Harden production authorization and service auth

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_redact_evidence.py

@@ -47,9 +47,15 @@ def test_evidence_record_has_no_value(tmp_path):
 
 
 def test_evidence_records_append_only_hub_delivery_success(tmp_path, monkeypatch):
+    captured = {}
+
+    def delivered(request, **_kwargs):
+        captured["headers"] = dict(request.header_items())
+        return SimpleNamespace(status=200, read=lambda: b"{}")
+
     monkeypatch.setattr(
         "urllib.request.urlopen",
-        lambda *_args, **_kwargs: SimpleNamespace(read=lambda: b"{}"),
+        delivered,
     )
     writer = EvidenceWriter(
         evidence_dir=tmp_path,
@@ -68,6 +74,62 @@ def test_evidence_records_append_only_hub_delivery_success(tmp_path, monkeypatch
     assert lines[1]["action"] == "evidence-delivery"
     assert lines[1]["result"] == "delivered"
     assert lines[1]["related_record_id"] == primary["record_id"]
+    assert captured["headers"]["Idempotency-key"] == (
+        f"secrets-engine:{primary['record_id']}"
+    )
+    assert captured["headers"]["X-statehub-source-agent"] == "secrets-engine"
+    assert captured["headers"]["X-statehub-repo-slug"] == "secrets-engine"
+
+
+def test_evidence_records_edge_queued_receipt_as_queued(tmp_path, monkeypatch):
+    outbox_id = "3f12014e-47c1-48a5-9c8f-774c1dac1853"
+    monkeypatch.setattr(
+        "urllib.request.urlopen",
+        lambda *_args, **_kwargs: SimpleNamespace(
+            status=202,
+            read=lambda: json.dumps(
+                {"queued": True, "outbox_id": outbox_id}
+            ).encode(),
+        ),
+    )
+    writer = EvidenceWriter(
+        evidence_dir=tmp_path,
+        hub_url="http://edge.invalid",
+        topic_id="topic-id",
+    )
+
+    writer.record("verify", result="pass", catalog_id="lane")
+
+    lines = [
+        json.loads(line)
+        for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    assert lines[-1]["action"] == "evidence-delivery"
+    assert lines[-1]["result"] == "queued"
+    assert lines[-1]["detail"] == {"outbox_id": outbox_id}
+    assert "upstream" not in json.dumps(lines[-1])
+
+
+def test_evidence_rejects_malformed_queued_receipt(tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        "urllib.request.urlopen",
+        lambda *_args, **_kwargs: SimpleNamespace(
+            status=202,
+            read=lambda: b'{"queued":true,"outbox_id":"not-a-uuid"}',
+        ),
+    )
+    writer = EvidenceWriter(
+        evidence_dir=tmp_path,
+        hub_url="http://edge.invalid",
+        topic_id="topic-id",
+    )
+    writer.record("verify", result="pass", catalog_id="lane")
+    lines = [
+        json.loads(line)
+        for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    assert lines[-1]["result"] == "failed"
+    assert lines[-1]["detail"] == {}
 
 
 def test_evidence_records_hub_failure_without_raising(tmp_path, monkeypatch):