Propose WH-ENG-20260822-AUDIT-E2-01 without authorizing traffic

Align plane ordering with Mason's apply, record the fresh audit-core
engagement as proposed, and keep offline admission fail-closed until
operator approval and owner acknowledgement exist.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

tests/test_cli.py

@@ -24,6 +24,28 @@ def test_kill_switch_is_clear_by_default(capsys):
     assert capsys.readouterr().out.strip() == "clear"
 
 
+def test_validate_engagement_refuses_proposed_record(capsys):
+    with pytest.raises(SystemExit) as stopped:
+        main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"])
+    assert stopped.value.code == 2
+    err = capsys.readouterr().err
+    assert err.startswith("not authorized:")
+    assert "proposed" in err
+
+
+def test_admit_plane_refuses_proposed_record(capsys):
+    with pytest.raises(SystemExit) as stopped:
+        main([
+            "admit-plane",
+            "engagements/2026-08-22-audit-core-e2.json",
+            "targets/audit-core-e2.json",
+        ])
+    assert stopped.value.code == 2
+    err = capsys.readouterr().err
+    assert "not authorized:" in err
+    assert "proposed" in err
+
+
 def test_admit_plane_refuses_cancelled_engagement(capsys):
     with pytest.raises(SystemExit) as stopped:
         main([

tests/test_engagement.py

@@ -63,6 +63,15 @@ def test_pending_owner_acknowledgement_fails_closed(tmp_path):
         load(tmp_path, data)
 
 
+def test_proposed_record_fails_closed_before_window_checks(tmp_path):
+    data = record()
+    data["status"] = "proposed"
+    data["approved_at"] = None
+    data["target_owner_acknowledged_at"] = None
+    with pytest.raises(AuthorizationError, match="proposed"):
+        load(tmp_path, data)
+
+
 def test_cancelled_record_fails_closed_even_with_owner_acknowledgement(tmp_path):
     data = record()
     data["status"] = "cancelled"