test: harden governance adapter release coverage

[ajaysurya1221]

Summary

Release-hardening test coverage for the v1.4 governance adapter, ahead of cutting v1.4.0.
Tests only — no source, no version bump, no behavior change. Pins the fail-closed PreToolUse
veto contract at its boundaries and proves the shipped wheel scaffolds dorian governance install
for a real pip install dorian-vwp user.

What changed

• tests/test_governance_install.py — 7 new functional PreToolUse veto subprocess tests (reuse
  the existing _run_veto/_fresh_packet helpers; execute the hook as a real subprocess):
  • identity mismatch (base_ref ≠ DORIAN_BASE) blocks under strict → exit 2;
  • DORIAN_EFFORT=godmode forces strict and blocks a standing escalate → exit 2;
  • freshness boundary: 899s is fresh → exit 0; 901s is stale under strict → exit 2;
  • escalate on a tool with empty file_path blocks even when attended → exit 2;
  • malformed tool JSON fails open under attended (exit 0) and closed under strict (exit 2).
• tests/test_packaging.py — test_installed_scaffolds_governance_adapter (slow): builds the
  wheel, installs it into a fresh venv, runs the packaged dorian governance install, and asserts
  both hooks + settings + docs exist, the installed veto carries return 2 / "FAIL CLOSED", and the
  SubagentStop hook emits hookSpecificOutput.

Why

v1.4's headline surface is a fail-closed enforcement veto; functional veto tests of exactly this
class already caught a real false-block-everything bug during v1.4 development, and the wheel path was
the one governance install scenario not yet covered end-to-end. This closes both before the GA tag.

Invariants

Purely additive (+89/−0). No src/ change; version stays 1.3.0; no Lawbook, provenance, effort
modes, provider abstraction, pane/TUI, or design work; exit-code contract / warrant schema / checker
grammar / fold policy unchanged. CI (uv sync --all-extras on 3.11/3.12/3.13) is authoritative.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Added broader coverage for governance installation behavior, including stricter boundary checks for allowed and blocked cases.
  • Added an end-to-end packaging test to verify the installed CLI can scaffold governance files correctly in a fresh repository.
  • Confirmed the generated setup includes expected hooks, settings, and documentation content.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds test-only coverage: new veto-hook boundary tests in the governance install test suite covering identity mismatch, strict mode, freshness windows, and malformed input handling, plus a new end-to-end packaging test verifying the installed CLI scaffolds governance adapter files correctly.

Changes

Governance Test Additions

Layer / File(s)	Summary
Veto-hook boundary tests tests/test_governance_install.py	Adds tests for identity mismatch, godmode-forced strict mode, freshness staleness/boundary edges (~899s vs ~901s), missing file_path in tool_input, and malformed stdin/tool JSON under attended vs strict/unattended policies.
Packaging end-to-end scaffolding test tests/test_packaging.py	Adds test_installed_scaffolds_governance_adapter, which runs the installed dorian CLI's governance install in a fresh git repo and verifies generated hook/settings/docs files, including "return 2", "FAIL CLOSED", and hookSpecificOutput markers.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the test-only changes that harden governance adapter release coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/governance-hardening-slice-0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

tests/test_packaging.py (1)

187-193: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add timeouts to subprocess calls to avoid indefinite CI hangs.

Neither the git init nor the governance install invocation has a timeout=. If the installed CLI unexpectedly blocks (e.g., an unhandled prompt), this test can hang the whole CI job rather than fail with a clear timeout error.

♻️ Proposed fix

-    subprocess.run(["git", "init", "-q"], cwd=repo, check=True, capture_output=True)
+    subprocess.run(["git", "init", "-q"], cwd=repo, check=True, capture_output=True, timeout=30)
     r = subprocess.run(
         [str(installed_dorian), "--repo", str(repo), "governance", "install"],
         capture_output=True,
         text=True,
+        timeout=60,
     )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_packaging.py` around lines 187 - 193, Add explicit timeouts to the
subprocess calls in this test so CI cannot hang indefinitely. Update both the
git init invocation and the installed CLI call in the test_packaging flow to use
a timeout, and keep the existing assertions on the return code and stderr so
failures still surface clearly. Locate the affected calls around the governance
install test case using the subprocess.run usages.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/test_packaging.py`:
- Around line 187-193: Add explicit timeouts to the subprocess calls in this
test so CI cannot hang indefinitely. Update both the git init invocation and the
installed CLI call in the test_packaging flow to use a timeout, and keep the
existing assertions on the return code and stderr so failures still surface
clearly. Locate the affected calls around the governance install test case using
the subprocess.run usages.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7bb14226-d2d3-4c81-b0d3-f6af7e66af5b

📥 Commits

Reviewing files that changed from the base of the PR and between f204a33 and 35a7f4b.

📒 Files selected for processing (2)

• tests/test_governance_install.py
• tests/test_packaging.py