Build authorization-gated tenancy evidence harness

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38

tests/test_differential.py

@@ -0,0 +1,37 @@
+from whitehat_security.cli import fixture_calibration
+from whitehat_security.differential import execute
+from whitehat_security.fixtures import FixtureService, probe_suite
+
+
+def test_every_probe_passes_known_good_fixture():
+    results = [execute(probe, salt=b"test") for probe in probe_suite(FixtureService(True))]
+    assert results
+    assert {result.outcome for result in results} == {"pass"}
+
+
+def test_every_probe_detects_known_bad_fixture():
+    results = [execute(probe, salt=b"test") for probe in probe_suite(FixtureService(False))]
+    assert results
+    assert {result.outcome for result in results} == {"finding"}
+
+
+def test_evidence_never_contains_fixture_body_values():
+    result = execute(probe_suite(FixtureService(False))[0], salt=b"test")
+    rendered = repr(result)
+    assert "fixture-b" not in rendered
+    assert "tenant-b" not in rendered
+    assert result.observations["attacker"].fixture_match_count > 0
+
+
+def test_fixture_marker_is_found_when_embedded_in_a_value():
+    service = FixtureService(False)
+    service.objects["object-b"]["label"] = "prefix-fixture-b-suffix"
+    result = execute(probe_suite(service)[0], salt=b"test")
+    assert result.outcome == "finding"
+
+
+def test_calibration_distinguishes_good_and_bad():
+    report = fixture_calibration()
+    assert report["outcome"] == "pass"
+    assert all(item["outcome"] == "pass" for item in report["known_good"])
+    assert all(item["outcome"] == "finding" for item in report["known_bad"])