M0 + M1 done

RI/tests/unit/test_schemas.py

@@ -0,0 +1,90 @@
+"""Sanity checks for the M1 config schemas (EP-01-T02, EP-02-T01, EP-04-T01)."""
+
+from __future__ import annotations
+
+import pytest
+from pydantic import ValidationError
+
+from emcp_bus.common.models import RiskTier, risk_tier_at_or_below
+from emcp_bus.entitlement.models import ClientProfile
+from emcp_bus.identity.models import ClientRegistration
+from emcp_bus.registry.models import BackendRef, CapabilityManifest
+
+
+def test_risk_tier_ordering() -> None:
+    assert risk_tier_at_or_below(RiskTier.R1, RiskTier.R2)
+    assert not risk_tier_at_or_below(RiskTier.R3, RiskTier.R2)
+    assert risk_tier_at_or_below(RiskTier.R0, RiskTier.R0)
+
+
+def test_client_profile_from_readme_example() -> None:
+    profile = ClientProfile.model_validate(
+        {
+            "name": "Sales.Write",
+            "owner": "sales-platform",
+            "environment": "production",
+            "risk_ceiling": "R2",
+            "allowed_tools": [
+                "sales.customer.get",
+                "sales.order.get",
+                "sales.quote.create",
+                "sales.quote.update",
+            ],
+            "restrictions": {"max_transaction_value": 500000},
+            "credential_policy": {"workload_identity": True, "short_lived": True},
+            "audit": {"level": "full"},
+        }
+    )
+    assert profile.risk_ceiling is RiskTier.R2
+    assert "sales.quote.create" in profile.allowed_tools
+
+
+def test_client_profile_rejects_flat_name() -> None:
+    with pytest.raises(ValidationError):
+        ClientProfile.model_validate(
+            {
+                "name": "SalesWrite",  # missing "<Domain>.<Qualifier>"
+                "owner": "sales-platform",
+                "risk_ceiling": "R2",
+                "allowed_tools": ["sales.quote.create"],
+            }
+        )
+
+
+def test_client_registration_references_a_profile_by_name() -> None:
+    registration = ClientRegistration.model_validate(
+        {"client_id": "sales-write-agent", "profile": "Sales.Write"}
+    )
+    assert registration.profile == "Sales.Write"
+
+
+def test_capability_manifest_domain_must_prefix_name() -> None:
+    manifest = CapabilityManifest.model_validate(
+        {
+            "name": "sales.quote.create",
+            "version": "2.1.0",
+            "domain": "sales",
+            "owner": "sales-platform",
+            "risk_tier": "R2",
+            "side_effects": True,
+            "idempotent": False,
+            "entitlements": ["Sales.Write", "Sales.Approve"],
+            "backend": {"type": "mcp", "service": "sales-domain"},
+        }
+    )
+    assert manifest.backend == BackendRef(type="mcp", service="sales-domain")
+
+    with pytest.raises(ValidationError):
+        CapabilityManifest.model_validate(
+            {
+                "name": "sales.quote.create",
+                "version": "2.1.0",
+                "domain": "finance",  # mismatched prefix
+                "owner": "sales-platform",
+                "risk_tier": "R2",
+                "side_effects": True,
+                "idempotent": False,
+                "entitlements": ["Sales.Write"],
+                "backend": {"type": "mcp", "service": "sales-domain"},
+            }
+        )