Ship secret-use snapshot surface for kings-guard

Add secrets-engine secret-use snapshot: catalog plus local evidence only,
contracted non-secret fields, declared 1d heartbeat cadence. Never contacts
OpenBao. Completeness is not claimed. owner_status stays proposed until
kings-guard admits the snapshot as an observation input.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00

tests/test_secret_use.py

@@ -0,0 +1,97 @@
+import copy
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+
+import yaml
+
+from secrets_engine.catalog import validate_entry
+from secrets_engine.secret_use import LANE_FIELDS, snapshot, snapshot_lane
+from tests.test_catalog import VALID
+
+NOW = datetime(2026, 9, 2, 12, 0, tzinfo=timezone.utc)
+
+
+def _write_catalog(tmp_path: Path, data=None):
+    entry = copy.deepcopy(data or VALID)
+    path = tmp_path / "catalog"
+    path.mkdir()
+    (path / f"{entry['id']}.yaml").write_text(
+        yaml.safe_dump(entry), encoding="utf-8"
+    )
+    return path
+
+
+def test_snapshot_omits_unknown_ready_and_never_claims_completeness(tmp_path):
+    catalog = _write_catalog(tmp_path)
+    payload = snapshot(catalog, tmp_path / "evidence", now=NOW)
+    assert payload["completeness_claimed"] is False
+    assert payload["cadence"]["form"] == "heartbeat"
+    assert payload["cadence"]["interval"] == "1d"
+    assert payload["surface"] == "secret-use-evidence"
+    assert len(payload["lanes"]) == 1
+    lane = payload["lanes"][0]
+    assert lane["catalog_id"] == "test-lane"
+    assert "ready" not in lane
+    assert set(lane) <= set(LANE_FIELDS)
+
+
+def test_snapshot_reads_last_verify_and_session_without_secrets(tmp_path):
+    catalog = _write_catalog(tmp_path)
+    evidence = tmp_path / "evidence"
+    evidence.mkdir()
+    records = [
+        {
+            "catalog_id": "test-lane",
+            "action": "verify",
+            "result": "pass",
+            "decision_id": "dec-1",
+            "evidence_kind": "attributive",
+            "detail": {
+                "session": {
+                    "session_handle": "abc123def456",
+                    "revocation_attempted": True,
+                    "revocation_succeeded": True,
+                },
+                "secret": "npm_SHOULDNEVERAPPEAR",
+            },
+        },
+        {
+            "catalog_id": "test-lane",
+            "action": "revoke",
+            "result": "native-access-deactivated",
+            "detail": {"stance_stage": "test", "stance_failure_mode": "fail_open"},
+        },
+    ]
+    (evidence / "evidence-2026-09-02.jsonl").write_text(
+        "".join(json.dumps(row) + "\n" for row in records), encoding="utf-8"
+    )
+    lane = snapshot_lane(
+        validate_entry(copy.deepcopy(VALID)), evidence, now=NOW
+    )
+    assert lane["ready"] is True
+    assert lane["session_handle"] == "abc123def456"
+    assert lane["revocation_attempted"] is True
+    assert lane["revocation_succeeded"] is True
+    assert lane["lifecycle_operation"] == "revoke"
+    assert lane["decision_id"] == "dec-1"
+    assert lane["stance_stage"] == "test"
+    dumped = json.dumps(lane)
+    assert "npm_SHOULDNEVERAPPEAR" not in dumped
+    assert "secret" not in lane
+    assert set(lane) <= set(LANE_FIELDS)
+
+
+def test_snapshot_does_not_contact_openbao(tmp_path, monkeypatch):
+    from secrets_engine import secret_use
+
+    monkeypatch.setattr(
+        secret_use,
+        "load_catalog",
+        lambda *_args, **_kwargs: {"test-lane": validate_entry(copy.deepcopy(VALID))},
+    )
+    # If OpenBao were imported/called, this would be the failure mode to catch
+    # in handlers. The snapshot function has no OpenBao client parameter.
+    payload = snapshot(tmp_path, tmp_path, now=NOW)
+    assert payload["lanes"][0]["mount"] == "secret"
+    assert payload["completeness_claimed"] is False