Add durable platform event delivery contract

tests/test_core_events.py

@@ -13,6 +13,7 @@ from sqlalchemy.orm import Session
 
 from govoplan_core.audit.logging import audit_event, audit_operation_context
 from govoplan_core.core.events import (
+    DurableEventConsumer,
     EventActorRef,
     EventBus,
     EventObjectRef,
@@ -41,6 +42,42 @@ def _configure_audit_runtime() -> None:
 
 
 class CoreEventTests(unittest.TestCase):
+    def test_durable_consumer_requires_policy_for_classified_events(self) -> None:
+        with self.assertRaisesRegex(ValueError, "policy decision"):
+            DurableEventConsumer(
+                consumer_id="workflow.triggers.v1",
+                classifications=frozenset({"restricted"}),
+                handler=lambda _event, _delivery_key: None,
+            )
+
+        consumer = DurableEventConsumer(
+            consumer_id="workflow.triggers.v1",
+            event_types=frozenset({"case.changed"}),
+            classifications=frozenset(
+                {"internal", "confidential"}
+            ),
+            policy_decision_ref="policy:decision:1",
+            handler=lambda _event, _delivery_key: None,
+        )
+        accepted = PlatformEvent(
+            type="case.changed",
+            module_id="cases",
+            classification="confidential",
+            event_id="event-1",
+        )
+        rejected = PlatformEvent(
+            type="case.deleted",
+            module_id="cases",
+            classification="confidential",
+        )
+
+        self.assertTrue(consumer.accepts(accepted))
+        self.assertFalse(consumer.accepts(rejected))
+        self.assertEqual(
+            "event-1:workflow.triggers.v1",
+            consumer.delivery_key(accepted),
+        )
+
     def test_fallback_event_waits_for_outer_commit_after_savepoint(self) -> None:
         engine = create_engine("sqlite:///:memory:")
         seen: list[PlatformEvent] = []