Port recovered contract and failure-path tests

[OgeonX-Ai]

Summary

Ports valuable uncommitted tests from a stale worktree onto current main, correcting stale fixtures and preserving the existing coverage policy.

Changes

• Add current API lifecycle and service-unavailable coverage
• Add evidence bundle validation, digest, traversal, provenance, and CLI failure-path tests
• Add workflow tracestate propagation coverage
• Exclude a duplicate telemetry test and reject the stale .coveragerc that omitted production source

Why

The stale worktree contained useful uncommitted coverage but could not be safely committed wholesale because it was 20 commits behind and included a coverage-bypass configuration.

Validation

• Focused pytest: 34 passed, 90.53% coverage
• Ruff: passed
• mypy: passed with no issues in 9 source files
• scripts/validate.ps1: 70 passed, 1 skipped, 99.73% coverage
• Evidence verification and git diff --check: passed

Risks

Test-only change. Assertions were manually ported against current APIs rather than copying stale files wholesale.

Related

Workspace hygiene and stranded-work recovery.

Reviewer notes

Start with tests/test_evidence.py; it contains most of the recovered negative-path coverage.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.