Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_redact_evidence.py

@@ -1,4 +1,6 @@
 import json
+import urllib.error
+from types import SimpleNamespace
 
 from secrets_engine.evidence import EvidenceWriter, _scrub
 from secrets_engine.redact import looks_secret, redact_text
@@ -39,3 +41,48 @@ def test_evidence_record_has_no_value(tmp_path):
     # written to disk too
     files = list(tmp_path.glob("evidence-*.jsonl"))
     assert files and "npm_shouldnotappear123" not in files[0].read_text()
+
+
+def test_evidence_records_append_only_hub_delivery_success(tmp_path, monkeypatch):
+    monkeypatch.setattr(
+        "urllib.request.urlopen",
+        lambda *_args, **_kwargs: SimpleNamespace(read=lambda: b"{}"),
+    )
+    writer = EvidenceWriter(
+        evidence_dir=tmp_path,
+        hub_url="http://hub.invalid",
+        topic_id="topic-id",
+    )
+
+    primary = writer.record("verify", result="pass", catalog_id="lane")
+
+    lines = [
+        json.loads(line)
+        for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    assert len(lines) == 2
+    assert lines[0] == primary
+    assert lines[1]["action"] == "evidence-delivery"
+    assert lines[1]["result"] == "delivered"
+    assert lines[1]["related_record_id"] == primary["record_id"]
+
+
+def test_evidence_records_hub_failure_without_raising(tmp_path, monkeypatch):
+    def offline(*_args, **_kwargs):
+        raise urllib.error.URLError("offline")
+
+    monkeypatch.setattr("urllib.request.urlopen", offline)
+    writer = EvidenceWriter(
+        evidence_dir=tmp_path,
+        hub_url="http://hub.invalid",
+        topic_id="topic-id",
+    )
+
+    writer.record("verify", result="pass", catalog_id="lane")
+
+    lines = [
+        json.loads(line)
+        for line in next(tmp_path.glob("evidence-*.jsonl")).read_text().splitlines()
+    ]
+    assert lines[-1]["action"] == "evidence-delivery"
+    assert lines[-1]["result"] == "failed"