[smith-xyz]

Plan: plans/traust-standardization/0-continuous-ops/in-review/17-shaun-traust-core-only.md (part)

Wave 2 lane (f) of the traust-core-only chain. traust's engine-loop tests over the security pack (tests/test_shadow_run.py, tests/test_security_router_engine.py) leave traust in the traust lane (f) PR; the decision (2026-10-26) is that loop-over-the-pack tests live here with the pack as a fixture, and the engine stays free of security-pack concepts.

What

This repo already runs the loop over a minimal, sanitized pack fixture (tests/fixtures/packs/security-source.yaml, shaped like traust's packs/security/assets.yaml, no estate data). Each loop behaviour the traust tests exercised maps onto an existing test here; the one that had no counterpart is added:

traust test (deleted there)	Loop behaviour	Covered here by
test_a_repo_state_completion_routes_the_repository_once	a materialized repo_state routes once; re-routes are idempotent	test_engine_loop.py::test_a_materialized_source_unblocks_downstream_and_routes_once, ::test_routing_the_same_repository_again_plans_no_second_order
test_an_iac_change_routes_the_cloud_config_lane_beside_the_tables	several routes for one repository each plan their lane asset	test_engine_loop.py::test_every_route_with_a_lane_plans_its_lane_asset_once
test_a_threat_model_pr_stamp_reaches_the_diff_scans_session	a routed order's whole rule reaches its command	test_ops_runner.py::test_a_routed_order_gets_the_rule_that_routed_it (rule-3+threat-model-pr), ::test_a_skill_session_with_a_command_runs_with_its_role
test_a_secret_in_the_patch_escalates_…	the router's answer is planned as given	test_engine_loop.py::test_every_route_with_a_lane_plans_its_lane_asset_once
test_a_lane_over_its_budget_is_withheld	budget-over withholding	test_engine_loop.py::test_the_lane_budget_cuts_the_lowest_priority_routed_work
test_a_forge_host_past_its_quota_is_deferred	per-host quota deferral	test_engine_loop.py::test_quota_is_per_forge_host, ::test_quota_refills_and_admits_the_deferred_order
test_a_minor_release_routes_a_rating_review_…	a recorded release routes each repository it ships once	test_engine_loop.py::test_a_recorded_release_routes_each_repository_it_ships_once
test_a_traust_door_is_recorded_as_it_answered	record keeps a refused answer and its reason on the order	new test_ops_shadow.py::test_record_a_refused_answer_leaves_the_order_refused_with_its_reason
test_shadow_routes_a_recorded_repo_state_with_the_security_router	shadow --router routes a recorded repo_state, plans nothing	test_ops_shadow.py::test_shadow_routes_with_the_pack_router, ::test_shadow_prints_what_a_pass_would_plan_and_diff_compares_it

What the security router decides (rule 5, lever 6, tripwire, threat-model PR stamp, release re-model) stays tested in traust (tests/test_security_router.py), without the engine.

Behaviour: none changed; tests only.

Tests

• make lint-fix && make test: 1285 passed, 26 skipped.
• Consumer ratchet as CI runs it: clean, baseline unchanged.

Changed tests

None (one test added).

Chain: traust-core #222, #223, #225, #229 → traust #291 (lane f; stacked on traust #279, #283, #284, #285, #286) · traust-engine #112.

• A person reviewed each changed test and the behaviour change is intended

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment