chore: initialize project repository

tests/unit/api/test_agent_run_security.py

@@ -0,0 +1,35 @@
+from unittest.mock import AsyncMock, Mock
+
+from fastapi.testclient import TestClient
+
+from app.api.controllers.agent_runs import get_session
+from app.api.dependencies.auth import build_request_context
+from app.core.contracts import RequestContext
+from app.main import create_app
+
+
+def test_unknown_agent_returns_contract_404_without_database_write():
+    app = create_app()
+    session = AsyncMock()
+    session.add = Mock()
+
+    async def context():
+        return RequestContext(user_id="1", trace_id="test-trace", roles=("customer",),
+                              permissions=("agent:run",))
+
+    async def database():
+        yield session
+
+    app.dependency_overrides[build_request_context] = context
+    app.dependency_overrides[get_session] = database
+    with TestClient(app) as client:
+        response = client.post("/api/v1/agent-runs", json={
+            "agent_type": "no_such_agent", "message": "test", "session_id": "test",
+            "idempotency_key": "1234567890123456",
+        })
+    assert response.status_code == 404
+    assert response.json()["error"]["code"] == "AGENT_TYPE_NOT_FOUND"
+    assert response.json()["meta"]["trace_id"] == "test-trace"
+    session.add.assert_not_called()
+    session.execute.assert_not_awaited()
+    session.flush.assert_not_awaited()