import json
from pathlib import Path


def test_managed_workspace_ensure_has_bounded_manifest_and_policy() -> None:
    manifest = json.loads(
        Path("catalog/tools/opencode-workspace-ensure.yaml").read_text(encoding="utf-8")
    )
    spec = manifest["spec"]

    assert spec["canonicalName"] == "opencode.workspace.ensure"
    assert spec["connectorType"] == "opencode"
    assert spec["riskClass"] == "R2"
    assert spec["readOnly"] is False
    assert spec["idempotent"] is True
    assert spec["inputSchema"] == {
        "type": "object",
        "additionalProperties": False,
        "required": ["repository"],
        "properties": {
            "repository": {
                "type": "string",
                "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,99}/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$",
            }
        },
    }
    assert spec["requiredScopes"] == ["project:{project}:write"]

    policy = json.loads(
        Path("catalog/policies/040-opencode-governed-jobs.yaml").read_text(
            encoding="utf-8"
        )
    )
    assert "opencode.workspace.ensure" in policy["spec"]["match"]["toolPatterns"]