diff --git a/packages/c0py-core/tests/provenance.test.ts b/packages/c0py-core/tests/provenance.test.ts
new file mode 100644
index 0000000..45a56d4
--- /dev/null
+++ b/packages/c0py-core/tests/provenance.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import { validateUpstreamCapability } from "../src/provenance/registry";
+
+const base = {
+  id: "visual-css-root-cause",
+  capability: "visual-css-root-cause",
+  disposition: "CHERRY_PICK" as const,
+  source: {
+    repository: "example/upstream",
+    commit: "0123456789abcdef",
+    sourcePaths: ["scripts/compare.mjs"],
+    license: "MIT",
+  },
+  targetModule: "verification",
+  rationale: "Adds deterministic style-root-cause diagnostics",
+  tests: ["geometry-diff"],
+};
+
+describe("upstream provenance policy", () => {
+  it("accepts traceable permissive cherry-picks", () => {
+    expect(validateUpstreamCapability(base)).toEqual({
+      valid: true,
+      errors: [],
+      warnings: [],
+    });
+  });
+
+  it("rejects AGPL code cherry-picked into core", () => {
+    const result = validateUpstreamCapability({
+      ...base,
+      source: { ...base.source, license: "AGPL-3.0" },
+    });
+
+    expect(result.valid).toBe(false);
+    expect(result.errors.join(" ")).toMatch(/adapter\/service boundary/i);
+  });
+
+  it("requires exact provenance for source-derived implementations", () => {
+    const result = validateUpstreamCapability({
+      ...base,
+      source: { license: "MIT", sourcePaths: ["compare.mjs"] },
+    });
+
+    expect(result.valid).toBe(false);
+    expect(result.errors).toContain("source.repository is required");
+    expect(result.errors).toContain("source.commit is required");
+  });
+});