feat: implement GEWU service and local agent workflows

tests/application/test_search_scope.py

@@ -0,0 +1,84 @@
+import json
+from pathlib import Path
+from typing import cast
+
+import pytest
+
+from gewu.application.identity import Principal
+from gewu.application.registry import LocalProjectRegistry
+from gewu.application.search import CanonicalSearchService, SearchError, SearchIndex
+from gewu.domain.contracts import ProjectRecord, ProjectStatus, Scope
+
+
+def _service() -> CanonicalSearchService:
+    return CanonicalSearchService(
+        index=cast(SearchIndex, object()),
+        project_ids_provider=lambda: ("dome-performance", "interactive-video"),
+        canonical_head=lambda: "a" * 40,
+        default_includes_provider=lambda project_id: (
+            ("interactive-video", "shared") if project_id == "dome-performance" else ()
+        ),
+    )
+
+
+def _principal(*projects: str) -> Principal:
+    return Principal("reader", "reader-key", frozenset({"viewer"}), frozenset(projects))
+
+
+def test_single_project_scope_resolves_defaults_and_shared() -> None:
+    resolved = _service()._resolve_scope(
+        Scope(projects=("dome-performance",)),
+        _principal("dome-performance", "interactive-video", "shared"),
+    )
+
+    assert resolved == ("dome-performance", "interactive-video")
+
+
+def test_explicit_empty_includes_suppresses_project_defaults() -> None:
+    resolved = _service()._resolve_scope(
+        Scope(projects=("dome-performance",), include_projects=(), include_shared=False),
+        _principal("dome-performance", "interactive-video", "shared"),
+    )
+
+    assert resolved == ("dome-performance",)
+
+
+def test_default_includes_must_be_authorized() -> None:
+    with pytest.raises(SearchError, match="cannot read every requested project") as error:
+        _service()._resolve_scope(
+            Scope(projects=("dome-performance",)), _principal("dome-performance", "shared")
+        )
+
+    assert error.value.status_code == 403
+
+
+def test_explicit_include_projects_override_defaults() -> None:
+    resolved = _service()._resolve_scope(
+        Scope(projects=("dome-performance",), include_projects=("interactive-video",)),
+        _principal("dome-performance", "interactive-video", "shared"),
+    )
+
+    assert resolved == ("dome-performance", "interactive-video")
+
+
+def test_local_project_registry_exposes_validated_default_includes(tmp_path: Path) -> None:
+    project = ProjectRecord(
+        project_id="dome-performance",
+        title="Dome",
+        status=ProjectStatus.ACTIVE,
+        north_star="Build useful dome experiences.",
+        key_questions=("What works?",),
+        default_includes=("interactive-video", "shared"),
+        autonomy_policy_id="dome-policy",
+    )
+    registry_file = tmp_path / "registry.json"
+    registry_file.write_text(
+        json.dumps(
+            {"schema_version": 1, "projects": [project.model_dump(mode="json")], "policies": []}
+        ),
+        encoding="utf-8",
+    )
+
+    registry = LocalProjectRegistry(registry_file)
+
+    assert registry.default_includes("dome-performance") == ("interactive-video",)