From 86aa06aa612f14fdcefb3d2bbb73b8e50261a20d Mon Sep 17 00:00:00 2001
From: mika <211269698+mikamikasuki@users.noreply.github.com>
Date: Wed, 7 Oct 2026 19:22:01 -0700
Subject: [PATCH 1/2] test(public-safety): distinguish file URL rejection
 messages

Signed-off-by: mika <211269698+mikamikasuki@users.noreply.github.com>
---
 .../test_remote_location_shape_owner.py       | 25 +++++++++++++------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/tests/control_plane/test_remote_location_shape_owner.py b/tests/control_plane/test_remote_location_shape_owner.py
index cc155e19f6..7aa7987b68 100644
--- a/tests/control_plane/test_remote_location_shape_owner.py
+++ b/tests/control_plane/test_remote_location_shape_owner.py
@@ -38,21 +38,24 @@
 # (site label, entry point, the message that site raises for a raw location).
 # Each row goes through the real entry point so the test proves the wiring, not just
 # the pattern; the messages differ per site on purpose.
-SITES: list[tuple[str, Callable[[str], str], str]] = [
+SITES: list[tuple[str, Callable[[str], str], str, str]] = [
     (
         "decision_context",
         lambda value: packets._compact_text(value, field="source_ref"),
         "must use an opaque source reference, not a raw URL",
+        "must not contain a local path",
     ),
     (
         "material_lifecycle",
         lambda value: _validation.compact_text(value, field="source_ref"),
         "must use an opaque reference, not a raw URL",
+        "must not contain a local path",
     ),
     (
         "ml_experiment",
         lambda value: ml_experiment._compact_public_text(value, field="dataset_ref"),
         "must use a public alias, not a raw URL or remote path",
+        "must use a public alias, not a raw URL or remote path",
     ),
 ]
 
@@ -99,22 +102,28 @@ def test_owner_shape_still_leaves_unlisted_schemes_alone() -> None:
     )
 
 
-@pytest.mark.parametrize("label,call,message", SITES)
+@pytest.mark.parametrize("label,call,remote_message,file_url_message", SITES)
 def test_each_site_rejects_a_raw_location_through_its_own_entry_point(
-    label: str, call: Callable[[str], str], message: str
+    label: str,
+    call: Callable[[str], str],
+    remote_message: str,
+    file_url_message: str,
 ) -> None:
-    for value in (
-        "s3://loopx-artifacts/run-7/metrics.json",
-        "file:///Users/dev/model.bin",
+    for value, message in (
+        ("s3://loopx-artifacts/run-7/metrics.json", remote_message),
+        ("file:///Users/dev/model.bin", file_url_message),
     ):
         with pytest.raises(ValueError) as caught:
             call(value)
         assert message in str(caught.value), (label, value)
 
 
-@pytest.mark.parametrize("label,call,_message", SITES)
+@pytest.mark.parametrize("label,call,_remote_message,_file_url_message", SITES)
 def test_each_site_still_accepts_an_opaque_reference(
-    label: str, call: Callable[[str], str], _message: str
+    label: str,
+    call: Callable[[str], str],
+    _remote_message: str,
+    _file_url_message: str,
 ) -> None:
     """Positive control on the same entry point with no injected fault."""
     assert call("run-7/metrics.json") == "run-7/metrics.json"

From e5e9c3438f51491c5321c0546fd6c9ab647920dc Mon Sep 17 00:00:00 2001
From: mika <211269698+mikamikasuki@users.noreply.github.com>
Date: Wed, 7 Oct 2026 19:35:55 -0700
Subject: [PATCH 2/2] test(public-safety): assert local-path receipt diagnostic

Signed-off-by: mika <211269698+mikamikasuki@users.noreply.github.com>
---
 tests/test_loopx_turn_executor.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_loopx_turn_executor.py b/tests/test_loopx_turn_executor.py
index 26528e3d1f..6c804a4c39 100644
--- a/tests/test_loopx_turn_executor.py
+++ b/tests/test_loopx_turn_executor.py
@@ -1061,7 +1061,7 @@ def test_enabled_host_result_rejects_receipt_local_path() -> None:
         (
             "evidence_refs",
             ["file:/tmp/private-result.json"],
-            "opaque 1-192 character public-safe reference",
+            "contains a local path",
         ),
     ],
 )