feat: add verifiable audit evidence bundles

tests/test_audit_module_contract.py

@@ -15,7 +15,7 @@ class AuditModuleContractTests(unittest.TestCase):
         project = tomllib.loads((ROOT / "pyproject.toml").read_text(encoding="utf-8"))["project"]
         dependencies = tuple(project["dependencies"])
 
-        self.assertIn("govoplan-core>=0.1.8", dependencies)
+        self.assertTrue(any(item.startswith("govoplan-core>=") for item in dependencies))
         self.assertFalse(any(item.startswith("govoplan-access") for item in dependencies))
 
     def test_audit_source_does_not_import_access_implementation(self) -> None:
@@ -40,6 +40,22 @@ class AuditModuleContractTests(unittest.TestCase):
         operations = topics["audit.recording-retention-and-outbox"]
         self.assertIn("audit.retention", operations.metadata["help_contexts"])
 
+    def test_evidence_export_permissions_are_module_owned_and_scope_separated(self) -> None:
+        manifest = get_manifest()
+        permissions = {item.scope: item for item in manifest.permissions}
+
+        self.assertEqual("tenant", permissions["audit:evidence:export"].level)
+        self.assertEqual("system", permissions["audit:system_evidence:export"].level)
+        roles = {item.slug: item for item in manifest.role_templates}
+        self.assertIn(
+            "audit:evidence:export",
+            roles["audit_evidence_exporter"].permissions,
+        )
+        self.assertIn(
+            "audit:system_evidence:export",
+            roles["audit_system_evidence_exporter"].permissions,
+        )
+
 
 if __name__ == "__main__":
     unittest.main()