plugin-scanner 2.0.793__tar.gz → 2.0.794__tar.gz

{plugin_scanner-2.0.793 → plugin_scanner-2.0.794}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.793
+Version: 2.0.794
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.793 → plugin_scanner-2.0.794}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.793"
+version = "2.0.794"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.793 → plugin_scanner-2.0.794}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.793"
+version = "2.0.794"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

plugin_scanner-2.0.794/src/codex_plugin_scanner/guard/local_trust_contract.py

@@ -0,0 +1,320 @@
+"""Stable local trust vocabulary shared by Guard runtime and UI APIs."""
+
+from __future__ import annotations
+
+import json
+import multiprocessing
+import os
+import pickle
+import signal
+import tempfile
+from collections.abc import Callable
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Literal, Protocol, TypeVar, cast
+
+LocalTrustMode = Literal[
+    "protected",
+    "cloud_authoritative",
+    "degraded_safe",
+    "setup_required",
+    "unsupported",
+]
+RuntimeProtectionStatus = Literal["protected", "degraded", "unknown"]
+RememberedRulesStatus = Literal["enforced", "disabled_degraded", "unknown"]
+CloudPoliciesStatus = Literal["available", "setup_unavailable", "unknown"]
+
+PolicyIntegrityMode = Literal["protected", "degraded"]
+PolicyIntegrityEnforcement = Literal["enforce", "warn"]
+
+POLICY_INTEGRITY_MODE_PROTECTED: PolicyIntegrityMode = "protected"
+POLICY_INTEGRITY_MODE_DEGRADED: PolicyIntegrityMode = "degraded"
+POLICY_INTEGRITY_ENFORCEMENT_ENFORCE: PolicyIntegrityEnforcement = "enforce"
+POLICY_INTEGRITY_ENFORCEMENT_WARN: PolicyIntegrityEnforcement = "warn"
+
+LOCAL_TRUST_MODES: tuple[LocalTrustMode, ...] = (
+    "protected",
+    "cloud_authoritative",
+    "degraded_safe",
+    "setup_required",
+    "unsupported",
+)
+
+POLICY_INTEGRITY_DEGRADED_REASONS: tuple[str, ...] = (
+    "system_keyring_unavailable",
+    "policy_integrity_key_unavailable",
+    "policy_integrity_control_unavailable",
+    "guard_home_symlink",
+    "guard_db_symlink",
+    "guard_home_permissions",
+    "guard_db_permissions",
+    "guard_home_inaccessible",
+    "guard_db_inaccessible",
+    "trust_backend_timeout",
+    "trust_backend_unavailable",
+    "trust_backend_permission_denied",
+    "trust_backend_corrupt",
+)
+
+POLICY_INTEGRITY_REASON_SYSTEM_KEYRING_UNAVAILABLE = "system_keyring_unavailable"
+POLICY_INTEGRITY_REASON_KEY_UNAVAILABLE = "policy_integrity_key_unavailable"
+POLICY_INTEGRITY_REASON_CONTROL_UNAVAILABLE = "policy_integrity_control_unavailable"
+POLICY_INTEGRITY_REASON_GUARD_HOME_SYMLINK = "guard_home_symlink"
+POLICY_INTEGRITY_REASON_GUARD_DB_SYMLINK = "guard_db_symlink"
+POLICY_INTEGRITY_REASON_GUARD_HOME_PERMISSIONS = "guard_home_permissions"
+POLICY_INTEGRITY_REASON_GUARD_DB_PERMISSIONS = "guard_db_permissions"
+POLICY_INTEGRITY_REASON_GUARD_HOME_INACCESSIBLE = "guard_home_inaccessible"
+POLICY_INTEGRITY_REASON_GUARD_DB_INACCESSIBLE = "guard_db_inaccessible"
+POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT = "trust_backend_timeout"
+POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE = "trust_backend_unavailable"
+POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED = "trust_backend_permission_denied"
+POLICY_INTEGRITY_REASON_BACKEND_CORRUPT = "trust_backend_corrupt"
+
+LOCAL_TRUST_DEGRADED_REASON_LABELS: dict[str, str] = {
+    POLICY_INTEGRITY_REASON_SYSTEM_KEYRING_UNAVAILABLE: "System credential store unavailable",
+    POLICY_INTEGRITY_REASON_KEY_UNAVAILABLE: "Local rule signing key unavailable",
+    POLICY_INTEGRITY_REASON_CONTROL_UNAVAILABLE: "Local rollback control unavailable",
+    POLICY_INTEGRITY_REASON_GUARD_HOME_SYMLINK: "Guard home path is not trusted",
+    POLICY_INTEGRITY_REASON_GUARD_DB_SYMLINK: "Guard database path is not trusted",
+    POLICY_INTEGRITY_REASON_GUARD_HOME_PERMISSIONS: "Guard home permissions are too broad",
+    POLICY_INTEGRITY_REASON_GUARD_DB_PERMISSIONS: "Guard database permissions are too broad",
+    POLICY_INTEGRITY_REASON_GUARD_HOME_INACCESSIBLE: "Guard home could not be inspected",
+    POLICY_INTEGRITY_REASON_GUARD_DB_INACCESSIBLE: "Guard database could not be inspected",
+    POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT: "Local trust backend timed out",
+    POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE: "Local trust backend unavailable",
+    POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED: "Local trust backend permission denied",
+    POLICY_INTEGRITY_REASON_BACKEND_CORRUPT: "Local trust backend data could not be read",
+}
+
+
+class TrustBackend(Protocol):
+    """Local trust backend contract for passive and explicit trust operations."""
+
+    name: str
+    priority: int
+    supported: bool
+    passive_no_ui_safe: bool
+
+    def status(self) -> TrustStatus:
+        """Return current backend trust status."""
+        ...
+
+    def sign(self, payload: bytes) -> str:
+        """Sign canonical trust payload bytes."""
+        ...
+
+    def verify(self, payload: bytes, signature: str) -> bool:
+        """Verify canonical trust payload bytes."""
+        ...
+
+    def setup(self) -> TrustStatus:
+        """Run explicit foreground setup."""
+        ...
+
+    def revoke(self) -> TrustStatus:
+        """Revoke backend trust material."""
+        ...
+
+
+class _ProcessHandle(Protocol):
+    @property
+    def pid(self) -> int | None: ...
+
+    def is_alive(self) -> bool: ...
+
+    def join(self, timeout: float | None = None) -> None: ...
+
+    def terminate(self) -> None: ...
+
+    def kill(self) -> None: ...
+
+
+_TrustResult = TypeVar("_TrustResult")
+
+
+class TrustBackendUnavailableError(RuntimeError):
+    """Raised when passive trust backend execution cannot be started."""
+
+
+def _trust_backend_check_worker(
+    operation: Callable[[], object],
+    result_path: str,
+) -> None:
+    if hasattr(os, "setsid"):
+        os.setsid()
+    try:
+        payload = (True, operation())
+    except Exception as error:
+        payload = (False, error)
+    temp_result_path = f"{result_path}.{os.getpid()}.tmp"
+    with Path(temp_result_path).open("wb") as handle:
+        pickle.dump(payload, handle, protocol=pickle.HIGHEST_PROTOCOL)
+    os.replace(temp_result_path, result_path)
+
+
+def _terminate_trust_backend_process_tree(process: _ProcessHandle) -> None:
+    pid = process.pid
+    if pid is None:
+        return
+    if hasattr(os, "killpg"):
+        try:
+            os.killpg(pid, signal.SIGTERM)
+        except ProcessLookupError:
+            pass
+        except PermissionError:
+            pass
+        process.terminate()
+        process.join(timeout=0.2)
+        if process.is_alive():
+            try:
+                os.killpg(pid, signal.SIGKILL)
+            except ProcessLookupError:
+                pass
+            except PermissionError:
+                pass
+            process.kill()
+            process.join(timeout=0.2)
+        return
+    process.terminate()
+    process.join(timeout=0.2)
+    if process.is_alive():
+        process.kill()
+        process.join(timeout=0.2)
+
+
+def select_trust_backend(
+    backends: tuple[TrustBackend, ...],
+    *,
+    passive: bool,
+) -> TrustBackend | None:
+    """Select highest-priority supported backend, gating passive use on no-UI safety."""
+
+    candidates = [backend for backend in backends if backend.supported and (not passive or backend.passive_no_ui_safe)]
+    if not candidates:
+        return None
+    return sorted(candidates, key=lambda backend: (-backend.priority, backend.name))[0]
+
+
+def run_trust_backend_check(
+    operation: Callable[[], _TrustResult],
+    *,
+    timeout_seconds: float,
+    timeout_result: _TrustResult,
+    on_error: Callable[[BaseException], _TrustResult] | None = None,
+) -> _TrustResult:
+    """Run side-effect-free passive backend work under a contained timeout."""
+
+    if timeout_seconds <= 0:
+        return timeout_result
+    try:
+        context = multiprocessing.get_context("fork")
+    except ValueError as error:
+        if on_error is None:
+            return timeout_result
+        return on_error(TrustBackendUnavailableError(str(error)))
+    with tempfile.TemporaryDirectory(prefix="hol-guard-trust-") as temp_dir:
+        result_path = str(Path(temp_dir) / "result.pickle")
+        process = context.Process(target=_trust_backend_check_worker, args=(operation, result_path))
+        try:
+            process.start()
+        except Exception as error:
+            if on_error is None:
+                return timeout_result
+            return on_error(error)
+        process.join(timeout=timeout_seconds)
+        if process.is_alive():
+            _terminate_trust_backend_process_tree(process)
+            return timeout_result
+        result_file = Path(result_path)
+        if not result_file.exists():
+            if on_error is None:
+                return timeout_result
+            return on_error(RuntimeError("trust_backend_process_failed"))
+        with result_file.open("rb") as handle:
+            ok, value = pickle.load(handle)
+        if ok:
+            return cast("_TrustResult", value)
+        if on_error is None:
+            return timeout_result
+        return on_error(cast("BaseException", value))
+
+
+def degraded_reason_for_backend_error(error: BaseException) -> str:
+    """Normalize backend failures into user-safe degraded reasons."""
+
+    if isinstance(error, TimeoutError):
+        return POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT
+    if isinstance(error, TrustBackendUnavailableError):
+        return POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE
+    if isinstance(error, PermissionError):
+        return POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED
+    if isinstance(error, (ValueError, json.JSONDecodeError)):
+        return POLICY_INTEGRITY_REASON_BACKEND_CORRUPT
+    return POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE
+
+
+@dataclass(frozen=True)
+class TrustStatus:
+    """User-safe trust summary for runtime, local rules, and Cloud policy authority."""
+
+    runtime_protection: RuntimeProtectionStatus
+    remembered_rules: RememberedRulesStatus
+    cloud_policies: CloudPoliciesStatus
+    backend: str
+    degraded_reasons: tuple[str, ...] = field(default_factory=tuple)
+    setup_available: bool = False
+    last_proof: str | None = None
+
+    @classmethod
+    def from_policy_integrity_state(cls, state: dict[str, object]) -> TrustStatus:
+        mode = state.get("mode")
+        reasons = state.get("degraded_reasons")
+        clean_reasons = (
+            tuple(reason for reason in reasons if isinstance(reason, str)) if isinstance(reasons, list) else ()
+        )
+        if mode == POLICY_INTEGRITY_MODE_PROTECTED:
+            runtime_protection: RuntimeProtectionStatus = "protected"
+            remembered_rules: RememberedRulesStatus = "enforced"
+        elif mode == POLICY_INTEGRITY_MODE_DEGRADED:
+            runtime_protection = "degraded"
+            remembered_rules = "disabled_degraded"
+        else:
+            runtime_protection = "unknown"
+            remembered_rules = "unknown"
+        setup_available = bool(state.get("setup_available"))
+        if not setup_available:
+            setup_available = any(reason in LOCAL_TRUST_DEGRADED_REASON_LABELS for reason in clean_reasons)
+        runtime_override = state.get("runtime_protection")
+        if runtime_override in ("protected", "degraded", "unknown"):
+            runtime_protection = runtime_override
+        cloud_override = state.get("cloud_policies")
+        if cloud_override in ("available", "setup_unavailable", "unknown"):
+            cloud_policies: CloudPoliciesStatus = cloud_override
+        elif setup_available:
+            cloud_policies = "setup_unavailable"
+        else:
+            cloud_policies = "available"
+        return cls(
+            runtime_protection=runtime_protection,
+            remembered_rules=remembered_rules,
+            cloud_policies=cloud_policies,
+            backend=str(state.get("backend") or "unknown"),
+            degraded_reasons=clean_reasons,
+            setup_available=setup_available,
+            last_proof=None,
+        )
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "runtime_protection": self.runtime_protection,
+            "remembered_rules": self.remembered_rules,
+            "cloud_policies": self.cloud_policies,
+            "backend": self.backend,
+            "degraded_reasons": list(self.degraded_reasons),
+            "degraded_reason_labels": {
+                reason: LOCAL_TRUST_DEGRADED_REASON_LABELS.get(reason, "Guard trust check degraded")
+                for reason in self.degraded_reasons
+            },
+            "setup_available": self.setup_available,
+            "last_proof": self.last_proof,
+        }

{plugin_scanner-2.0.793 → plugin_scanner-2.0.794}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.793"
+__version__ = "2.0.794"

{plugin_scanner-2.0.793 → plugin_scanner-2.0.794}/tests/test_guard_policy_integrity.py

@@ -6,12 +6,15 @@ import base64
 import json
 import sqlite3
 import sys
+import time
+from dataclasses import dataclass
 from pathlib import Path
 from typing import cast
 
 import pytest
 
 from codex_plugin_scanner.cli import main
+from codex_plugin_scanner.guard import local_trust_contract as local_trust_contract_module
 from codex_plugin_scanner.guard import store as guard_store_module
 from codex_plugin_scanner.guard.local_trust_contract import (
     LOCAL_TRUST_DEGRADED_REASON_LABELS,
@@ -21,7 +24,15 @@ from codex_plugin_scanner.guard.local_trust_contract import (
     POLICY_INTEGRITY_ENFORCEMENT_WARN,
     POLICY_INTEGRITY_MODE_DEGRADED,
     POLICY_INTEGRITY_MODE_PROTECTED,
+    POLICY_INTEGRITY_REASON_BACKEND_CORRUPT,
+    POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED,
+    POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT,
+    POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE,
+    TrustBackendUnavailableError,
     TrustStatus,
+    degraded_reason_for_backend_error,
+    run_trust_backend_check,
+    select_trust_backend,
 )
 from codex_plugin_scanner.guard.models import PolicyDecision
 from codex_plugin_scanner.guard.store import GuardStore, SystemKeyringSecretStore
@@ -41,6 +52,49 @@ def _store(tmp_path: Path) -> GuardStore:
     return GuardStore(tmp_path / "guard-home")
 
 
+@dataclass
+class _FakeTrustBackend:
+    name: str
+    priority: int
+    supported: bool = True
+    passive_no_ui_safe: bool = True
+
+    def status(self) -> TrustStatus:
+        return TrustStatus(
+            runtime_protection="protected",
+            remembered_rules="enforced",
+            cloud_policies="available",
+            backend=self.name,
+        )
+
+    def sign(self, payload: bytes) -> str:
+        return base64.urlsafe_b64encode(payload).decode("ascii")
+
+    def verify(self, payload: bytes, signature: str) -> bool:
+        return self.sign(payload) == signature
+
+    def setup(self) -> TrustStatus:
+        return self.status()
+
+    def revoke(self) -> TrustStatus:
+        return TrustStatus(
+            runtime_protection="degraded",
+            remembered_rules="disabled_degraded",
+            cloud_policies="setup_unavailable",
+            backend=self.name,
+            setup_available=True,
+        )
+
+
+def _write_nested_trust_marker(marker_path: str) -> None:
+    Path(marker_path).write_text("ok", encoding="utf-8")
+
+
+def _write_delayed_nested_trust_marker(marker_path: str) -> None:
+    time.sleep(0.4)
+    Path(marker_path).write_text("late", encoding="utf-8")
+
+
 def test_local_trust_contract_exports_stable_status_vocabulary() -> None:
     assert LOCAL_TRUST_MODES == (
         "protected",
@@ -63,6 +117,225 @@ def test_local_trust_contract_exports_stable_status_vocabulary() -> None:
     assert set(LOCAL_TRUST_DEGRADED_REASON_LABELS) == set(POLICY_INTEGRITY_DEGRADED_REASONS)
 
 
+def test_trust_backend_registry_requires_no_ui_safe_passive_backend() -> None:
+    unsafe_high_priority = _FakeTrustBackend(
+        name="unsafe-high",
+        priority=100,
+        passive_no_ui_safe=False,
+    )
+    safe_low_priority = _FakeTrustBackend(name="safe-low", priority=10)
+    unsupported = _FakeTrustBackend(name="unsupported", priority=200, supported=False)
+
+    passive_backend = select_trust_backend(
+        (unsupported, unsafe_high_priority, safe_low_priority),
+        passive=True,
+    )
+    explicit_backend = select_trust_backend(
+        (unsupported, unsafe_high_priority, safe_low_priority),
+        passive=False,
+    )
+
+    assert passive_backend is safe_low_priority
+    assert explicit_backend is unsafe_high_priority
+
+
+def test_trust_backend_timeout_returns_degraded_result_without_waiting() -> None:
+    timeout_result = TrustStatus(
+        runtime_protection="degraded",
+        remembered_rules="disabled_degraded",
+        cloud_policies="setup_unavailable",
+        backend="timeout",
+        degraded_reasons=(POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT,),
+        setup_available=True,
+    )
+
+    started = time.monotonic()
+    result = run_trust_backend_check(
+        lambda: (time.sleep(1.0), _FakeTrustBackend("slow", 1).status())[1],
+        timeout_seconds=0.01,
+        timeout_result=timeout_result,
+        on_error=lambda error: TrustStatus(
+            runtime_protection="degraded",
+            remembered_rules="disabled_degraded",
+            cloud_policies="setup_unavailable",
+            backend="error",
+            degraded_reasons=(degraded_reason_for_backend_error(error),),
+        ),
+    )
+
+    assert result == timeout_result
+    assert time.monotonic() - started < 0.5
+
+
+def test_trust_backend_timeout_contains_late_side_effects(tmp_path: Path) -> None:
+    marker_path = tmp_path / "late-side-effect"
+
+    def slow_mutation() -> TrustStatus:
+        time.sleep(0.5)
+        marker_path.write_text("mutated", encoding="utf-8")
+        return _FakeTrustBackend("slow", 1).status()
+
+    timeout_result = TrustStatus(
+        runtime_protection="degraded",
+        remembered_rules="disabled_degraded",
+        cloud_policies="setup_unavailable",
+        backend="timeout",
+        degraded_reasons=(POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT,),
+    )
+
+    result = run_trust_backend_check(
+        slow_mutation,
+        timeout_seconds=0.01,
+        timeout_result=timeout_result,
+    )
+    time.sleep(0.1)
+
+    assert result == timeout_result
+    assert not marker_path.exists()
+
+
+def test_trust_backend_timeout_kills_nested_helper_process(tmp_path: Path) -> None:
+    marker_path = tmp_path / "nested-late-side-effect"
+
+    def slow_nested_mutation() -> TrustStatus:
+        context = local_trust_contract_module.multiprocessing.get_context("fork")
+        process = context.Process(target=_write_delayed_nested_trust_marker, args=(str(marker_path),))
+        process.start()
+        time.sleep(2.0)
+        return _FakeTrustBackend("slow", 1).status()
+
+    timeout_result = TrustStatus(
+        runtime_protection="degraded",
+        remembered_rules="disabled_degraded",
+        cloud_policies="setup_unavailable",
+        backend="timeout",
+        degraded_reasons=(POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT,),
+    )
+
+    result = run_trust_backend_check(
+        slow_nested_mutation,
+        timeout_seconds=0.05,
+        timeout_result=timeout_result,
+    )
+    time.sleep(0.6)
+
+    assert result == timeout_result
+    assert not marker_path.exists()
+
+
+def test_trust_backend_timeout_falls_back_when_process_group_missing(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    calls: list[str] = []
+
+    class FakeProcess:
+        pid = 12345
+
+        def is_alive(self) -> bool:
+            return False
+
+        def join(self, timeout: float | None = None) -> None:
+            calls.append(f"join:{timeout}")
+
+        def terminate(self) -> None:
+            calls.append("terminate")
+
+        def kill(self) -> None:
+            calls.append("kill")
+
+    def fake_killpg(pid: int, sig: int) -> None:
+        calls.append(f"killpg:{pid}:{sig}")
+        raise ProcessLookupError("process group not ready")
+
+    monkeypatch.setattr(local_trust_contract_module.os, "killpg", fake_killpg)
+
+    local_trust_contract_module._terminate_trust_backend_process_tree(FakeProcess())
+
+    assert calls == ["killpg:12345:15", "terminate", "join:0.2"]
+
+
+def test_trust_backend_timeout_helper_allows_minimal_fallback_contract() -> None:
+    timeout_result = {"mode": "degraded"}
+
+    result = run_trust_backend_check(
+        lambda: (time.sleep(1.0), {"mode": "protected"})[1],
+        timeout_seconds=0.01,
+        timeout_result=timeout_result,
+    )
+
+    assert result == timeout_result
+
+
+def test_trust_backend_check_drains_large_completed_result_before_timeout() -> None:
+    timeout_result = {"mode": "degraded"}
+    large_status = {"mode": "protected", "payload": "x" * 1_000_000}
+
+    result = run_trust_backend_check(
+        lambda: large_status,
+        timeout_seconds=1.0,
+        timeout_result=timeout_result,
+    )
+
+    assert result == large_status
+
+
+def test_trust_backend_check_allows_native_helper_child_process(tmp_path: Path) -> None:
+    marker_path = tmp_path / "nested-helper"
+
+    def operation() -> dict[str, str]:
+        context = local_trust_contract_module.multiprocessing.get_context("fork")
+        process = context.Process(target=_write_nested_trust_marker, args=(str(marker_path),))
+        process.start()
+        process.join(timeout=1.0)
+        return {"mode": "protected", "nested": str(marker_path.exists())}
+
+    result = run_trust_backend_check(
+        operation,
+        timeout_seconds=1.0,
+        timeout_result={"mode": "degraded", "nested": "False"},
+    )
+
+    assert result == {"mode": "protected", "nested": "True"}
+
+
+def test_trust_backend_check_degrades_without_spawn_when_fork_unavailable(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    calls: list[str | None] = []
+
+    def fake_get_context(method: str | None = None):
+        calls.append(method)
+        if method == "fork":
+            raise ValueError("fork unavailable")
+        raise AssertionError("spawn fallback must not be used for passive trust checks")
+
+    monkeypatch.setattr(local_trust_contract_module.multiprocessing, "get_context", fake_get_context)
+
+    result = run_trust_backend_check(
+        lambda: {"mode": "protected"},
+        timeout_seconds=1.0,
+        timeout_result={"mode": "degraded"},
+        on_error=lambda error: {"mode": "degraded", "reason": degraded_reason_for_backend_error(error)},
+    )
+
+    assert result == {"mode": "degraded", "reason": POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE}
+    assert calls == ["fork"]
+
+
+def test_trust_backend_errors_normalize_to_safe_degraded_reasons() -> None:
+    assert degraded_reason_for_backend_error(TimeoutError("slow")) == POLICY_INTEGRITY_REASON_BACKEND_TIMEOUT
+    assert (
+        degraded_reason_for_backend_error(TrustBackendUnavailableError("fork unavailable"))
+        == POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE
+    )
+    assert (
+        degraded_reason_for_backend_error(PermissionError("denied"))
+        == POLICY_INTEGRITY_REASON_BACKEND_PERMISSION_DENIED
+    )
+    assert degraded_reason_for_backend_error(ValueError("bad payload")) == POLICY_INTEGRITY_REASON_BACKEND_CORRUPT
+    assert degraded_reason_for_backend_error(RuntimeError("broken")) == POLICY_INTEGRITY_REASON_BACKEND_UNAVAILABLE
+
+
 def test_trust_status_serializes_policy_integrity_authority_without_paths() -> None:
     status = TrustStatus.from_policy_integrity_state(
         {