feat: add institutional governance and recovery contracts

tests/test_install_config.py

@@ -186,6 +186,44 @@ class InstallConfigTests(unittest.TestCase):
             ).file_storage_s3_deployment_managed
         )
 
+    def test_external_s3_requires_explicit_https_deployment_trust(self) -> None:
+        base = {
+            "APP_ENV": "development",
+            "FILE_STORAGE_BACKEND": "s3",
+            "FILE_STORAGE_S3_ENDPOINT_URL": "https://s3.example.test",
+            "FILE_STORAGE_S3_REGION": "eu-test-1",
+            "FILE_STORAGE_S3_ACCESS_KEY_ID": "access",
+            "FILE_STORAGE_S3_SECRET_ACCESS_KEY": "secret",
+            "FILE_STORAGE_S3_BUCKET": "files",
+            "FILE_STORAGE_S3_DEPLOYMENT_MANAGED": "false",
+        }
+        rejected = validate_runtime_configuration(base, profile="development")
+        accepted = validate_runtime_configuration(
+            {**base, "FILE_STORAGE_S3_ENDPOINT_TRUSTED": "true"},
+            profile="development",
+        )
+        insecure = validate_runtime_configuration(
+            {
+                **base,
+                "FILE_STORAGE_S3_ENDPOINT_URL": "http://s3.example.test",
+                "FILE_STORAGE_S3_ENDPOINT_TRUSTED": "true",
+            },
+            profile="development",
+        )
+
+        self.assertIn(
+            "FILE_STORAGE_S3_ENDPOINT_TRUSTED",
+            {issue.key for issue in rejected.errors},
+        )
+        self.assertNotIn(
+            "FILE_STORAGE_S3_ENDPOINT_TRUSTED",
+            {issue.key for issue in accepted.errors},
+        )
+        self.assertIn(
+            "FILE_STORAGE_S3_ENDPOINT_URL",
+            {issue.key for issue in insecure.errors},
+        )
+
     def test_connector_deployment_allowlists_require_exact_names_and_absolute_paths(self) -> None:
         result = validate_runtime_configuration(
             {
@@ -215,6 +253,7 @@ class InstallConfigTests(unittest.TestCase):
         self.assertIn("GOVOPLAN_HTTP_HSTS_SECONDS=31536000", self_hosted)
         self.assertIn("AUTH_LOGIN_THROTTLE_IDENTITY_LIMIT=10", self_hosted)
         self.assertIn("FILE_STORAGE_S3_DEPLOYMENT_MANAGED=false", self_hosted)
+        self.assertIn("FILE_STORAGE_S3_ENDPOINT_TRUSTED=false", self_hosted)
         self.assertIn("GOVOPLAN_INSTALL_PROFILE=production-like", production_like)
         self.assertNotIn("MASTER_KEY_B64=<generate", production_like)
         self.assertIn("CALENDAR_OUTBOX_TERMINAL_RETENTION_DAYS=90", production_like)
@@ -229,6 +268,10 @@ class InstallConfigTests(unittest.TestCase):
             "FILE_STORAGE_S3_DEPLOYMENT_MANAGED=false",
             production_like,
         )
+        self.assertIn(
+            "FILE_STORAGE_S3_ENDPOINT_TRUSTED=false",
+            production_like,
+        )
 
 
 if __name__ == "__main__":