feat: sync astrology provenance gates

tests/test_real_case_timing_optimization_audit.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+DOC = ROOT / "docs" / "research" / "real_case_timing_optimization_audit_2026_07_19.md"
+
+
+def test_real_case_timing_audit_separates_positive_replay_from_specificity() -> None:
+    text = DOC.read_text(encoding="utf-8")
+
+    for token in [
+        "Positive-event replay is healthy",
+        "known positive events only",
+        "does not verify day/month predictive specificity",
+        "Day-level negative holdout remains empty",
+        "status = awaiting_independent_labels",
+        "day_level_holdout_v3_pilot_source_queue_2026_07_19.json",
+        "not a holdout manifest",
+        "production_tuning_allowed = false",
+        "claim_status = exploratory_unvalidated",
+        "Forbidden UX: packaging candidate dates as verified event promises",
+    ]:
+        assert token in text

tests/test_shadbala_av_component_registry.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from scripts.shadbala_av_component_registry import build_registry
+
+ROOT = Path(__file__).resolve().parents[1]
+ARBITRATION = ROOT / "references" / "oracle" / "three_engine_mismatch_arbitration_2026_07_19.json"
+
+
+def test_component_registry_groups_shadbala_and_av_mismatches_without_truth_upgrade() -> None:
+    registry = build_registry(ARBITRATION)
+
+    assert registry["scope"] == "shadbala_av_component_provenance_registry"
+    assert registry["truth_policy"] == "method_variant_not_majority_vote"
+    assert registry["status"] == "classified_unresolved"
+    assert registry["production_tuning_allowed"] is False
+    assert registry["summary"]["source_mismatch_count"] == 60
+    assert registry["summary"]["registry_count"] >= 4
+
+    categories = {row["category"] for row in registry["registry"]}
+    assert "shadbala_formula_variant" in categories
+    assert "derived_total_from_component_variants" in categories
+    assert "ashtakavarga_table_or_contributor_variant" in categories
+
+    for row in registry["registry"]:
+        assert row["allowed_claim"] in {
+            "current_target_observation_only",
+            "component_method_variant",
+            "table_variant",
+            "derived_total_blocked_until_components_close",
+        }
+        assert row["unit_contract"]
+        assert row["next_evidence_required"]
+
+
+def test_component_registry_json_artifact_matches_source_counts() -> None:
+    artifact = ROOT / "references" / "oracle" / "shadbala_av_component_provenance_registry_2026_07_19.json"
+    data = json.loads(artifact.read_text(encoding="utf-8"))
+
+    assert data["summary"]["source_mismatch_count"] == 60
+    assert data["summary"]["category_counts"]["shadbala_formula_variant"] == 35
+    assert data["summary"]["category_counts"]["derived_total_from_component_variants"] == 7
+    assert data["summary"]["category_counts"]["ashtakavarga_table_or_contributor_variant"] == 8
+    assert data["production_tuning_allowed"] is False
+
+
+def test_component_provenance_markdown_report_is_human_readable() -> None:
+    report = ROOT / "docs" / "research" / "shadbala_av_component_provenance_report_2026_07_19.md"
+    text = report.read_text(encoding="utf-8")
+
+    for token in [
+        "Shadbala / AV component provenance report",
+        "method_variant_not_majority_vote",
+        "Production tuning: `false`",
+        "`shadbala_formula_variant`",
+        "`derived_total_from_component_variants`",
+        "`ashtakavarga_table_or_contributor_variant`",
+        "Total Rupa/Virupa cannot be arbitrated until component units close",
+        "Next source-evidence queue",
+    ]:
+        assert token in text

tests/test_vedastro_reproducible_build_probe.py

@@ -0,0 +1,33 @@
+from pathlib import Path
+
+from scripts.vedastro_reproducible_build_probe import build_identity
+
+
+def test_build_identity_binds_source_and_container_inputs(tmp_path: Path) -> None:
+    (tmp_path / "API").mkdir()
+    (tmp_path / "API/Dockerfile").write_text(
+        "FROM example/sdk:7@sha256:" + "a" * 64 + " AS build\nFROM build AS final\n",
+        encoding="utf-8",
+    )
+    (tmp_path / "API/API.csproj").write_text("<Project />\n", encoding="utf-8")
+    report = build_identity(tmp_path, source_commit="1f3a464", image_inspect=None)
+
+    assert report["source_commit"] == "1f3a464"
+    assert len(report["dockerfile_sha256"]) == 64
+    assert report["base_images"] == ["example/sdk:7@sha256:" + "a" * 64]
+    assert len(report["project_file_hashes"]["API/API.csproj"]) == 64
+    assert report["status"] == "source_pinned_image_not_built"
+
+
+def test_build_identity_records_built_image_digest(tmp_path: Path) -> None:
+    (tmp_path / "API").mkdir()
+    (tmp_path / "API/Dockerfile").write_text("FROM example/sdk:7\n", encoding="utf-8")
+    report = build_identity(
+        tmp_path,
+        source_commit="abc123",
+        image_inspect={"Id": "sha256:" + "b" * 64, "RepoDigests": ["repo@sha256:" + "c" * 64]},
+    )
+
+    assert report["status"] == "reproducible_candidate_built"
+    assert report["image_id"] == "sha256:" + "b" * 64
+    assert report["repo_digests"] == ["repo@sha256:" + "c" * 64]