feat: implement GEWU service and local agent workflows

tests/domain/test_run_checkpoint.py

@@ -0,0 +1,160 @@
+import copy
+import hashlib
+import json
+import stat
+from pathlib import Path
+
+import agents.gewu.scripts.run_checkpoint as checkpoint_module
+import pytest
+from agents.gewu.scripts.run_checkpoint import (
+    create_checkpoint,
+    load_checkpoint,
+    update_checkpoint,
+)
+
+
+def test_run_checkpoint_records_scope_coverage_receipt_and_pins(tmp_path: Path) -> None:
+    workspace = tmp_path / "research-workspace"
+    checkpoint = create_checkpoint(
+        workspace,
+        run_id="run-2026-01",
+        objective="Compare audience response",
+        projects=["dome-performance"],
+        include_shared=True,
+        lens="Audience behavior",
+        budgets={"sources": 8},
+    )
+    path = workspace / "Runs" / "run-2026-01.json"
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert checkpoint["pack"]["snapshot_digest"]
+
+    updated = update_checkpoint(
+        workspace,
+        "run-2026-01",
+        {
+            "stage": "report",
+            "sources": [
+                {
+                    "source_revision_id": "source:r1",
+                    "extraction_id": "a" * 64,
+                    "status": "extracted",
+                }
+            ],
+            "coverage": {
+                "selected": ["section-1", "section-2"],
+                "included": ["section-1"],
+                "excluded": [{"item": "section-2", "reason": "outside project lens"}],
+                "skipped": [],
+            },
+            "pending_operations": [
+                {
+                    "operation_id": "proposal-op-1",
+                    "tool_name": "proposal_submit",
+                    "input_sha256": "b" * 64,
+                    "status": "complete",
+                }
+            ],
+            "proposals": [
+                {
+                    "proposal_id": "proposal-1",
+                    "revision": 1,
+                    "status": "accepted",
+                    "receipt": {
+                        "proposal_id": "proposal-1",
+                        "revision": 1,
+                        "state": "accepted",
+                        "commit_id": "c" * 40,
+                    },
+                }
+            ],
+            "outputs": [{"sha256": "d" * 64}],
+        },
+    )
+    resumed = load_checkpoint(workspace, "run-2026-01")
+    assert resumed == updated
+    assert resumed["coverage"]["excluded"][0]["reason"] == "outside project lens"
+    assert resumed["proposals"][0]["receipt"]["commit_id"] == "c" * 40
+    with pytest.raises(ValueError, match="does not match"):
+        update_checkpoint(
+            workspace,
+            "run-2026-01",
+            {
+                "proposals": [
+                    {
+                        "proposal_id": "proposal-1",
+                        "revision": 1,
+                        "status": "accepted",
+                        "receipt": {
+                            "proposal_id": "proposal-other",
+                            "revision": 1,
+                            "state": "accepted",
+                            "commit_id": "c" * 40,
+                        },
+                    }
+                ]
+            },
+        )
+
+
+def test_run_checkpoint_rejects_secrets_bad_progress_and_snapshot_drift(tmp_path: Path) -> None:
+    workspace = tmp_path / "research-workspace"
+    create_checkpoint(
+        workspace,
+        run_id="run-drift-01",
+        objective="Test resume pinning",
+        projects=["dome-performance"],
+        include_shared=False,
+        lens="A bounded lens",
+    )
+    with pytest.raises(ValueError, match="credentials or source bodies"):
+        update_checkpoint(workspace, "run-drift-01", {"last_failure": {"api_key": "secret"}})
+    with pytest.raises(ValueError, match="SHA-256"):
+        update_checkpoint(
+            workspace,
+            "run-drift-01",
+            {
+                "outputs": [{"sha256": "not-a-digest"}],
+                "stage": "report",
+            },
+        )
+
+    path = workspace / "Runs" / "run-drift-01.json"
+    checkpoint = json.loads(path.read_text(encoding="utf-8"))
+    checkpoint["pack"]["snapshot_digest"] = "0" * 64
+    path.write_text(json.dumps(checkpoint), encoding="utf-8")
+    with pytest.raises(ValueError, match="pack changed"):
+        load_checkpoint(workspace, "run-drift-01")
+
+
+def test_existing_run_cannot_resume_after_verified_pack_upgrade(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    workspace = tmp_path / "research-workspace"
+    create_checkpoint(
+        workspace,
+        run_id="run-pack-update-01",
+        objective="Resume with pinned modules",
+        projects=["dome-performance"],
+        include_shared=True,
+        lens="Keep the original extraction and evidence rules",
+    )
+    checkpoint_path = workspace / "Runs" / "run-pack-update-01.json"
+    original_checkpoint = checkpoint_path.read_bytes()
+
+    updated_manifest = copy.deepcopy(checkpoint_module.load_manifest())
+    updated_manifest["pack_version"] = "0.7.0"
+    updated_manifest["modules"][0]["implementation_version"] += ".updated"
+    modules_json = json.dumps(
+        updated_manifest["modules"], ensure_ascii=False, sort_keys=True, separators=(",", ":")
+    )
+    updated_manifest["snapshot"]["digest"] = hashlib.sha256(modules_json.encode()).hexdigest()
+
+    # This fixture stands in for a newer pack whose own manifest verification
+    # succeeded; the behavior under test is the active run's compatibility pin.
+    monkeypatch.setattr(checkpoint_module, "load_manifest", lambda: updated_manifest)
+    monkeypatch.setattr(checkpoint_module, "verify", lambda _manifest: None)
+
+    with pytest.raises(ValueError, match="pack changed since this run"):
+        load_checkpoint(workspace, "run-pack-update-01")
+    assert checkpoint_path.read_bytes() == original_checkpoint