[SaulBuilds]

Summary

Tests only. No production code, version or dependency changes.

Pins two fail-closed guards at their public entry points. Before this PR, each guard could be removed with the rest of the suite still green, because a later check masked the removal.

Guard	Entry point	New test(s)
Up-front "nonce required" check in exchange_code	IdentityClient.exchange_code	test_exchange_code_without_a_nonce_is_refused_before_the_token_request[None], [""]. Positive control: test_exchange_code_with_the_matching_nonce_still_succeeds
IPFS upload failure aborts the deploy (no placeholder CID)	CitrateClient.deploy_model	test_deploy_model_aborts_when_the_ipfs_upload_fails. Positive control: test_deploy_model_carries_the_cid_the_upload_returned

• Without the nonce check, nonce="" was still caught later by the ID-token claim comparison. nonce=None, however, skipped the nonce check entirely and the token verified. The new test asserts that both values raise IdentityError before the authorization code is redeemed: no request reaches the token endpoint.
• The deploy test makes upload_to_ipfs raise. It then asserts that deploy_model raises CitrateError and that no eth_sendRawTransaction is made.

All transports are in-process fakes, so no test opens a socket.

Standard: met

• Revert check: each guard was neutralised in turn (if not nonce: → if False:; the raise CitrateError(...) in _upload_to_ipfs → return "fallback_…"), and the suite was run each time:
  • nonce check off → 2 red (both parametrisations, on assertion: "DID NOT RAISE" / message mismatch, plus the token endpoint was hit).
  • IPFS fail-closed off → 1 red (test_deploy_model_aborts_when_the_ipfs_upload_fails).
  • Restored → green.
• Before this PR, both reverts left the suite green: 806 passed, 49 skipped (economics simulation excluded for the mutation runs; it imports only citrate_sdk.economics).
• Suite: uv run --frozen pytest -q collects 907 → 912 tests (5 new). The new file passes, and the suite without the economics simulation runs 811 passed, 49 skipped.
• Lint and types: ruff check . and mypy . are clean.
• Wider sweep: 14 further guard reverts in the client, transport, identity and envelope code were checked in the same pass. Each one already went red in the existing suite, so no new tests were needed for them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KGMeatV8UjtCB4CTbWuAv4

[BerryManifold]

Approval at d8e7207373ed3a4e6a5d5ec50b0ddddd69e87d34 after focused differential review of changed files, history, security guards and immediate callers. All 5 targeted tests pass; both nonce-guard-removal and IPFS fail-open mutants fail assertions, restoring source returns 5/5 green.

Limits: No deployments, live authority/chain/storage operations, full cross-repository integration or full historical security audit. Required CI/branch/owner gates still apply. Both account submissions reflect the same automated review.

[Matr0xshka]

Approval at d8e7207373ed3a4e6a5d5ec50b0ddddd69e87d34 after focused differential review of changed files, history, security guards and immediate callers. All 5 targeted tests pass; both nonce-guard-removal and IPFS fail-open mutants fail assertions, restoring source returns 5/5 green.

Limits: No deployments, live authority/chain/storage operations, full cross-repository integration or full historical security audit. Required CI/branch/owner gates still apply. Both account submissions reflect the same automated review.

[BerryManifold]

Automated Codex static review of d8e7207373ed3a4e6a5d5ec50b0ddddd69e87d34 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of d8e7207373ed3a4e6a5d5ec50b0ddddd69e87d34 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[BerryManifold]

Automated Codex static review of d8e7207373ed3a4e6a5d5ec50b0ddddd69e87d34 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.

[Matr0xshka]

Automated Codex static review of d8e7207373ed3a4e6a5d5ec50b0ddddd69e87d34 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.