Harden flow advancement exit assertions

tests/test_routers_core.py

@@ -370,3 +370,25 @@ class TestFlowEndpoints:
 
         r = await client.get(f"/workstreams/{ws['id']}")
         assert r.json()["status"] == "finished"
+
+    async def test_advance_workstream_respects_current_exit_assertions(self, client):
+        await _create_domain(client)
+        topic = await _create_topic(client)
+        ws = await _create_workstream(client, topic["id"], slug="exit-blocked-ws")
+        dependency_ws = await _create_workstream(client, topic["id"], slug="unfinished-dep")
+        task = await _create_task(client, ws["id"])
+        await client.patch(f"/tasks/{task['id']}", json={"status": "done"})
+        await client.post(
+            f"/workstreams/{ws['id']}/dependencies/",
+            json={
+                "to_workstream_id": dependency_ws["id"],
+                "description": "Dependency must finish first",
+            },
+        )
+
+        r = await client.post(f"/flows/workstream/{ws['id']}/advance/finished")
+        assert r.status_code == 409
+        assert r.json()["detail"]["blocking_assertions"][0]["id"] == "dependencies.all_complete"
+
+        r = await client.get(f"/workstreams/{ws['id']}")
+        assert r.json()["status"] == "active"

tests/test_task_flow_engine.py

@@ -64,6 +64,50 @@ def test_failing_exit_assertion_identifies_blocking_assertion():
     assert result.blocking_assertions[0].actual == ["done", "todo"]
 
 
+def test_can_reach_checks_current_exit_assertions_before_target_entry():
+    flow = FlowDef(
+        id="workstream.test",
+        entity_type="workstream",
+        workstations=[
+            WorkstationDef(
+                name="active",
+                exit_assertions=[
+                    AssertionDef(
+                        id="dependencies.all_complete",
+                        target="dependencies.*.workstation",
+                        op="all_eq",
+                        value=["finished", "archived"],
+                    )
+                ],
+            ),
+            WorkstationDef(
+                name="finished",
+                entry_assertions=[
+                    AssertionDef(
+                        id="tasks.all_done",
+                        target="tasks.*.status",
+                        op="all_eq",
+                        value=["done", "cancelled"],
+                    )
+                ],
+            ),
+        ],
+    )
+
+    can_reach, failures = FlowEngine().can_reach(
+        {
+            "status": "active",
+            "tasks": [{"status": "done"}],
+            "dependencies": [{"workstation": "active"}],
+        },
+        flow,
+        "finished",
+    )
+
+    assert can_reach is False
+    assert [item.id for item in failures] == ["dependencies.all_complete"]
+
+
 def test_custom_op_callable_is_invoked():
     calls = []