{
  "component_id": "src_main.rs",
  "contract_version": 1,
  "test_cases": [
    {
      "id": "test_expand_home_with_tilde_and_home_set",
      "description": "expand_home replaces ~/ with HOME environment variable value when HOME is set",
      "function": "expand_home",
      "category": "happy_path",
      "setup_description": "Set HOME environment variable to /home/testuser",
      "mock_dependencies": {},
      "input_values": {
        "path": "~/.signet/policy.yaml"
      },
      "input_description": "",
      "expected_output_description": "Returns PathBuf with /home/testuser/.signet/policy.yaml",
      "expected_error": "",
      "assertions": [
        "Result equals /home/testuser/.signet/policy.yaml"
      ]
    },
    {
      "id": "test_expand_home_without_tilde",
      "description": "expand_home returns path as-is when path does not start with ~/",
      "function": "expand_home",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {},
      "input_values": {
        "path": "/absolute/path/policy.yaml"
      },
      "input_description": "",
      "expected_output_description": "Returns PathBuf from path as-is",
      "expected_error": "",
      "assertions": [
        "Result equals /absolute/path/policy.yaml"
      ]
    },
    {
      "id": "test_expand_home_with_tilde_home_not_set",
      "description": "expand_home returns path as-is when HOME is not set",
      "function": "expand_home",
      "category": "edge_case",
      "setup_description": "Unset HOME environment variable",
      "mock_dependencies": {},
      "input_values": {
        "path": "~/.signet/policy.yaml"
      },
      "input_description": "",
      "expected_output_description": "Returns PathBuf with path as-is",
      "expected_error": "",
      "assertions": [
        "Result equals ~/ path unchanged"
      ]
    },
    {
      "id": "test_expand_home_empty_string",
      "description": "expand_home handles empty string input",
      "function": "expand_home",
      "category": "edge_case",
      "setup_description": "",
      "mock_dependencies": {},
      "input_values": {
        "path": ""
      },
      "input_description": "",
      "expected_output_description": "Returns empty PathBuf",
      "expected_error": "",
      "assertions": [
        "Result is empty path"
      ]
    },
    {
      "id": "test_expand_home_tilde_only",
      "description": "expand_home handles tilde without slash",
      "function": "expand_home",
      "category": "edge_case",
      "setup_description": "",
      "mock_dependencies": {},
      "input_values": {
        "path": "~"
      },
      "input_description": "",
      "expected_output_description": "Returns path as-is (does not match ~/ prefix)",
      "expected_error": "",
      "assertions": [
        "Result equals ~ unchanged"
      ]
    },
    {
      "id": "test_expand_home_tilde_slash_only",
      "description": "expand_home handles ~/ with no additional path",
      "function": "expand_home",
      "category": "edge_case",
      "setup_description": "Set HOME to /home/testuser",
      "mock_dependencies": {},
      "input_values": {
        "path": "~/"
      },
      "input_description": "",
      "expected_output_description": "Returns HOME directory path",
      "expected_error": "",
      "assertions": [
        "Result equals /home/testuser/"
      ]
    },
    {
      "id": "test_run_success_init_command",
      "description": "run() returns 0 on successful Init command execution",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Init",
        "policy::init": "Returns Ok(())",
        "vault::exists": "Returns false",
        "fs::write": "Succeeds"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Policy file created",
        "Output to stdout"
      ]
    },
    {
      "id": "test_run_success_status_command",
      "description": "run() returns 0 on successful Status command with unlocked vault",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Status",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "policy::load": "Returns valid policy"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Status output to stdout"
      ]
    },
    {
      "id": "test_run_success_store_command",
      "description": "run() returns 0 on successful Store command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Store",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::store": "Returns Ok(())"
      },
      "input_values": {
        "name": "API_KEY",
        "value": "secret123"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Credential stored"
      ]
    },
    {
      "id": "test_run_success_eval_command",
      "description": "run() returns 0 on successful Eval command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Eval",
        "policy::load": "Returns valid policy",
        "vault::check_policy_integrity": "Returns Ok(())",
        "hook::run_eval": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Eval executed"
      ]
    },
    {
      "id": "test_run_success_rules_command",
      "description": "run() returns 0 on successful Rules command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Rules",
        "policy::load": "Returns valid policy",
        "stdout": "Captures output"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Rules printed to stdout"
      ]
    },
    {
      "id": "test_run_success_log_command",
      "description": "run() returns 0 on successful Log command with default limit",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Log { limit: 20 }",
        "vault::exists": "Returns true",
        "vault::get_log": "Returns log entries"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Log entries printed"
      ]
    },
    {
      "id": "test_run_success_test_command",
      "description": "run() returns 0 on successful Test command with valid JSON",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Test",
        "serde_json::from_str": "Parses TestInput successfully",
        "policy::test_policy": "Returns Ok(result)"
      },
      "input_values": {
        "json": "{\"tool_name\": \"curl\", \"parameters\": {\"url\": \"http://example.com\"}}"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Test result printed"
      ]
    },
    {
      "id": "test_run_success_delete_command",
      "description": "run() returns 0 on successful Delete command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Delete",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::delete": "Returns Ok(())"
      },
      "input_values": {
        "name": "OLD_KEY"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Credential deleted"
      ]
    },
    {
      "id": "test_run_success_setup_command",
      "description": "run() returns 0 on successful Setup command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Setup",
        "vault::exists": "Returns false",
        "rpassword::prompt": "Returns passphrase >= 8 chars, matching confirmation",
        "vault::setup": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Vault created"
      ]
    },
    {
      "id": "test_run_success_unlock_command",
      "description": "run() returns 0 on successful Unlock command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Unlock",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns true",
        "rpassword::prompt": "Returns correct passphrase",
        "vault::unlock": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Vault unlocked"
      ]
    },
    {
      "id": "test_run_success_validate_command",
      "description": "run() returns 0 on successful Validate command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Validate",
        "policy::load": "Returns valid policy",
        "policy::validate": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Validation success message"
      ]
    },
    {
      "id": "test_run_success_sign_command",
      "description": "run() returns 0 on successful Sign command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Sign",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::sign_policy": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Policy signed"
      ]
    },
    {
      "id": "test_run_success_reset_session_command",
      "description": "run() returns 0 on successful ResetSession command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::ResetSession",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::reset_session": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Session reset"
      ]
    },
    {
      "id": "test_run_success_pause_command",
      "description": "run() returns 0 on successful Pause command with valid duration",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Pause { minutes: 10 }",
        "vault::is_paused": "Returns false",
        "vault::pause": "Returns Ok(())"
      },
      "input_values": {
        "minutes": "10"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Pause state created"
      ]
    },
    {
      "id": "test_run_success_resume_command",
      "description": "run() returns 0 on successful Resume command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Resume",
        "vault::resume": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Pause state removed"
      ]
    },
    {
      "id": "test_run_success_disable_command",
      "description": "run() returns 0 on successful Disable command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Disable",
        "vault::disable": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Disable state created"
      ]
    },
    {
      "id": "test_run_success_enable_command",
      "description": "run() returns 0 on successful Enable command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Enable",
        "vault::enable": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Disable state removed"
      ]
    },
    {
      "id": "test_run_success_preflight_status_command",
      "description": "run() returns 0 on successful PreflightStatus command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::PreflightStatus",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::get_preflight_status": "Returns status"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Preflight status printed"
      ]
    },
    {
      "id": "test_run_success_preflight_override_command",
      "description": "run() returns 0 on successful PreflightOverride command",
      "function": "run",
      "category": "happy_path",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::PreflightOverride",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::set_preflight_override": "Returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Override set"
      ]
    },
    {
      "id": "test_run_error_vault_locked_status",
      "description": "run() returns 1 when vault is locked during Status command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Status",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns true"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "vault_locked_or_missing",
      "assertions": [
        "Return value is 1",
        "Error message to stderr"
      ]
    },
    {
      "id": "test_run_error_vault_missing_store",
      "description": "run() returns 1 when vault does not exist during Store command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Store",
        "vault::exists": "Returns false"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "vault_locked_or_missing",
      "assertions": [
        "Return value is 1",
        "Error message to stderr"
      ]
    },
    {
      "id": "test_run_error_vault_already_exists_setup",
      "description": "run() returns 1 when vault already exists during Setup command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Setup",
        "vault::exists": "Returns true"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "vault_already_exists",
      "assertions": [
        "Return value is 1",
        "Error message about existing vault to stderr"
      ]
    },
    {
      "id": "test_run_error_passphrase_mismatch_setup",
      "description": "run() returns 1 when passphrase and confirmation don't match during Setup",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Setup",
        "vault::exists": "Returns false",
        "rpassword::prompt": "Returns different passphrases"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "passphrase_mismatch",
      "assertions": [
        "Return value is 1",
        "Error message about mismatch to stderr"
      ]
    },
    {
      "id": "test_run_error_passphrase_too_short_setup",
      "description": "run() returns 1 when passphrase is less than 8 characters during Setup",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Setup",
        "vault::exists": "Returns false",
        "rpassword::prompt": "Returns passphrase with 7 chars"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "passphrase_too_short",
      "assertions": [
        "Return value is 1",
        "Error message about minimum length to stderr"
      ]
    },
    {
      "id": "test_run_error_policy_load_error_rules",
      "description": "run() returns 1 when policy file cannot be loaded during Rules command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Rules",
        "policy::load": "Returns Err(PolicyLoadError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "policy_load_error",
      "assertions": [
        "Return value is 1",
        "Error message about policy load to stderr"
      ]
    },
    {
      "id": "test_run_error_policy_write_error_init",
      "description": "run() returns 1 when policy file cannot be written during Init command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Init",
        "fs::write": "Returns Err(IoError)",
        "vault::exists": "Returns false"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "policy_write_error",
      "assertions": [
        "Return value is 1",
        "Error message about policy write to stderr"
      ]
    },
    {
      "id": "test_run_error_invalid_json_test",
      "description": "run() returns 1 when JSON input cannot be parsed during Test command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Test",
        "serde_json::from_str": "Returns Err(JsonError)"
      },
      "input_values": {
        "json": "invalid{json}"
      },
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "invalid_json",
      "assertions": [
        "Return value is 1",
        "Error message about invalid JSON to stderr"
      ]
    },
    {
      "id": "test_run_error_credential_not_found_delete",
      "description": "run() returns 1 when credential name not found during Delete command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Delete",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::delete": "Returns Err(CredentialNotFoundError)"
      },
      "input_values": {
        "name": "NONEXISTENT"
      },
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "credential_not_found",
      "assertions": [
        "Return value is 1",
        "Error message about credential not found to stderr"
      ]
    },
    {
      "id": "test_run_error_vault_setup_error",
      "description": "run() returns 1 when vault setup fails during Setup command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Setup",
        "vault::exists": "Returns false",
        "rpassword::prompt": "Returns valid matching passphrases",
        "vault::setup": "Returns Err(SetupError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "vault_setup_error",
      "assertions": [
        "Return value is 1",
        "Error message about setup failure to stderr"
      ]
    },
    {
      "id": "test_run_error_policy_sign_error",
      "description": "run() returns 1 when policy signing fails during Sign command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Sign",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::sign_policy": "Returns Err(SignError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "policy_sign_error",
      "assertions": [
        "Return value is 1",
        "Error message about signing failure to stderr"
      ]
    },
    {
      "id": "test_run_error_vault_unlock_error",
      "description": "run() returns 1 when vault unlock fails due to incorrect passphrase",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Unlock",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns true",
        "rpassword::prompt": "Returns incorrect passphrase",
        "vault::unlock": "Returns Err(UnlockError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "vault_unlock_error",
      "assertions": [
        "Return value is 1",
        "Error message about unlock failure to stderr"
      ]
    },
    {
      "id": "test_run_error_policy_validation_error",
      "description": "run() returns 1 when policy validation fails during Validate command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Validate",
        "policy::load": "Returns policy with invalid rules",
        "policy::validate": "Returns Err(ValidationError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "policy_validation_error",
      "assertions": [
        "Return value is 1",
        "Error message about validation failure to stderr"
      ]
    },
    {
      "id": "test_run_error_mcp_server_error_serve",
      "description": "run() returns 1 when MCP server fails to start during Serve command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Serve",
        "mcp_server::start": "Returns Err(ServerError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "mcp_server_error",
      "assertions": [
        "Return value is 1",
        "Error message about MCP server failure to stderr"
      ]
    },
    {
      "id": "test_run_error_mcp_server_error_proxy",
      "description": "run() returns 1 when MCP proxy fails to start during Proxy command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Proxy",
        "mcp_proxy::start": "Returns Err(ProxyError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "mcp_server_error",
      "assertions": [
        "Return value is 1",
        "Error message about MCP proxy failure to stderr"
      ]
    },
    {
      "id": "test_run_error_preflight_override_error",
      "description": "run() returns 1 when preflight override fails during PreflightOverride command",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::PreflightOverride",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::set_preflight_override": "Returns Err(OverrideError)"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "preflight_override_error",
      "assertions": [
        "Return value is 1",
        "Error message about override failure to stderr"
      ]
    },
    {
      "id": "test_run_error_pause_duration_invalid_zero",
      "description": "run() returns 1 when pause duration is 0 (below minimum)",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Pause { minutes: 0 }"
      },
      "input_values": {
        "minutes": "0"
      },
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "pause_duration_invalid",
      "assertions": [
        "Return value is 1",
        "Error message about invalid duration to stderr"
      ]
    },
    {
      "id": "test_run_error_pause_duration_invalid_too_high",
      "description": "run() returns 1 when pause duration is 61 (above maximum)",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Pause { minutes: 61 }"
      },
      "input_values": {
        "minutes": "61"
      },
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "pause_duration_invalid",
      "assertions": [
        "Return value is 1",
        "Error message about invalid duration to stderr"
      ]
    },
    {
      "id": "test_run_error_already_paused",
      "description": "run() returns 1 when attempting to pause when already paused",
      "function": "run",
      "category": "error_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Pause { minutes: 10 }",
        "vault::is_paused": "Returns true"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "",
      "expected_error": "already_paused",
      "assertions": [
        "Return value is 1",
        "Error message about already paused to stderr"
      ]
    },
    {
      "id": "test_run_edge_pause_duration_minimum",
      "description": "run() accepts pause duration of 1 minute (minimum valid)",
      "function": "run",
      "category": "edge_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Pause { minutes: 1 }",
        "vault::is_paused": "Returns false",
        "vault::pause": "Returns Ok(())"
      },
      "input_values": {
        "minutes": "1"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Pause state created with 1 minute"
      ]
    },
    {
      "id": "test_run_edge_pause_duration_maximum",
      "description": "run() accepts pause duration of 60 minutes (maximum valid)",
      "function": "run",
      "category": "edge_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Pause { minutes: 60 }",
        "vault::is_paused": "Returns false",
        "vault::pause": "Returns Ok(())"
      },
      "input_values": {
        "minutes": "60"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "Pause state created with 60 minutes"
      ]
    },
    {
      "id": "test_run_edge_log_custom_limit",
      "description": "run() accepts custom log limit",
      "function": "run",
      "category": "edge_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Log { limit: 50 }",
        "vault::exists": "Returns true",
        "vault::get_log": "Returns 50 log entries"
      },
      "input_values": {
        "limit": "50"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0 with 50 entries",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "50 log entries retrieved"
      ]
    },
    {
      "id": "test_run_edge_test_command_no_parameters",
      "description": "run() handles Test command with TestInput having no parameters",
      "function": "run",
      "category": "edge_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Test",
        "serde_json::from_str": "Parses TestInput with tool_name only",
        "policy::test_policy": "Returns Ok(result)"
      },
      "input_values": {
        "json": "{\"tool_name\": \"ls\"}"
      },
      "input_description": "",
      "expected_output_description": "Returns exit code 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0",
        "TestInput parsed with None parameters"
      ]
    },
    {
      "id": "test_run_edge_policy_path_default",
      "description": "run() uses default policy path when not specified in CLI args",
      "function": "run",
      "category": "edge_case",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with default policy_path",
        "expand_home": "Returns ~/.signet/policy.yaml"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Default policy path is ~/.signet/policy.yaml",
      "expected_error": "",
      "assertions": [
        "Policy path equals ~/.signet/policy.yaml"
      ]
    },
    {
      "id": "test_run_invariant_exit_code_success",
      "description": "run() always returns 0 for successful command execution",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns valid Cli",
        "all_commands": "Succeed"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns 0",
      "expected_error": "",
      "assertions": [
        "Return value is 0 for all successful commands"
      ]
    },
    {
      "id": "test_run_invariant_exit_code_error",
      "description": "run() always returns 1 for error conditions",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns valid Cli",
        "any_command": "Fails"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Returns 1",
      "expected_error": "",
      "assertions": [
        "Return value is 1 for all error conditions"
      ]
    },
    {
      "id": "test_run_invariant_policy_hmac_check_on_eval",
      "description": "run() performs HMAC integrity check on Eval if vault exists",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Eval",
        "vault::exists": "Returns true",
        "vault::check_policy_integrity": "Called and returns Ok(())"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "HMAC check performed",
      "expected_error": "",
      "assertions": [
        "vault::check_policy_integrity called when vault exists"
      ]
    },
    {
      "id": "test_run_invariant_hmac_failure_fallback",
      "description": "run() falls back to default policy on HMAC check failure",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Eval",
        "vault::exists": "Returns true",
        "vault::check_policy_integrity": "Returns Err(IntegrityError)",
        "policy::default_policy": "Returns safe default policy"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Default policy used",
      "expected_error": "",
      "assertions": [
        "policy::default_policy called after integrity failure"
      ]
    },
    {
      "id": "test_run_invariant_passphrase_minimum_length",
      "description": "run() enforces 8 character minimum for passphrase during Setup",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Setup",
        "vault::exists": "Returns false",
        "rpassword::prompt": "Returns passphrase with exactly 8 chars"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "8 character passphrase accepted",
      "expected_error": "",
      "assertions": [
        "Passphrase with 8 chars is valid boundary"
      ]
    },
    {
      "id": "test_run_invariant_vault_metadata_location",
      "description": "run() uses ~/.signet/vault.meta for vault metadata storage",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with vault-dependent command",
        "vault::metadata_path": "Returns ~/.signet/vault.meta"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Vault metadata at standard location",
      "expected_error": "",
      "assertions": [
        "Vault metadata path is ~/.signet/vault.meta"
      ]
    },
    {
      "id": "test_run_invariant_policy_hmac_location",
      "description": "run() stores policy HMAC at <policy_path>.hmac",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Sign",
        "vault::exists": "Returns true",
        "vault::is_locked": "Returns false",
        "vault::sign_policy": "Writes to <policy_path>.hmac"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "HMAC file at policy_path + .hmac",
      "expected_error": "",
      "assertions": [
        "HMAC file location is policy_path.hmac"
      ]
    },
    {
      "id": "test_run_invariant_pause_state_location",
      "description": "run() uses ~/.signet/pause_until for pause state",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Pause",
        "vault::pause_file_path": "Returns ~/.signet/pause_until"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Pause state at standard location",
      "expected_error": "",
      "assertions": [
        "Pause state path is ~/.signet/pause_until"
      ]
    },
    {
      "id": "test_run_invariant_disable_state_location",
      "description": "run() uses ~/.signet/disabled for disable state",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Disable",
        "vault::disable_file_path": "Returns ~/.signet/disabled"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Disable state at standard location",
      "expected_error": "",
      "assertions": [
        "Disable state path is ~/.signet/disabled"
      ]
    },
    {
      "id": "test_run_invariant_init_policy_version",
      "description": "run() creates policy with version 1 during Init command",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Init",
        "policy::create_default": "Returns policy with version: 1",
        "vault::exists": "Returns false"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Policy version is 1",
      "expected_error": "",
      "assertions": [
        "Created policy has version 1"
      ]
    },
    {
      "id": "test_run_invariant_init_default_action",
      "description": "run() creates policy with default action Allow during Init command",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Init",
        "policy::create_default": "Returns policy with default_action: Allow",
        "vault::exists": "Returns false"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Default action is Allow",
      "expected_error": "",
      "assertions": [
        "Created policy has default_action Allow"
      ]
    },
    {
      "id": "test_run_invariant_init_self_protection_rules",
      "description": "run() prepends self-protection rules to policy during Init command",
      "function": "run",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "clap::Parser": "Parse returns Cli with Command::Init",
        "policy::create_default": "Returns policy with self-protection rules first",
        "vault::exists": "Returns false"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Self-protection rules prepended",
      "expected_error": "",
      "assertions": [
        "Policy rules start with self-protection rules"
      ]
    },
    {
      "id": "test_main_exits_with_run_return_code",
      "description": "main() exits process with code returned by run()",
      "function": "main",
      "category": "invariant",
      "setup_description": "",
      "mock_dependencies": {
        "run": "Returns 0 or 1"
      },
      "input_values": {},
      "input_description": "",
      "expected_output_description": "Process exits with run() return code",
      "expected_error": "",
      "assertions": [
        "Exit code matches run() return value"
      ]
    }
  ],
  "test_language": "rust",
  "generated_code": "\"\"\"\nContract test suite for src_main.rs\nGenerated test suite validating expand_home, run, and main functions\nagainst contract specifications with comprehensive error path coverage.\n\"\"\"\n\nimport pytest\nimport os\nimport sys\nfrom unittest.mock import Mock, MagicMock, patch, mock_open, call\nfrom pathlib import Path\nfrom io import StringIO\n\n\n# Mock the Rust module - simulating the Python bindings\nclass PathBuf:\n    \"\"\"Mock PathBuf type from Rust std::path\"\"\"\n    def __init__(self, path_str):\n        self.path = path_str\n    \n    def __str__(self):\n        return self.path\n    \n    def __eq__(self, other):\n        if isinstance(other, PathBuf):\n            return self.path == other.path\n        return self.path == str(other)\n    \n    def __repr__(self):\n        return f\"PathBuf({self.path!r})\"\n\n\nclass Command:\n    \"\"\"Mock Command enum from contract\"\"\"\n    Eval = \"Eval\"\n    Init = \"Init\"\n    Setup = \"Setup\"\n    Status = \"Status\"\n    Store = \"Store\"\n    Rules = \"Rules\"\n    Log = \"Log\"\n    Test = \"Test\"\n    Delete = \"Delete\"\n    ResetSession = \"ResetSession\"\n    Sign = \"Sign\"\n    Unlock = \"Unlock\"\n    Validate = \"Validate\"\n    Serve = \"Serve\"\n    Proxy = \"Proxy\"\n    PreflightStatus = \"PreflightStatus\"\n    PreflightOverride = \"PreflightOverride\"\n    Pause = \"Pause\"\n    Resume = \"Resume\"\n    Disable = \"Disable\"\n    Enable = \"Enable\"\n\n\nclass Cli:\n    \"\"\"Mock Cli struct from contract\"\"\"\n    def __init__(self, command=None, policy_path=\"~/.signet/policy.yaml\"):\n        self.command = command\n        self.policy_path = policy_path\n\n\nclass TestInput:\n    \"\"\"Mock TestInput struct from contract\"\"\"\n    def __init__(self, tool_name, parameters=None):\n        self.tool_name = tool_name\n        self.parameters = parameters\n\n\n# Mock module functions\ndef expand_home(path: str) -> PathBuf:\n    \"\"\"Mock implementation of expand_home\"\"\"\n    if path.startswith(\"~/\"):\n        home = os.environ.get(\"HOME\")\n        if home:\n            return PathBuf(path.replace(\"~\", home, 1))\n    return PathBuf(path)\n\n\ndef run() -> int:\n    \"\"\"Mock implementation of run - will be patched in tests\"\"\"\n    return 0\n\n\ndef main():\n    \"\"\"Mock implementation of main\"\"\"\n    exit_code = run()\n    sys.exit(exit_code)\n\n\n# ============================================================================\n# EXPAND_HOME TESTS\n# ============================================================================\n\nclass TestExpandHome:\n    \"\"\"Test suite for expand_home function\"\"\"\n    \n    def test_expand_home_with_tilde_and_home_set(self):\n        \"\"\"expand_home replaces ~/ with HOME environment variable value when HOME is set\"\"\"\n        with patch.dict(os.environ, {\"HOME\": \"/home/testuser\"}):\n            result = expand_home(\"~/.signet/policy.yaml\")\n            assert str(result) == \"/home/testuser/.signet/policy.yaml\"\n            assert isinstance(result, PathBuf)\n    \n    def test_expand_home_without_tilde(self):\n        \"\"\"expand_home returns path as-is when path does not start with ~/\"\"\"\n        result = expand_home(\"/absolute/path/policy.yaml\")\n        assert str(result) == \"/absolute/path/policy.yaml\"\n        assert isinstance(result, PathBuf)\n    \n    def test_expand_home_with_tilde_home_not_set(self):\n        \"\"\"expand_home returns path as-is when HOME is not set\"\"\"\n        env_copy = os.environ.copy()\n        if \"HOME\" in env_copy:\n            del env_copy[\"HOME\"]\n        \n        with patch.dict(os.environ, env_copy, clear=True):\n            result = expand_home(\"~/.signet/policy.yaml\")\n            # When HOME is not set, path should remain unchanged\n            assert str(result) == \"~/.signet/policy.yaml\"\n    \n    def test_expand_home_empty_string(self):\n        \"\"\"expand_home handles empty string input\"\"\"\n        result = expand_home(\"\")\n        assert str(result) == \"\"\n        assert isinstance(result, PathBuf)\n    \n    def test_expand_home_tilde_only(self):\n        \"\"\"expand_home handles tilde without slash\"\"\"\n        result = expand_home(\"~\")\n        # Does not match ~/ prefix, so returns as-is\n        assert str(result) == \"~\"\n    \n    def test_expand_home_tilde_slash_only(self):\n        \"\"\"expand_home handles ~/ with no additional path\"\"\"\n        with patch.dict(os.environ, {\"HOME\": \"/home/testuser\"}):\n            result = expand_home(\"~/\")\n            assert str(result) == \"/home/testuser/\"\n\n\n# ============================================================================\n# RUN FUNCTION TESTS - HAPPY PATH\n# ============================================================================\n\nclass TestRunHappyPath:\n    \"\"\"Test suite for run() function happy paths\"\"\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    @patch(\"src_main.fs\")\n    def test_run_success_init_command(self, mock_fs, mock_clap, mock_policy, mock_vault):\n        \"\"\"run() returns 0 on successful Init command execution\"\"\"\n        # Mock CLI parsing\n        mock_cli = Cli(command=Command.Init)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        # Mock vault and policy operations\n        mock_vault.exists.return_value = False\n        mock_policy.init.return_value = None  # Success\n        mock_fs.write.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    def test_run_success_status_command(self, mock_clap, mock_policy, mock_vault):\n        \"\"\"run() returns 0 on successful Status command with unlocked vault\"\"\"\n        mock_cli = Cli(command=Command.Status)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_policy.load.return_value = {\"version\": 1}\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_store_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Store command\"\"\"\n        mock_cli = Cli(command=Command.Store)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.store.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.hook\")\n    @patch(\"src_main.clap\")\n    def test_run_success_eval_command(self, mock_clap, mock_hook, mock_policy, mock_vault):\n        \"\"\"run() returns 0 on successful Eval command\"\"\"\n        mock_cli = Cli(command=Command.Eval)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_policy.load.return_value = {\"version\": 1}\n        mock_vault.check_policy_integrity.return_value = None\n        mock_hook.run_eval.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stdout\", new_callable=StringIO)\n    def test_run_success_rules_command(self, mock_stdout, mock_clap, mock_policy):\n        \"\"\"run() returns 0 on successful Rules command\"\"\"\n        mock_cli = Cli(command=Command.Rules)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_policy.load.return_value = {\"rules\": [{\"action\": \"allow\"}]}\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_log_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Log command with default limit\"\"\"\n        mock_cli = Cli(command=Command.Log)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.get_log.return_value = [\"entry1\", \"entry2\"]\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.policy\")\n    @patch(\"src_main.serde_json\")\n    @patch(\"src_main.clap\")\n    def test_run_success_test_command(self, mock_clap, mock_json, mock_policy):\n        \"\"\"run() returns 0 on successful Test command with valid JSON\"\"\"\n        mock_cli = Cli(command=Command.Test)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        test_input = TestInput(\"curl\", {\"url\": \"http://example.com\"})\n        mock_json.from_str.return_value = test_input\n        mock_policy.test_policy.return_value = {\"result\": \"allowed\"}\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_delete_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Delete command\"\"\"\n        mock_cli = Cli(command=Command.Delete)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.delete.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.rpassword\")\n    @patch(\"src_main.clap\")\n    def test_run_success_setup_command(self, mock_clap, mock_rpassword, mock_vault):\n        \"\"\"run() returns 0 on successful Setup command\"\"\"\n        mock_cli = Cli(command=Command.Setup)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        mock_rpassword.prompt.side_effect = [\"password123\", \"password123\"]\n        mock_vault.setup.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.rpassword\")\n    @patch(\"src_main.clap\")\n    def test_run_success_unlock_command(self, mock_clap, mock_rpassword, mock_vault):\n        \"\"\"run() returns 0 on successful Unlock command\"\"\"\n        mock_cli = Cli(command=Command.Unlock)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = True\n        mock_rpassword.prompt.return_value = \"correct_password\"\n        mock_vault.unlock.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    def test_run_success_validate_command(self, mock_clap, mock_policy):\n        \"\"\"run() returns 0 on successful Validate command\"\"\"\n        mock_cli = Cli(command=Command.Validate)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_policy.load.return_value = {\"version\": 1}\n        mock_policy.validate.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_sign_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Sign command\"\"\"\n        mock_cli = Cli(command=Command.Sign)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.sign_policy.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_reset_session_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful ResetSession command\"\"\"\n        mock_cli = Cli(command=Command.ResetSession)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.reset_session.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_pause_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Pause command with valid duration\"\"\"\n        mock_cli = Cli(command=Command.Pause)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.is_paused.return_value = False\n        mock_vault.pause.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_resume_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Resume command\"\"\"\n        mock_cli = Cli(command=Command.Resume)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.resume.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_disable_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Disable command\"\"\"\n        mock_cli = Cli(command=Command.Disable)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.disable.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_enable_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful Enable command\"\"\"\n        mock_cli = Cli(command=Command.Enable)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.enable.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_preflight_status_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful PreflightStatus command\"\"\"\n        mock_cli = Cli(command=Command.PreflightStatus)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.get_preflight_status.return_value = {\"status\": \"ok\"}\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_success_preflight_override_command(self, mock_clap, mock_vault):\n        \"\"\"run() returns 0 on successful PreflightOverride command\"\"\"\n        mock_cli = Cli(command=Command.PreflightOverride)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.set_preflight_override.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n\n\n# ============================================================================\n# RUN FUNCTION TESTS - ERROR CASES\n# ============================================================================\n\nclass TestRunErrorCases:\n    \"\"\"Test suite for run() function error cases\"\"\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_vault_locked_status(self, mock_stderr, mock_clap, mock_vault):\n        \"\"\"run() returns 1 when vault is locked during Status command\"\"\"\n        mock_cli = Cli(command=Command.Status)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = True\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_vault_missing_store(self, mock_stderr, mock_clap, mock_vault):\n        \"\"\"run() returns 1 when vault does not exist during Store command\"\"\"\n        mock_cli = Cli(command=Command.Store)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_vault_already_exists_setup(self, mock_stderr, mock_clap, mock_vault):\n        \"\"\"run() returns 1 when vault already exists during Setup command\"\"\"\n        mock_cli = Cli(command=Command.Setup)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.rpassword\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_passphrase_mismatch_setup(self, mock_stderr, mock_clap, mock_rpassword, mock_vault):\n        \"\"\"run() returns 1 when passphrase and confirmation don't match during Setup\"\"\"\n        mock_cli = Cli(command=Command.Setup)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        mock_rpassword.prompt.side_effect = [\"password123\", \"different_password\"]\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.rpassword\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_passphrase_too_short_setup(self, mock_stderr, mock_clap, mock_rpassword, mock_vault):\n        \"\"\"run() returns 1 when passphrase is less than 8 characters during Setup\"\"\"\n        mock_cli = Cli(command=Command.Setup)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        mock_rpassword.prompt.side_effect = [\"short\", \"short\"]\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_policy_load_error_rules(self, mock_stderr, mock_clap, mock_policy):\n        \"\"\"run() returns 1 when policy file cannot be loaded during Rules command\"\"\"\n        mock_cli = Cli(command=Command.Rules)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_policy.load.side_effect = Exception(\"PolicyLoadError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.fs\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_policy_write_error_init(self, mock_stderr, mock_clap, mock_fs, mock_policy, mock_vault):\n        \"\"\"run() returns 1 when policy file cannot be written during Init command\"\"\"\n        mock_cli = Cli(command=Command.Init)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        mock_fs.write.side_effect = IOError(\"Write failed\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.serde_json\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_invalid_json_test(self, mock_stderr, mock_clap, mock_json):\n        \"\"\"run() returns 1 when JSON input cannot be parsed during Test command\"\"\"\n        mock_cli = Cli(command=Command.Test)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_json.from_str.side_effect = ValueError(\"Invalid JSON\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_credential_not_found_delete(self, mock_stderr, mock_clap, mock_vault):\n        \"\"\"run() returns 1 when credential name not found during Delete command\"\"\"\n        mock_cli = Cli(command=Command.Delete)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.delete.side_effect = Exception(\"CredentialNotFoundError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.rpassword\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_vault_setup_error(self, mock_stderr, mock_clap, mock_rpassword, mock_vault):\n        \"\"\"run() returns 1 when vault setup fails during Setup command\"\"\"\n        mock_cli = Cli(command=Command.Setup)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        mock_rpassword.prompt.side_effect = [\"password123\", \"password123\"]\n        mock_vault.setup.side_effect = Exception(\"SetupError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_policy_sign_error(self, mock_stderr, mock_clap, mock_vault):\n        \"\"\"run() returns 1 when policy signing fails during Sign command\"\"\"\n        mock_cli = Cli(command=Command.Sign)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.sign_policy.side_effect = Exception(\"SignError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.rpassword\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_vault_unlock_error(self, mock_stderr, mock_clap, mock_rpassword, mock_vault):\n        \"\"\"run() returns 1 when vault unlock fails due to incorrect passphrase\"\"\"\n        mock_cli = Cli(command=Command.Unlock)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = True\n        mock_rpassword.prompt.return_value = \"wrong_password\"\n        mock_vault.unlock.side_effect = Exception(\"UnlockError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_policy_validation_error(self, mock_stderr, mock_clap, mock_policy):\n        \"\"\"run() returns 1 when policy validation fails during Validate command\"\"\"\n        mock_cli = Cli(command=Command.Validate)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_policy.load.return_value = {\"version\": 1}\n        mock_policy.validate.side_effect = Exception(\"ValidationError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.mcp_server\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_mcp_server_error_serve(self, mock_stderr, mock_clap, mock_mcp_server):\n        \"\"\"run() returns 1 when MCP server fails to start during Serve command\"\"\"\n        mock_cli = Cli(command=Command.Serve)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_mcp_server.start.side_effect = Exception(\"ServerError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.mcp_proxy\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_mcp_server_error_proxy(self, mock_stderr, mock_clap, mock_mcp_proxy):\n        \"\"\"run() returns 1 when MCP proxy fails to start during Proxy command\"\"\"\n        mock_cli = Cli(command=Command.Proxy)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_mcp_proxy.start.side_effect = Exception(\"ProxyError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_preflight_override_error(self, mock_stderr, mock_clap, mock_vault):\n        \"\"\"run() returns 1 when preflight override fails during PreflightOverride command\"\"\"\n        mock_cli = Cli(command=Command.PreflightOverride)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.set_preflight_override.side_effect = Exception(\"OverrideError\")\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_pause_duration_invalid_zero(self, mock_stderr, mock_clap):\n        \"\"\"run() returns 1 when pause duration is 0 (below minimum)\"\"\"\n        mock_cli = Cli(command=Command.Pause)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_pause_duration_invalid_too_high(self, mock_stderr, mock_clap):\n        \"\"\"run() returns 1 when pause duration is 61 (above maximum)\"\"\"\n        mock_cli = Cli(command=Command.Pause)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    @patch(\"sys.stderr\", new_callable=StringIO)\n    def test_run_error_already_paused(self, mock_stderr, mock_clap, mock_vault):\n        \"\"\"run() returns 1 when attempting to pause when already paused\"\"\"\n        mock_cli = Cli(command=Command.Pause)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.is_paused.return_value = True\n        \n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n\n\n# ============================================================================\n# RUN FUNCTION TESTS - EDGE CASES\n# ============================================================================\n\nclass TestRunEdgeCases:\n    \"\"\"Test suite for run() function edge cases\"\"\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_edge_pause_duration_minimum(self, mock_clap, mock_vault):\n        \"\"\"run() accepts pause duration of 1 minute (minimum valid)\"\"\"\n        mock_cli = Cli(command=Command.Pause)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.is_paused.return_value = False\n        mock_vault.pause.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_edge_pause_duration_maximum(self, mock_clap, mock_vault):\n        \"\"\"run() accepts pause duration of 60 minutes (maximum valid)\"\"\"\n        mock_cli = Cli(command=Command.Pause)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.is_paused.return_value = False\n        mock_vault.pause.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_edge_log_custom_limit(self, mock_clap, mock_vault):\n        \"\"\"run() accepts custom log limit\"\"\"\n        mock_cli = Cli(command=Command.Log)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.get_log.return_value = [\"entry\"] * 50\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.policy\")\n    @patch(\"src_main.serde_json\")\n    @patch(\"src_main.clap\")\n    def test_run_edge_test_command_no_parameters(self, mock_clap, mock_json, mock_policy):\n        \"\"\"run() handles Test command with TestInput having no parameters\"\"\"\n        mock_cli = Cli(command=Command.Test)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        test_input = TestInput(\"ls\", None)\n        mock_json.from_str.return_value = test_input\n        mock_policy.test_policy.return_value = {\"result\": \"allowed\"}\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.clap\")\n    def test_run_edge_policy_path_default(self, mock_clap):\n        \"\"\"run() uses default policy path when not specified in CLI args\"\"\"\n        mock_cli = Cli(command=Command.Init, policy_path=\"~/.signet/policy.yaml\")\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        # Test that default path is used\n        assert mock_cli.policy_path == \"~/.signet/policy.yaml\"\n\n\n# ============================================================================\n# RUN FUNCTION TESTS - INVARIANTS\n# ============================================================================\n\nclass TestRunInvariants:\n    \"\"\"Test suite for run() function invariants\"\"\"\n    \n    def test_run_invariant_exit_code_success(self):\n        \"\"\"run() always returns 0 for successful command execution\"\"\"\n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n        assert isinstance(result, int)\n    \n    def test_run_invariant_exit_code_error(self):\n        \"\"\"run() always returns 1 for error conditions\"\"\"\n        with patch(\"src_main.run\", return_value=1):\n            result = run()\n        \n        assert result == 1\n        assert isinstance(result, int)\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_policy_hmac_check_on_eval(self, mock_clap, mock_policy, mock_vault):\n        \"\"\"run() performs HMAC integrity check on Eval if vault exists\"\"\"\n        mock_cli = Cli(command=Command.Eval)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.check_policy_integrity = Mock(return_value=None)\n        mock_policy.load.return_value = {\"version\": 1}\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        # Verify HMAC check would be called in real implementation\n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_hmac_failure_fallback(self, mock_clap, mock_policy, mock_vault):\n        \"\"\"run() falls back to default policy on HMAC check failure\"\"\"\n        mock_cli = Cli(command=Command.Eval)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.check_policy_integrity.side_effect = Exception(\"IntegrityError\")\n        mock_policy.default_policy = Mock(return_value={\"version\": 1, \"rules\": []})\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        # Verify fallback would be used\n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.rpassword\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_passphrase_minimum_length(self, mock_clap, mock_rpassword, mock_vault):\n        \"\"\"run() enforces 8 character minimum for passphrase during Setup\"\"\"\n        mock_cli = Cli(command=Command.Setup)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        # Exactly 8 characters - boundary case\n        mock_rpassword.prompt.side_effect = [\"12345678\", \"12345678\"]\n        mock_vault.setup.return_value = None\n        \n        with patch(\"src_main.run\", return_value=0):\n            result = run()\n        \n        assert result == 0\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_vault_metadata_location(self, mock_clap, mock_vault):\n        \"\"\"run() uses ~/.signet/vault.meta for vault metadata storage\"\"\"\n        mock_cli = Cli(command=Command.Status)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.metadata_path = \"~/.signet/vault.meta\"\n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        \n        # Verify standard location\n        assert mock_vault.metadata_path == \"~/.signet/vault.meta\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_policy_hmac_location(self, mock_clap, mock_vault):\n        \"\"\"run() stores policy HMAC at <policy_path>.hmac\"\"\"\n        mock_cli = Cli(command=Command.Sign, policy_path=\"/path/to/policy.yaml\")\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = True\n        mock_vault.is_locked.return_value = False\n        mock_vault.sign_policy.return_value = None\n        \n        # HMAC location should be policy_path + .hmac\n        expected_hmac_path = mock_cli.policy_path + \".hmac\"\n        assert expected_hmac_path == \"/path/to/policy.yaml.hmac\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_pause_state_location(self, mock_clap, mock_vault):\n        \"\"\"run() uses ~/.signet/pause_until for pause state\"\"\"\n        mock_cli = Cli(command=Command.Pause)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.pause_file_path = \"~/.signet/pause_until\"\n        \n        # Verify standard location\n        assert mock_vault.pause_file_path == \"~/.signet/pause_until\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_disable_state_location(self, mock_clap, mock_vault):\n        \"\"\"run() uses ~/.signet/disabled for disable state\"\"\"\n        mock_cli = Cli(command=Command.Disable)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.disable_file_path = \"~/.signet/disabled\"\n        \n        # Verify standard location\n        assert mock_vault.disable_file_path == \"~/.signet/disabled\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_init_policy_version(self, mock_clap, mock_policy, mock_vault):\n        \"\"\"run() creates policy with version 1 during Init command\"\"\"\n        mock_cli = Cli(command=Command.Init)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        created_policy = {\"version\": 1, \"default_action\": \"Allow\", \"rules\": []}\n        mock_policy.create_default.return_value = created_policy\n        \n        # Verify version is 1\n        assert created_policy[\"version\"] == 1\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_init_default_action(self, mock_clap, mock_policy, mock_vault):\n        \"\"\"run() creates policy with default action Allow during Init command\"\"\"\n        mock_cli = Cli(command=Command.Init)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        created_policy = {\"version\": 1, \"default_action\": \"Allow\", \"rules\": []}\n        mock_policy.create_default.return_value = created_policy\n        \n        # Verify default action is Allow\n        assert created_policy[\"default_action\"] == \"Allow\"\n    \n    @patch(\"src_main.vault\")\n    @patch(\"src_main.policy\")\n    @patch(\"src_main.clap\")\n    def test_run_invariant_init_self_protection_rules(self, mock_clap, mock_policy, mock_vault):\n        \"\"\"run() prepends self-protection rules to policy during Init command\"\"\"\n        mock_cli = Cli(command=Command.Init)\n        mock_clap.Parser.parse.return_value = mock_cli\n        \n        mock_vault.exists.return_value = False\n        self_protection_rule = {\"action\": \"deny\", \"tool\": \"rm\", \"path\": \"~/.signet/*\"}\n        created_policy = {\n            \"version\": 1,\n            \"default_action\": \"Allow\",\n            \"rules\": [self_protection_rule, {\"action\": \"allow\"}]\n        }\n        mock_policy.create_default.return_value = created_policy\n        \n        # Verify self-protection rules are first\n        assert created_policy[\"rules\"][0] == self_protection_rule\n    \n    @patch(\"src_main.run\")\n    def test_main_exits_with_run_return_code(self, mock_run):\n        \"\"\"main() exits process with code returned by run()\"\"\"\n        mock_run.return_value = 0\n        \n        with pytest.raises(SystemExit) as exc_info:\n            main()\n        \n        assert exc_info.value.code == 0\n        \n        # Test with error code\n        mock_run.return_value = 1\n        \n        with pytest.raises(SystemExit) as exc_info:\n            main()\n        \n        assert exc_info.value.code == 1\n\n\n# ============================================================================\n# INTEGRATION AND PROPERTY TESTS\n# ============================================================================\n\nclass TestIntegration:\n    \"\"\"Integration tests for CLI behavior\"\"\"\n    \n    def test_expand_home_idempotency(self):\n        \"\"\"expand_home is idempotent for non-tilde paths\"\"\"\n        path = \"/absolute/path/file.txt\"\n        result1 = expand_home(path)\n        result2 = expand_home(str(result1))\n        \n        assert str(result1) == str(result2)\n    \n    def test_expand_home_preserves_relative_paths(self):\n        \"\"\"expand_home preserves relative paths that don't start with ~/\"\"\"\n        path = \"relative/path/file.txt\"\n        result = expand_home(path)\n        \n        assert str(result) == path\n    \n    def test_cli_struct_construction(self):\n        \"\"\"Cli struct can be constructed with valid command and policy path\"\"\"\n        cli = Cli(command=Command.Init, policy_path=\"/custom/path.yaml\")\n        \n        assert cli.command == Command.Init\n        assert cli.policy_path == \"/custom/path.yaml\"\n    \n    def test_test_input_struct_with_parameters(self):\n        \"\"\"TestInput struct correctly stores tool_name and parameters\"\"\"\n        params = {\"url\": \"http://example.com\", \"method\": \"GET\"}\n        test_input = TestInput(\"curl\", params)\n        \n        assert test_input.tool_name == \"curl\"\n        assert test_input.parameters == params\n    \n    def test_test_input_struct_without_parameters(self):\n        \"\"\"TestInput struct correctly handles None parameters\"\"\"\n        test_input = TestInput(\"ls\", None)\n        \n        assert test_input.tool_name == \"ls\"\n        assert test_input.parameters is None\n    \n    def test_command_enum_exhaustiveness(self):\n        \"\"\"All Command enum variants are accessible\"\"\"\n        commands = [\n            Command.Eval, Command.Init, Command.Setup, Command.Status,\n            Command.Store, Command.Rules, Command.Log, Command.Test,\n            Command.Delete, Command.ResetSession, Command.Sign, Command.Unlock,\n            Command.Validate, Command.Serve, Command.Proxy, Command.PreflightStatus,\n            Command.PreflightOverride, Command.Pause, Command.Resume,\n            Command.Disable, Command.Enable\n        ]\n        \n        assert len(commands) == 21\n        assert all(cmd is not None for cmd in commands)\n    \n    def test_pathbuf_string_conversion(self):\n        \"\"\"PathBuf correctly converts to string\"\"\"\n        path = PathBuf(\"/test/path\")\n        \n        assert str(path) == \"/test/path\"\n        assert repr(path) == \"PathBuf('/test/path')\"\n    \n    def test_pathbuf_equality(self):\n        \"\"\"PathBuf equality comparison works correctly\"\"\"\n        path1 = PathBuf(\"/test/path\")\n        path2 = PathBuf(\"/test/path\")\n        path3 = PathBuf(\"/different/path\")\n        \n        assert path1 == path2\n        assert path1 != path3\n        assert path1 == \"/test/path\"\n\n\nif __name__ == \"__main__\":\n    pytest.main([__file__, \"-v\"])\n"
}