plugin-scanner 2.0.677__tar.gz → 2.0.679__tar.gz

{plugin_scanner-2.0.677 → plugin_scanner-2.0.679}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.677
+Version: 2.0.679
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.677 → plugin_scanner-2.0.679}/dashboard/e2e/fixture-states.ts

@@ -126,7 +126,61 @@ export const degradedStateSnapshot = {
 };
 
 export const emptyReceiptsPayload = { items: [] };
-export const emptyPoliciesPayload = { items: [] };
+export const emptyPoliciesPayload = { items: [], cloud_exceptions: [] };
+
+export const connectedCloudExceptionsPayload = {
+  items: [
+    {
+      id: "artifact:codex:e2e-active",
+      effect: "allow",
+      scope: "artifact",
+      harness: "codex",
+      owner: "owner@example.com",
+      approver: "approver@example.com",
+      expiry: "2099-01-01T00:00:00+00:00",
+      artifact_id: "codex:project:e2e-active",
+      source_receipt_id: "receipt-e2e",
+      bundle_hash: "sha256:e2e-bundle",
+      ack_status: "synced",
+      last_used_at: null,
+      rejection_reason: null,
+    },
+  ],
+};
+
+export const ackFailureCloudExceptionsPayload = {
+  items: [
+    {
+      id: "artifact:codex:e2e-failed",
+      effect: "allow",
+      scope: "artifact",
+      harness: "codex",
+      owner: "owner@example.com",
+      approver: "approver@example.com",
+      expiry: "2099-01-01T00:00:00+00:00",
+      artifact_id: "codex:project:e2e-failed",
+      source_receipt_id: "receipt-e2e-failed",
+      bundle_hash: "sha256:e2e-bundle-failed",
+      ack_status: "failed",
+      last_used_at: null,
+      rejection_reason: "Bundle signature mismatch",
+    },
+  ],
+};
+
+export const pendingCloudExceptionRequestsPayload = {
+  items: [
+    {
+      requestId: "req-e2e-pending",
+      scope: "artifact",
+      status: "pending",
+      reason: "Temporary allow for e2e",
+      owner: "owner@example.com",
+      requestedAt: "2026-06-14T12:00:00+00:00",
+      requestedExpiresAt: "2099-01-01T00:00:00+00:00",
+    },
+  ],
+};
 export const emptyInventoryPayload = { items: [] };
 
 export const defaultSettingsPayload = {

plugin_scanner-2.0.679/dashboard/e2e/policy-cloud-exceptions-states.spec.ts

@@ -0,0 +1,89 @@
+import { test, expect, type Page } from "@playwright/test";
+import {
+  freeStateSnapshot,
+  paidStateSnapshot,
+  connectedCloudExceptionsPayload,
+  ackFailureCloudExceptionsPayload,
+  pendingCloudExceptionRequestsPayload,
+  emptyReceiptsPayload,
+  emptyInventoryPayload,
+  defaultSettingsPayload,
+} from "./fixture-states";
+
+const DAEMON_PARAM = "?guardDaemon=http://127.0.0.1:4175";
+
+async function mountPolicyCloudRoute(
+  page: Page,
+  snapshot: typeof paidStateSnapshot,
+  cloudExceptions: typeof connectedCloudExceptionsPayload,
+) {
+  await page.route("**/v1/**", (route) => {
+    const path = new URL(route.request().url()).pathname;
+    if (path.includes("/initialize")) {
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ auth_token: "e2e-token-policy" }),
+      });
+      return;
+    }
+    if (path.includes("/runtime")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(snapshot) });
+      return;
+    }
+    if (path.includes("/policy/cloud-exception-requests")) {
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(pendingCloudExceptionRequestsPayload),
+      });
+      return;
+    }
+    if (path.includes("/policy/cloud-exceptions") || path.endsWith("/policy")) {
+      route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(cloudExceptions),
+      });
+      return;
+    }
+    if (path.includes("/receipts")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(emptyReceiptsPayload) });
+      return;
+    }
+    if (path.includes("/settings")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(defaultSettingsPayload) });
+      return;
+    }
+    if (path.includes("/inventory")) {
+      route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(emptyInventoryPayload) });
+      return;
+    }
+    route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify({}) });
+  });
+}
+
+test.describe("Policy cloud exceptions states", () => {
+  test("connected cloud shows synced exception groups", async ({ page }) => {
+    await mountPolicyCloudRoute(page, paidStateSnapshot, connectedCloudExceptionsPayload);
+    await page.goto(`/policy${DAEMON_PARAM}`);
+    await page.getByRole("tab", { name: "Cloud exceptions" }).click();
+    await expect(page.getByText("Active on this device")).toBeVisible();
+    await expect(page.getByText("codex:project:e2e-active")).toBeVisible();
+  });
+
+  test("disconnected cloud shows honest offline state", async ({ page }) => {
+    await mountPolicyCloudRoute(page, freeStateSnapshot, { items: [] });
+    await page.goto(`/policy${DAEMON_PARAM}`);
+    await page.getByRole("tab", { name: "Cloud exceptions" }).click();
+    await expect(page.getByText("Guard Cloud is not connected")).toBeVisible();
+  });
+
+  test("ack failure surfaces in exception detail", async ({ page }) => {
+    await mountPolicyCloudRoute(page, paidStateSnapshot, ackFailureCloudExceptionsPayload);
+    await page.goto(`/policy${DAEMON_PARAM}`);
+    await page.getByRole("tab", { name: "Cloud exceptions" }).click();
+    await page.getByText("codex:project:e2e-failed").click();
+    await expect(page.getByText("Ack failed")).toBeVisible();
+  });
+});

{plugin_scanner-2.0.677 → plugin_scanner-2.0.679}/dashboard/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "vite build",
-    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
+    "test": "tsx src/guard-api.test.ts && tsx src/guard-update.test.ts && tsx src/approval-scopes.test.ts && tsx src/approval-center-layout.test.ts && tsx src/runtime-overview.test.ts && tsx src/receipts-workspace.test.ts && tsx src/settings/settings-ia.test.ts && tsx src/settings-workspace.test.ts && tsx src/settings-save-proof-modal.test.ts && tsx src/queue-state.test.ts && tsx src/approval-center-mobile.test.ts && tsx src/home-dashboard.test.ts && tsx src/fleet-workspace.test.ts && tsx src/evidence/evidence-filters.test.ts && tsx src/evidence/evidence-sort.test.ts && tsx src/evidence/evidence-pagination.test.ts && tsx src/evidence/evidence-url-state.test.ts && tsx src/evidence/evidence-metrics.test.ts && tsx src/evidence/evidence-export.test.ts && tsx src/evidence/scoped-evidence-table.test.ts && tsx src/app-routing.test.ts && tsx src/app-activity-evidence.test.ts && tsx src/app-detail-workspace.test.ts && tsx src/clear-policy-payload.test.ts && tsx src/policy-workspace-helpers.test.ts && tsx src/phase09-review.test.ts && tsx src/evidence/evidence-story.test.ts && tsx src/evidence/evidence-detail.test.ts && tsx src/evidence/evidence-copy.test.ts && tsx src/evidence/evidence-perf.test.ts && tsx src/fleet-workspace-phase11.test.ts && tsx src/settings-workspace-phase11.test.ts && tsx src/app-detail-phase11.test.ts && tsx src/security-fixes.test.ts && tsx src/approval-gate.test.ts && tsx src/scrg159-170.test.ts && tsx src/scrg171-172.test.ts && tsx src/scsr-phase09-package-firewall-status.test.ts && tsx src/scsr-phase09-next-action.test.ts && tsx src/scsr-phase10-package-workbench.test.ts && tsx src/supply-chain-ux-consolidation.test.ts && tsx src/supply-chain-audit-connect.test.tsx && tsx src/supply-chain-audit-result.test.ts && tsx src/supply-chain-audit-recovery.test.ts && tsx src/about/about-content.test.ts && tsx src/about/about-external-links.test.ts && tsx src/about/about-design.test.ts && tsx src/about/about-section-shell.test.ts && tsx src/workspace-page-header.test.tsx && tsx src/policy-cloud-exceptions-boundary.test.ts && tsx src/policy-cloud-exceptions-ia.test.tsx && tsx src/policy-cloud-exception-request-ia.test.ts && tsx src/policy-cloud-exceptions-utils.test.ts && tsx src/policy-data-truth.test.ts && tsx src/policy-ui-hardening.test.ts && tsx src/policy-review-scope.test.ts && tsx src/policy-strict-config-utils.test.ts && tsx src/policy-strict-config-ia.test.ts",
     "test:e2e": "playwright test",
     "dev": "vite dev"
   },

plugin_scanner-2.0.679/dashboard/src/policy-review-scope.test.ts

@@ -0,0 +1,18 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+function assert(condition: boolean, message: string): void {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const reviewSource = readFileSync(join(here, "approval-center-layout.tsx"), "utf8");
+
+assert(!reviewSource.includes("PolicyCloudExceptionsTab"), "review layout must not mount cloud exceptions tab");
+assert(!reviewSource.includes("policy-cloud-exception"), "review layout must not import cloud exception modules");
+assert(reviewSource.includes("Review"), "review layout remains the review surface");
+
+console.log("policy-review-scope.test.ts: all assertions passed");

{plugin_scanner-2.0.677 → plugin_scanner-2.0.679}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.677"
+version = "2.0.679"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.677 → plugin_scanner-2.0.679}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.677"
+version = "2.0.679"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.679/scripts/run-cloud-exception-sync-proof.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+python3 -m pytest tests/test_cloud_exception_sync_proof.py -q
+if [ -f "./dashboard/node_modules/.bin/tsx" ]; then
+  ./dashboard/node_modules/.bin/tsx dashboard/src/policy-review-scope.test.ts
+else
+  echo "Warning: tsx not found, skipping policy-review-scope test"
+fi
+
+echo "cloud exception sync proof: ok"

{plugin_scanner-2.0.677 → plugin_scanner-2.0.679}/src/codex_plugin_scanner/integrations/cisco_skill_scanner.py

@@ -2,12 +2,14 @@
 
 from __future__ import annotations
 
+import json
+import os
+import subprocess
+import sys
+import tempfile
 from dataclasses import dataclass
 from enum import Enum
-from multiprocessing import get_context
-from multiprocessing.process import BaseProcess
 from pathlib import Path
-from queue import Empty
 
 from ..models import Finding, Severity, severity_from_value
 
@@ -83,20 +85,15 @@ def _scan_directory_payload(skills_dir: Path, policy_name: str) -> dict[str, obj
     return payload if isinstance(payload, dict) else {}
 
 
-def _scan_directory_worker(skills_dir: str, policy_name: str, result_queue: object) -> None:
-    try:
-        payload = _scan_directory_payload(Path(skills_dir), policy_name)
-        result_queue.put(("ok", payload))
-    except BaseException as exc:
-        result_queue.put(("error", type(exc).__name__, str(exc)))
-
+_SUBPROCESS_SCAN_SNIPPET = """
+from pathlib import Path
+import json
+import sys
+from codex_plugin_scanner.integrations.cisco_skill_scanner import _scan_directory_payload
 
-def _terminate_scan_process(process: BaseProcess) -> None:
-    process.terminate()
-    process.join(1)
-    if process.is_alive():
-        process.kill()
-        process.join()
+payload = _scan_directory_payload(Path(sys.argv[1]), sys.argv[2])
+Path(sys.argv[3]).write_text(json.dumps(payload), encoding='utf-8')
+""".strip()
 
 
 def _scan_directory_with_timeout(
@@ -105,35 +102,50 @@ def _scan_directory_with_timeout(
     if timeout_seconds is None:
         return _scan_directory_payload(skills_dir, policy_name)
 
-    context = get_context("spawn")
-    result_queue = context.Queue(maxsize=1)
-    process = context.Process(
-        target=_scan_directory_worker,
-        args=(str(skills_dir), policy_name, result_queue),
-    )
-    process.start()
+    file_descriptor, output_name = tempfile.mkstemp(prefix="cisco-skill-scan-", suffix=".json")
+    output_path = Path(output_name)
+    # Explicit close avoids leaking the temp file descriptor into the child.
+    os.close(file_descriptor)
 
+    env = os.environ.copy()
+    env["PYTHONPATH"] = os.pathsep.join(sys.path)
     try:
-        status, payload, *details = result_queue.get(timeout=timeout_seconds)
-    except Empty as exc:
-        process.join(0)
-        if process.is_alive():
-            _terminate_scan_process(process)
+        try:
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    "-c",
+                    _SUBPROCESS_SCAN_SNIPPET,
+                    str(skills_dir),
+                    policy_name,
+                    str(output_path),
+                ],
+                capture_output=True,
+                check=False,
+                text=True,
+                timeout=timeout_seconds,
+                env=env,
+            )
+        except subprocess.TimeoutExpired as exc:
             raise TimeoutError("Cisco skill scanner timed out") from exc
+
+        if result.returncode != 0:
+            error_output = result.stderr.strip() or result.stdout.strip()
+            if not error_output:
+                error_output = f"Cisco skill scanner exited with code {result.returncode}"
+            raise RuntimeError(error_output)
+
+        if not output_path.is_file():
+            raise RuntimeError("Cisco skill scanner did not produce a result payload")
+
         try:
-            status, payload, *details = result_queue.get(timeout=1)
-        except Empty as empty_exc:
-            raise RuntimeError(f"Cisco skill scanner exited with code {process.exitcode}") from empty_exc
-    else:
-        process.join(1)
-        if process.is_alive():
-            _terminate_scan_process(process)
-
-    if status == "error":
-        error_type = str(payload)
-        error_message = str(details[0]) if details else "unknown error"
-        raise RuntimeError(f"{error_type}: {error_message}")
-    return payload if isinstance(payload, dict) else {}
+            payload = json.loads(output_path.read_text(encoding="utf-8"))
+        except json.JSONDecodeError as exc:
+            raise RuntimeError("Cisco skill scanner produced invalid JSON output") from exc
+
+        return payload if isinstance(payload, dict) else {}
+    finally:
+        output_path.unlink(missing_ok=True)
 
 
 def _to_local_finding(plugin_dir: Path, skill_result: dict[str, object], finding: dict[str, object]) -> Finding:
@@ -241,6 +253,8 @@ def run_cisco_skill_scan(
 
     findings: list[Finding] = []
     results = payload.get("results", [])
+    if not isinstance(results, list):
+        results = []
     for result in results:
         if not isinstance(result, dict):
             continue
@@ -252,6 +266,8 @@ def run_cisco_skill_scan(
                 findings.append(_to_local_finding(skills_dir.parent, result, finding))
 
     summary = payload.get("summary", {})
+    if not isinstance(summary, dict):
+        summary = {}
     counts = _empty_counts()
     findings_by_severity = summary.get("findings_by_severity", {})
     if isinstance(findings_by_severity, dict):

{plugin_scanner-2.0.677 → plugin_scanner-2.0.679}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.677"
+__version__ = "2.0.679"

plugin_scanner-2.0.679/tests/cloud_exception_bundle_fixtures.py

@@ -0,0 +1,98 @@
+"""Code-generated Cloud exception bundle fixtures for sync proof tests."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from codex_plugin_scanner.guard.policy_bundle_parser import computed_policy_bundle_hash
+
+
+def _sample_policy_bundle(*, bundle_hash: str | None = None) -> dict[str, object]:
+    bundle: dict[str, object] = {
+        "contractVersion": "guard-policy-bundle.v1",
+        "bundleVersion": "policy-2026-04-19.1",
+        "bundleHash": bundle_hash or "",
+        "issuedAt": "2026-04-19T00:00:10+00:00",
+        "expiresAt": None,
+        "verifier": {
+            "algorithm": "sha256",
+            "keyId": "guard-policy-bundle-v1",
+            "signature": None,
+        },
+        "rolloutState": "enforcing",
+        "policyDefaults": {
+            "mode": "enforce",
+            "defaultAction": "warn",
+            "unknownPublisherAction": "review",
+            "changedHashAction": "require-reapproval",
+            "newNetworkDomainAction": "warn",
+            "subprocessAction": "block",
+            "telemetryEnabled": False,
+            "syncEnabled": True,
+        },
+        "rules": [
+            {
+                "ruleId": "pkg-block",
+                "action": "block",
+                "reason": "Block risky package installs before execution.",
+                "matcherFamilies": ["package-request"],
+                "scope": {
+                    "agents": [],
+                    "devices": [],
+                    "ecosystems": ["npm"],
+                    "environments": ["development"],
+                    "harnesses": ["codex"],
+                    "locations": [],
+                },
+            }
+        ],
+        "acknowledgements": [],
+    }
+    if bundle_hash is None:
+        bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+    return bundle
+
+
+def build_cloud_exception_bundle_entry(
+    *,
+    exception_id: str = "artifact:codex:sync-proof",
+    expires_at: str = "2099-01-01T00:00:00+00:00",
+    workspace_id: str | None = None,
+) -> dict[str, object]:
+    entry: dict[str, object] = {
+        "exceptionId": exception_id,
+        "effect": "allow",
+        "scope": "artifact",
+        "harness": "codex",
+        "artifactId": "codex:project:sync-proof",
+        "owner": "owner@example.com",
+        "approver": "approver@example.com",
+        "expiresAt": expires_at,
+        "sourceReceiptId": "receipt-sync-proof",
+    }
+    if workspace_id is not None:
+        entry["workspaceId"] = workspace_id
+    return entry
+
+
+def build_cloud_exception_policy_bundle(
+    *,
+    bundle_hash: str | None = None,
+    cloud_exceptions: list[dict[str, object]] | None = None,
+    workspace_id: str = "workspace-sync-proof",
+    device_id: str = "device-sync-proof",
+) -> dict[str, object]:
+    bundle = _sample_policy_bundle(bundle_hash=bundle_hash)
+    bundle["workspaceId"] = workspace_id
+    bundle["cloudExceptions"] = cloud_exceptions or [build_cloud_exception_bundle_entry()]
+    bundle["acknowledgements"] = [
+        {
+            "deviceId": device_id,
+            "deviceName": "Sync proof device",
+            "acknowledgedAt": datetime.now(timezone.utc).isoformat(),
+            "status": "synced",
+        }
+    ]
+    if bundle_hash is None:
+        bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+    return bundle

plugin_scanner-2.0.679/tests/test_cloud_exception_sync_proof.py

@@ -0,0 +1,146 @@
+"""Cross-repo Cloud exception sync proof (HGLP136-HGLP141)."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import pytest
+
+from codex_plugin_scanner.guard.cloud_exceptions import (
+    build_cloud_exceptions_from_policy_bundle,
+    list_active_cloud_exceptions,
+)
+from codex_plugin_scanner.guard.policy_bundle_parser import validated_policy_bundle_payload
+from codex_plugin_scanner.guard.runtime.runner import _persist_cloud_exceptions
+from codex_plugin_scanner.guard.store import GuardStore
+from tests.cloud_exception_bundle_fixtures import (
+    build_cloud_exception_bundle_entry,
+    build_cloud_exception_policy_bundle,
+)
+from tests.test_policy_bundle_parser import computed_policy_bundle_hash
+
+
+class _JsonResponse:
+    def __init__(self, payload: dict[str, object]) -> None:
+        self._payload = payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, tb):
+        return False
+
+    def read(self) -> bytes:
+        return json.dumps(self._payload).encode("utf-8")
+
+
+def test_hglp136_fixture_is_code_generated_not_static_ui_copy() -> None:
+    bundle = build_cloud_exception_policy_bundle()
+    assert isinstance(bundle.get("cloudExceptions"), list)
+    assert bundle["cloudExceptions"][0]["exceptionId"] == "artifact:codex:sync-proof"
+
+
+def test_hglp137_local_daemon_accepts_valid_exception_bundle(tmp_path: Path) -> None:
+    store = GuardStore(tmp_path / "home")
+    bundle = build_cloud_exception_policy_bundle()
+    validated, reason = validated_policy_bundle_payload(bundle)
+    assert reason is None
+    assert validated is not None
+    _persist_cloud_exceptions(store, policy_bundle=validated, now="2026-06-14T12:00:00+00:00")
+    listed = store.list_cloud_exceptions()
+    assert len(listed) == 1
+    assert listed[0]["id"] == "artifact:codex:sync-proof"
+
+
+def test_hglp138_local_daemon_rejects_tampered_exception_bundle(tmp_path: Path) -> None:
+    bundle = build_cloud_exception_policy_bundle()
+    bundle["bundleHash"] = "sha256:tampered"
+    validated, reason = validated_policy_bundle_payload(bundle)
+    assert validated is None
+    assert reason == "bundle_hash_mismatch"
+
+
+def test_hglp139_expired_cloud_exception_is_not_active_after_bundle_load() -> None:
+    bundle = build_cloud_exception_policy_bundle(
+        cloud_exceptions=[
+            build_cloud_exception_bundle_entry(
+                exception_id="artifact:codex:expired",
+                expires_at="2020-01-01T00:00:00+00:00",
+            )
+        ]
+    )
+    items = build_cloud_exceptions_from_policy_bundle(bundle, device_id="device-sync-proof")
+    active = list_active_cloud_exceptions(items, now="2026-06-14T12:00:00+00:00")
+    assert active == []
+
+
+def test_hglp140_wrong_workspace_bundle_is_rejected(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    from codex_plugin_scanner.guard.runtime import runner as guard_runner_module
+
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "guard-live-token",
+        "2026-06-14T12:00:00+00:00",
+        workspace_id="workspace-a",
+    )
+    bundle = build_cloud_exception_policy_bundle(workspace_id="workspace-b")
+    bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+
+    def _fake_urlopen(request, timeout):
+        if request.full_url.endswith("/api/v1/guard/events"):
+            return _JsonResponse({"accepted": 0, "rejected": 0, "statuses": []})
+        return _JsonResponse(
+            {
+                "syncedAt": "2026-06-14T12:00:01+00:00",
+                "receiptsStored": 0,
+                "policyBundle": bundle,
+            }
+        )
+
+    monkeypatch.setattr(guard_runner_module.urllib.request, "urlopen", _fake_urlopen)
+    monkeypatch.setattr(guard_runner_module, "sync_pain_signals", lambda _store, auth_context=None: 0)
+
+    guard_runner_module.sync_receipts(store)
+
+    assert store.get_sync_payload("policy_bundle") is None
+    assert store.get_sync_payload("policy_bundle_last_error") == {"reason": "wrong_workspace"}
+
+
+def test_hglp141_bundle_ack_metadata_is_available_for_sync_upload(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from codex_plugin_scanner.guard.runtime import runner as guard_runner_module
+
+    store = GuardStore(tmp_path / "guard-home")
+    store.set_sync_credentials(
+        "https://hol.org/api/guard/receipts/sync",
+        "guard-live-token",
+        "2026-06-14T12:00:00+00:00",
+    )
+    bundle = build_cloud_exception_policy_bundle()
+    bundle["bundleHash"] = computed_policy_bundle_hash(bundle)
+    requests: list[dict[str, object]] = []
+
+    def _fake_urlopen(request, timeout):
+        if request.full_url.endswith("/api/v1/guard/events"):
+            return _JsonResponse({"accepted": 0, "rejected": 0, "statuses": []})
+        body = json.loads(request.data.decode("utf-8"))
+        requests.append(body)
+        return _JsonResponse(
+            {
+                "syncedAt": f"2026-06-14T12:00:0{len(requests)}+00:00",
+                "receiptsStored": 0,
+                "policyBundle": bundle,
+            }
+        )
+
+    monkeypatch.setattr(guard_runner_module.urllib.request, "urlopen", _fake_urlopen)
+    monkeypatch.setattr(guard_runner_module, "sync_pain_signals", lambda _store, auth_context=None: 0)
+
+    guard_runner_module.sync_receipts(store)
+    guard_runner_module.sync_receipts(store)
+
+    assert store.get_sync_payload("policy_bundle") is not None
+    assert "policyBundleAcknowledgement" in requests[1]["syncContext"]