test(api): cover canonical context and correlation propagation

JoTalbot · Aug 26, 2026 · Aug 26, 2026 · Aug 26, 2026 · Aug 26, 2026 · Aug 26, 2026
commit c0ef54aeb2f16555e26dfeeb96d33d36eac06661
diff --git a/tests/test_recovery_rbac_matrix.py b/tests/test_recovery_rbac_matrix.py
@@ -9,6 +9,10 @@
 from runtime.recovery_queue import RecoveryQueue, RecoveryQueueItem
 
 
+def context(role, correlation_id="corr-test"):
+    return SecurityContext(actor="alice", role=role, correlation_id=correlation_id)
+
+
 @pytest.mark.parametrize("role,mutation_status", [
     (OperatorRole.VIEWER, 403),
     (OperatorRole.OPERATOR, 200),
@@ -18,29 +22,20 @@ def test_recovery_mutation_rbac(role, mutation_status, tmp_path):
     queue = RecoveryQueue(str(tmp_path / "queue.jsonl"))
     queue.enqueue(RecoveryQueueItem("e1", "manual_review", "operator action", 3, "corr-1"))
     service = RecoveryOperatorService(queue=queue)
-    app = create_app(
-        recovery_service=service,
-        operator_validator=lambda request: SecurityContext(actor="alice", role=role),
-    )
-    client = TestClient(app)
-    response = client.post("/recovery/resolve", json={"execution_id": "e1", "action": "manual_review", "reason": "approved"})
+    app = create_app(recovery_service=service, operator_validator=lambda request: context(role))
+    response = TestClient(app).post("/recovery/resolve", json={"execution_id": "e1", "action": "manual_review", "reason": "approved"})
     assert response.status_code == mutation_status
-    if response.status_code == 200:
-        assert response.json()["execution_id"] == "e1"
 
 
-def test_actor_and_correlation_are_propagated(tmp_path):
+def test_correlation_propagates_to_audit(tmp_path):
     queue = RecoveryQueue(str(tmp_path / "queue.jsonl"))
     queue.enqueue(RecoveryQueueItem("e2", "manual_review", "needs review", 3, "corr-77"))
-    audit_path = tmp_path / "audit.jsonl"
     from runtime.operator_audit import OperatorAuditLog
-    service = RecoveryOperatorService(queue=queue, audit_log=OperatorAuditLog(str(audit_path)))
-    app = create_app(
-        recovery_service=service,
-        operator_validator=lambda request: SecurityContext(actor="alice", role=OperatorRole.OPERATOR),
-    )
+    service = RecoveryOperatorService(queue=queue, audit_log=OperatorAuditLog(str(tmp_path / "audit.jsonl")))
+    app = create_app(recovery_service=service, operator_validator=lambda request: context(OperatorRole.OPERATOR, "corr-99"))
     response = TestClient(app).post("/recovery/resolve", json={"execution_id": "e2", "action": "manual_review"})
     assert response.status_code == 200
     event = service.audit_events()[-1]
     assert event.actor == "alice"
+    assert event.correlation_id == "corr-99"
     assert event.outcome == "resolved"