Accept systemd credential delivery and clarify manual K1 control

tests/test_node_k1_bridge.py

@@ -70,6 +70,39 @@ def bridge():
     return result
 
 
+@pytest.mark.parametrize("available", [False, True])
+def test_startup_credential_check_does_not_authorize_control(monkeypatch, available):
+    from k1link.device_plugins.xgrids_k1 import node_bridge
+    from k1link.device_plugins.xgrids_k1.protocol.application_authority import (
+        ApplicationAuthorityLoadError,
+    )
+
+    calls = []
+
+    class Loader:
+        def load(self):
+            calls.append("load")
+            if not available:
+                raise ApplicationAuthorityLoadError("Unavailable")
+            return object()
+
+    monkeypatch.setattr(node_bridge, "_validate_installed_compatibility_profile", lambda _: None)
+    monkeypatch.setattr(node_bridge, "LinuxApplicationAuthorityLoader", Loader)
+    monkeypatch.setattr(node_bridge, "XgridsK1CompatibilityService", lambda *a, **kw: object())
+    device = NodeBridge(Path.cwd())
+    device.facade = Facade()
+    device.facade.current["connection_lifecycle"] = {"connection_ready": False}
+
+    async def read():
+        for _ in range(2):
+            snapshot = await device.state()
+            assert snapshot["application_authority_available"] is available
+            assert snapshot["connected"] is False
+
+    asyncio.run(read())
+    assert calls == ["load"]
+
+
 def test_journalled_failure_logs_source_without_secret_and_does_not_repeat(caplog):
     from bleak.exc import BleakError
 
@@ -352,6 +385,27 @@ def test_sensor_projection_binds_native_sdk_to_board():
     assert value["kind"] == "k1"
 
 
+def test_applied_wifi_does_not_grant_control_or_start_authority():
+    current = state()
+    current["connection_lifecycle"] = {
+        "connection_ready": False, "ready_to_start": False,
+        "allowed_actions": ["verify-control-read-only"],
+    }
+    current["connection_attempt"] = {
+        "phase": "network_applied", "public_error_code": "application_authority_unavailable",
+    }
+    item = project_sensor(current, "node-test")
+    assert not item["online"] and not item["verified"]
+    assert item["control"]["network_applied"]
+    assert item["control"]["reason_code"] == "application_authority_unavailable"
+    assert not item["control"]["can_start"]
+    assert item["control"]["can_verify"]
+    current["connection_lifecycle"].update(connection_ready=True, ready_to_start=True)
+    item = project_sensor(current, "node-test")
+    assert item["online"] and item["verified"] and item["control"]["can_start"]
+    assert item["control"]["reason_code"] is None
+
+
 def test_one_start_intent_preserves_canonical_enter_prepare_start_sequence():
     async def run():
         device = bridge()