K8: record blocked owner review and release evidence

scripts/test_post_release_audit.py

@@ -0,0 +1,52 @@
+import json
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from generate_post_release_audit import AUDIT, generate
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class PostReleaseAuditTests(unittest.TestCase):
+    def test_report_contract_preserves_stop_decision_and_blockers(self):
+        report = json.loads((ROOT / AUDIT).read_text(encoding="utf-8"))
+        self.assertEqual(report["schema"], "post-release-audit.v1")
+        self.assertEqual(report["audit_id"], "K8-REL-05")
+        self.assertEqual(report["status"], "blocked")
+        self.assertEqual(report["release_action"], "STOP_RELEASE")
+        self.assertEqual(report["release_decision"], "blocked_not_release_candidate")
+        self.assertFalse(report["candidate_eligible"])
+        self.assertEqual(report["blocked_count"], 6)
+        self.assertEqual(report["checks"]["input_hashes"]["status"], "verified")
+        self.assertEqual(report["checks"]["context_consistency"]["status"], "verified")
+        self.assertEqual(report["checks"]["cross_references"]["status"], "verified")
+        self.assertEqual(report["checks"]["blocker_review"]["status"], "verified")
+        self.assertEqual(report["checks"]["gate_checks"]["status"], "verified")
+        self.assertTrue(all(row["owner"] and row["review_owner"] for row in report["blockers"]))
+        self.assertTrue(all(row["evidence"] and row["remediation"] for row in report["blockers"]))
+        self.assertEqual(
+            {row["id"] for row in report["blockers"]},
+            {
+                "manifest_seed_unassigned",
+                "accepted_entries_missing",
+                "official_oracle_missing",
+                "configuration_resources_missing",
+                "browser_matrix_unverified",
+                "license_closure_incomplete",
+            },
+        )
+
+    def test_generation_is_deterministic(self):
+        before = (ROOT / AUDIT).read_bytes()
+        generated = generate(ROOT, ROOT / AUDIT)
+        after = (ROOT / AUDIT).read_bytes()
+        self.assertEqual(before, after)
+        self.assertEqual(generated["report_sha256"], json.loads(after.decode())["report_sha256"])
+
+
+if __name__ == "__main__":
+    unittest.main()