Knowledge Wiki Orchestrata Ultimate

Orchestrata Ultimate › Tests › Reference › governance

Tests reference — tests/governance

tests/governance — 44 test modules, 562 test functions (cumulative over subdirectories). Source tree: tests/governance at commit 8a2cb42ad. Generated from the tests AST snapshot by scripts/gen-data-pages.py.

Prose pending.

Subdirectories

Directory Modules Tests
e2e/ 6 31

Modules

Module Tests Covers
conftest.py 0 3
test_audit.py 11 3
test_audit_coverage.py 5 4
test_cache.py 9 2
test_cache_coverage.py 7 4
test_constants.py 15 1
test_constitutional.py 14 3
test_constitutional_real_rules.py 13 3
test_constitutional_suite.py 41 3
test_dynamic_policy.py 10 3
test_dynamic_policy_extended.py 19 7
test_error_paths.py 20 11
test_escalation_handler.py 58 6
test_ethical.py 19 3
test_ethical_real_rules.py 8 3
test_event_emitting_policy_engine.py 3 5
test_exceptions.py 10 1
test_explain.py 4 2
test_gateway_governance_handler.py 6 5
test_interfaces.py 5 1
test_may_execute_real_rules.py 5 2
test_monitoring.py 10 1
test_policy_engine.py 14 9
test_policy_engine_extended.py 10 8
test_policy_layers.py 17 4
test_prolog_client.py 50 6
test_prolog_gate.py 24 2
test_resource_access.py 18 5
test_resource_access_extended.py 21 4
test_safe_mode.py 9 3
test_safe_mode_coverage.py 2 2
test_tabling_safety.py 2 2
test_types.py 13 1
test_verdict_provenance.py 22 6
test_violations.py 10 3
test_violations_coverage.py 3 4
test_volk_facts.py 24 3

Module details

tests/governance/conftest.py

source · 0 tests · 132 lines

Covers: core.infra_config, governance.prolog_client, infra.prolog_bridge

tests/governance/test_audit.py

source · 11 tests · 163 lines

Tests for GovernanceAudit using real Redis.

Covers: governance.audit, governance.types, orchestrator.graph_audit

Kind Name Line Description
function test_log_decision_redis 58
function test_log_decision_no_backends_safe 66
function test_log_violation 72
function test_query_decisions_by_actor 77
function test_get_audit_trail_finds_matching 85
function test_get_audit_trail_no_backends 98
function test_query_decisions_no_backends 104
function test_log_decision_with_graph 135
function test_log_violation_with_graph 141
function test_query_decisions_via_graph 148 Exercise the Graph query branch. If it raises, Redis fallback is used.
function test_get_audit_trail_via_graph 161

tests/governance/test_audit_coverage.py

source · 5 tests · 223 lines

Coverage for GovernanceAudit branches not reached by test_audit.py /

Covers: governance.audit, governance.types, infra.redis_state, orchestrator.graph_audit

Kind Name Line Description
function test_query_decisions_graph_with_actor_filter 70 actor= against a working graph sets filters["volk_id"] (line 162).
function test_query_decisions_graph_error_falls_back_to_redis 112 Graph query raising -> warning logged -> Redis fallback (165-166).
function test_get_audit_trail_graph_error_falls_back_to_redis 130 Graph trail query raising -> warning logged -> Redis search (204-205).
function test_query_decisions_decodes_bytes_entries 187 bytes lrange entries are decoded before json.loads (line 182).
function test_get_audit_trail_decodes_bytes_entries 208 bytes entries decoded while scanning decisions+violations (line 221).

tests/governance/test_cache.py

source · 9 tests · 124 lines

Tests for GovernanceCache using real Redis.

Covers: governance.cache, governance.types

Kind Name Line Description
function test_generate_cache_key_deterministic 26
function test_generate_cache_key_differs_on_action 33
function test_cache_miss_returns_none_and_stats 39
function test_cache_set_then_get_local 48
function test_cache_promotes_from_redis 63
function test_cache_invalidate_clears_local_tier 77
function test_cache_clear_resets_stats 101
function test_cache_without_redis 113
function test_cache_hit_rate_zero_when_empty 122

tests/governance/test_cache_coverage.py

source · 7 tests · 182 lines

Coverage-gap tests for governance/cache.py.

Covers: governance.cache, governance.constants, governance.types, infra.redis_state

Kind Name Line Description
function test_deserialize_missing_timestamp_falls_back_to_now 54
function test_deserialize_non_string_timestamp_falls_back_to_now 76
function test_deserialize_iso_string_timestamp_round_trips 92
function test_invalidate_deletes_redis_tier 113
function test_invalidate_deletes_only_matching_prefix 133
function test_clear_empties_redis_tier 158
function test_generate_cache_key_empty_context_is_deterministic 176

tests/governance/test_constants.py

source · 15 tests · 92 lines

Tests for governance.constants.

Covers: governance.constants

Kind Name Line Description
class TestGovernanceConstants 26
method TestGovernanceConstants.test_safe_mode_thresholds 27
method TestGovernanceConstants.test_cache_settings 32
method TestGovernanceConstants.test_monitoring_settings 38
method TestGovernanceConstants.test_audit_prefix 42
method TestGovernanceConstants.test_protected_paths 45
method TestGovernanceConstants.test_allowed_write_prefixes 50
method TestGovernanceConstants.test_network_whitelist 54
method TestGovernanceConstants.test_constitutional_articles 58
method TestGovernanceConstants.test_policy_limits 65
method TestGovernanceConstants.test_audit_query_limit 69
method TestGovernanceConstants.test_escalation_defaults 72
method TestGovernanceConstants.test_monitoring_latency_deque 76
method TestGovernanceConstants.test_redis_scan_batch 79
method TestGovernanceConstants.test_severity_levels 82
method TestGovernanceConstants.test_redis_keys 88

tests/governance/test_constitutional.py

source · 14 tests · 151 lines

Test Standards Compliance (see AGENTS.md § Test Standards):

Covers: governance.constants, governance.constitutional, governance.prolog_client

Kind Name Line Description
function test_check_article_out_of_range_low 40
function test_check_article_out_of_range_high 47
function test_check_article_valid_range_compliant 54
function test_check_article_valid_range_non_compliant 62
function test_check_all_covers_all_articles 70
function test_check_critical_covers_phase_1 80
function test_get_articles_returns_full_set 92
function test_get_article_known_number 97
function test_get_article_unknown_returns_none 104
function test_requires_human_consent 109
function test_requires_human_consent_default_false 115
function test_requires_human_consent_fails_closed_on_error_by_default 121 P0.3: a genuine error (here: the enforcer's own _prolog_client is
function test_requires_human_consent_permissive_when_strict_false 133 The same genuine error resolves to the legacy permissive (no consent
function test_human_override_records_fact 146

tests/governance/test_constitutional_real_rules.py

source · 13 tests · 225 lines

SPEC-007 regression: ConstitutionalEnforcer via the REAL constitutional.pl

Covers: governance.constitutional, governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_article_1_denies_delete_data_without_human_consent 67 Article I (Human Autonomy): delete_data requires human consent per
function test_article_1_allows_delete_data_after_human_override 76 Recording a human override asserts human_consent_given/2 (dynamic in
function test_article_8_sustainability_always_passes 87 Article VIII has no gating predicate -- constitutional.pl always
function test_article_3_harm_prevention_denies_delete_data 95 Article III (Harm Prevention): delete_data is a high-severity
function test_article_3_harm_prevention_allows_benign_action 104
function test_check_critical_denies_delete_data_via_real_rules 110 delete_data fails critical Articles I (no consent) and III (harm),
function test_check_critical_allows_benign_action_via_real_rules 122
function test_requires_human_consent_true_for_delete_data 129 Real constitutional.pl fact, not a manually-asserted one (contrast
function test_requires_human_consent_false_for_benign_action 136
function test_article_12_permits_when_no_plan_active 154 plan_fidelity/2's vacuous-truth clause: no active_plan/1 fact at all
function test_article_12_denies_action_off_the_active_plan 164 While a plan is active, an action it does not prescribe is
function test_article_12_permits_plan_prescribed_action 183 A plan-prescribed action is faithful by definition, even while the
function test_article_12_permits_divergence_once_human_issue_raised 201 RUL-015's own escape hatch ("the idea of diverting should never come

tests/governance/test_constitutional_suite.py

source · 41 tests · 890 lines

Task B17 Lane 2: the constitution test suite (SPEC-033 §1.3, ADR-0010).

Covers: core.infra_config, governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_completeness_guard_covers_every_exported_invariant 208 SPEC-033 §1.3: constitutional.pl's invariants must be explicit,
function test_constitutional_article_denies_unknown_article_number 234 No 13th article exists -- an out-of-range number yields no solution.
function test_constitutional_article_permits_known_article_number 244
function test_constitutional_check_denies_violating_action 258 Article III (Harm Prevention): delete_data is a high-severity
function test_constitutional_check_permits_compliant_action 269
function test_constitutional_check_article_xi_now_enforces_valid_improvement 279 Article XI was human-ratified enforcing on 2026-07-24: its
function test_constitutional_check_articles_viii_ix_x_still_pending_ratification 302 Articles VIII (Sustainability), IX (Dignity), X (Rights) remain bare
function test_human_override_denies_malformed_arguments 326 Reason must be an atom; a non-atom Reason fails the guard and no
function test_human_override_permits_well_formed_override_and_records_consent 345 Ratified contract (2026-07-24, ADR-0005/0025): human_override/3 is
function test_requires_human_consent_flags_dangerous_action 405
function test_requires_human_consent_does_not_flag_benign_action 414
function test_operation_transparent_denies_opaque_operation 429
function test_operation_transparent_permits_normal_operation 447
function test_may_not_cause_harm_flags_harmful_action 461 override_safety is a critical-severity assess_harm/3 fact.
function test_may_not_cause_harm_permits_safe_action 470
function test_assess_harm_flags_known_high_severity_action 484
function test_assess_harm_permits_unknown_action_as_no_harm 493
function test_respects_privacy_flags_pii_access_without_consent 508 access_pii is a static involves_pii/1 fact; absent any prior
function test_respects_privacy_permits_non_pii_action 520
function test_handle_pii_denies_without_consent 534
function test_handle_pii_permits_with_consent 544
function test_operates_fairly_flags_detected_bias 568
function test_operates_fairly_permits_when_no_bias_detected 585
function test_detect_bias_flags_asserted_bias 599
function test_detect_bias_permits_absence_of_bias 617
function test_accountable_operation_denies_non_atom_action 637
function test_accountable_operation_permits_atom_action 644
function test_secure_operation_flags_security_threat 658
function test_secure_operation_permits_non_threat_action 666
function test_verify_integrity_flags_unverified_data 680
function test_verify_integrity_permits_verified_data 689
function test_resource_efficient_denies_non_atom_action 714
function test_resource_efficient_permits_atom_action 721
function test_respects_dignity_denies_non_atom_action 737
function test_respects_dignity_permits_atom_action 743
function test_protects_rights_denies_non_atom_action 759
function test_protects_rights_permits_atom_action 765
function test_valid_improvement_flags_destructive_change 779
function test_valid_improvement_permits_non_destructive_change 787
function test_plan_fidelity_flags_divergence_from_active_plan 806 Under an active plan, an action the plan does not prescribe is
function test_plan_fidelity_permits_plan_prescribed_action 838 The three faithful paths: (a) no active plan at all; (b) the action

tests/governance/test_dynamic_policy.py

source · 10 tests · 115 lines

Test Standards Compliance (see AGENTS.md § Test Standards):

Covers: governance.dynamic_policy, governance.exceptions, governance.prolog_client

Kind Name Line Description
function test_add_rule_happy_path 38
function test_add_rule_auto_generates_id 52
function test_add_rule_invalid_fails 60
function test_remove_rule 67
function test_remove_rule_nonexistent_noop 74
function test_validate_reports_conflict_warning 80
function test_validate_non_dict_fails 90
function test_get_version_initial 96
function test_reload_bumps_version 101
function test_rollback 110

tests/governance/test_dynamic_policy_extended.py

source · 19 tests · 297 lines

Covers: core.paths, governance.constants, governance.dynamic_policy, governance.exceptions, governance.prolog_client, infra.prolog_bridge, infra.redis_state

Kind Name Line Description
function test_add_rule_with_predicate_only 75
function test_add_rule_max_rules_reached 84
function test_remove_rule_without_fact_id 99
function test_reload_reasserts_rules_and_restores_fact_ids 117
function test_reload_no_rules_still_bumps_version 130
function test_validate_predicate_only_is_valid 143
function test_validate_empty_dict_fails 150
function test_validate_no_conflict_when_same_decision 157
function test_validate_loop_no_matching_action 167
function test_rollback_multiple_steps 183
function test_rollback_more_steps_than_stack 197
function test_rollback_empty_stack 207
function test_get_rules_returns_copy 218
function test_get_rule_count_empty 225
function test_get_rule_count_after_add 230
function test_version_bumps_on_add_and_remove 238
function test_bump_version_without_redis 254
function test_bump_version_with_broken_redis_logs_warning 261
function test_bump_version_with_real_redis_sets_key 293

tests/governance/test_error_paths.py

source · 20 tests · 338 lines

Coverage for Redis/Graph error paths using an intentionally-broken

Covers: governance.audit, governance.cache, governance.exceptions, governance.monitoring, governance.prolog_client, governance.safe_mode, governance.types, governance.violations, infra.prolog_bridge, infra.redis_state, orchestrator.graph_audit

Kind Name Line Description
function test_cache_get_redis_error 91
function test_cache_set_redis_error 97
function test_cache_invalidate_redis_error 105
function test_cache_clear_redis_error 112
function test_monitoring_redis_error 123
function test_violation_tracker_redis_error 136
function test_safe_mode_enter_redis_error 157
function test_safe_mode_exit_redis_error 165
function test_safe_mode_is_safe_mode_redis_error 173
function test_safe_mode_status_redis_error 179
function test_audit_log_decision_redis_error 191
function test_audit_log_violation_redis_error 198
function test_audit_query_decisions_redis_error 204
function test_audit_trail_redis_error 211
function test_violation_tracker_get_violations_skips_bytes_entry 222 Exercise the branch where Redis returns bytes that must be decoded.
function test_prolog_client_evaluate_context_bytes_decoded 255 evaluate_context should decode bytes Decision values from Prolog.
function test_audit_log_decision_graph_raises 276 Exercise the Graph except branch in log_decision.
function test_audit_log_violation_graph_raises 296
function test_audit_query_decisions_graph_falls_back_to_redis 309 Graph driver=None returns [] from query_audit_trail (success branch).
function test_audit_trail_graph_raises 328

tests/governance/test_escalation_handler.py

source · 58 tests · 906 lines

Tests for escalation_handler with real Redis + Prolog.

Covers: core.paths, governance.escalation_handler.models, infra.prolog_bridge, orchestrator.graph_audit, core.packet/ (package), governance.escalation_handler/ (package)

Kind Name Line Description
function test_escalate_records_in_redis 124
function test_get_escalation_path_default 135 F4 real-rules regression: multi_hop_escalation/2 did not exist
function test_track_escalation_state 148
function test_override_escalation_path 156
function test_handle_escalation_timeout 163
function test_handle_timeout_with_existing_state 179
function test_dispatch_without_callback 187
function test_conflict_detect_returns_none_for_single_volk 203
function test_conflict_create_workflow 212
function test_conflict_assign_to_authority 220
function test_conflict_assign_unknown_is_noop 228
function test_conflict_track_resolution_status 233
function test_conflict_track_unknown_is_noop 241
function test_apply_resolution_strategy 254
function test_apply_vote_strategy_with_no_volks 263
function test_apply_priority_strategy_with_no_volks 271
function test_apply_delegation_strategy_with_no_volks 278
function test_conflict_create_workflow_propagates_redis_error 285
function test_conflict_assign_to_authority_propagates_redis_error 295
function test_conflict_track_resolution_status_propagates_redis_error 309
function test_log_resolution_decision_propagates_redis_error 320
function test_sla_start_and_resolve 337
function test_sla_resolve_unknown_escalation 347
function test_sla_threshold_default_30 353
function test_sla_check_breach_without_timer 359
function test_log_notification_channel 365
function test_sla_get_metrics_empty 371
function test_sla_calculate_avg_resolution_empty 379
function test_sla_calculate_compliance_with_data 385
function test_sla_check_breach_triggers_notification 396
function test_sla_start_timer_redis_failure 419
function test_sla_resolve_twice_uses_cached_started_at 428
function test_sla_check_breach_redis_failure 445
function test_sla_get_threshold_with_no_prolog_bridge 453
function test_sla_send_to_channels_failure 467
function test_sla_store_breach_notification_failure 491
function test_conflict_detect_with_multi_volk 501
function test_conflict_detect_returns_none_when_allowed 514
function test_get_escalation_path_with_loaded_rule 523
function test_is_terminal_authority_false 533 A non-terminal (level_1) authority is really not terminal.
function test_is_terminal_authority_true 539 F4 real-rules regression: U:Ox is the shipped level_2 (final)
function test_escalate_terminates_on_terminal_authority 547 F4 real-rules regression: a component with no registered owner
function test_hop_times_out_when_timeout_at_already_passed 569
function test_hop_retries_dispatch_failure_before_giving_up 612
function test_hop_dispatch_exception_is_retried_then_fails 636
function test_track_escalation_state_propagates_redis_error 660
function test_override_escalation_path_propagates_redis_error 671
function test_handle_escalation_timeout_propagates_wrongtype_error 680
function test_log_escalation_hop_propagates_wrongtype_error 694
function test_store_escalation_propagates_redis_error 713
function test_store_escalation_status_timeout_when_a_hop_timed_out 737
function test_store_escalation_status_in_progress_with_no_terminal_hops 759
function test_store_escalation_with_no_hops_defaults_current_hop_zero 782
function test_escalate_audits_to_graph 815
function test_escalation_timeout_audits_to_graph 836
function test_escalation_override_audits_to_graph 851
function test_conflict_resolver_apply_strategy_graph 866
function test_sla_breach_notifies_graph 880

tests/governance/test_ethical.py

source · 19 tests · 245 lines

Tests for EthicalBoundary via real Prolog bridge.

Covers: governance.ethical, governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_harm_severity_order_constants 64
function test_check_default_all_pass 69
function test_detect_harm_default_no_harm 86
function test_detect_deception_default_false 94
function test_detect_privacy_violation_default_false 100
function test_detect_bias_default_false 106
function test_detect_autonomy_violation_default_false 112
function test_detect_harm_high_severity 119
function test_detect_harm_medium_severity 129
function test_detect_deception_true 138
function test_detect_privacy_violation_true 145
function test_detect_bias_true 152
function test_detect_autonomy_violation_true 159
function test_check_aggregates_all_concerns 166
function test_detect_harm_exception_fallback 203
function test_detect_deception_exception_fallback 213
function test_detect_privacy_exception_fallback 222
function test_detect_bias_exception_fallback 231
function test_detect_autonomy_exception_fallback 240

tests/governance/test_ethical_real_rules.py

source · 8 tests · 133 lines

SPEC-007 regression: EthicalBoundary enforcement via the REAL governance

Covers: governance.ethical, governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_check_benign_action_is_ethical 74
function test_detect_harm_delete_data_high 83
function test_detect_harm_override_safety_critical 91
function test_detect_harm_leak_data_critical 99
function test_detect_harm_read_file_no_harm 106
function test_check_delete_data_denied 113
function test_check_override_safety_denied 121
function test_check_leak_data_denied 129

tests/governance/test_event_emitting_policy_engine.py

source · 3 tests · 78 lines

Tests for EventEmittingPolicyEngine.

Covers: governance.event_emitting_policy_engine, governance.policy_engine, governance.prolog_client, infra.prolog_bridge, core.interfaces/ (package)

Kind Name Line Description
function test_emits_decision_event 43 A DENY evaluation emits BOTH the decision event and the violation
function test_no_event_bus_transparent 67
function test_getattr_delegates_to_inner 74

tests/governance/test_exceptions.py

source · 10 tests · 84 lines

Tests for governance exceptions.

Covers: governance.exceptions

Kind Name Line Description
class TestGovernanceExceptions 39 Tests for governance exception hierarchy.
method TestGovernanceExceptions.test_governance_error_is_exception 42
method TestGovernanceExceptions.test_policy_evaluation_error_inheritance 46
method TestGovernanceExceptions.test_constitutional_violation_error 51
method TestGovernanceExceptions.test_ethical_violation_error 58
method TestGovernanceExceptions.test_safe_mode_error 62
method TestGovernanceExceptions.test_policy_validation_error 66
method TestGovernanceExceptions.test_resource_access_error 70
method TestGovernanceExceptions.test_cache_error 74
method TestGovernanceExceptions.test_prolog_client_error 78
method TestGovernanceExceptions.test_audit_error 82

tests/governance/test_explain.py

source · 4 tests · 146 lines

ADR-0031 / SPEC-033: GovernancePrologClient.may_execute_explained against

Covers: governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_may_execute_explained_allowed_carries_a_derivation 65 An allowed decision carries a rule derivation (kind == 'proved').
function test_may_execute_explained_denied_names_failing_precondition 87 A blocked, unregistered agent is denied by BOTH candidate clauses of
function test_may_execute_unaffected_by_explained_variant 126 Calling may_execute_explained must not change what the plain,
function test_may_execute_explained_handles_query_failure_gracefully 139 A syntactically-broken goal must degrade to a clean deny, not raise.

tests/governance/test_gateway_governance_handler.py

source · 6 tests · 168 lines

Covers: gateway.handlers.governance, gateway.pubsub, governance.policy_engine, governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_handle_evaluate_with_injected_engine_denies 73
function test_handle_evaluate_with_injected_engine_allows 85
function test_handle_evaluate_builds_engine_from_factory_lazily 104
function test_handle_evaluate_wired_engine_raises_denies_fail_closed 125
function test_handle_rules_with_injected_engine 144
function test_handle_evaluate_denies_on_malformed_intent 155

tests/governance/test_interfaces.py

source · 5 tests · 124 lines

Cover the Protocol stub methods in interfaces.py.

Covers: governance.interfaces

Kind Name Line Description
function test_policy_engine_protocol_stubs 85
function test_constitutional_protocol_stubs 93
function test_ethical_protocol_stubs 101
function test_dynamic_policy_protocol_stubs 110
function test_resource_access_protocol_stubs 119

tests/governance/test_may_execute_real_rules.py

source · 5 tests · 142 lines

SPEC-007 regression: GovernancePrologClient.may_execute via the REAL

Covers: governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_explicit_role_fact_allows_qa_run_tests 57 governance.pl:711 — may_execute('U:Qa', run_tests) is a shipped fact.
function test_explicit_role_fact_allows_human_submit_intent 64 governance.pl:702 — HUMAN may always submit intents.
function test_unregistered_agent_is_denied 72 An agent the rule base has never heard of is DENIED.
function test_an_operational_volk_is_allowed 91 The other half: denying everything would be just as useless.
function test_blocked_agent_is_denied_and_argument_order_holds 108 agent_action_blocked/2 (governance.pl:716) denies the pair — and this

tests/governance/test_monitoring.py

source · 10 tests · 90 lines

Tests for GovernanceMonitoring using real Redis.

Covers: governance.monitoring

Kind Name Line Description
function test_record_query_no_redis 20
function test_percentiles_empty 29
function test_percentiles_populated 34
function test_record_violation 43
function test_violation_rate_with_queries 49
function test_throughput_with_queries 59
function test_throughput_empty 67
function test_reset 71
function test_cache_hit_rate_empty 80
function test_record_query_with_redis 84

tests/governance/test_policy_engine.py

source · 14 tests · 362 lines

Tests for PolicyEngine with real Prolog + Redis.

Covers: governance.cache, governance.constitutional, governance.monitoring, governance.policy_engine, governance.prolog_client, governance.safe_mode, governance.types, governance.violations, infra.prolog_bridge

Kind Name Line Description
function test_evaluate_returns_policy_decision 50
function test_is_allowed_returns_bool 68
function test_evaluate_batch 80
function test_evaluate_with_cache_and_monitoring 91
function test_safe_mode_denies_writes 99
function test_safe_mode_allows_read 109
function test_evaluate_records_violation_and_metrics 120
function test_evaluate_allowed_caches_decision 131
function test_ethical_violation_denies_and_records 172 Assert ethics facts so that ethical.check() returns ethical=False.
function test_policy_engine_handle_violation_triggers_safe_mode 209 When violations.should_trigger_safe_mode returns True, the engine
function test_evaluate_twice_with_cache_allows 261
function test_check_constitutional_error_fails_closed_by_default 300 P0.3: a genuine error raised by the constitutional enforcer (here: an
function test_check_constitutional_error_permissive_when_strict_false 312 The same genuine error resolves to the legacy permissive result (fall
function test_evaluate_consults_policy_layers_in_production_configuration 331 SPEC-033 B27 wiring proof: PolicyEngine.evaluate() genuinely

tests/governance/test_policy_engine_extended.py

source · 10 tests · 201 lines

Extended tests for PolicyEngine edge cases and error handling.

Covers: governance.audit, governance.cache, governance.monitoring, governance.policy_engine, governance.prolog_client, governance.safe_mode, governance.violations, infra.prolog_bridge

Kind Name Line Description
function test_id 36
function test_evaluate_uses_volk_id_when_actor_missing 53 Actor falls back to volk_id when actor key is absent.
function test_evaluate_batch_missing_keys 60 Batch evaluation defaults to 'unknown' for missing action/context.
function test_prolog_deny_triggers_handle_violation 76 Prolog deny reaches _handle_violation when allowed is False.
function test_prolog_allow_no_cache 93 Allowed decision when cache is None does not attempt to cache.
function test_record_with_audit_present 119 _record hits the audit branch when audit is provided.
function test_handle_violation_with_safe_mode_no_violations 137 _handle_violation with safe_mode but no violations tracker.
function test_handle_violation_with_violations_only 156 _handle_violation records violations when only violations is set.
function test_handle_violation_with_monitoring_only 175 _handle_violation records metrics when only monitoring is set.
function test_cache_miss_proceeds 193 Cache miss continues to policy evaluation.

tests/governance/test_policy_layers.py

source · 17 tests · 411 lines

Tests for SPEC-033 B27 — defeasible policy layering

Covers: governance.policy_engine, governance.policy_layers, governance.prolog_client, infra.prolog_bridge

Kind Name Line Description
function test_lower_layer_never_widens_higher 82 A team_norms allow must NEVER survive a constitutional deny:
function test_defeasibility_novel_action_team_norms_decides_then_retracts_to_silent 116 A genuinely novel action (never named by constitutional.pl's or
function test_team_norm_deny_also_decides 146 The team_norms layer can decide deny too (not just allow) when
function test_constitutional_decides_allow_when_governed_and_consented 167 Article I: 'terminate_agent' is a STATIC requires_human_consent/1
function test_ethical_decides_when_constitutional_silent 188 A fresh action untouched by constitutional.pl's risk facts, with a
function test_resource_decides_when_higher_layers_silent 210 A fresh action/domain pair, with a resources.pl dynamic-fact seam
function test_silent_round_trips_with_deciding_layer_none 253
function test_assert_team_norm_rejects_invalid_verdict 266
function test_consult_returns_true 271
function test_format_atom_escapes_quotes_and_backslashes 278
function test_decode_handles_bytes_from_janus 283
function test_find_deciding_layer_returns_none_when_every_layer_silent 290
function test_layered_verdict_raises_on_an_unexpected_verdict_value 296 Defensive branch: policy_layers.pl's shipped clauses only ever emit
function test_policy_layers_pl_registered_in_governance_rulebases 323
function test_policy_layers_pl_passes_meta_lint_with_zero_violations 331
function test_engine_silent_verdict_leaves_pre_existing_decision_unchanged 351 A silent layered verdict (no layer has an opinion on this action)
function test_engine_policy_layer_allow_does_not_override_a_later_prolog_deny 380 A team_norms allow (the lowest-ranked layer, deciding only because

tests/governance/test_prolog_client.py

source · 50 tests · 554 lines

Test Standards Compliance (see AGENTS.md § Test Standards):

Covers: core.paths, core.prolog_adapter, governance.exceptions, governance.prolog_client, infra.prolog_bridge, core.enums/ (package)

Kind Name Line Description
function test_bridge_property 53
function test_format_atom_quotes_and_escapes 57
function test_may_execute_fallback_returns_bool 63
function test_constitutional_check_default_false_when_predicate_missing 70
function test_has_permission_returns_false_when_predicate_missing 75
function test_may_access_fallback_returns_bool 81
function test_ethical_check_default_false_when_predicate_missing 86
function test_valid_policy_fails_closed_when_predicate_not_loaded 90
function test_may_execute_fails_closed_on_error_by_default 107
function test_may_execute_permissive_fallback_when_strict_false 112
function test_may_access_fails_closed_on_error_by_default 123
function test_ethical_check_fails_closed_on_error_by_default 128
function test_ethical_check_permissive_when_strict_false 133
function test_valid_policy_fails_closed_on_error_when_strict 140 A broken bridge reference (real None, not a double) makes
function test_valid_policy_permissive_on_error_when_strict_false 148
function test_track_violation_returns_fact_id 155
function test_enter_and_exit_safe_mode 161
function test_is_safe_mode_returns_bool 169
function test_evaluate_context_no_policy 173
function test_collect_metrics_returns_dict 179
function test_generate_cache_key_deterministic 186
function test_query_safe_returns_error_result_on_bad_syntax 193
function test_query_bool_safe_returns_false_on_missing_predicate 200
function test_fact_scope_enum_used_for_violation 205
function test_evaluate_via_policy_returns_decision_when_predicate_loaded 210
function test_evaluate_via_policy_denies_when_decision_deny 222
function test_evaluate_context_hits_loaded_policy 232
function test_may_execute_with_loaded_predicate 240
function test_enter_and_exit_safe_mode_cycle 254
function test_exit_safe_mode_without_tracked_fact 261 Exercise the direct-retract branch when no tracked safe_mode fact exists.
function test_evaluate_via_policy_returns_false_when_no_solutions 271 Query a predicate that doesn't match — falls through to return False.
function test_evaluate_context_no_solutions_returns_deny 282 evaluate_context without a matching rule returns decision=deny.
function test_valid_policy_with_defined_predicate 291 valid_policy queries Prolog on the rule's decision (F6): when a
function test_valid_policy_defaults_decision_to_allow_when_absent 302 F6: rule.get('decision', 'allow') — a rule dict with no 'decision'
function test_valid_policy_rejects_unrecognized_decision 309 F6 real-rules regression: with governance.pl's real valid_policy/1
function test_query_bool_safe_wraps_internal_failure_in_prolog_client_error 320 _query_bool_safe must translate ANY internal failure (not just a
function test_query_safe_wraps_internal_failure_in_prolog_client_error 332 Same contract as above but for _query_safe / bridge.query.
function test_constitutional_check_fails_closed_on_internal_exception_by_default 351 constitutional_check's except-block is reachable even when the
function test_constitutional_check_permissive_on_internal_exception_when_strict_false 366 The same genuine internal exception resolves to the legacy permissive
function test_exit_safe_mode_direct_retract_permission_error_returns_false 384 When safe_mode_active/1 is defined as a STATIC (non-dynamic) fact —
function test_has_permission_true_for_real_pam_owns_fact 437 pam_rules.pl:82 — pam_owns('U:Ox', governance) is a shipped fact;
function test_has_permission_false_for_unowned_resource 444 A volk with no pam_owns fact for the resource, and no active
function test_has_permission_argument_order_holds 450 Regression: swapping actor/resource must NOT accidentally match —
function test_may_access_file_mode_allows_workspace_write 476
function test_may_access_file_mode_denies_protected_path 485
function test_may_access_network_dispatches_to_may_access_network 494 resources.pl:130 — localhost is whitelisted regardless of port.
function test_may_access_api_dispatches_to_may_access_api 504 resources.pl:149 — GET is always allowed.
function test_may_access_db_dispatches_to_may_access_db 514 resources.pl:185 — delete is always denied for db resources.
function test_may_access_unknown_resource_type_denies_under_strict 530 F5: an unrecognized resource_type must be a real 'unknown mode'
function test_may_access_unknown_resource_type_permissive_when_strict_false 541

tests/governance/test_prolog_gate.py

source · 24 tests · 361 lines

Unit tests for prolog_gate.py using the real janus-swi engine (via the

Covers: core.prolog_adapter, governance.prolog_gate

Kind Name Line Description
function test_load_rules 34
function test_may_execute_not_loaded 41
function test_may_execute_loaded 47
function test_may_execute_denies_an_agent_it_has_never_heard_of 58 The other half of the loaded gate: it can say no.
function test_may_complete_not_loaded 65
function test_may_complete_loaded 71
function test_assert_fact 79
function test_assert_task_output 85
function test_assert_open_question 92
function test_retract_open_question 100
function test_may_complete_with_output_and_no_open_question 108 Exercise the all-gates-pass branch of may_complete.
function test_assert_fact_not_loaded_is_noop 120
function test_retract_not_loaded_is_noop 129
function test_gate_runs_on_janus_via_adapter 137
function test_may_execute_blocked_by_asserted_block_rule 153 Covers the if results: FALSE branch of may_execute (no exception,
function test_may_execute_trailing_backslash_is_safely_escaped 173 P0.2 regression: an agent name ending in a backslash must NOT break
function test_may_execute_unknown_procedure_treated_as_blocked 202 Covers the except Exception branch of may_execute where the message
function test_may_complete_gate_query_exception_marks_default_fail 227 Covers the per-gate except Exception branch inside may_complete's
function test_assert_fact_exception_is_swallowed_and_fact_not_recorded 258 Covers the except Exception branch of assert_fact (L149-150): a
function test_retract_open_question_injection_safe 272 P0.2: quotes, backslashes, and newlines in the volk id must not break
function test_escape_prolog_atom_order_and_coverage 281 Direct unit coverage of _escape_prolog_atom: backslash MUST be
function test_prolog_injection_prevention 295 P0.2: single quotes, backslashes, and newlines in agent/action/fact
function test_may_complete_outer_error_fails_closed_by_default 340 A genuine error BEFORE the per-gate loop (here: a non-string volk
function test_may_complete_outer_error_permissive_when_strict_false 350 The same genuine error resolves to the legacy permissive fallback when

tests/governance/test_resource_access.py

source · 18 tests · 169 lines

Unit tests for resource_access.py.

Covers: governance.constants, governance.prolog_client, governance.resource_access, governance.types, infra.prolog_bridge

Kind Name Line Description
function test_check_file_access_read 46
function test_check_file_access_write_allowed 54
function test_check_file_access_write_denied 61
function test_check_file_access_protected 68
function test_check_file_access_traversal 75
function test_check_file_access_fallback 82
function test_check_network_access 91
function test_check_api_access_get 97
function test_check_api_access_post 104
function test_check_db_access_select 111
function test_check_db_access_delete 118
function test_python_file_check_read_allowed 129 Direct check — read path of fallback returns allowed.
function test_python_file_check_protected_path 136
function test_python_file_check_traversal 142
function test_python_file_check_traversal_url_encoded 148
function test_python_file_check_write_with_allowed_prefix 154
function test_python_file_check_write_no_prefix 160
function test_python_file_check_default_deny_unknown_mode 166

tests/governance/test_resource_access_extended.py

source · 21 tests · 300 lines

Extended tests for resource_access.py edge cases, success paths, and error handling.

Covers: governance.prolog_client, governance.resource_access, governance.types, infra.prolog_bridge

Kind Name Line Description
function test_is_valid_prolog_atom_valid 62
function test_is_valid_prolog_atom_invalid 70
function test_check_file_access_prolog_allowed_read 87
function test_check_file_access_prolog_allowed_write 101
function test_check_file_access_invalid_mode_uppercase_fallback 117
function test_check_file_access_invalid_mode_number_fallback 126
function test_check_file_access_invalid_mode_special_fallback 133
function test_check_network_access_prolog_allowed 145
function test_check_api_access_prolog_allowed_post 163
function test_check_db_access_prolog_allowed_delete 179
function test_python_file_check_protected_exact_match 194
function test_python_file_check_protected_case_insensitive 201
function test_python_file_check_traversal_blocks_read 207
function test_python_file_check_traversal_uppercase_encoded 214
function test_python_file_check_write_tmp_allowed 220
function test_python_file_check_write_workspace_allowed 226
function test_python_file_check_default_deny_append 232
function test_check_file_access_exception_fallback 260
function test_check_network_access_exception_fallback 271
function test_check_api_access_exception_fallback 282
function test_check_db_access_exception_fallback 293

tests/governance/test_safe_mode.py

source · 9 tests · 120 lines

Tests for SafeModeManager using real Redis.

Covers: governance.prolog_client, governance.safe_mode, infra.prolog_bridge

Kind Name Line Description
function test_is_safe_mode_initially_false 40
function test_enter_and_exit_safe_mode 44
function test_get_status_inactive 54
function test_check_violation_rate_triggers 59
function test_check_violation_rate_below_threshold 68
function test_is_action_allowed_in_safe_mode 74
function test_safe_mode_with_prolog_client 83
function test_get_status_after_cooldown_expired 91
function test_get_status_auto_exit_when_cooldown_zero 106

tests/governance/test_safe_mode_coverage.py

source · 2 tests · 105 lines

Branch-coverage tests for SafeModeManager.

Covers: governance.safe_mode, infra.redis_state

Kind Name Line Description
function test_safe_mode_data_decodes_bytes_payload 59 A bytes JSON payload in Redis is decoded before json.loads.
function test_is_safe_mode_false_when_record_inactive 82 Stored record with active=False takes the early-return branch.

tests/governance/test_tabling_safety.py

source · 2 tests · 82 lines

Tabling-safety audit for governance Prolog rules.

Covers: core.base.traces, core.paths

Kind Name Line Description
function test_assess_harm_is_not_tabled 32 constitutional.pl:assess_harm/3 contains self-referential negation and
function test_no_self_negated_predicate_is_tabled 46 Static audit: no Prolog source file tables a predicate whose body uses

tests/governance/test_types.py

source · 13 tests · 122 lines

Unit tests for governance types (dataclasses and enums).

Covers: governance.types

Kind Name Line Description
function test_decision_type_values 22
function test_violation_type_values 29
function test_article_priority_values 37
function test_policy_decision_defaults 42
function test_violation_defaults 57
function test_compliance_result_defaults 64
function test_ethical_result_defaults 71
function test_harm_assessment_defaults 77
function test_access_result_defaults 85
function test_safe_mode_status_defaults 93
function test_validation_result_defaults 101
function test_article_defaults 107
function test_governance_metrics_defaults 113

tests/governance/test_verdict_provenance.py

source · 22 tests · 562 lines

W1-P6 verdict-provenance tests: every governance verdict must carry

Covers: governance.exceptions, governance.prolog_client, governance.prolog_gate, governance.verdict, infra.prolog_bridge, kernel.policy_evaluator

Kind Name Line Description
class TestGovernancePrologClientMayExecuteProvenance 84
method TestGovernancePrologClientMayExecuteProvenance.test_real_allow_is_labeled_policy 85 governance.pl:863 -- may_execute('U:Qa', run_tests) is a shipped
method TestGovernancePrologClientMayExecuteProvenance.test_real_deny_is_labeled_policy_with_explanation 99 agent_action_blocked/2 is a DIFFERENT predicate than may_execute
method TestGovernancePrologClientMayExecuteProvenance.test_broken_bridge_is_labeled_error 130 A genuinely broken bridge reference (real None, not a
class TestPrologGateMayExecuteProvenance 153
method TestPrologGateMayExecuteProvenance.test_real_allow_is_labeled_policy 154 A pair the SHIPPED facts allow -- may_execute('U:Qa', run_tests).
method TestPrologGateMayExecuteProvenance.test_real_deny_is_labeled_policy_with_explanation 175
method TestPrologGateMayExecuteProvenance.test_not_loaded_is_labeled_error_allow 194 No rules consulted at all: an ALLOW carrying zero rule authority
method TestPrologGateMayExecuteProvenance.test_unknown_procedure_is_labeled_error_deny 209 Genuinely undefine may_execute/2 (real abolish/1), forcing the
class TestEvaluateRoutingProvenance 244
method TestEvaluateRoutingProvenance.test_real_allow_is_labeled_policy 246
method TestEvaluateRoutingProvenance.test_real_deny_is_labeled_policy_with_explanation 274 Zero facts asserted: an unregistered sender denies by
method TestEvaluateRoutingProvenance.test_query_exception_is_labeled_error 297 A plain class whose query raises forces the genuine
class TestConstitutionalCheckProvenance 329
method TestConstitutionalCheckProvenance.test_real_allow_is_labeled_policy 330 constitutional.pl:63-64 -- Article 1 passes for any action that
method TestConstitutionalCheckProvenance.test_real_deny_is_labeled_policy 345 constitutional.pl:70 -- delete_data requires human consent;
class TestHasPermissionProvenance 360
method TestHasPermissionProvenance.test_broken_bridge_reraises_and_is_labeled_error 361 has_permission delegates to _query_bool_safe, whose documented
class TestEthicalCheckProvenance 380
method TestEthicalCheckProvenance.test_real_allow_is_labeled_policy 381 ethics.pl:41-47 -- an action with no shipped harm fact passes.
method TestEthicalCheckProvenance.test_real_deny_is_labeled_policy 393 ethics.pl:64 -- delete_data is a SHIPPED high-severity harm
class TestMayAccessErrorFallbackProvenance 409
method TestMayAccessErrorFallbackProvenance.test_permissive_fallback_success_is_labeled_error 410 Non-strict mode: the resource-kind query (may_access_file/3)
class TestExplainMayExecuteDeny 467
method TestExplainMayExecuteDeny.test_registered_but_not_operational 468
method TestExplainMayExecuteDeny.test_no_clause_matched_fallback_text 480 Neither registered, not operational, not blocked -- the third,
class TestExplainPolicyPermitsDeny 491
method TestExplainPolicyPermitsDeny.test_recipient_unknown 492
method TestExplainPolicyPermitsDeny.test_recipient_blacklisted 506
method TestExplainPolicyPermitsDeny.test_action_blocked 525
method TestExplainPolicyPermitsDeny.test_no_allow_or_queue_clause_fallback_text 547 Both registered, neither blacklisted nor blocked: none of the

tests/governance/test_violations.py

source · 10 tests · 147 lines

Tests for ViolationTracker using real Redis.

Covers: governance.types, governance.violations, orchestrator.graph_audit

Kind Name Line Description
function test_record_and_get 41
function test_record_auto_id_when_blank 49
function test_filter_by_type_and_actor 56
function test_get_rate_initially_zero 65
function test_get_rate_increments 71
function test_should_trigger_safe_mode_below_threshold 79
function test_should_trigger_safe_mode_high_threshold 86
function test_clear 93
function test_record_is_async 100 The Graph audit write is async, so record() must be a coroutine function
function test_record_awaits_graph_persistence 106 Regression: record() must AWAIT the async Graph audit log.

tests/governance/test_violations_coverage.py

source · 3 tests · 172 lines

Coverage tests for ViolationTracker byte-decoding and graph-error branches.

Covers: governance.types, governance.violations, infra.redis_state, orchestrator.graph_audit

Kind Name Line Description
function test_get_violations_decodes_bytes_entries 75 zrevrange returns bytes with a decode_responses=False client; the
function test_get_rate_decodes_bytes_counter 111 get() returns bytes for the rate counter; get_rate must decode it and
function test_record_swallows_graph_error_and_keeps_redis_record 138 Lines 100-101: a graph write that raises must not break record().

tests/governance/test_volk_facts.py

source · 24 tests · 287 lines

governance:may_execute/2 can deny — the fix for the rubber-stamp defect.

Covers: agents.volk_registry, governance.prolog_gate, governance.volk_facts

Kind Name Line Description
class TestGoalConstruction 65 The goal strings, before any engine runs them.
method TestGoalConstruction.test_an_alias_is_quoted 68 U:Cd unquoted parses as a MODULE reference, not an atom.
method TestGoalConstruction.test_a_quote_in_an_alias_is_escaped 77 An alias is data. Data that can close its own quote is injection.
method TestGoalConstruction.test_assert_covers_every_leg_of_volk_operational 81
method TestGoalConstruction.test_assert_clears_the_blocking_facts 88 Re-registering after a suspension must not leave a half state.
method TestGoalConstruction.test_every_assert_is_preceded_by_a_retract 96 Otherwise registering twice leaves two clauses.
method TestGoalConstruction.test_retract_removes_everything_assert_added 110
method TestGoalConstruction.test_deactivating_only_retracts 122
method TestGoalConstruction.test_activating_asserts_exactly_one_fact 125
class TestTheGateCanNowDeny 130 The defect, expressed as the test that would have caught it.
method TestTheGateCanNowDeny.test_an_unknown_agent_is_denied 133 THE regression. This exact pair returned True before the fix.
method TestTheGateCanNowDeny.test_an_unregistered_volk_is_denied 138 A real-looking alias gets no more credit than an attacker's.
method TestTheGateCanNowDeny.test_a_registered_volk_is_allowed 143
method TestTheGateCanNowDeny.test_registration_does_not_grant_anyone_else 149 volk_operational/1 is per-agent; asserting one must not open the door.
method TestTheGateCanNowDeny.test_deactivating_revokes 157 A volk that stops answering must stop being dispatchable.
method TestTheGateCanNowDeny.test_reactivating_restores 165
method TestTheGateCanNowDeny.test_deregistering_revokes 172
method TestTheGateCanNowDeny.test_asserting_twice_then_retracting_once_revokes 179 Duplicate clauses would survive a single retractall.
method TestTheGateCanNowDeny.test_the_explicit_human_facts_still_hold 193 Deleting the permissive clause must not break the intent path.
method TestTheGateCanNowDeny.test_human_is_not_allowed_everything 201 HUMAN is named for three actions, not blanket-trusted.
class TestRegistryDrivesTheFacts 206 The wire: registering a volk is what makes governance able to answer.
method TestRegistryDrivesTheFacts.test_registering_makes_the_volk_dispatchable 223
method TestRegistryDrivesTheFacts.test_deregistering_makes_it_undispatchable_again 232
method TestRegistryDrivesTheFacts.test_a_registry_without_a_sink_still_registers 241 The registry is not the governance layer and must not require one.
method TestRegistryDrivesTheFacts.test_attaching_a_sink_backfills_existing_volks 247 PipelineRunner builds its registry BEFORE its gate.
method TestRegistryDrivesTheFacts.test_status_transitions_reach_governance 264 Registration is not liveness.
method TestRegistryDrivesTheFacts.test_a_registered_but_unbeaten_volk_is_dispatchable 274 REGISTERED counts as active.

Support files

Fixtures, package markers and helpers without test functions.