Test BW Manager deploy endpoint safety gates

tests/test_bw_manager_deploy.py

@@ -0,0 +1,32 @@
+import importlib.util
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def load_app(monkeypatch):
+    monkeypatch.setenv("BUTLER_TOKEN", "test-token")
+    spec = importlib.util.spec_from_file_location("butler_bw_test", ROOT / "app.py")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_bw_manager_deploy_rejects_bundle_without_and_gate(monkeypatch):
+    app = load_app(monkeypatch)
+    files = {path: "placeholder" for path in app.BW_MANAGER_REPO_FILES}
+    files["compose.yaml"] = "services:\n  bw-manager:\n    build: ./src\n"
+    files["src/app.py"] = "def old_policy(): pass\n"
+
+    with pytest.raises(ValueError, match="AND gate"):
+        app._deploy_bw_manager_compose(files)
+
+
+def test_bw_manager_deploy_endpoint_requires_auth(monkeypatch):
+    app = load_app(monkeypatch)
+    response = TestClient(app.app).post("/vps/bw-manager/deploy")
+    assert response.status_code in (401, 403)