Freeze SCUM SQLite template run contract

platform/validator/scum_live_data_test.go

@@ -85,6 +85,45 @@ func TestValidateSCUMSchemaProbeResultAcceptsRunTerminalStatuses(t *testing.T) {
 	}
 }
 
+func TestValidateSCUMSQLiteTemplateRequestAllowsBoundedGenericTemplate(t *testing.T) {
+	request := validatorSCUMSQLiteTemplateRequest()
+
+	if err := ValidateSCUMSQLiteTemplateRequest(request); err != nil {
+		t.Fatalf("expected valid SQLite template request, got %v", err)
+	}
+}
+
+func TestValidateSCUMSQLiteTemplateRequestRejectsSQLPathsAndLooseBounds(t *testing.T) {
+	request := validatorSCUMSQLiteTemplateRequest()
+	request.TemplateKey = "select * from players"
+	request.Parameters = map[string]any{"profilePath": `C:\SCUM\Saved\SCUM.db`}
+	request.Bounds.MaxRows = 50000
+
+	err := ValidateSCUMSQLiteTemplateRequest(request)
+	if err == nil || !strings.Contains(err.Error(), "templateKey is unsafe") || !strings.Contains(err.Error(), "protected material") || !strings.Contains(err.Error(), "maxRows") {
+		t.Fatalf("expected template/key/bounds violations, got %v", err)
+	}
+}
+
+func TestValidateSCUMSQLiteTemplateResultAcceptsTypedRows(t *testing.T) {
+	result := validatorSCUMSQLiteTemplateResult()
+
+	if err := ValidateSCUMSQLiteTemplateResult(result); err != nil {
+		t.Fatalf("expected valid SQLite template result, got %v", err)
+	}
+}
+
+func TestValidateSCUMSQLiteTemplateResultRejectsUnsafeRowsAndMismatchedCounts(t *testing.T) {
+	result := validatorSCUMSQLiteTemplateResult()
+	result.RowCount = 2
+	result.Rows[0]["displayName"] = "select * from user_profile"
+
+	err := ValidateSCUMSQLiteTemplateResult(result)
+	if err == nil || !strings.Contains(err.Error(), "rowCount") || !strings.Contains(err.Error(), "protected material") {
+		t.Fatalf("expected row-count and protected-row violations, got %v", err)
+	}
+}
+
 func TestValidateSCUMCapabilityEvidenceRequiresSafeCurrentServiceIdentity(t *testing.T) {
 	evidence := domain.SCUMCapabilityEvidence{Capability: domain.SCUMDataCapabilityPlayerRead, Status: domain.SCUMCapabilityEvidenceCompatible, Binding: validatorSCUMBinding(), AdapterVersion: "adapter-1", SchemaFingerprint: scumProbeHash, ProbeResultDigest: scumProbeHash, AssetDigests: []string{scumProbeHash}, SafeError: domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone}}
 	if err := ValidateSCUMCapabilityEvidence(evidence); err != nil {
@@ -100,3 +139,12 @@ func TestValidateSCUMCapabilityEvidenceRequiresSafeCurrentServiceIdentity(t *tes
 func validatorSCUMBinding() domain.SCUMBindingIdentity {
 	return domain.SCUMBindingIdentity{ServerInstanceID: "server-1", RunBindingID: "binding-1", RunEndpointID: "run-1", PluginID: "game.scum", PluginVersion: "0.1.6", AdapterVersion: "adapter-1", GameVersion: "scum-1", DatabaseIdentity: "db-fingerprint-1"}
 }
+
+func validatorSCUMSQLiteTemplateRequest() domain.SCUMSQLiteTemplateRequest {
+	return domain.SCUMSQLiteTemplateRequest{RequestID: "request-1", JobID: "job-1", Binding: validatorSCUMBinding(), Capability: domain.SCUMDataCapabilityPlayerRead, TargetKey: "scum-database", TemplateKey: "players.active.v1", AdapterVersion: "adapter-1", RequiredSchemaFingerprint: scumProbeHash, AssetDigest: scumProbeHash, ParameterDigest: scumProbeHash, Parameters: map[string]any{"cursor": "", "limit": 100.0}, Bounds: domain.DefaultSCUMSQLiteTemplateBounds(), RequestedAt: time.Now()}
+}
+
+func validatorSCUMSQLiteTemplateResult() domain.SCUMSQLiteTemplateResult {
+	request := validatorSCUMSQLiteTemplateRequest()
+	return domain.SCUMSQLiteTemplateResult{RequestID: request.RequestID, JobID: request.JobID, Binding: request.Binding, Status: domain.SCUMTerminalResultSucceeded, Capability: request.Capability, TargetKey: request.TargetKey, TemplateKey: request.TemplateKey, AdapterVersion: request.AdapterVersion, SchemaFingerprint: request.RequiredSchemaFingerprint, AssetDigest: request.AssetDigest, ParameterDigest: request.ParameterDigest, SourceFingerprint: scumProbeHash, ObservedAt: time.Now(), ResultDigest: scumProbeHash, RowCount: 1, Rows: []map[string]any{{"externalPlayerId": "player-redacted", "displayName": "Known Player", "fame": 12.5, "online": true, "squadId": nil}}, Limits: request.Bounds, SafeError: domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone}}
+}