Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_manifests.py

@@ -1,7 +1,9 @@
 from pathlib import Path
 
 import pytest
+from pydantic import ValidationError
 
+from modelforge_api.domain.contracts import ProjectManifest
 from modelforge_api.services.manifest_registry import PROJECT_ROOT, ManifestRegistry
 
 
@@ -26,3 +28,35 @@ def test_project_referencing_missing_contract_is_rejected(tmp_path: Path) -> Non
     )
     with pytest.raises(ValueError, match="missing capability"):
         ManifestRegistry(tmp_path).projects()
+
+
+def test_duplicate_project_manifest_identity_is_rejected(tmp_path: Path) -> None:
+    (tmp_path / "capabilities").mkdir()
+    projects = tmp_path / "projects"
+    projects.mkdir()
+    (projects / "first.yaml").write_text(
+        "project:\n  id: shared\n  name: First\n  description: First declaration\nbindings: {}\n",
+        encoding="utf-8",
+    )
+    (projects / "second.yaml").write_text(
+        "project:\n  id: shared\n  name: Second\n  description: Conflicting declaration\nbindings: {}\n",
+        encoding="utf-8",
+    )
+
+    with pytest.raises(ValueError, match="duplicate project manifest identity"):
+        ManifestRegistry(tmp_path).projects()
+
+
+def test_project_manifest_rejects_secret_bearing_extra_fields() -> None:
+    payload = {
+        "project": {
+            "id": "local-consumer",
+            "name": "Local Consumer",
+            "description": "A non-secret project contract.",
+            "service_token": "placeholder-only",
+        },
+        "bindings": {},
+    }
+
+    with pytest.raises(ValidationError):
+        ProjectManifest.model_validate(payload)