lock.hcl").write_text(
+        'provider "registry.terraform.io/hashicorp/null" {\n  version = "3.2.3"\n}\n',
+        encoding="utf-8",
+    )
+    ansible = tmp_path / "deploy" / "ansible"
+    ansible.mkdir(parents=True)
+    (ansible / "requirements.yml").write_text("collections:\n  - community.general\n", encoding="utf-8")
+    ignored = tmp_path / "node_modules"
+    ignored.mkdir()
+    (ignored / "package-lock.json").write_text("{}", encoding="utf-8")
+
+    sources = {str(path.relative_to(tmp_path)) for path, _parser in detect_sources(tmp_path)}
+
+    assert sources == {
+        "deploy/ansible/requirements.yml",
+        "go.sum",
+        "infra/.terraform.lock.hcl",
+    }
+
+
+def test_go_sum_marks_modules_declared_in_go_mod_as_direct(tmp_path: Path) -> None:
+    (tmp_path / "go.mod").write_text(
+        "module example.test/app\n\nrequire example.test/direct v1.2.3\n",
+        encoding="utf-8",
+    )
+    (tmp_path / "go.sum").write_text(
+        "example.test/direct v1.2.3 h1:abc\n"
+        "example.test/direct v1.2.3/go.mod h1:def\n"
+        "example.test/transitive v2.0.0 h1:ghi\n",
+        encoding="utf-8",
+    )
+
+    result = scan_repository(tmp_path)
+
+    assert result["ok"] is True
+    assert [(entry["package_name"], entry["is_direct"]) for entry in result["entries"]] == [
+        ("example.test/direct", True),
+        ("example.test/transitive", False),
+    ]
+
+
+def test_invalid_source_is_reported_without_partial_failure(tmp_path: Path) -> None:
+    (tmp_path / "uv.lock").write_text("not = [valid", encoding="utf-8")
+
+    result = scan_repository(tmp_path)
+
+    assert result["ok"] is False
+    assert result["entry_count"] == 0
+    assert result["errors"][0]["source_path"] == "uv.lock"

tests/test_time.py

@@ -0,0 +1,17 @@
+from datetime import UTC, datetime, timedelta, timezone
+
+import pytest
+
+from repo_manager.time import format_utc
+
+
+def test_format_utc_normalizes_offsets_and_uses_z() -> None:
+    local = datetime(2026, 8, 21, 22, 30, tzinfo=timezone(timedelta(hours=2)))
+
+    assert format_utc(local) == "2026-08-21T20:30:00Z"
+    assert format_utc(local.astimezone(UTC)).endswith("Z")
+
+
+def test_format_utc_rejects_naive_datetime() -> None:
+    with pytest.raises(ValueError, match="timezone-aware"):
+        format_utc(datetime(2026, 8, 21, 20, 30))  # noqa: DTZ001 - deliberate invalid input