Testing and CI

Testing and CI

The one command

python -m pytest -q

Mock rail only. No credentials. The only network use is loopback HTTP servers on 127.0.0.1 (ephemeral ports).

Result at 9900817 (2026-10-07, America/Edmonton, Python 3.13.5, pytest 9.1.1): 170 passed in 6.10 s. python demo.py: exit 0.

Tests per file (collected)

File	Tests	Covers
test_authority_layer.py	28	Four clauses, amount boundaries, e-stop races (P1-1)
test_delegation.py	22	Carves, roll-up, cascade, lineage gate
test_tighten.py	19	Tighten-only rules, cascade, /tighten route
test_approval.py	18	Pending, approve, deny, expire, single-use, re-check, revoke-during-pending (PR #10)
test_agent.py	15	Agent tools, ACTION parsing, PERMIT_GROK_CLI preflight, replay re-execution with id remap
test_permit.py	13	Grant, clauses, e-stop, no PayPal imports in permit/permit.py
test_settlement.py	13	Verifier, predicates, voids
test_server.py	11	HTTP verbs on an ephemeral port
test_sandbox_client.py	10	Merchant/amount binding, approval polling, empty 204 void (HTTP stubbed)
test_flow.py	8	Pipeline, e-stop
test_reconcile.py	6	UNKNOWN convergence
test_sla_escrow.py	5	SLA scenario
test_demo_paths.py	2	demo.py and trace.py exit clean
Total	170

Compared with d7d27d6 (166): test_agent.py went up 10 → 15, test_approval.py 17 → 18, and test_sandbox_client.py went down 12 → 10. The two removed tests were the ORDER_ALREADY_AUTHORIZED / GET trust-bind regression tests. See PayPal Sandbox Runbook.

Port flake: resolved

trace.py used to bind fixed port 8741, so test_trace_exits_clean could fail if another server held that port. Since 17943eb, trace.py picks a free loopback port and checks that its own server is alive.

CI

.github/workflows/ci.yml (ci). It runs on push and PR to main: Ubuntu, Python 3.12, pip install pytest, then python -m pytest -q, then python demo.py. CodeQL also runs (default setup).

Commit	ci result (push)	When (America/Edmonton)
9900817	success	2026-10-07 3:04 PM
07c1874	success	2026-10-07 2:48 PM
845e813	success	2026-10-07 8:27 AM

Conventions (CONTRIBUTING.md)

• Authority only narrows. A PR touching permit/ or settlement/ must say why it cannot widen authority.
• New behaviour ships with tests. Refusal-path and race-path tests are valued most.
• State changes that move money or authority must write a receipt.
• Keep unit tests off the network. The mock rail is the default.
• The minimum supported Python version is Unknown. The checklist says 3.10+ and the README badge says 3.12. Only 3.12 (CI) and 3.13 (here) were observed.