fix(platform): govern geospatial analysis and raster handoffs

backend/tests/test_sprint236_bathymetry_expansion.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 from datetime import UTC, datetime
-import json
 from pathlib import Path
 import ssl
 import sys
@@ -31,7 +30,7 @@ if str(SCRIPTS) not in sys.path:
     sys.path.insert(0, str(SCRIPTS))
 
 import provision_flanders_geographic_scope as flanders_scope  # noqa: E402
-from tests.frontend_contract import read_map_workspace, read_feature
+from tests.frontend_contract import read_map_workspace, read_feature  # noqa: E402
 
 
 class BinaryResponse:
@@ -136,6 +135,32 @@ def test_mdk_probe_parses_capabilities_without_enabling_acquisition() -> None:
     assert seen["timeout"] == 20
 
 
+def test_mdk_probe_default_opener_uses_guarded_strict_tls_path(monkeypatch) -> None:
+    seen = {}
+
+    def guarded_factory(expected_url):
+        seen["expected_url"] = expected_url
+
+        def open_request(request, timeout):
+            seen["request_url"] = request.full_url
+            seen["timeout"] = timeout
+            return BinaryResponse(capabilities_xml())
+
+        return open_request
+
+    monkeypatch.setattr(
+        "app.services.mdk_bathymetry_probe_service.guarded_opener",
+        guarded_factory,
+    )
+
+    result = MdkBathymetryProbeService.probe(settings=Settings(_env_file=None))
+
+    assert result["status"] == "reachable"
+    assert seen["expected_url"] == seen["request_url"]
+    assert seen["expected_url"].startswith("https://")
+    assert seen["timeout"] == 20
+
+
 def test_mdk_probe_reports_tls_failure_and_never_uses_insecure_fallback() -> None:
     calls = 0