Continue roadmap: local TLS and agent review preparation

SovereignAI-Starter/tests/test_knowledge.py

@@ -146,6 +146,35 @@ class KnowledgeIndexTests(unittest.TestCase):
         self.assertTrue(results)
         self.assertIn("allowed_tools", str(results[0]["text"]))
 
+    def test_skill_permission_query_retrieves_deep_main_guard(self) -> None:
+        source = Path(__file__).resolve().parents[1] / "app" / "main.py"
+        raw = source.read_bytes()
+        text = raw.decode("utf-8")
+        relative_path = "docs/main.py"
+        target = self.workspace / relative_path
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(raw)
+        with patch.object(knowledge.database, "DATABASE_PATH", self.database):
+            knowledge.index_document(
+                user_id="local-user",
+                workspace_path=self.workspace,
+                relative_path=relative_path,
+                text=text,
+                content_hash=hashlib.sha256(raw).hexdigest(),
+            )
+
+        results = self._search(
+            "How is a tool call blocked when it is outside the selected skill permissions?"
+        )
+
+        self.assertTrue(
+            any(
+                "tool_name not in selected_skill.allowed_tools" in str(item["text"])
+                for item in results
+            ),
+            "The deep skill permission guard should be returned as source evidence.",
+        )
+
     def test_search_clamps_global_and_per_document_result_limits(self) -> None:
         with patch.object(knowledge.database, "DATABASE_PATH", self.database):
             for index in range(5):