feat: complete Epic 1 production foundation

tests/unit/test_authenticated_product_smoke.py

@@ -131,9 +131,11 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
                 self.requests = []
 
             def request_json(self, method, path, payload=None, **kwargs):
-                self.requests.append((method, path, payload))
+                self.requests.append((method, path, payload, kwargs))
                 if path.endswith("/operations"):
                     return smoke.JsonResponse(200, {}, {"operation_id": "op_safe", "version": 7})
+                if path.endswith("/operations/op_safe"):
+                    return smoke.JsonResponse(200, {"ETag": '"safe-etag"'}, {"id": "op_safe"})
                 if path.endswith("/publish") and "/operations/" in path:
                     return smoke.JsonResponse(200, {}, {"published_version": 7})
                 if path.endswith("/agents"):
@@ -154,8 +156,10 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
 
         self.assertEqual((operation_id, operation_version, published_operation_version), ("op_safe", 7, 7))
         self.assertEqual((agent_id, agent_version, published_agent_version), ("agent_safe", 3, 3))
-        binding = next(payload for _, path, payload in client.requests if path.endswith("/bindings"))[0]
+        binding = next(payload for _, path, payload, _ in client.requests if path.endswith("/bindings"))[0]
         self.assertEqual(binding["operation_version"], 7)
+        publish = next(request for request in client.requests if request[1].endswith("/operations/op_safe/publish"))
+        self.assertEqual(publish[3]["headers"], {"If-Match": '"safe-etag"'})
 
     def test_admin_test_run_uses_created_version_and_rejects_failed_outcome(self) -> None:
         smoke = load_smoke_module()
@@ -177,6 +181,35 @@ class AuthenticatedProductSmokeTests(unittest.TestCase):
             smoke.run_operation_test(FakeClient(False), "ws", "op", 9)
         self.assertNotIn("secret-canary", str(raised.exception))
 
+    def test_edit_and_archive_use_fresh_operation_preconditions(self) -> None:
+        smoke = load_smoke_module()
+
+        class FakeClient:
+            def __init__(self):
+                self.calls = []
+                self.etag_index = 0
+
+            def request_json(self, method, path, payload=None, **kwargs):
+                self.calls.append((method, path, payload, kwargs))
+                if method == "GET":
+                    self.etag_index += 1
+                    return smoke.JsonResponse(200, {"ETag": f'"etag-{self.etag_index}"'}, {})
+                if method == "PATCH":
+                    return smoke.JsonResponse(200, {}, {"version": 2})
+                if path.endswith("/archive"):
+                    return smoke.JsonResponse(200, {}, {"status": "archived"})
+                raise AssertionError((method, path))
+
+        client = FakeClient()
+        version = smoke.edit_and_archive_operation(
+            client, "ws", "op", "safe_operation", "http://admin-api:3001"
+        )
+        self.assertEqual(version, 2)
+        patch = next(call for call in client.calls if call[0] == "PATCH")
+        archive = next(call for call in client.calls if call[1].endswith("/archive"))
+        self.assertEqual(patch[3]["headers"], {"If-Match": '"etag-1"'})
+        self.assertEqual(archive[3]["headers"], {"If-Match": '"etag-2"'})
+
     def test_http_failure_message_is_bounded_and_redacted(self) -> None:
         smoke = load_smoke_module()
         error = smoke.safe_error("http", "unexpected_status", status=500)