Harden M8 preflight foundation

tests/test_collection_api.py

@@ -37,7 +37,10 @@ def app():
         app = create_app()
         app.config["TESTING"] = True
 
-    yield app
+        # Keep the environment override active for the entire test. Registry
+        # request handlers open fresh connections rather than reusing the one
+        # created during app initialization.
+        yield app
 
     # Cleanup
     Path(db_path).unlink(missing_ok=True)
@@ -155,6 +158,74 @@ class TestToolApprovedEndpoint:
         assert data['data']['has_approved_public_version'] is False
 
 
+@flask_required
+class TestPublishPreflightEndpoint:
+    def test_dry_run_includes_shared_preflight(self, client, auth_headers):
+        response = client.post(
+            "/api/v1/tools",
+            headers=auth_headers,
+            json={
+                "dry_run": True,
+                "config": (
+                    "name: preflight-tool\n"
+                    "version: 1.0.0\n"
+                    "description: Constant output\n"
+                    "output: constant\n"
+                    "input_schema:\n  type: string\n"
+                    "output_schema:\n  type: string\n"
+                ),
+            },
+        )
+
+        assert response.status_code == 200
+        report = response.get_json()["data"]["preflight"]
+        assert report["errors"] == []
+
+    def test_invalid_contract_is_rejected(self, client, auth_headers):
+        response = client.post(
+            "/api/v1/tools",
+            headers=auth_headers,
+            json={
+                "dry_run": True,
+                "config": (
+                    "name: invalid-contract\n"
+                    "version: 1.0.0\n"
+                    "output_schema:\n  type: nonsense\n"
+                ),
+            },
+        )
+
+        assert response.status_code == 400
+        assert response.get_json()["error"]["code"] == "INVALID_CONFIG"
+
+    def test_non_mapping_config_is_rejected(self, client, auth_headers):
+        response = client.post(
+            "/api/v1/tools",
+            headers=auth_headers,
+            json={"dry_run": True, "config": "- not\n- a\n- tool\n"},
+        )
+
+        assert response.status_code == 400
+        assert response.get_json()["error"]["code"] == "VALIDATION_ERROR"
+
+    def test_legacy_source_string_remains_publishable(self, client, auth_headers):
+        response = client.post(
+            "/api/v1/tools",
+            headers=auth_headers,
+            json={
+                "dry_run": True,
+                "config": (
+                    "name: legacy-source\n"
+                    "version: 1.0.0\n"
+                    "source: old/tool\n"
+                    "output: constant\n"
+                ),
+            },
+        )
+
+        assert response.status_code == 200
+
+
 @flask_required
 class TestPostCollectionsEndpoint:
     """Tests for POST /api/v1/collections endpoint."""