Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_audit.py

@@ -0,0 +1,102 @@
+import json
+import urllib.error
+from pathlib import Path
+from types import SimpleNamespace
+
+from secrets_engine.audit import summarize_lane_evidence
+from secrets_engine.cli import build_parser
+from secrets_engine.evidence import EvidenceWriter
+
+
+DECISION_ID = "e6381a56-3e55-4fac-b22c-63ee1c152ce8"
+
+
+def test_lane_audit_summarizes_allowlisted_fields_and_cleanup(tmp_path, monkeypatch):
+    writer = EvidenceWriter(
+        evidence_dir=tmp_path,
+        hub_url="http://hub.invalid",
+        topic_id="topic-id",
+    )
+    monkeypatch.setattr(
+        "urllib.request.urlopen", lambda *_args, **_kwargs: SimpleNamespace(read=lambda: b"{}")
+    )
+    writer.record(
+        "exec",
+        result="exit-0",
+        catalog_id="test-lane",
+        stage="test",
+        decision_id=DECISION_ID,
+        detail={
+            "session": {
+                "session_handle": "safe-fingerprint",
+                "revocation_attempted": True,
+                "revocation_succeeded": True,
+            }
+        },
+    )
+
+    def offline(*_args, **_kwargs):
+        raise urllib.error.URLError("offline")
+
+    monkeypatch.setattr("urllib.request.urlopen", offline)
+    writer.record(
+        "verify",
+        result="positive-pass",
+        catalog_id="test-lane",
+        stage="test",
+        decision_id=DECISION_ID,
+        detail={
+            "session": {
+                "session_handle": "another-safe-fingerprint",
+                "revocation_attempted": True,
+                "revocation_succeeded": False,
+            }
+        },
+    )
+
+    path = next(tmp_path.glob("evidence-*.jsonl"))
+    with path.open("a", encoding="utf-8") as fh:
+        fh.write("not-json\n")
+        fh.write(
+            json.dumps(
+                {
+                    "catalog_id": "test-lane",
+                    "action": "fake-SUPER-SECRET-value",
+                    "result": "fake-SUPER-SECRET-value",
+                    "decision_id": "fake-SUPER-SECRET-value",
+                    "ts": "not-a-time",
+                    "detail": {"value": "fake-SUPER-SECRET-value"},
+                }
+            )
+            + "\n"
+        )
+
+    summary = summarize_lane_evidence(tmp_path, "test-lane")
+    rendered = json.dumps(summary.to_json()) + summary.render()
+
+    assert summary.operation_records == 3
+    assert summary.malformed_records == 1
+    assert summary.actions == {"exec": 1, "invalid-label": 1, "verify": 1}
+    assert summary.results == {
+        "exit-0": 1,
+        "invalid-label": 1,
+        "positive-pass": 1,
+    }
+    assert summary.decision_refs == [DECISION_ID]
+    assert summary.session_cleanup == {"failed": 1, "succeeded": 1}
+    assert summary.hub_delivery == {"delivered": 1, "failed": 1}
+    assert "fake-SUPER-SECRET-value" not in rendered
+    assert "safe-fingerprint" not in rendered
+
+
+def test_lane_audit_empty_directory_is_a_valid_empty_summary(tmp_path):
+    summary = summarize_lane_evidence(tmp_path, "test-lane")
+    assert summary.operation_records == 0
+    assert summary.actions == {}
+    assert summary.render().startswith("Lane audit summary for 'test-lane'")
+
+
+def test_cli_parser_exposes_audit_json_command():
+    args = build_parser().parse_args(["audit", "test-lane", "--json"])
+    assert args.catalog_id == "test-lane"
+    assert args.json is True