feat: pass deployment receipts to configuration providers

tests/test_configuration_package_context.py

@@ -6,6 +6,9 @@ import unittest
 from unittest.mock import patch
 
 from govoplan_access.backend.api.v1.routes import _configuration_context
+from govoplan_core.core.infrastructure_capabilities import (
+    InfrastructureCapabilityReceiptError,
+)
 from govoplan_core.core.provider_governance import (
     ExternalProviderRuntimeState,
     ExternalProviderStateProviderRegistration,
@@ -13,6 +16,54 @@ from govoplan_core.core.provider_governance import (
 
 
 class ConfigurationPackageContextTests(unittest.TestCase):
+    def test_context_carries_operator_scopes_and_validated_infrastructure_receipt(self) -> None:
+        receipt = SimpleNamespace(installation_id="deployment-1")
+        principal = SimpleNamespace(
+            tenant_id="tenant-1",
+            user=SimpleNamespace(id="user-1"),
+            scopes=frozenset({"system:settings:write"}),
+        )
+
+        with (
+            patch(
+                "govoplan_access.backend.api.v1.routes.get_registry",
+                return_value=None,
+            ),
+            patch(
+                "govoplan_access.backend.api.v1.routes.load_infrastructure_capability_receipt",
+                return_value=receipt,
+            ),
+        ):
+            context = _configuration_context(principal)
+
+        self.assertIs(receipt, context.infrastructure_receipt)
+        self.assertEqual(
+            frozenset({"system:settings:write"}),
+            context.operator_scopes,
+        )
+
+    def test_context_preserves_invalid_receipt_as_fail_closed_provider_state(self) -> None:
+        principal = SimpleNamespace(
+            tenant_id="tenant-1",
+            user=SimpleNamespace(id="user-1"),
+            scopes=frozenset(),
+        )
+
+        with (
+            patch(
+                "govoplan_access.backend.api.v1.routes.get_registry",
+                return_value=None,
+            ),
+            patch(
+                "govoplan_access.backend.api.v1.routes.load_infrastructure_capability_receipt",
+                side_effect=InfrastructureCapabilityReceiptError("invalid receipt"),
+            ),
+        ):
+            context = _configuration_context(principal)
+
+        self.assertIsNone(context.infrastructure_receipt)
+        self.assertEqual("invalid receipt", context.infrastructure_receipt_error)
+
     def test_context_projects_installed_external_provider_declarations(self) -> None:
         declaration = SimpleNamespace(
             id="connectors.example",