ai-kit-python 1.4.2__py3-none-any.whl

aikit/tests/test_context7.py

@@ -0,0 +1,153 @@
+"""Context7 workflows remain optional, offline and separate from native MCP activation."""
+from __future__ import annotations
+
+import contextlib
+import io
+import json
+from pathlib import Path
+import shutil
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
+import doctor
+import install
+
+ENTRY = ".agents/skills/context7-docs/SKILL.md"
+NATIVE = ".claude/skills/context7-docs/SKILL.md"
+
+
+class Context7Tests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="ai-kit-context7-")
+        self.addCleanup(self.temp.cleanup)
+        base = Path(self.temp.name).resolve()
+        self.source = base / "reference"
+        self.target = base / "project with spaces"
+        shutil.copytree(install.ROOT, self.source, ignore=shutil.ignore_patterns("__pycache__", ".git"))
+
+    def plan(self, **options):
+        return install.build_plan(self.target, root=self.source, **options)
+
+    def apply(self, **options):
+        plan = self.plan(**options)
+        self.assertFalse(install.needs_review(plan), plan)
+        self.assertTrue(install.apply_plan(plan))
+        return plan
+
+    def test_default_and_presets_omit_skill_and_registry_entry(self):
+        for preset in (None, *install.PRESETS):
+            with self.subTest(preset=preset):
+                plan = self.plan(preset=preset, agents=["codex", "claude"])
+                self.assertNotIn("context7", plan["extras"])
+                self.assertNotIn(ENTRY, plan["actions"])
+                self.assertNotIn(NATIVE, plan["actions"])
+                self.assertNotIn(b"context7-docs/SKILL.md", plan["actions"]["ai-kit/SKILLS.md"]["data"])
+        self.apply()
+        self.assertEqual(doctor.link_warnings(self.target), [])
+
+    def test_apply_is_offline_and_preserves_native_mcp_configuration(self):
+        paths = (".codex/config.toml", ".mcp.json", ".cursor/mcp.json", ".gemini/settings.json")
+        for path in paths:
+            existing = self.target / path
+            existing.parent.mkdir(parents=True, exist_ok=True)
+            existing.write_bytes(b"Existing client-owned configuration.\n")
+        with patch("subprocess.Popen", side_effect=AssertionError("No client or package process")), \
+                patch("socket.socket", side_effect=AssertionError("No network connection")):
+            plan = self.apply(extras=["context7"], agents=["codex", "claude", "cursor"])
+        for path in paths:
+            self.assertNotIn(path, plan["actions"])
+            self.assertEqual((self.target / path).read_bytes(), b"Existing client-owned configuration.\n")
+        original = (self.source / "template" / ENTRY).read_bytes()
+        self.assertEqual((self.target / ENTRY).read_bytes(), original)
+        self.assertEqual((self.target / NATIVE).read_bytes(), original)
+        self.assertNotIn(b"disable-model-invocation", original)
+        self.assertEqual(doctor.examine(self.target, root=self.source)["errors"], [])
+        self.assertEqual(doctor.link_warnings(self.target), [])
+        self.assertEqual(self.plan()["actions"], {})
+
+    def test_selection_persists_independently_of_other_integrations_and_presets(self):
+        self.apply(extras=["context7"])
+        self.assertFalse((self.target / "ai-kit/vendor/security-audit").exists())
+        self.assertFalse((self.target / "ai-kit/vendor/strix").exists())
+        self.apply(preset="minimal")
+        self.assertEqual(self.plan()["extras"], ["context7"])
+        self.apply(extras=["security-audit", "strix"], agents=["codex", "claude"])
+        self.assertEqual(self.plan()["extras"], ["context7", "security-audit", "strix"])
+        settings = json.loads((self.target / "ai-kit/settings.json").read_text(encoding="utf-8"))
+        self.assertIs(settings["context7"], True)
+        self.assertEqual(self.plan()["actions"], {})
+
+    def test_local_edits_and_source_upgrade_preserve_conflicting_files(self):
+        self.apply(extras=["context7"])
+        path = self.target / ENTRY
+        local = path.read_bytes() + b"\nProject-specific documentation scope.\n"
+        path.write_bytes(local)
+        self.assertEqual(self.plan()["actions"], {})
+        source = self.source / "template" / ENTRY
+        incoming = source.read_bytes() + b"\nUpdated documentation workflow.\n"
+        source.write_bytes(incoming)
+        old_state = (self.target / "ai-kit/.install-state.json").read_bytes()
+        plan = self.plan()
+        self.assertIn(ENTRY, plan["conflicts"])
+        self.assertFalse(install.apply_plan(plan))
+        self.assertEqual(path.read_bytes(), local)
+        self.assertEqual((self.target / "ai-kit/.install-state.json").read_bytes(), old_state)
+        self.assertEqual((self.target / plan["candidates"][ENTRY]["path"]).read_bytes(), incoming)
+
+    def test_untracked_skill_conflict_blocks_install_before_managed_writes(self):
+        path = self.target / ENTRY
+        path.parent.mkdir(parents=True)
+        path.write_bytes(b"Existing skill.\n")
+        plan = self.plan(extras=["context7"])
+        self.assertIn(ENTRY, plan["conflicts"])
+        self.assertFalse(install.apply_plan(plan))
+        self.assertEqual(path.read_bytes(), b"Existing skill.\n")
+        self.assertFalse((self.target / "ai-kit/settings.json").exists())
+
+    def test_deselection_retains_files_and_native_retirement_requires_review(self):
+        self.apply(extras=["context7"], agents=["codex", "claude"])
+        plan = self.plan(agents=["codex"])
+        self.assertIn(NATIVE, plan["adapter_conflicts"])
+        self.assertFalse(install.apply_plan(plan))
+        settings_path = self.target / "ai-kit/settings.json"
+        settings = json.loads(settings_path.read_text(encoding="utf-8"))
+        settings["context7"] = False
+        settings_path.write_text(json.dumps(settings) + "\n", encoding="utf-8")
+        old = (self.target / ENTRY).read_bytes()
+        plan = self.apply()
+        self.assertNotIn("context7", plan["extras"])
+        self.assertEqual((self.target / ENTRY).read_bytes(), old)
+        self.assertTrue(any("Previously managed path retained" in warning and "context7-docs" in warning
+                            for warning in plan["warnings"]))
+        self.assertEqual(doctor.link_warnings(self.target), [])
+
+    def test_invalid_choice_and_blocked_skill_parent_are_refused(self):
+        defaults_path = self.source / "template/ai-kit/settings.json"
+        defaults = json.loads(defaults_path.read_text(encoding="utf-8"))
+        defaults["context7"] = "true"
+        defaults_path.write_text(json.dumps(defaults) + "\n", encoding="utf-8")
+        with self.assertRaisesRegex(ValueError, "context7"):
+            self.plan(extras=["context7"])
+        defaults.pop("context7")
+        defaults_path.write_text(json.dumps(defaults) + "\n", encoding="utf-8")
+        parent = (self.target / ENTRY).parent
+        parent.parent.mkdir(parents=True)
+        parent.write_bytes(b"Blocked directory.\n")
+        with self.assertRaises(NotADirectoryError):
+            self.plan(extras=["context7"])
+        self.assertFalse((self.target / "ai-kit/settings.json").exists())
+        self.assertEqual(parent.read_bytes(), b"Blocked directory.\n")
+
+    def test_cli_flag_only_previews_until_apply_is_requested(self):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(install.main([str(self.target), "--with-context7"]), 0)
+        self.assertFalse(self.target.exists())
+        self.assertIn("context7", json.loads(output.getvalue())["extras"])
+
+
+if __name__ == "__main__":
+    unittest.main()

aikit/tests/test_context_selection.py

@@ -0,0 +1,70 @@
+"""Module-scoped instruction selection, immutable critical rules and byte-budget transparency."""
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
+import context
+import install
+
+
+class SelectionTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        for name in ("AGENTS.md", "ai-kit/CORE.md", "ai-kit/settings.json", "PROJECT_CONTEXT.md",
+                     "ai-kit/ENGINEERING.md", "ai-kit/SECURITY.md", "docs/DECISIONS.md",
+                     "docs/adr/0001-module-boundary.md", "ai-kit/stacks/PYTHON.md", "ai-kit/stacks/GO.md"):
+            path = self.root / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(json.dumps({"conventions": "owner"}) if name.endswith(".json") else "Rules: " + name, encoding="utf-8")
+        (self.root / "ai-kit/project.json").write_text(json.dumps({"schema": 1, "modules": [
+            {"path": "/api/", "profiles": ["PYTHON"]}, {"path": "/worker/", "profiles": ["GO"]}]}), encoding="utf-8")
+
+    def test_only_matching_profiles_are_selected_and_no_file_is_changed(self):
+        before = {p.relative_to(self.root): p.read_bytes() for p in self.root.rglob("*") if p.is_file()}
+        report = context.select_context(self.root, path="api/services")
+        names = {item["path"] for item in report["selected"]}
+        self.assertIn("ai-kit/stacks/PYTHON.md", names)
+        self.assertNotIn("ai-kit/stacks/GO.md", names)
+        self.assertIn("docs/adr/0001-module-boundary.md", names)
+        self.assertEqual(report["modules"], ["/api/"])
+        self.assertEqual(before, {p.relative_to(self.root): p.read_bytes() for p in self.root.rglob("*") if p.is_file()})
+
+    def test_critical_context_survives_budget_and_duplicates_are_reported(self):
+        (self.root / "ai-kit/ENGINEERING.md").write_bytes((self.root / "ai-kit/SECURITY.md").read_bytes())
+        report = context.select_context(self.root, path="worker", budget=1)
+        self.assertTrue(report["over_budget"])
+        self.assertTrue(any(r["path"] == "ai-kit/CORE.md" for r in report["selected"]))
+        self.assertEqual(len(report["duplicates"]), 1)
+        self.assertEqual(report["total_bytes"], sum(r["bytes"] for r in report["selected"]))
+
+    def test_unknown_scope_is_not_given_sibling_stack_facts(self):
+        report = context.select_context(self.root, path="unknown")
+        self.assertFalse(report["selection_complete"])
+        self.assertEqual(report["profiles"], [])
+
+    def test_nested_module_overrides_parent_stack_but_preserves_shared_requirements(self):
+        path = self.root / "ai-kit/project.json"
+        data = json.loads(path.read_text())
+        data["modules"].append({"path": "/", "profiles": ["LARAVEL"]})
+        path.write_text(json.dumps(data), encoding="utf-8")
+        report = context.select_context(self.root, path="worker")
+        self.assertEqual(report["profiles"], ["GO"])
+        self.assertTrue(any(r["path"] == "ai-kit/SECURITY.md" for r in report["selected"]))
+
+    def test_traversal_link_and_missing_profile_are_refused(self):
+        for scope in ("../outside", "/api", "C:/outside"):
+            with self.subTest(scope=scope), self.assertRaises(ValueError):
+                context.select_context(self.root, path=scope)
+        original = install.is_link
+        with mock.patch.object(install, "is_link", side_effect=lambda p: p.name == "CORE.md" or original(p)):
+            with self.assertRaises(ValueError):
+                context.select_context(self.root, path="api")
+        (self.root / "ai-kit/stacks/PYTHON.md").unlink()
+        with self.assertRaisesRegex(ValueError, "Missing required"):
+            context.select_context(self.root, path="api")

aikit/tests/test_distribution.py

@@ -0,0 +1,181 @@
+"""Exercise publication guards and built-artifact privacy/resource contracts offline."""
+import io
+from pathlib import Path
+import sys
+import tarfile
+import tempfile
+import unittest
+import zipfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
+import check_distribution as release
+import build_distribution
+
+VERSION = "1.4.1"
+DESCRIPTION = b"# AI-KIT\n\nPortable project instructions.\n"
+
+
+class DistributionTests(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory(prefix="aikit-package-")
+        self.addCleanup(self.temporary.cleanup)
+        self.directory = Path(self.temporary.name)
+
+    def metadata(self, *, version=VERSION, extra="", description=DESCRIPTION):
+        headers = ("Metadata-Version: 2.4\nName: ai-kit-python\nVersion: " + version + "\n"
+                   "Requires-Python: >=3.10\nLicense-Expression: MIT AND Apache-2.0\n"
+                   "Author: Igor Sazonov\nDescription-Content-Type: text/markdown\n")
+        headers += "".join("License-File: " + name + "\n" for name in release.LICENSES)
+        headers += "".join("Project-URL: " + name + ", https://example.invalid/\n"
+                           for name in ("Homepage", "Documentation", "Source", "Issues", "Changelog"))
+        return (headers + extra + "\n").encode() + description
+
+    def payload(self, *, description=DESCRIPTION):
+        result = {name: b"Public resource.\n" for name in release.REQUIRED}
+        result["VERSION"] = (VERSION + "\n").encode()
+        result["docs/PYPI_DESCRIPTION.md"] = description
+        return result
+
+    def wheel(self, *, payload=None, metadata=None, mutate=None):
+        payload = self.payload() if payload is None else payload
+        files = {"aikit/" + name: data for name, data in payload.items()}
+        prefix = "ai_kit_python-" + VERSION + ".dist-info/"
+        files[prefix + "METADATA"] = self.metadata() if metadata is None else metadata
+        files[prefix + "entry_points.txt"] = b"[console_scripts]\naikit = aikit.aikit_cli:main\n"
+        files[prefix + "WHEEL"] = b"Wheel-Version: 1.0\nRoot-Is-Purelib: true\nTag: py3-none-any\n"
+        for name in release.LICENSES:
+            files[prefix + "licenses/" + name] = payload.get(name, b"")
+        if mutate:
+            mutate(files, prefix)
+        path = self.directory / ("ai_kit_python-" + VERSION + "-py3-none-any.whl")
+        with zipfile.ZipFile(path, "w") as archive:
+            for name, data in files.items():
+                archive.writestr(name, data)
+        return path
+
+    def sdist(self, *, metadata=None):
+        path = self.directory / ("ai_kit_python-" + VERSION + ".tar.gz")
+        files = {**self.payload(), "PKG-INFO": self.metadata() if metadata is None else metadata}
+        with tarfile.open(path, "w:gz") as archive:
+            for name, data in files.items():
+                item = tarfile.TarInfo("ai_kit_python-" + VERSION + "/" + name)
+                item.size = len(data)
+                archive.addfile(item, io.BytesIO(data))
+        return path
+
+    def test_valid_wheel_and_sdist_keep_templates_licenses_and_same_version(self):
+        self.wheel()
+        self.sdist()
+        reports = release.check_archives(self.directory, VERSION)
+        self.assertEqual(len(reports), 2)
+        self.assertTrue(all(report["version"] == VERSION and len(report["sha256"]) == 64 for report in reports))
+
+    def test_archive_version_mismatch_refuses(self):
+        path = self.wheel(metadata=self.metadata(version="1.3.0"))
+        with self.assertRaisesRegex(ValueError, "name/version"):
+            release.inspect_distribution(path, VERSION)
+
+    def test_legacy_distribution_name_refuses(self):
+        metadata = self.metadata().replace(b"Name: ai-kit-python\n", b"Name: ai-kit\n")
+        for path in (self.wheel(metadata=metadata), self.sdist(metadata=metadata)):
+            with self.assertRaisesRegex(ValueError, "name/version"):
+                release.inspect_distribution(path, VERSION)
+
+    def test_unexpected_runtime_dependency_refuses(self):
+        path = self.wheel(metadata=self.metadata(extra="Requires-Dist: unexpected-package\n"))
+        with self.assertRaisesRegex(ValueError, "dependency contract"):
+            release.inspect_distribution(path, VERSION)
+
+    def test_private_root_documents_and_memory_refuse_but_templates_remain_required(self):
+        for name in ("AGENTS.md", "PROJECT_CONTEXT.md", "WIKI.md", "ai-kit/.memory/raw.json",
+                     "ai-kit/.design/raw.md", "docs/.private/raw.md", ".env", "auth.json", "docs/private.pem"):
+            with self.subTest(name=name):
+                path = self.wheel(payload={**self.payload(), name: b"Synthetic private content."})
+                with self.assertRaisesRegex(ValueError, "Private local|Credential"):
+                    release.inspect_distribution(path, VERSION)
+        payload = self.payload()
+        del payload["template/AGENTS.md"]
+        with self.assertRaisesRegex(ValueError, "required distribution resources"):
+            release.inspect_distribution(self.wheel(payload=payload), VERSION)
+
+    def test_missing_cli_and_changed_license_payload_refuse(self):
+        for suffix in ("entry_points.txt", "licenses/LICENSE"):
+            with self.subTest(suffix=suffix):
+                path = self.wheel(mutate=lambda files, prefix: files.__setitem__(prefix + suffix, b"changed\n"))
+                with self.assertRaises((ValueError, release.configparser.Error)):
+                    release.inspect_distribution(path, VERSION)
+
+    def test_source_description_and_portable_links_are_checked(self):
+        with self.assertRaisesRegex(ValueError, "differs from"):
+            release.inspect_distribution(self.wheel(metadata=self.metadata(description=b"Other description.\n")), VERSION)
+        for text in (b"[Guide](../README.md)\n", b"```mermaid\ngraph LR\n```\n"):
+            with self.subTest(text=text):
+                path = self.wheel(payload=self.payload(description=text), metadata=self.metadata(description=text))
+                with self.assertRaisesRegex(ValueError, "nonportable"):
+                    release.inspect_distribution(path, VERSION)
+
+    def test_missing_or_multiple_archives_refuse(self):
+        self.wheel()
+        with self.assertRaisesRegex(ValueError, "exactly one"):
+            release.check_archives(self.directory, VERSION)
+        self.sdist()
+        (self.directory / "extra.whl").write_bytes(b"not a wheel")
+        with self.assertRaisesRegex(ValueError, "exactly one"):
+            release.check_archives(self.directory, VERSION)
+
+    def test_traversal_and_linked_members_refuse_without_extraction(self):
+        path = self.wheel()
+        with zipfile.ZipFile(path, "a") as archive:
+            archive.writestr("../outside", b"synthetic")
+        with self.assertRaisesRegex(ValueError, "Unsafe"):
+            release.inspect_distribution(path, VERSION)
+        self.assertFalse((self.directory.parent / "outside").exists())
+        path = self.wheel()
+        with zipfile.ZipFile(path, "a") as archive:
+            item = zipfile.ZipInfo("aikit/linked")
+            item.create_system = 3
+            item.external_attr = 0o120777 << 16
+            archive.writestr(item, "outside")
+        with self.assertRaisesRegex(ValueError, "Linked"):
+            release.inspect_distribution(path, VERSION)
+        path = self.sdist()
+        with tarfile.open(path, "w:gz") as archive:
+            item = tarfile.TarInfo("source/linked")
+            item.type = tarfile.SYMTYPE
+            item.linkname = "outside"
+            archive.addfile(item)
+        with self.assertRaisesRegex(ValueError, "Linked"):
+            release.inspect_distribution(path, VERSION)
+
+    def test_default_validation_is_local_and_allows_review_branches(self):
+        result = release.release_identity(VERSION, "", "validate", "refs/heads/review", "example/fork")
+        self.assertFalse(result["upload_performed"])
+
+    def test_build_output_inside_source_refuses_before_writing(self):
+        with self.assertRaisesRegex(ValueError, "outside the source"):
+            build_distribution.prepare(build_distribution.ROOT / "dist")
+
+    def test_registry_upload_requires_exact_version_tag_and_canonical_repository(self):
+        for destination in ("testpypi", "pypi"):
+            for expected, ref, repository in (
+                ("", "refs/tags/v" + VERSION, "tigusigalpa/ai-kit"),
+                ("1.3.0", "refs/tags/v" + VERSION, "tigusigalpa/ai-kit"),
+                (VERSION, "refs/heads/main", "tigusigalpa/ai-kit"),
+                (VERSION, "refs/tags/v1.3.0", "tigusigalpa/ai-kit"),
+                (VERSION, "refs/tags/v" + VERSION, "example/fork"),
+            ):
+                with self.subTest(destination=destination, expected=expected, ref=ref, repository=repository):
+                    with self.assertRaises(ValueError):
+                        release.release_identity(VERSION, expected, destination, ref, repository)
+            result = release.release_identity(VERSION, VERSION, destination, "refs/tags/v" + VERSION, "tigusigalpa/ai-kit")
+            self.assertFalse(result["upload_performed"])
+
+    def test_invalid_versions_destinations_and_mismatched_validation_refuse(self):
+        for version, expected, destination in (("1.4", "", "validate"), (VERSION, "1.3.0", "validate"), (VERSION, "", "other")):
+            with self.subTest(version=version, destination=destination), self.assertRaises(ValueError):
+                release.release_identity(version, expected, destination, "", "")
+        self.assertEqual(release.release_identity("1.5.0rc1", "", "validate", "", "")["version"], "1.5.0rc1")
+
+
+if __name__ == "__main__":
+    unittest.main()

aikit/tests/test_docker_image.py

@@ -0,0 +1,63 @@
+"""Version binding and safe CLI image smoke argument construction."""
+import importlib.util
+import os
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+
+def module(path, name):
+    spec = importlib.util.spec_from_file_location(name, path)
+    result = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(result)
+    return result
+
+
+ROOT = Path(__file__).resolve().parents[1]
+version_check = module(ROOT / "docker/check_version.py", "aikit_image_version_check")
+smoke = module(ROOT / "tests/docker_smoke.py", "aikit_image_smoke")
+
+
+class DockerImageTests(unittest.TestCase):
+    def test_matching_version_returns_the_bundled_value(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / "VERSION"
+            path.write_bytes(b"1.3.0\r\n")
+            self.assertEqual(version_check.check_version(path, "1.3.0"), "1.3.0")
+
+    def test_missing_or_wrong_image_label_is_refused(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / "VERSION"
+            path.write_text("1.3.0\n", encoding="utf-8")
+            for expected in (None, "", "1.2.0"):
+                with self.subTest(expected=expected), self.assertRaises(ValueError):
+                    version_check.check_version(path, expected)
+
+    def test_mount_paths_with_spaces_are_one_argument_and_runtime_is_restricted(self):
+        with tempfile.TemporaryDirectory(prefix="aikit image ") as folder:
+            path = Path(folder).resolve()
+            arguments = smoke.runtime_arguments("aikit:test", path, readonly=True)
+            self.assertIn(f"type=bind,source={path},target=/workspace,readonly", arguments)
+            self.assertIn("--read-only", arguments)
+            self.assertEqual(arguments[arguments.index("--network") + 1], "none")
+            self.assertEqual(arguments[arguments.index("--cap-drop") + 1], "ALL")
+            self.assertEqual(arguments[-1], "aikit:test")
+            self.assertNotIn("--privileged", arguments)
+
+    def test_nonexistent_mount_is_refused(self):
+        with tempfile.TemporaryDirectory() as folder:
+            with self.assertRaises(ValueError):
+                smoke.runtime_arguments("aikit:test", Path(folder) / "missing")
+
+    def test_linux_host_identity_is_used_without_switching_to_root(self):
+        with patch.object(os, "getuid", return_value=1002, create=True), \
+                patch.object(os, "getgid", return_value=1003, create=True):
+            arguments = smoke.runtime_arguments("aikit:test")
+        self.assertEqual(arguments[arguments.index("--user") + 1], "1002:1003")
+        with patch.object(os, "getuid", return_value=0, create=True):
+            self.assertNotIn("--user", smoke.runtime_arguments("aikit:test"))
+
+
+if __name__ == "__main__":
+    unittest.main()

aikit/tests/test_docker_test_usage.py

@@ -0,0 +1,54 @@
+"""Evidence collection never authorizes deletion or infers exact storage ownership."""
+import json
+from pathlib import Path
+import subprocess
+import sys
+import unittest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "scripts"))
+import docker_test_usage
+
+
+class DockerEvidenceTests(unittest.TestCase):
+    def test_inspection_only_and_referenced_volume_is_protected(self):
+        calls = []
+
+        def run(argv):
+            calls.append(argv)
+            args = argv[1:]
+            if args == ["context", "show"]:
+                return "desktop-linux\n"
+            if args[:1] == ["info"]:
+                return "test-version\n"
+            if args[:2] == ["volume", "ls"]:
+                return "exact test volume\n"
+            if args[:2] == ["volume", "inspect"]:
+                self.assertEqual(args[2], "exact test volume")
+                return json.dumps([{"Labels": {"com.docker.compose.project": "demo",
+                                               "ai-kit.disposable": "true"}}])
+            if args[:1] == ["ps"]:
+                return "stopped-container\n"
+            if args == ["system", "df", "-v"]:
+                return "Human-readable storage report\n"
+            if args[:2] == ["buildx", "du"]:
+                return "{}\n"
+            self.fail("Unexpected command: " + repr(argv))
+
+        report = docker_test_usage.collect("demo", run=run, builder="dedicated-test")
+        self.assertIsNone(report["measured_project_bytes"])
+        self.assertEqual(report["builder_project_ownership"], "unverified")
+        self.assertTrue(report["volumes"][0]["declared_disposable"])
+        self.assertEqual(report["volumes"][0]["container_references"], ["stopped-container"])
+        self.assertFalse(report["volumes"][0]["eligible_without_more_evidence"])
+        self.assertFalse(any(token in {"rm", "prune", "remove", "stop"} for argv in calls for token in argv))
+
+    def test_stopped_daemon_is_not_a_successful_evidence_report(self):
+        def unavailable(argv):
+            raise subprocess.CalledProcessError(1, argv, stderr="Daemon unavailable")
+
+        with self.assertRaises(subprocess.CalledProcessError):
+            docker_test_usage.collect("demo", run=unavailable)
+
+
+if __name__ == "__main__":
+    unittest.main()