Initial server source import

tests/test_docker_shadow_coverage.py

@@ -0,0 +1,43 @@
+from pathlib import Path
+import sys
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'app'))
+import docker_shadow
+import scanner
+
+
+@pytest.mark.parametrize('partial', [
+    {'warnings': ['synthetic warning']}, {'degraded': True},
+    {'scan_meta': {'docker_layer_scope': {'coverage_complete': False}}},
+    {'scan_meta': {'docker_full_recovery': {'coverage_complete': False}}},
+])
+def test_full_reference_rejects_incomplete_without_false_regression(monkeypatch, partial, capsys):
+    class DB:
+        def docker_adaptive_shadow_control_identities(self, _scan_id):
+            return {('fixture', 'a' * 64)}, set()
+
+    result = {'findings': [], 'errors': [], 'retryable': False, **partial}
+    monkeypatch.setattr(scanner, 'scan_docker_image', lambda *a, **k: result)
+    monkeypatch.setattr(scanner.docker_token_manager, 'get_next_config', lambda: None)
+    metrics = docker_shadow.private_full_side_metrics(
+        DB(), {'target_scan_id': 1, 'normalized_target': 'private-synthetic-target'}, {'timeout_sec': 5})
+    assert metrics['failure_count'] == 1
+    assert metrics['diagnostic_full_incomplete'] == 1
+    assert metrics['safety_regression_count'] == 0
+    assert result == {}
+    assert 'private-synthetic-target' not in capsys.readouterr().out
+
+
+def test_successful_full_recovery_is_a_valid_reference(monkeypatch):
+    class DB:
+        def docker_adaptive_shadow_control_identities(self, _scan_id):
+            return set(), set()
+
+    result = {'findings': [], 'errors': [], 'scan_meta': {'docker_full_recovery': {'coverage_complete': True}}}
+    monkeypatch.setattr(scanner, 'scan_docker_image', lambda *a, **k: result)
+    monkeypatch.setattr(scanner.docker_token_manager, 'get_next_config', lambda: None)
+    metrics = docker_shadow.private_full_side_metrics(
+        DB(), {'target_scan_id': 1, 'normalized_target': 'offline/fixture'}, {'timeout_sec': 5})
+    assert metrics['failure_count'] == metrics['safety_regression_count'] == 0