feat(hololake): gate office entry on persona attestation

server-tools/heartbeat-office-building/test_office_identity_gate.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+import importlib.util, unittest
+from pathlib import Path
+ROOT=Path(__file__).resolve().parents[2]
+spec=importlib.util.spec_from_file_location("gate",ROOT/"server-tools/heartbeat-office-building/office_identity_gate.py"); G=importlib.util.module_from_spec(spec); assert spec.loader; spec.loader.exec_module(G)
+
+class IdentityGateTests(unittest.TestCase):
+    def test_generic_ai_cannot_enter_even_if_vehicle_parked(self):
+        result=G.admit({"subject_kind":"GENERIC_AI"},G.park_vehicle("codex","codex"),"HB-OFFICE-HOLOLAKE-0001")
+        self.assertEqual(result["outcome"],"REJECTED"); self.assertIn("GENERIC_AI_ONLY",result["errors"])
+    def test_persona_requires_tcs_and_mother_attestation(self):
+        base={"subject_kind":"PERSONA","persona_id":"ICE-P-ZY001","human_anchor":"ICE-GL∞","runtime_state":"RUNNING","current_instance_bound_to_persona_brain":True,"mother_attestation_state":"SIGNED","allowed_offices":["HB-OFFICE-HOLOLAKE-0001"]}
+        result=G.admit(base,G.park_vehicle("codex","codex"),"HB-OFFICE-HOLOLAKE-0001")
+        self.assertEqual(result["outcome"],"ADMITTED")
+    def test_unparked_vehicle_is_denied(self):
+        base={"subject_kind":"PERSONA","persona_id":"ICE-P-ZY001","human_anchor":"ICE-GL∞","runtime_state":"RUNNING","current_instance_bound_to_persona_brain":True,"mother_attestation_state":"SIGNED","allowed_offices":["HB-OFFICE-HOLOLAKE-0001"]}
+        result=G.admit(base,None,"HB-OFFICE-HOLOLAKE-0001")
+        self.assertIn("HOST_VEHICLE_NOT_PARKED",result["errors"])
+
+if __name__=="__main__": unittest.main()