K8: record blocked owner review and release evidence

scripts/test_owner_review_gate_refresh.py

@@ -0,0 +1,37 @@
+import json
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from generate_owner_review_gate_refresh import OUTPUT, generate
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class OwnerReviewGateRefreshTests(unittest.TestCase):
+    def test_contract_fails_closed_without_owner_inputs(self):
+        report = json.loads((ROOT / OUTPUT).read_text(encoding="utf-8"))
+        self.assertEqual(report["schema"], "owner-review-gate-refresh.v1")
+        self.assertEqual(report["task_id"], "K8-REL-15")
+        self.assertEqual(report["status"], "blocked")
+        self.assertEqual(report["review_status"], "owner_input_required")
+        self.assertEqual(report["release_action"], "STOP_RELEASE")
+        self.assertFalse(report["candidate_eligible"])
+        self.assertEqual(len(report["decisions"]), 6)
+        self.assertEqual(report["checks"]["owner_inputs_present"]["status"], "blocked")
+        self.assertEqual(report["checks"]["gate_refresh_allowed"]["status"], "blocked")
+        self.assertEqual(report["checks"]["release_stop_preserved"]["status"], "verified")
+
+    def test_generation_is_deterministic(self):
+        before = (ROOT / OUTPUT).read_bytes()
+        generated = generate(ROOT, ROOT / OUTPUT)
+        after = (ROOT / OUTPUT).read_bytes()
+        self.assertEqual(before, after)
+        self.assertEqual(generated["report_sha256"], json.loads(after.decode())["report_sha256"])
+
+
+if __name__ == "__main__":
+    unittest.main()