docs(accuracy): refresh governed scan and training evidence

backend/tests/test_accuracy_phase3_full_data_scan.py

@@ -9,7 +9,13 @@ from pathlib import Path
 SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "run_accuracy_phase3_full_data_scan.py"
 
 
-def run_scan(repo: Path, output: Path, *, resume: bool = False) -> dict:
+def run_scan(
+    repo: Path,
+    output: Path,
+    *,
+    resume: bool = False,
+    unreachable_scopes: tuple[str, ...] = (),
+) -> dict:
     command = [
         sys.executable,
         str(SCRIPT),
@@ -24,6 +30,8 @@ def run_scan(repo: Path, output: Path, *, resume: bool = False) -> dict:
     ]
     if resume:
         command.append("--resume")
+    for scope in unreachable_scopes:
+        command.extend(("--unreachable-scope", scope))
     completed = subprocess.run(command, check=True, capture_output=True, text=True)
     return json.loads(completed.stdout)
 
@@ -57,8 +65,18 @@ def test_phase3_scan_reconciles_and_resumes_deterministically(tmp_path: Path) ->
     (data / "broken.tif").write_bytes(b"not a geotiff")
 
     output = tmp_path / "evidence"
-    first = run_scan(tmp_path, output)
-    second = run_scan(tmp_path, output, resume=True)
+    unreachable_scopes = (
+        "external://tower-corpora=Tower corpora are not mounted in this fixture",
+        "external://mounted-model-volumes=Model volumes are not mounted in this fixture",
+        "external://production-postgis-or-api=Production database is not configured in this fixture",
+    )
+    first = run_scan(tmp_path, output, unreachable_scopes=unreachable_scopes)
+    second = run_scan(
+        tmp_path,
+        output,
+        resume=True,
+        unreachable_scopes=unreachable_scopes,
+    )
     manifest = json.loads((output / "full-scan-manifest.json").read_text(encoding="utf-8"))
     quarantine = json.loads((output / "quarantine-manifest.json").read_text(encoding="utf-8"))
 
@@ -68,3 +86,46 @@ def test_phase3_scan_reconciles_and_resumes_deterministically(tmp_path: Path) ->
     assert any(item["path"] == "data/broken.tif" for item in quarantine["items"])
     assert any(item["path"] == "data/invalid.geojson" for item in quarantine["items"])
     assert len(manifest["duplicates"]["exact_duplicate_groups"]) == 1
+
+
+def test_phase3_scan_does_not_invent_unreachable_production_boundaries(
+    tmp_path: Path,
+) -> None:
+    data = tmp_path / "data"
+    data.mkdir()
+    (data / "present.json").write_text("{}", encoding="utf-8")
+    output = tmp_path / "evidence"
+
+    result = run_scan(tmp_path, output)
+
+    assert result["reconciliation"] == {
+        "examined": 1,
+        "skipped": 0,
+        "unreachable": 0,
+        "inventory_total": 1,
+        "reconciles": True,
+    }
+
+
+def test_phase3_scan_records_a_missing_requested_root(tmp_path: Path) -> None:
+    output = tmp_path / "evidence"
+    completed = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT),
+            "--repo-root",
+            str(tmp_path),
+            "--output-dir",
+            str(output),
+            "--roots",
+            "missing-data",
+        ],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    result = json.loads(completed.stdout)
+    manifest = json.loads((output / "full-scan-manifest.json").read_text(encoding="utf-8"))
+
+    assert result["reconciliation"]["unreachable"] == 1
+    assert manifest["items"][0]["path"] == "root://missing-data"