from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]


def test_wp09_runtime_api_is_authenticated_no_store_and_rejects_client_scope():
    source = (ROOT / "app/api/knowledge_base/agent_governance_routes.py").read_text(encoding="utf-8")
    repository = (ROOT / "app/core/llm/runtime_governance_repository.py").read_text(encoding="utf-8")

    assert '/agents/<agent_uid>/runtime/invocations' in source
    assert "X-Agent-Credential" in source
    assert "validate_credential(agent_uid, token)" in source
    assert "RuntimeServerContext" in source
    assert "_no_store" in source
    assert "ServerGovernedInvocationService" in source
    assert "grant_context" in repository
    assert "agent_runtime_authorize" in repository
    assert "SET LOCAL ROLE dataops_agent_runtime" in repository
    assert "/runtime/invocations/<idempotency_key>/settle" in source
    assert "settle_runtime_invocation" in source