Initial curated Unraid-AppOps-Gateway source from 3bd6f6fee310125bfbb4d4650389a817f498724d

backend/tests/test_workmesh_promotion_contract.py

@@ -0,0 +1,34 @@
+from backend.app.services.action_execution import (
+    action_execution_profile,
+    approval_execution_supported,
+    mcp_execution_supported,
+)
+from backend.app.services.action_registry import (
+    ACTION_RISK,
+    ACTIONS,
+    action_default_target,
+)
+from backend.app.services.policy_engine import evaluate_policy
+
+
+def test_workmesh_promotion_is_fixed_target_human_approved_and_not_mcp_executable():
+    action = "deployment.target.promote_workmesh"
+
+    assert action in ACTIONS
+    assert ACTION_RISK[action] == "high"
+    assert action_default_target(action) == "jens/workmesh"
+    assert evaluate_policy(None, action, "jens/workmesh", "manual")["decision"] == "approval_required"
+    assert approval_execution_supported(action)
+    assert not mcp_execution_supported(action)
+    assert action_execution_profile(action, "approval_required", "operator") == {
+        "executionMode": "approval_then_execute",
+        "executionSupported": True,
+        "commandExecutionSupported": False,
+        "executionSurface": "/approvals",
+    }
+
+
+def test_workmesh_promotion_action_does_not_generalize_to_another_target():
+    # The product executor resolves its fixed target from persisted preflight
+    # state; callers cannot alter it through the shared action registry.
+    assert action_default_target("deployment.target.promote_workmesh") == "jens/workmesh"