From e131e8658da495e888425eb1a4aabe8fd58efdba Mon Sep 17 00:00:00 2001
From: host <host@test.local>
Date: Mon, 2 Nov 2026 03:32:25 +0000
Subject: [PATCH] code-to10 v6 A11: whole-tree audit_log single-writer scan
 assertion

(cherry picked from commit 9308503f90090526bb91b5aa2ae0971f84781a1d)
---
 cloud/tests/test_audit_log_single_writer.py | 74 +++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 cloud/tests/test_audit_log_single_writer.py

diff --git a/cloud/tests/test_audit_log_single_writer.py b/cloud/tests/test_audit_log_single_writer.py
new file mode 100644
index 0000000..93b0c07
--- /dev/null
+++ b/cloud/tests/test_audit_log_single_writer.py
@@ -0,0 +1,74 @@
+"""A11: whole-tree audit_log single-writer scan assertion.
+
+Extends the pre-existing ``NoAuditBypassTestCase`` in
+``test_audit_automations_chain.py`` (which only scanned
+``cloud/*.py`` at the top level) to the whole tree: every
+``.py`` file under the repository root is scanned for a
+direct audit_log insert code form, except the test fixtures
+themselves.
+
+Scope and exclusions, stated so a future red test is readable:
+
+- Production code: exactly one hit is allowed, ``cloud/auth.py``
+  (``audit_on_conn``, the unified port; ``AuthStore.audit`` is
+  that function plus a commit/retry wrapper, not a second write
+  path). Any new production hit -- any module, any subdirectory
+  (``cloud/skills/...``, ``tools/``, ``deploy/``, ``host.py``,
+  top level) -- turns this test red.
+- Test fixtures excluded: ``cloud/tests/test_tamper_ledger.py``
+  (tamper simulation) and ``cloud/tests/test_chat_history.py``
+  (legacy-row simulation) deliberately insert audit_log rows
+  into throwaway databases, and
+  ``cloud/tests/test_automation_run_due.py`` (a fake PG
+  connection whose ``execute`` matches intercepted audit_log
+  SQL strings and records params in memory -- it executes no
+  SQL at all). They are fixtures, not production writes, and
+  were already documented as out of scope by the pre-existing
+  test. They are listed by name here, not by a broad ``tests/``
+  exclusion, so a new test file that starts writing audit_log
+  directly would still turn this red.
+- No pending production direct-write points were found at the
+  time this test was added (2026-11-02): the full-tree scan
+  returned only ``cloud/auth.py`` in production code. If a
+  future scan finds one, do NOT silently fix production code
+  under this test's name and do NOT land a red test: record
+  the point in the delivery report and route the fix to its
+  own batch.
+"""
+
+import re
+import unittest
+from pathlib import Path
+
+_PATTERN = re.compile(r"INSERT\s+INTO\s+audit_log", re.IGNORECASE)
+# Fixture files that deliberately insert audit_log rows into
+# throwaway test databases (see module docstring).
+_FIXTURE_FILES = {
+    "cloud/tests/test_tamper_ledger.py",
+    "cloud/tests/test_chat_history.py",
+    "cloud/tests/test_automation_run_due.py",
+}
+
+
+class AuditLogSingleWriterTestCase(unittest.TestCase):
+    def test_only_auth_writes_audit_log_tree_wide(self):
+        repo_root = Path(__file__).resolve().parents[2]
+        offenders = []
+        for path in sorted(repo_root.rglob("*.py")):
+            rel = path.relative_to(repo_root).as_posix()
+            if rel in _FIXTURE_FILES:
+                continue
+            # Skip nothing else: .git contains no .py files, and
+            # a work/host-worktrees checkout (if present) is a
+            # separate worktree's copy of the code, not this
+            # tree's production code.
+            if rel.startswith("work/host-worktrees/"):
+                continue
+            text = path.read_text(encoding="utf-8", errors="replace")
+            if _PATTERN.search(text):
+                offenders.append(rel)
+        self.assertEqual(offenders, ["cloud/auth.py"])
+
+
+if __name__ == "__main__":
+    unittest.main()