feat: complete Epic 1 production foundation

tests/unit/test_authenticated_product_smoke.py

@@ -131,9 +131,11 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
                 self.requests = []
 
             def request_json(self, method, path, payload=None, **kwargs):
-                self.requests.append((method, path, payload))
+                self.requests.append((method, path, payload, kwargs))
                 if path.endswith("/operations"):
                     return smoke.JsonResponse(200, {}, {"operation_id": "op_safe", "version": 7})
+                if path.endswith("/operations/op_safe"):
+                    return smoke.JsonResponse(200, {"ETag": '"safe-etag"'}, {"id": "op_safe"})
                 if path.endswith("/publish") and "/operations/" in path:
                     return smoke.JsonResponse(200, {}, {"published_version": 7})
                 if path.endswith("/agents"):
@@ -154,8 +156,10 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
 
         self.assertEqual((operation_id, operation_version, published_operation_version), ("op_safe", 7, 7))
         self.assertEqual((agent_id, agent_version, published_agent_version), ("agent_safe", 3, 3))
-        binding = next(payload for _, path, payload in client.requests if path.endswith("/bindings"))[0]
+        binding = next(payload for _, path, payload, _ in client.requests if path.endswith("/bindings"))[0]
         self.assertEqual(binding["operation_version"], 7)
+        publish = next(request for request in client.requests if request[1].endswith("/operations/op_safe/publish"))
+        self.assertEqual(publish[3]["headers"], {"If-Match": '"safe-etag"'})
 
     def test_admin_test_run_uses_created_version_and_rejects_failed_outcome(self) -> None:
         smoke = load_smoke_module()
@@ -177,6 +181,35 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
             smoke.run_operation_test(FakeClient(False), "ws", "op", 9)
         self.assertNotIn("secret-canary", str(raised.exception))
 
+    def test_edit_and_archive_use_fresh_operation_preconditions(self) -> None:
+        smoke = load_smoke_module()
+
+        class FakeClient:
+            def __init__(self):
+                self.calls = []
+                self.etag_index = 0
+
+            def request_json(self, method, path, payload=None, **kwargs):
+                self.calls.append((method, path, payload, kwargs))
+                if method == "GET":
+                    self.etag_index += 1
+                    return smoke.JsonResponse(200, {"ETag": f'"etag-{self.etag_index}"'}, {})
+                if method == "PATCH":
+                    return smoke.JsonResponse(200, {}, {"version": 2})
+                if path.endswith("/archive"):
+                    return smoke.JsonResponse(200, {}, {"status": "archived"})
+                raise AssertionError((method, path))
+
+        client = FakeClient()
+        version = smoke.edit_and_archive_operation(
+            client, "ws", "op", "safe_operation", "http://admin-api:3001"
+        )
+        self.assertEqual(version, 2)
+        patch = next(call for call in client.calls if call[0] == "PATCH")
+        archive = next(call for call in client.calls if call[1].endswith("/archive"))
+        self.assertEqual(patch[3]["headers"], {"If-Match": '"etag-1"'})
+        self.assertEqual(archive[3]["headers"], {"If-Match": '"etag-2"'})
+
     def test_http_failure_message_is_bounded_and_redacted(self) -> None:
         smoke = load_smoke_module()
         error = smoke.safe_error("http", "unexpected_status", status=500)

tests/unit/test_check_execution_boundaries.py

@@ -0,0 +1,89 @@
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+CHECKER = ROOT / "scripts" / "check-execution-boundaries.py"
+
+
+class ExecutionBoundaryCheckTests(unittest.TestCase):
+    def run_checker(self, root: Path, *files: str) -> subprocess.CompletedProcess[str]:
+        return subprocess.run(
+            ["python3", str(CHECKER), "--root", str(root), "--files", *files],
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            check=False,
+        )
+
+    def assert_rejected(self, relative: str, source_text: str) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            source = root / relative
+            source.parent.mkdir(parents=True)
+            source.write_text(source_text, encoding="utf-8")
+            result = self.run_checker(root, relative)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn("EXECUTION_BOUNDARY", result.stderr)
+
+    def test_rejects_adapter_alias(self) -> None:
+        self.assert_rejected(
+            "apps/admin-api/src/service/bypass.rs",
+            "use crank_adapter_rest as transport;\n",
+        )
+
+    def test_rejects_each_raw_runtime_entrypoint(self) -> None:
+        for method in ("execute_with_context", "execute_request", "prepare_request", "invoke_unary"):
+            with self.subTest(method=method):
+                self.assert_rejected(
+                    "crates/crank-community-mcp/src/app/new_helper.rs",
+                    f"runtime.{method}(request);\n",
+                )
+
+    def test_rejects_execution_reexport_and_direct_sqlx(self) -> None:
+        self.assert_rejected(
+            "apps/admin-api/src/routes/reexport.rs",
+            "pub use crank_runtime::RuntimeExecutor;\n",
+        )
+        self.assert_rejected(
+            "apps/admin-api/src/routes/persist.rs",
+            'let _ = sqlx::query("insert into invocation_logs values (...)");\n',
+        )
+
+    def test_rejects_direct_mapping_or_schema_execution(self) -> None:
+        self.assert_rejected(
+            "apps/admin-api/src/service/mapping_bypass.rs",
+            "operation.input_mapping.apply(&input);\n",
+        )
+        self.assert_rejected(
+            "crates/crank-community-mcp/src/app/schema_bypass.rs",
+            "operation.input_schema.validate_shape(&input);\n",
+        )
+
+    def test_allows_canonical_runtime_request(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            source = root / "crates/crank-community-mcp/src/app.rs"
+            source.parent.mkdir(parents=True)
+            source.write_text("runtime.execute_outcome(request).await;\n", encoding="utf-8")
+            result = self.run_checker(root, "crates/crank-community-mcp/src/app.rs")
+            self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_explicit_missing_or_symlink_path_fails_closed(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            missing = self.run_checker(root, "apps/admin-api/src/service/missing.rs")
+            self.assertNotEqual(missing.returncode, 0)
+            target = root / "outside.rs"
+            target.write_text("safe", encoding="utf-8")
+            link = root / "apps/admin-api/src/service/link.rs"
+            link.parent.mkdir(parents=True)
+            link.symlink_to(target)
+            symlink = self.run_checker(root, "apps/admin-api/src/service/link.rs")
+            self.assertNotEqual(symlink.returncode, 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/test_check_runtime_config.py

@@ -100,6 +100,38 @@ class RuntimeConfigContractTests(unittest.TestCase):
         result = self.run_check(root)
         self.assertNotEqual(result.returncode, 0)
 
+    def test_deprecated_startup_bootstrap_password_may_be_absent_from_compose(self) -> None:
+        root = self.fixture()
+        schema_path = root / "docs/schemas/runtime-config.schema.json"
+        schema = json.loads(schema_path.read_text(encoding="utf-8"))
+        schema["fields"].append(
+            {
+                "env_name": "CRANK_BOOTSTRAP_ADMIN_PASSWORD",
+                "process": "admin_api",
+                "mode": "effective",
+                "required": False,
+                "default": None,
+                "sensitivity": "secret",
+                "compatibility": "deprecated startup-bootstrap password; use local bootstrap contract",
+            }
+        )
+        schema_path.write_text(json.dumps(schema), encoding="utf-8")
+        for relative in (
+            ".env.example",
+            "deploy/community/.env.example",
+            "deploy/community/.env.images.example",
+        ):
+            path = root / relative
+            path.write_text(
+                path.read_text().replace(
+                    "CRANK_SHARED=value\n",
+                    "CRANK_SHARED=value\nCRANK_BOOTSTRAP_ADMIN_PASSWORD=\n",
+                ),
+                encoding="utf-8",
+            )
+        result = self.run_check(root)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
     def test_divergent_inline_default_fails(self) -> None:
         root = self.fixture()
         path = root / "docker-compose.yml"