#355 test(engine): cover role boundary batch worst-wins

[Anonymous]

Originally created by: jasperdingg

Pull Request

Slice

• Repo: doberman-core
• Feature / Slice: Issue [#227]
• Plan reference: Issue [#227]

What this PR does

Adds a parameterized test confirming that a blocked path produces BLOCK regardless of whether it appears first or last in raw_paths.

Closes [#227].

Tests added (run in CI)

• Tests allowed-first/blocked-last and blocked-first/allowed-last ordering.
• Verified by breaking the severity comparison and first-result behavior, both mutations made the test fail and were reverted.

Public-release safety (doberman-core only)

• [x] Contains no enterprise code, proprietary detection, customer data, secrets, or commercial-license code
• [x] Core still builds/tests/runs without the enterprise package

Security checklist

• [x] Fails closed on error / uncertainty
• [x] No secret, full file, or unredacted prompt logged or committed
• [x] The change protects a raise-only invariant
• [x] BLOCK assertions include the expected reason code
• [x] doberman-core does not import doberman_enterprise

Edge cases covered / Deviations from plan / Risks introduced

• Covers both path orderings.
• No deviations or runtime risks; test-only change.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed

[Anonymous]

Originally posted by: fu351

Exactly the coverage that was missing — nothing exercised the multi-path raw_paths batch before this, only single-target. Testing both orderings (blocked-first and blocked-last) is the right call: it pins worst-wins against the two ways it actually regresses, classifying only action.target, or flipping the severity comparison so the last path wins. Merging now.

If you want another in the same vein, [#334] asks for a test proving the AUTH deadline auto-deny stays distinct from a plain timeout — same invariant-pinning instinct, a step up in difficulty. I can assign it to you if you'd like it.

Thanks, jasperdingg.