Add atomic runtime tuple promotion gate

test/repository_test.rb

@@ -11,7 +11,7 @@ class RepositoryTest < Minitest::Test
   end
 
   def test_every_json_document_parses
-    paths = Dir.glob(File.join(ROOT, "{fixtures,manifests,profiles}/**/*.json"))
+    paths = Dir.glob(File.join(ROOT, "{evidence,fixtures,manifests,profiles}/**/*.json"))
     refute_empty paths
     paths.each { |path| JSON.parse(File.read(path)) }
   end
@@ -50,9 +50,21 @@ class RepositoryTest < Minitest::Test
     return unless tuples.fetch("migration_state") == "certified"
 
     tuples.fetch("consumers").each_value do |consumer|
-      refute_nil consumer["current"]
-      refute_nil consumer["previous"]
-      assert_equal "certified", consumer.fetch("current").fetch("status")
+      %w[current previous].each do |slot|
+        tuple = consumer.fetch(slot)
+        assert_equal "certified", tuple.fetch("status")
+        assert_equal "pass", tuple.fetch("certification").fetch("status")
+        assert_match(/\Asha256:[0-9a-f]{64}\z/, tuple.fetch("certification").fetch("tuple_sha256"))
+        refute_empty tuple.fetch("certification").fetch("evidence")
+      end
+    end
+  end
+
+  def test_runtime_tuple_profiles_exist
+    tuples = json("manifests/runtime-tuples.json")
+    tuples.fetch("consumers").each_value do |consumer|
+      profile = consumer.fetch("profile")
+      assert_path_exists File.join(ROOT, "profiles", "#{profile}.json")
     end
   end
 
@@ -60,4 +72,16 @@ class RepositoryTest < Minitest::Test
     workflow = File.read(File.join(ROOT, ".github/workflows/watch-upstream.yml"))
     refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, workflow)
   end
+
+  def test_tuple_promotion_has_no_command_execution_or_deployment_client
+    paths = %w[
+      lib/opencode_compat/runtime_tuple_promoter.rb
+      scripts/promote_runtime_tuple.rb
+    ]
+    implementation = paths.map { |path| File.read(File.join(ROOT, path)) }.join("\n")
+
+    refute_match(/\b(system|exec|spawn|popen|Open3)\b/, implementation)
+    refute_match(/`[^`]+`/, implementation)
+    refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, implementation)
+  end
 end