feat: admit existing OpenBao catalog lanes

tests/test_decisions.py

@@ -1,6 +1,8 @@
 import pytest
+from types import SimpleNamespace
 
 from secrets_engine.catalog import validate_entry
+from secrets_engine.cli import _require_lane_approval
 from secrets_engine.decisions import Decision, require_approved, resolve_decision
 from secrets_engine.errors import DecisionError
 
@@ -50,3 +52,23 @@ def test_local_fixture_resolves(tmp_path):
 def test_missing_decision_raises(tmp_path):
     with pytest.raises(DecisionError):
         resolve_decision(hub_url="http://127.0.0.1:1", repo_root=tmp_path, decision_ref="nope")
+
+
+def test_privileged_lane_helper_fails_closed_without_decision(tmp_path, monkeypatch):
+    import secrets_engine.cli as cli
+
+    monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
+    with pytest.raises(DecisionError):
+        _require_lane_approval(SimpleNamespace(hub_url=""), _approved())
+
+
+def test_privileged_lane_helper_accepts_local_approval(tmp_path, monkeypatch):
+    import secrets_engine.cli as cli
+
+    (tmp_path / ".decisions").mkdir()
+    (tmp_path / ".decisions" / "x.yaml").write_text(
+        "id: x\ntitle: approved\nstatus: resolved\nsuperseded_by: null\n"
+    )
+    monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
+    decision = _require_lane_approval(SimpleNamespace(hub_url=""), _approved())
+    assert decision.id == "x"