fix: stop the provider-drift gate asserting third-party tenant presence

[blisspixel]

What went red

The scheduled Provider drift job failed on 2026-08-05, its first failure in four runs. test_resolve_second_reserved_domain failed on:

assert 'Could not resolve display name or default domain' is None
 +  where ... = SourceResult(source_name='user_realm', ...).error

Nothing regressed

example.org no longer has a third-party Microsoft 365 tenant registered against it. Verified live against both endpoints:

Domain	GetUserRealm	OIDC discovery
example.com	State: 3, NameSpaceType: Federated	200, tenant c7c08208-…
example.org	State: 4, NameSpaceType: Unknown	400 AADSTS90002: Tenant 'example.org' not found

UserRealmSource handles that correctly. Unknown is not in _TENANT_NAMESPACE_TYPES, Autodiscover returns no domains, so has_data is false and the source returns a stable negative: error set, source_unavailable false, degraded_sources empty.

That split is deliberate and documented on the model (models.py:679):

True only when the source had no observation opportunity because of a transport, protocol, or internal failure. A stable negative response uses error with this flag false. The distinction prevents failed sources from being interpreted as observed absence during merge and delta.

source_unavailable is what merger.py:459 consumes for the degraded set, and SourceResult.error only reaches a user through _raise_if_all_sources_failed, which requires every source to error. DNS succeeded here, so the negative was never surfaced as a failure. No shipped behavior changed and no user-visible output was ever wrong.

What was actually wrong

The gate asserted user_realm.error is None, which is asserting that a tenant exists. That is third-party registration state. example.com passes only because someone currently holds a Federated tenant on it, and that can lapse exactly the way example.org's did.

The helper's own docstring already warned about this — "third parties have been observed registering M365 tenants against example.com, so the state of that specific field is outside our control" — while the shared assertion did the opposite.

The fix

Assert two things the project does control:

1. Transport and parse health — source_unavailable is False and no identity:user_realm degradation marker.
2. Agreement with the provider — read NameSpaceType straight from GetUserRealm in the test, then require recon's auth_type to match it under recon's own _TENANT_NAMESPACE_TYPES.

The raw read also asserts the response is a JSON object carrying a string NameSpaceType. That is the contract UserRealmSource parses, so a field rename or shape change now fails loudly instead of silently producing no auth type while the source still looks healthy — a drift class the old assertion could not distinguish from tenant churn.

Why this is stricter, not weaker

Both branches are exercised today:

example.com: NameSpaceType='Federated' -> tenant-positive branch=True
example.org: NameSpaceType='Unknown'   -> tenant-positive branch=False

example.com takes the exact-agreement assertion, which the old gate never made. Neither branch depends on who owns a tenant.

Verification

• uv run pytest tests/test_integration.py -m integration -q — 3 passed
• uv run python scripts/check.py — all 26 stages pass, coverage 91.41% against the 90.2% floor

[Copilot]

Pull request overview

Updates the scheduled provider-drift integration gate so it no longer asserts third-party Microsoft 365 tenant presence on reserved domains, and instead validates provider contract shape plus recon’s interpretation alignment.

Changes:

• Adds a raw GetUserRealm read in integration tests to treat NameSpaceType as drift-gate ground truth.
• Updates the reserved-domain health assertion to check transport/parse health and to compare auth_type against the provider’s NameSpaceType when tenant-positive.
• Documents the drift-gate behavior change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tests/test_integration.py	Reworks provider-drift assertions to avoid tenant-presence coupling; adds direct GetUserRealm contract check and auth-type agreement check.
CHANGELOG.md	Records the provider-drift gate fix and clarifies that shipped behavior was unchanged.

Suppressed comments (1)

tests/test_integration.py:80

• In the tenant-positive branch (NameSpaceType in _TENANT_NAMESPACE_TYPES), also assert user_realm.error is None, and in the stable-negative branch assert user_realm.error is not None. Without these, a regression could set error while still leaving auth_type unset/set and the gate wouldn’t distinguish a stable negative from an inconsistent SourceResult state.

    if realm_namespace in _TENANT_NAMESPACE_TYPES:
        assert user_realm.auth_type == realm_namespace
        assert "user_realm" in info.sources
    else:
        # A stable negative. Per ``SourceResult.source_unavailable``, that case

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.