K8: record blocked owner review and release evidence

scripts/test_migration_closure.py

@@ -0,0 +1,35 @@
+import json
+import hashlib
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+REPORT = ROOT / "coverage/workspace-migration.report.json"
+
+
+class MigrationClosureTests(unittest.TestCase):
+    def test_report_contract_and_blockers(self):
+        report = json.loads(REPORT.read_text(encoding="utf-8"))
+        self.assertEqual(report["schema"], "workspace-migration-report.v1")
+        self.assertEqual(report["status"], "passed")
+        self.assertEqual(report["implementation_status"], "verified")
+        self.assertEqual(report["format"]["schema"], "workspace-package.v1")
+        self.assertEqual(report["format"]["supported_versions"], [1, 2])
+        self.assertTrue(report["format"]["payload_schemas_unchanged"])
+        self.assertTrue(report["migration"]["round_trip_equal"])
+        self.assertTrue(report["migration"]["deterministic"])
+        self.assertEqual(report["rollback"]["failure_result"], "rollback_injected_failure")
+        self.assertEqual(report["rollback"]["recovery_status"], "recovered")
+        self.assertEqual(report["offline"]["offline_start"], "ready")
+        self.assertEqual(report["offline"]["missing_resource_result"], "offline_resource_invalid")
+        self.assertTrue((ROOT / "coverage/workspace-rollback.package.json").is_file())
+        self.assertTrue((ROOT / "coverage/offline-cache.package.json").is_file())
+        self.assertTrue(report["recovery_endpoint"]["no_silent_downgrade"])
+        self.assertEqual(report["oracle"]["status"], "blocked")
+        unsigned = {key: value for key, value in report.items() if key != "report_sha256"}
+        self.assertEqual(report["report_sha256"], hashlib.sha256(json.dumps(unsigned, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest())
+
+
+if __name__ == "__main__":
+    unittest.main()