feat(governance): add agent market automation surfaces

apps/api/tests/test_javascript_package_inventory_api.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from src.api.v1.agents import router
+
+
+def test_javascript_package_inventory_endpoint_returns_committed_snapshot():
+    app = FastAPI()
+    app.include_router(router, prefix="/api/v1")
+    client = TestClient(app)
+
+    response = client.get("/api/v1/agents/javascript-package-inventory")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["schema_version"] == "javascript_package_inventory_v1"
+    assert data["program_status"]["overall_completion_percent"] == 95
+    assert data["program_status"]["read_only_mode"] is True
+    assert data["program_status"]["next_task_id"] == "P1-203"
+    assert data["lockfile_summary"]["status"] == "in_sync"
+    assert data["lockfile_summary"]["write_allowed"] is False
+    assert data["rollups"]["total_workspaces"] == len(data["workspaces"]) == 6
+    assert data["rollups"]["total_direct_dependencies"] == 51
+    assert data["rollups"]["manifest_lock_mismatch_count"] == 0
+    assert data["rollups"]["missing_in_lockfile_count"] == 0
+    assert data["rollups"]["extra_in_lockfile_count"] == 0
+    assert data["operation_boundaries"]["package_installation_allowed"] is False
+    assert data["operation_boundaries"]["lockfile_write_allowed"] is False
+    assert data["operation_boundaries"]["npm_audit_allowed"] is False
+    assert any(finding["finding_id"] == "apps_web_caret_range_exposure" for finding in data["drift_findings"])