feat(provenance): govern source snapshots and data inputs

backend/tests/test_sprint17_export_foundation.py

@@ -8,7 +8,7 @@ from fastapi.testclient import TestClient
 
 from app.core.errors import AppError
 from app.main import app
-from app.models import Area, Dataset, Export, Project, QualityCheck
+from app.models import Area, Dataset, Export, Project, QualityCheck, SourceRegistry, SourceSnapshot
 from app.schemas.export import ExportCreateResponse
 from app.services.export_service import ExportService
 from app.services.storage_service import StorageService
@@ -66,13 +66,57 @@ class FakeSession:
         return row
 
 
+def _govern_fixture_dataset(dataset: Dataset) -> Dataset:
+    """Give an export fixture a governed authoritative source identity.
+
+    Export is a production boundary: test data must model a source that could
+    cross it, rather than using the deliberately QA-only ``fixture`` source.
+    """
+
+    source_id = uuid4()
+    snapshot_id = uuid4()
+    checksum = "a" * 64
+    source = SourceRegistry(
+        id=source_id,
+        source_key="grb",
+        display_name="GRB export test source",
+        classification="authoritative",
+        authority_name="Digitaal Vlaanderen",
+        authority_scope_json={"zone": "Flanders"},
+        usage_policy_json={"ground_truth_allowed": True},
+    )
+    snapshot = SourceSnapshot(
+        id=snapshot_id,
+        source_registry_id=source_id,
+        snapshot_key=f"export-grb-{dataset.id}",
+        checksum_sha256=checksum,
+        ingest_status="ingested",
+        freshness_status="current",
+    )
+    dataset.source = "grb"
+    dataset.source_name = "grb"
+    dataset.checksum_sha256 = checksum
+    dataset.source_registry_id = source_id
+    dataset.source_snapshot_id = snapshot_id
+    dataset.data_contract_key = "geointel.vector.geojson"
+    dataset.data_contract_version = "1.0.0"
+    dataset.validation_status = "passed"
+    dataset.provenance_status = "complete"
+    dataset.lineage_status = "not_applicable"
+    dataset.quarantine_status = "not_quarantined"
+    dataset.status = "ready"
+    dataset.source_registry = source
+    dataset.source_snapshot = snapshot
+    return dataset
+
+
 def test_dataset_geojson_export_persists_export_and_writes_artifact(tmp_path, monkeypatch) -> None:
     project_id = uuid4()
     dataset_id = uuid4()
     dataset_path = tmp_path / "input.geojson"
     dataset_path.write_text(json.dumps({"type": "FeatureCollection", "features": []}), encoding="utf-8")
     export_path = tmp_path / "exports" / "buildings.geojson"
-    dataset = Dataset(
+    dataset = _govern_fixture_dataset(Dataset(
         id=dataset_id,
         project_id=project_id,
         name="buildings.geojson",
@@ -80,7 +124,7 @@ def test_dataset_geojson_export_persists_export_and_writes_artifact(tmp_path, mo
         source="fixture",
         storage_path=str(dataset_path),
         status="ready",
-    )
+    ))
     db = FakeSession({(Dataset, dataset_id): dataset})
     monkeypatch.setattr(StorageService, "dataset_export_path", lambda *_args: str(export_path))