fix(arch-008,arch-009): canonical 2-segment permission schema enforced; fix dead role wildcard patterns

tests/test_arch_block_a.py

@@ -129,3 +129,71 @@ class TestGetFileMetadataAsync:
 
         meta = get_file_metadata('nonexistent/sync.txt')
         assert meta == {'size': None, 'modified': None, 'exists': False}
+
+
+# --- ARCH-008/009: 2-segment permission canonical schema ---
+
+
+import re as _re
+
+from app.core.permissions import _matches_permission
+
+_THREE_SEGMENT = _re.compile(r'^[a-z_]+:[a-z_]+:[a-z_*]+$')
+
+
+class TestMatchesPermissionCanonical:
+    def test_two_segment_wildcards(self):
+        assert _matches_permission('*:*', 'contacts:read') is True
+        assert _matches_permission('contacts:*', 'contacts:read') is True
+        assert _matches_permission('*:read', 'contacts:read') is True
+        assert _matches_permission('contacts:read', 'contacts:read') is True
+
+    def test_three_segment_grant_never_matches(self):
+        assert _matches_permission('core:*:read', 'contacts:read') is False
+
+    def test_segment_count_mismatch(self):
+        assert _matches_permission('contacts:read', 'contacts:read:extra') is False
+
+
+class TestRouteLiteralsTwoSegment:
+    def test_no_three_segment_literals_in_routes(self):
+        import pathlib
+
+        routes_dir = pathlib.Path('/a0/usr/projects/leocrm/app/routes')
+        offenders = []
+        for py_file in sorted(routes_dir.glob('*.py')):
+            text = py_file.read_text()
+            for m in _re.finditer(r'require_permission\(([^)]*)\)', text):
+                arg = m.group(1).strip()
+                if not arg:
+                    continue
+                value = arg.strip('\'"')
+                if ':' in value and value.count(':') != 1:
+                    offenders.append(f'{py_file.name}: {value}')
+        assert offenders == [], f'3-segment permission literals found: {offenders}'
+
+
+class TestManifestPermissionValidator:
+    def test_valid_permissions_accepted(self):
+        from app.plugins.manifest import PluginManifest
+
+        manifest = PluginManifest(
+            name='x',
+            version='1.0.0',
+            display_name='X',
+            permissions=['contacts:read', '*:*'],
+        )
+        assert manifest.permissions == ['contacts:read', '*:*']
+
+    def test_three_segment_rejected(self):
+        from pydantic import ValidationError
+
+        from app.plugins.manifest import PluginManifest
+
+        with pytest.raises(ValidationError):
+            PluginManifest(
+                name='x',
+                version='1.0.0',
+                display_name='X',
+                permissions=['core:contacts:read'],
+            )