Release v0.1.8

tests/test_policy_contracts.py

@@ -115,6 +115,16 @@ class PolicyContractTests(unittest.TestCase):
         self.assertTrue(allowed.allowed, allowed.to_dict())
         self.assertEqual(allowed.secret_handling, "reference_only")
 
+        compound_secret = plan_configuration_change(
+            "files.connector_profiles",
+            actor_scopes=("tenant:*",),
+            value={"auth": {"bearer_token": "plain-secret"}, "credential_ref": "env:FILES_TOKEN"},
+            dry_run=True,
+            approval_count=2,
+        )
+        self.assertFalse(compound_secret.allowed)
+        self.assertIn("secret_reference_required", compound_secret.blockers)
+
         env_only = plan_configuration_change("DATABASE_URL", actor_scopes=("system:*",), value="postgresql://example")
         self.assertFalse(env_only.allowed)
         self.assertIn("deployment_managed", env_only.blockers)