Implement authenticated custody observations and durable root-grant baseline

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

tests/test_custody_bootstrap.py

@@ -0,0 +1,33 @@
+import hashlib
+import json
+import unittest
+import test_custody_adapter as adapter_fixtures
+CANON = adapter_fixtures.CANON
+from user_engine.custody_bootstrap import initialize_baseline
+
+
+@unittest.skipUnless(CANON.exists(), "optional sibling fixtures absent")
+class CustodyBootstrapTests(unittest.TestCase):
+    def setUp(self):
+        self.fixture = adapter_fixtures.CustodyAdapterTests()
+        self.fixture.setUp()
+        self.fixture.adapter.clock = lambda: self.fixture.now
+        self.digest = hashlib.sha256(json.dumps(self.fixture.document, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()).hexdigest()
+
+    def test_authenticated_receipt_match_initializes_once(self):
+        self.assertTrue(initialize_baseline(self.fixture.adapter, expected_sha256=self.digest))
+        self.assertFalse(initialize_baseline(self.fixture.adapter, expected_sha256=self.digest))
+        self.assertEqual(self.fixture.reads, 1)
+
+    def test_wrong_receipt_and_failure_do_not_seed_baseline(self):
+        self.assertFalse(initialize_baseline(self.fixture.adapter, expected_sha256="0" * 64))
+        self.fixture.failure = True
+        self.assertFalse(initialize_baseline(self.fixture.adapter, expected_sha256=self.digest))
+        self.assertIsNone(self.fixture.baselines.value)
+
+
+    def test_empty_approved_document_initializes_no_grant(self):
+        self.fixture.document["entries"] = []
+        digest = hashlib.sha256(json.dumps(self.fixture.document, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()).hexdigest()
+        self.assertTrue(initialize_baseline(self.fixture.adapter, expected_sha256=digest))
+        self.assertIsNone(self.fixture.observe())