plugin-scanner 2.0.791__tar.gz → 2.0.793__tar.gz

{plugin_scanner-2.0.791 → plugin_scanner-2.0.793}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.791
+Version: 2.0.793
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.791 → plugin_scanner-2.0.793}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.791"
+version = "2.0.793"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.791 → plugin_scanner-2.0.793}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.791"
+version = "2.0.793"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.793/src/codex_plugin_scanner/guard/local_trust_contract.py

@@ -0,0 +1,134 @@
+"""Stable local trust vocabulary shared by Guard runtime and UI APIs."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Literal
+
+LocalTrustMode = Literal[
+    "protected",
+    "cloud_authoritative",
+    "degraded_safe",
+    "setup_required",
+    "unsupported",
+]
+RuntimeProtectionStatus = Literal["protected", "degraded", "unknown"]
+RememberedRulesStatus = Literal["enforced", "disabled_degraded", "unknown"]
+CloudPoliciesStatus = Literal["available", "setup_unavailable", "unknown"]
+
+PolicyIntegrityMode = Literal["protected", "degraded"]
+PolicyIntegrityEnforcement = Literal["enforce", "warn"]
+
+POLICY_INTEGRITY_MODE_PROTECTED: PolicyIntegrityMode = "protected"
+POLICY_INTEGRITY_MODE_DEGRADED: PolicyIntegrityMode = "degraded"
+POLICY_INTEGRITY_ENFORCEMENT_ENFORCE: PolicyIntegrityEnforcement = "enforce"
+POLICY_INTEGRITY_ENFORCEMENT_WARN: PolicyIntegrityEnforcement = "warn"
+
+LOCAL_TRUST_MODES: tuple[LocalTrustMode, ...] = (
+    "protected",
+    "cloud_authoritative",
+    "degraded_safe",
+    "setup_required",
+    "unsupported",
+)
+
+POLICY_INTEGRITY_DEGRADED_REASONS: tuple[str, ...] = (
+    "system_keyring_unavailable",
+    "policy_integrity_key_unavailable",
+    "policy_integrity_control_unavailable",
+    "guard_home_symlink",
+    "guard_db_symlink",
+    "guard_home_permissions",
+    "guard_db_permissions",
+    "guard_home_inaccessible",
+    "guard_db_inaccessible",
+)
+
+POLICY_INTEGRITY_REASON_SYSTEM_KEYRING_UNAVAILABLE = "system_keyring_unavailable"
+POLICY_INTEGRITY_REASON_KEY_UNAVAILABLE = "policy_integrity_key_unavailable"
+POLICY_INTEGRITY_REASON_CONTROL_UNAVAILABLE = "policy_integrity_control_unavailable"
+POLICY_INTEGRITY_REASON_GUARD_HOME_SYMLINK = "guard_home_symlink"
+POLICY_INTEGRITY_REASON_GUARD_DB_SYMLINK = "guard_db_symlink"
+POLICY_INTEGRITY_REASON_GUARD_HOME_PERMISSIONS = "guard_home_permissions"
+POLICY_INTEGRITY_REASON_GUARD_DB_PERMISSIONS = "guard_db_permissions"
+POLICY_INTEGRITY_REASON_GUARD_HOME_INACCESSIBLE = "guard_home_inaccessible"
+POLICY_INTEGRITY_REASON_GUARD_DB_INACCESSIBLE = "guard_db_inaccessible"
+
+LOCAL_TRUST_DEGRADED_REASON_LABELS: dict[str, str] = {
+    POLICY_INTEGRITY_REASON_SYSTEM_KEYRING_UNAVAILABLE: "System credential store unavailable",
+    POLICY_INTEGRITY_REASON_KEY_UNAVAILABLE: "Local rule signing key unavailable",
+    POLICY_INTEGRITY_REASON_CONTROL_UNAVAILABLE: "Local rollback control unavailable",
+    POLICY_INTEGRITY_REASON_GUARD_HOME_SYMLINK: "Guard home path is not trusted",
+    POLICY_INTEGRITY_REASON_GUARD_DB_SYMLINK: "Guard database path is not trusted",
+    POLICY_INTEGRITY_REASON_GUARD_HOME_PERMISSIONS: "Guard home permissions are too broad",
+    POLICY_INTEGRITY_REASON_GUARD_DB_PERMISSIONS: "Guard database permissions are too broad",
+    POLICY_INTEGRITY_REASON_GUARD_HOME_INACCESSIBLE: "Guard home could not be inspected",
+    POLICY_INTEGRITY_REASON_GUARD_DB_INACCESSIBLE: "Guard database could not be inspected",
+}
+
+
+@dataclass(frozen=True)
+class TrustStatus:
+    """User-safe trust summary for runtime, local rules, and Cloud policy authority."""
+
+    runtime_protection: RuntimeProtectionStatus
+    remembered_rules: RememberedRulesStatus
+    cloud_policies: CloudPoliciesStatus
+    backend: str
+    degraded_reasons: tuple[str, ...] = field(default_factory=tuple)
+    setup_available: bool = False
+    last_proof: str | None = None
+
+    @classmethod
+    def from_policy_integrity_state(cls, state: dict[str, object]) -> TrustStatus:
+        mode = state.get("mode")
+        reasons = state.get("degraded_reasons")
+        clean_reasons = (
+            tuple(reason for reason in reasons if isinstance(reason, str)) if isinstance(reasons, list) else ()
+        )
+        if mode == POLICY_INTEGRITY_MODE_PROTECTED:
+            runtime_protection: RuntimeProtectionStatus = "protected"
+            remembered_rules: RememberedRulesStatus = "enforced"
+        elif mode == POLICY_INTEGRITY_MODE_DEGRADED:
+            runtime_protection = "degraded"
+            remembered_rules = "disabled_degraded"
+        else:
+            runtime_protection = "unknown"
+            remembered_rules = "unknown"
+        setup_available = bool(state.get("setup_available"))
+        if not setup_available:
+            setup_available = any(reason in LOCAL_TRUST_DEGRADED_REASON_LABELS for reason in clean_reasons)
+        runtime_override = state.get("runtime_protection")
+        if runtime_override in ("protected", "degraded", "unknown"):
+            runtime_protection = runtime_override
+        cloud_override = state.get("cloud_policies")
+        if cloud_override in ("available", "setup_unavailable", "unknown"):
+            cloud_policies: CloudPoliciesStatus = cloud_override
+        elif setup_available:
+            cloud_policies = "setup_unavailable"
+        else:
+            cloud_policies = "available"
+        return cls(
+            runtime_protection=runtime_protection,
+            remembered_rules=remembered_rules,
+            cloud_policies=cloud_policies,
+            backend=str(state.get("backend") or "unknown"),
+            degraded_reasons=clean_reasons,
+            setup_available=setup_available,
+            last_proof=None,
+        )
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "runtime_protection": self.runtime_protection,
+            "remembered_rules": self.remembered_rules,
+            "cloud_policies": self.cloud_policies,
+            "backend": self.backend,
+            "degraded_reasons": list(self.degraded_reasons),
+            "degraded_reason_labels": {
+                reason: LOCAL_TRUST_DEGRADED_REASON_LABELS.get(reason, "Guard trust check degraded")
+                for reason in self.degraded_reasons
+            },
+            "setup_available": self.setup_available,
+            "last_proof": self.last_proof,
+        }

{plugin_scanner-2.0.791 → plugin_scanner-2.0.793}/src/codex_plugin_scanner/guard/store.py

@@ -39,6 +39,7 @@ from .local_trust_contract import (
     POLICY_INTEGRITY_REASON_GUARD_HOME_SYMLINK,
     POLICY_INTEGRITY_REASON_KEY_UNAVAILABLE,
     POLICY_INTEGRITY_REASON_SYSTEM_KEYRING_UNAVAILABLE,
+    TrustStatus,
 )
 from .models import GuardApprovalRequest, GuardArtifact, GuardReceipt, GuardRuntimeState, PolicyDecision
 from .policy_integrity import (
@@ -844,6 +845,31 @@ class EncryptedFileSecretStore:
             return None
 
 
+class UnavailableSecretStore:
+    """Secret store placeholder for platforms without safe credential storage."""
+
+    def __init__(self, guard_home: Path | None = None) -> None:
+        self._legacy_fallback = EncryptedFileSecretStore(guard_home) if guard_home is not None else None
+
+    def set_secret(self, secret_id: str, value: str) -> None:
+        _ = (secret_id, value)
+        raise RuntimeError(
+            "Guard local credentials require an available OS credential store. "
+            "Fix the system credential store, then sign in again."
+        )
+
+    def get_secret(self, secret_id: str) -> str | None:
+        _ = secret_id
+        return None
+
+    def delete_secret(self, secret_id: str) -> None:
+        if self._legacy_fallback is None:
+            return
+        legacy_path = self._legacy_fallback._path_for(secret_id)
+        with suppress(OSError):
+            legacy_path.unlink()
+
+
 class FallbackSecretStore:
     """Fallback-capable secret store that tolerates primary backend failures."""
 
@@ -965,16 +991,22 @@ def _write_system_keyring_availability_cache(guard_home: Path, *, available: boo
             tmp_path.unlink()
 
 
-def _system_keyring_is_available(guard_home: Path) -> bool:
-    cached = _read_system_keyring_availability_cache(guard_home)
+def _system_keyring_is_available(guard_home: Path, *, use_cache: bool = True) -> bool:
+    cached = _read_system_keyring_availability_cache(guard_home) if use_cache else None
     if cached is not None:
         return cached
+    if not use_cache and sys.platform == "darwin":
+        SystemKeyringSecretStore._clear_macos_keychain_health_cache()
     available = SystemKeyringSecretStore._is_available()
     _write_system_keyring_availability_cache(guard_home, available=available)
     return available
 
 
 def _build_oauth_secret_store(guard_home: Path) -> SecretStore:
+    if sys.platform == "darwin":
+        if _system_keyring_is_available(guard_home, use_cache=False):
+            return SystemKeyringSecretStore(service_name="hol-guard.oauth")
+        return UnavailableSecretStore(guard_home)
     fallback_store = EncryptedFileSecretStore(guard_home)
     if _system_keyring_is_available(guard_home):
         return FallbackSecretStore(
@@ -998,6 +1030,8 @@ def _secret_store_backend_name(secret_store: SecretStore) -> str:
         return "system-keyring"
     if isinstance(secret_store, EncryptedFileSecretStore):
         return "encrypted-file"
+    if isinstance(secret_store, UnavailableSecretStore):
+        return "unavailable"
     if isinstance(secret_store, FallbackSecretStore):
         return _secret_store_backend_name(secret_store.primary)
     return "unknown"
@@ -1087,6 +1121,16 @@ class GuardStore:
 
     def _assert_oauth_secret_persisted(self, secret_id: str, value: str) -> None:
         secret_store = self._oauth_secret_store
+        if sys.platform == "darwin" and isinstance(secret_store, SystemKeyringSecretStore):
+            persisted_value = self._get_secret_from_primary_store(secret_store, secret_id)
+            if persisted_value == value:
+                return
+            raise RuntimeError("Guard could not persist local Guard Cloud authorization securely.")
+        if isinstance(secret_store, UnavailableSecretStore):
+            raise RuntimeError(
+                "Guard local credentials require an available OS credential store. "
+                "Fix the system credential store, then sign in again."
+            )
         if isinstance(secret_store, FallbackSecretStore) and isinstance(
             secret_store.fallback,
             EncryptedFileSecretStore,
@@ -1139,6 +1183,9 @@ class GuardStore:
         self._cached_policy_integrity_secret_material = None
         self._cached_policy_integrity_control_state = None
 
+    def _oauth_primary_reads_are_no_ui_safe(self) -> bool:
+        return sys.platform == "darwin" and isinstance(self._oauth_secret_store, SystemKeyringSecretStore)
+
     def _get_secret_candidates(
         self,
         secret_store: SecretStore,
@@ -1164,11 +1211,7 @@ class GuardStore:
                     return [primary_token]
                 if fallback_token is not None and expected_hash_value is not None:
                     return []
-            primary_token = (
-                self._get_secret_from_primary_store(secret_store.primary, secret_id)
-                if prefer_fallback_first
-                else self._get_secret_from_store(secret_store.primary, secret_id)
-            )
+            primary_token = self._get_secret_from_primary_store(secret_store.primary, secret_id)
             if primary_token is not None:
                 if expected_hash_value is None or _secret_matches_hash(primary_token, expected_hash_value):
                     return [primary_token]
@@ -1180,7 +1223,7 @@ class GuardStore:
             if fallback_token is None:
                 return []
             return [fallback_token]
-        token = secret_store.get_secret(secret_id)
+        token = self._get_secret_from_primary_store(secret_store, secret_id)
         if token is None:
             return []
         return [token]
@@ -4076,6 +4119,7 @@ class GuardStore:
             "generation": state.get("generation"),
             "key_id": state.get("key_id"),
             "degraded_reasons": state.get("degraded_reasons", []),
+            "trust_status": TrustStatus.from_policy_integrity_state(state).to_dict(),
             "counts": counts,
             "local_rows_scanned": sum(counts.values()),
         }
@@ -4101,6 +4145,7 @@ class GuardStore:
             "generation": state.get("generation"),
             "key_id": state.get("key_id"),
             "degraded_reasons": state.get("degraded_reasons", []),
+            "trust_status": TrustStatus.from_policy_integrity_state(state).to_dict(),
             "counts": counts,
             "local_rows_scanned": sum(counts.values()),
             "items": invalid_items,
@@ -4172,6 +4217,7 @@ class GuardStore:
             "generation": state.get("generation"),
             "key_id": state.get("key_id"),
             "degraded_reasons": state.get("degraded_reasons", []),
+            "trust_status": TrustStatus.from_policy_integrity_state(state).to_dict(),
             "counts": counts,
             "local_rows_scanned": sum(counts.values()),
             "cleared": cleared,
@@ -4277,6 +4323,7 @@ class GuardStore:
             "generation": final_state.get("generation"),
             "key_id": final_state.get("key_id"),
             "degraded_reasons": final_state.get("degraded_reasons", []),
+            "trust_status": TrustStatus.from_policy_integrity_state(final_state).to_dict(),
             "legacy_row_ids": legacy_ids,
             "rollback_row_ids": rollback_row_ids,
             "unknown_key_row_ids": unknown_key_ids,
@@ -4963,6 +5010,7 @@ class GuardStore:
             self._oauth_secret_store.set_secret(self._oauth_local_credentials_ref, secret_json)
         self._mirror_oauth_secret_to_fallback(self._oauth_local_credentials_ref, secret_json)
         self._assert_oauth_secret_persisted(self._oauth_local_credentials_ref, secret_json)
+        self._remember_oauth_secret_payload(self._oauth_local_credentials_ref, secret_hash, secret_json)
         self.set_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY, payload, now)
 
     def get_oauth_local_credentials(self, *, allow_primary: bool = False) -> dict[str, object] | None:
@@ -4972,7 +5020,10 @@ class GuardStore:
         metadata = self._oauth_local_credentials_metadata(payload)
         if metadata is None:
             return None
-        secret_payload = self._load_oauth_secret_payload(payload, allow_primary=allow_primary)
+        secret_payload = self._load_oauth_secret_payload(
+            payload,
+            allow_primary=allow_primary or self._oauth_primary_reads_are_no_ui_safe(),
+        )
         if secret_payload is None:
             return None
         return self._build_oauth_local_credentials_result(metadata=metadata, secret_payload=secret_payload)
@@ -4996,6 +5047,11 @@ class GuardStore:
             secret_ref = payload.get(_OAUTH_LOCAL_CREDENTIALS_REF_KEY)
             if isinstance(secret_ref, str) and secret_ref:
                 self._oauth_secret_store.delete_secret(secret_ref)
+                if sys.platform == "darwin":
+                    legacy_fallback = EncryptedFileSecretStore(self.guard_home)
+                    legacy_path = legacy_fallback._path_for(secret_ref)
+                    with suppress(OSError):
+                        legacy_path.unlink()
         self.delete_sync_payload(_OAUTH_LOCAL_CREDENTIALS_STATE_KEY)
 
     def get_oauth_local_credential_health(self) -> dict[str, object]:
@@ -5017,9 +5073,17 @@ class GuardStore:
         if cached_health is not None:
             health.update(cached_health)
             return health
-        secret_payload = self._load_oauth_secret_payload(payload, promote=False, allow_primary=False)
+        secret_payload = self._load_oauth_secret_payload(
+            payload,
+            promote=False,
+            allow_primary=self._oauth_primary_reads_are_no_ui_safe(),
+        )
         if secret_payload is None and self.repair_oauth_local_credential_storage_from_primary():
-            secret_payload = self._load_oauth_secret_payload(payload, promote=False, allow_primary=False)
+            secret_payload = self._load_oauth_secret_payload(
+                payload,
+                promote=False,
+                allow_primary=self._oauth_primary_reads_are_no_ui_safe(),
+            )
         if secret_payload is None:
             health["state"] = "degraded"
             self._remember_oauth_health_result(secret_hash, health)

{plugin_scanner-2.0.791 → plugin_scanner-2.0.793}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.791"
+__version__ = "2.0.793"

{plugin_scanner-2.0.791 → plugin_scanner-2.0.793}/tests/test_guard_oauth_device_connect.py

@@ -11,6 +11,7 @@ from pathlib import Path
 import pytest
 
 from codex_plugin_scanner.cli import _build_parser
+from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.cli import commands as guard_commands
 from codex_plugin_scanner.guard.cli import connect_flow
 from codex_plugin_scanner.guard.cli.commands import run_guard_command
@@ -787,12 +788,15 @@ def test_headless_connect_slows_down_polling_when_server_requests_it(tmp_path: P
     assert sleeps == [7]
 
 
-def test_headless_connect_avoids_keychain_password_prompts_when_system_keyring_is_available(
+def test_headless_connect_rejects_unreadable_macos_keychain_credentials_without_prompt(
     tmp_path: Path,
     monkeypatch,
 ) -> None:
     guard_home = tmp_path / "guard-home"
     _install_fake_system_keyring(monkeypatch)
+    monkeypatch.setattr(guard_store_module.sys, "platform", "darwin", raising=False)
+    monkeypatch.setattr(SystemKeyringSecretStore, "_macos_default_keychain_is_usable", classmethod(lambda cls: True))
+    monkeypatch.setattr(SystemKeyringSecretStore, "get_secret_with_timeout", lambda *args, **kwargs: None)
 
     def fail_on_keychain(*args: object, **kwargs: object) -> subprocess.CompletedProcess[str]:
         raise AssertionError("device connect should not shell out to macOS keychain prompts")
@@ -823,31 +827,28 @@ def test_headless_connect_avoids_keychain_password_prompts_when_system_keyring_i
         def read(self) -> bytes:
             return json.dumps(self._payload).encode("utf-8")
 
-    payload = connect_flow.run_guard_device_connect_command(
-        store=store,
-        connect_url="https://hol.org/guard/connect",
-        request_device_authorization=fake_request,
-        token_urlopen=lambda request, timeout: _Response(
-            {
-                "access_token": _fake_access_token(
-                    grant_id="grant-123",
-                    machine_id="machine-123",
-                    workspace_id="workspace-123",
-                ),
-                "refresh_token": "refresh-123",
-                "expires_in": 3600,
-                "scope": "guard:runtime.sync guard:offline_access",
-                "token_type": "Bearer",
-            }
-        ),
-        now="2026-06-01T12:00:00+00:00",
-    )
+    with pytest.raises(RuntimeError, match="persist local Guard Cloud authorization"):
+        connect_flow.run_guard_device_connect_command(
+            store=store,
+            connect_url="https://hol.org/guard/connect",
+            request_device_authorization=fake_request,
+            token_urlopen=lambda request, timeout: _Response(
+                {
+                    "access_token": _fake_access_token(
+                        grant_id="grant-123",
+                        machine_id="machine-123",
+                        workspace_id="workspace-123",
+                    ),
+                    "refresh_token": "refresh-123",
+                    "expires_in": 3600,
+                    "scope": "guard:runtime.sync guard:offline_access",
+                    "token_type": "Bearer",
+                }
+            ),
+            now="2026-06-01T12:00:00+00:00",
+        )
 
-    assert payload["status"] == "connected"
-    credentials = store.get_oauth_local_credentials()
-    assert credentials is not None
-    assert credentials["refresh_token"] == "refresh-123"
-    assert credentials["grant_id"] == "grant-123"
+    assert store.get_oauth_local_credentials() is None
 
 
 def test_headless_connect_expired_code_surfaces_retry_command(tmp_path: Path) -> None:

{plugin_scanner-2.0.791 → plugin_scanner-2.0.793}/tests/test_guard_policy_integrity.py

@@ -14,12 +14,14 @@ import pytest
 from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.local_trust_contract import (
+    LOCAL_TRUST_DEGRADED_REASON_LABELS,
     LOCAL_TRUST_MODES,
     POLICY_INTEGRITY_DEGRADED_REASONS,
     POLICY_INTEGRITY_ENFORCEMENT_ENFORCE,
     POLICY_INTEGRITY_ENFORCEMENT_WARN,
     POLICY_INTEGRITY_MODE_DEGRADED,
     POLICY_INTEGRITY_MODE_PROTECTED,
+    TrustStatus,
 )
 from codex_plugin_scanner.guard.models import PolicyDecision
 from codex_plugin_scanner.guard.store import GuardStore, SystemKeyringSecretStore
@@ -58,6 +60,70 @@ def test_local_trust_contract_exports_stable_status_vocabulary() -> None:
     assert "guard_db_symlink" in POLICY_INTEGRITY_DEGRADED_REASONS
     assert "guard_home_permissions" in POLICY_INTEGRITY_DEGRADED_REASONS
     assert "guard_db_permissions" in POLICY_INTEGRITY_DEGRADED_REASONS
+    assert set(LOCAL_TRUST_DEGRADED_REASON_LABELS) == set(POLICY_INTEGRITY_DEGRADED_REASONS)
+
+
+def test_trust_status_serializes_policy_integrity_authority_without_paths() -> None:
+    status = TrustStatus.from_policy_integrity_state(
+        {
+            "backend": "unavailable",
+            "mode": POLICY_INTEGRITY_MODE_DEGRADED,
+            "degraded_reasons": ["system_keyring_unavailable", "guard_home_symlink"],
+            "key_id": "/Users/example/.hol-guard/key",
+        }
+    ).to_dict()
+
+    assert status["runtime_protection"] == "degraded"
+    assert status["remembered_rules"] == "disabled_degraded"
+    assert status["cloud_policies"] == "setup_unavailable"
+    assert status["backend"] == "unavailable"
+    assert status["degraded_reasons"] == ["system_keyring_unavailable", "guard_home_symlink"]
+    assert status["setup_available"] is True
+    assert status["last_proof"] is None
+
+
+def test_trust_status_hides_policy_integrity_proof_ids_and_handles_unknown_mode() -> None:
+    status = TrustStatus.from_policy_integrity_state(
+        {
+            "backend": "system-keyring",
+            "mode": "future-mode",
+            "degraded_reasons": [],
+            "key_id": "abc/def==",
+        }
+    ).to_dict()
+
+    assert status["runtime_protection"] == "unknown"
+    assert status["remembered_rules"] == "unknown"
+    assert status["cloud_policies"] == "available"
+    assert status["setup_available"] is False
+    assert status["last_proof"] is None
+
+    windows_status = TrustStatus.from_policy_integrity_state(
+        {
+            "backend": "system-keyring",
+            "mode": POLICY_INTEGRITY_MODE_PROTECTED,
+            "degraded_reasons": [],
+            "key_id": "\\Users\\alice\\.hol-guard\\key",
+        }
+    ).to_dict()
+    assert windows_status["runtime_protection"] == "protected"
+    assert windows_status["last_proof"] is None
+
+
+def test_policy_integrity_status_includes_trust_status(tmp_path: Path) -> None:
+    store = _store(tmp_path)
+
+    status = store.get_policy_integrity_status()
+    trust_status = status["trust_status"]
+
+    assert isinstance(trust_status, dict)
+    assert trust_status["runtime_protection"] == "degraded"
+    assert trust_status["remembered_rules"] == "disabled_degraded"
+    assert trust_status["cloud_policies"] == "setup_unavailable"
+    assert trust_status["degraded_reasons"] == status["degraded_reasons"]
+
+    verify = store.verify_policy_integrity()
+    assert verify["trust_status"] == trust_status
 
 
 def test_guard_store_init_does_not_create_policy_integrity_keyring_material(tmp_path: Path) -> None: