Derive repository grant count from reviewed policy - #1013

Scope

Concurrent inventory-grant additions currently require editing the same numeric test assertion. Derive its expected repository-grant count from the policy's repository rows so future grant additions need no test-count edit, while preserving the independent exact Git-inventory comparison.

• Reviewed landing head: 42b2b03986b8de23018c387c502443fad790ba18; the CC builder rebased and pushed the two commits, with carry PASS. The grant test is byte-identical to the previously reviewed 0ce65753 (Git blob af578dc204a38750752b36d485dbe347f6006c31). Merged at 2026-10-11T22:21:44Z.
• Base commit: bcf55c457d057c71faceeab068bdd02017c43342 (current main at branch creation).
• Lane: lane:foundation.
• Owned paths: tests/test_local_pages_policy_grants.py and its hash/byte registration in manifests/evidence.json.

SOTA sources

• Existing reviewed policy and selector at native-agent-stack bcf55c457d057c71faceeab068bdd02017c43342: source_policy.json, inventory_paths, and the existing independent inventory assertion at tests/test_local_pages_policy_grants.py:74-81. The policy and production selector are unchanged.
• CPython cbc944f4bc59639a444dd971c737788ba2283a91 (installed Python 3.13.16 reference mirror): Python/bltinmodule.c:2578, supported sum over the Boolean repository-row predicate; Lib/unittest/mock.py:1764, supported temporary fixture patches. Exact pinned-source excerpts/blob identities are retained in the local evidence packet.
• The base policy loader tools/local-pages/source_policy.py:251-260 collects grants into a set, so duplicate repository rows were accepted before this PR; the new row-count guard rejects them.
• Existing supported file-registration API, scripts/host_receipts.py:710, updates only the touched test's registration.

Evidence-class table

Why the derivation is not vacuous

The count compares unique policy paths with the number of repository policy rows, so duplicate rows now also fail. The previous literal counted unique paths and accepted duplicate rows; rejecting duplicates is new in this PR. The existing actual == expected assertion remains unchanged: expected still comes independently from git ls-files through the existing reviewed selector and catalog metadata. A missing or extra grant fails that exact-set comparison, and a replacement with the same cardinality also fails. The four negative controls exercise these boundaries; every other original test method is unchanged.

Local commands run

python3 -m unittest tests.test_local_pages_policy_grants.PolicyGrantDerivation.test_inventory_check_accepts_one_more_grant_without_changing_the_count
Before count correction: exit 1, one assertion failure, zero errors (92 != 91).

python3 -m unittest tests.test_local_pages_policy_grants
After correction: exit 0, 23 tests passed.

python3 scripts/validate.py
Exit 0: 70 components, 11,630 hashed files, 4 profiles, 239 receipts.

Retained local packet: ~/.local/state/native-agent-stack/coordination/ns2604-coop/lanes/engine-qual.grant-count-20261011/, including exact fail-before test bytes, input/output hashes, observed exits and pinned source excerpts. This is the original 7cdeacd packet; its historical method name and body used "still" for duplicate refusal and are superseded by the correction.

Current wording-correction packet: ~/.local/state/native-agent-stack/coordination/ns2604-coop/lanes/engine-qual.grant-count-wording-20261011/, with the renamed final source, current test/validator observations and the base-versus-head duplicate control.

Decision record

No repository rule or production grant changes. This adopts a source-derived test expectation within the existing policy/selector contract.

Host evidence

Not applicable: no evidence/hosts/ receipt or platform-status change.

Follow-ups

• Astra P3 inherited host-label hygiene: 20 pre-existing occurrences on 18 lines in manifests/evidence.json, counted only; no identifier is published here. Later normalization must update dependent integrity records together.
• F2 (pre-existing P3), scripts/local_pages_policy_grants.py:48-53: the selector adds fixed and catalog paths without checking that they are tracked. Deleting a fixed path from the index can leave this test green at both base and head; follow up separately after landing.

The CC owns the landing order; this PR is merged at the head/time above and made no edits to peer PR branches.

Checklist

• No workflow or action changes.
• No secrets printed, logged or committed; no new required secret.
• No paid hosting, subscription or billing surface.
• Peer-owned worktrees and untracked files preserved.
• Original derivation commit plus one tiny wording correction; policy checks and independent inventory comparison retained.