Prepare receipt-bound audit E2 third attempt

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

tests/test_platform_custody_adapter.py

@@ -15,6 +15,7 @@ from whitehat_security.platform_custody import (
     broker_from_receipt,
     contract_digest,
     digest,
+    finalize_run_report,
     interface_artifacts,
     load_schemas,
     resource_names,
@@ -381,3 +382,38 @@ def test_cleanup_receipt_must_match_lease():
         bad = cleanup_receipt(bound, projection)
         bad["lease_id"] = "custody:" + "0" * 32
         validate_cleanup_receipt(bad, projection=projection, contract=bound)
+
+
+def test_finalized_report_is_bound_to_cleanup_receipt():
+    bound = contract()
+    projection = projection_receipt(bound)
+    cleanup = cleanup_receipt(bound, projection)
+    report = {
+        "engagement_id": bound["engagement_id"],
+        "target": bound["target"]["id"],
+        "target_revision": bound["target"]["image_digest"],
+        "credential_revocation": "pending orchestrator cleanup",
+        "cleanup": "pending",
+    }
+    finalized = finalize_run_report(
+        report, projection=projection, cleanup=cleanup, contract=bound
+    )
+    assert finalized["credential_revocation"].startswith("revoked by railiance-platform")
+    assert projection["receipt_id"] in finalized["cleanup"]
+
+
+def test_finalized_report_refuses_wrong_engagement():
+    bound = contract()
+    projection = projection_receipt(bound)
+    cleanup = cleanup_receipt(bound, projection)
+    with pytest.raises(AuthorizationError, match="report engagement"):
+        finalize_run_report(
+            {
+                "engagement_id": "WH-ENG-WRONG",
+                "target": "audit-core",
+                "target_revision": bound["target"]["image_digest"],
+            },
+            projection=projection,
+            cleanup=cleanup,
+            contract=bound,
+        )