Enforce fixture interaction policy

tests/test_fixtures.py

@@ -32,6 +32,7 @@ class FixtureCheckTest(unittest.TestCase):
                                 "protocol": "ipfs",
                                 "url": "ipfs://bafyexample",
                                 "checks": {"transport": "ipfs", "profile": "ipfs"},
+                                "interaction": {"tier": "static"},
                             },
                         ],
                     }
@@ -70,6 +71,58 @@ class FixtureCheckTest(unittest.TestCase):
         self.assertEqual("fail", result.checks[0].status)
         self.assertIn("transport expected tor got clearnet", result.checks[0].message)
 
+    def test_rejects_transactional_ipfs_fixture(self) -> None:
+        result = _check_one(
+            "ipfs",
+            "ipfs://bafyexample",
+            {"tier": "transactional", "payments": "server-invoice"},
+        )
+
+        self.assertFalse(result.ok)
+        self.assertIn("tier transactional exceeds ipfs max static", result.checks[0].message)
+        self.assertIn("payments server-invoice not allowed on ipfs", result.checks[0].message)
+
+    def test_allows_transactional_tor_fixture(self) -> None:
+        result = _check_one(
+            "tor",
+            "http://example.onion/",
+            {"tier": "transactional", "identity": "http-session", "payments": "server-invoice"},
+        )
+
+        self.assertTrue(result.ok)
+
+    def test_allows_interactive_lite_gemini_but_rejects_realtime(self) -> None:
+        ok = _check_one("gemini", "gemini://example.test/", {"tier": "interactive-lite"})
+        bad = _check_one("gemini", "gemini://example.test/", {"tier": "realtime", "realtime": True})
+
+        self.assertTrue(ok.ok)
+        self.assertFalse(bad.ok)
+        self.assertIn("tier realtime exceeds gemini max interactive-lite", bad.checks[0].message)
+        self.assertIn("realtime not allowed on gemini", bad.checks[0].message)
+
+
+def _check_one(transport: str, url: str, interaction: dict) -> object:
+    with tempfile.TemporaryDirectory() as tmp:
+        path = Path(tmp) / "manifest.json"
+        path.write_text(
+            json.dumps(
+                {
+                    "schema": "ampg.fixture-manifest.v1",
+                    "site": {"id": "example", "domain": "example.test"},
+                    "fixtures": [
+                        {
+                            "protocol": transport,
+                            "url": url,
+                            "checks": {"transport": transport, "profile": transport},
+                            "interaction": interaction,
+                        }
+                    ],
+                }
+            ),
+            encoding="utf-8",
+        )
+        return check_fixture_manifest(path)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_interaction_policy.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+import unittest
+
+from ampbrowser.interaction_policy import interaction_failures
+
+
+class InteractionPolicyTest(unittest.TestCase):
+    def test_static_ipfs_is_allowed(self) -> None:
+        self.assertEqual(
+            [],
+            interaction_failures(
+                "ipfs",
+                tier="static",
+                identity="none",
+                payments="none",
+                realtime=False,
+                public_allowed=True,
+            ),
+        )
+
+    def test_public_allowed_false_fails(self) -> None:
+        failures = interaction_failures(
+            "tor",
+            tier="static",
+            identity="none",
+            payments="none",
+            realtime=False,
+            public_allowed=False,
+        )
+
+        self.assertEqual(["fixture is not public_allowed"], failures)
+
+
+if __name__ == "__main__":
+    unittest.main()