From 35f1a3ca668d729ea3b213daf9a49cf13c8b70e7 Mon Sep 17 00:00:00 2001
From: Simon Axelsson <simon@siax.io>
Date: Wed, 16 Sep 2026 15:35:43 +0200
Subject: [PATCH] test(core): validate upstream provenance policy

---
 packages/c0py-core/tests/provenance.test.ts | 48 +++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 packages/c0py-core/tests/provenance.test.ts

diff --git a/packages/c0py-core/tests/provenance.test.ts b/packages/c0py-core/tests/provenance.test.ts
new file mode 100644
index 0000000..45a56d4
--- /dev/null
+++ b/packages/c0py-core/tests/provenance.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import { validateUpstreamCapability } from "../src/provenance/registry";
+
+const base = {
+  id: "visual-css-root-cause",
+  capability: "visual-css-root-cause",
+  disposition: "CHERRY_PICK" as const,
+  source: {
+    repository: "example/upstream",
+    commit: "0123456789abcdef",
+    sourcePaths: ["scripts/compare.mjs"],
+    license: "MIT",
+  },
+  targetModule: "verification",
+  rationale: "Adds deterministic style-root-cause diagnostics",
+  tests: ["geometry-diff"],
+};
+
+describe("upstream provenance policy", () => {
+  it("accepts traceable permissive cherry-picks", () => {
+    expect(validateUpstreamCapability(base)).toEqual({
+      valid: true,
+      errors: [],
+      warnings: [],
+    });
+  });
+
+  it("rejects AGPL code cherry-picked into core", () => {
+    const result = validateUpstreamCapability({
+      ...base,
+      source: { ...base.source, license: "AGPL-3.0" },
+    });
+
+    expect(result.valid).toBe(false);
+    expect(result.errors.join(" ")).toMatch(/adapter\/service boundary/i);
+  });
+
+  it("requires exact provenance for source-derived implementations", () => {
+    const result = validateUpstreamCapability({
+      ...base,
+      source: { license: "MIT", sourcePaths: ["compare.mjs"] },
+    });
+
+    expect(result.valid).toBe(false);
+    expect(result.errors).toContain("source.repository is required");
+    expect(result.errors).toContain("source.commit is required");
+  });
+});