tests/integration/test_sweep.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import pytest
 
+from aegis_gitea_mcp.audit import validate_audit_log_integrity
 from aegis_gitea_mcp.catalog import load_catalog
 from tests.integration.conftest import McpSession, RegularUser
 from tests.integration.harness import GiteaInstance
@@ -71,3 +72,8 @@ async def test_every_tool_reaches_gitea(
     for value in hidden:
         assert all(value not in text for text in mcp.texts), "a secret leaked into a result"
         assert value not in mcp.audit_text(), "a secret leaked into the audit log"
+
+    # One audit entry per call, and the hash chain over all of them is intact.
+    assert len(mcp.audit_entries()) == len(records)
+    valid, errors = validate_audit_log_integrity(mcp.audit_path)
+    assert valid, errors[:3]

tests/test_sweep_plan.py

@@ -251,7 +251,7 @@ def test_report_groups_by_domain_and_has_no_em_dash_or_bold() -> None:
     assert "`gitea_repo_get`" in text
     assert "| `gitea_repo_list_forks` | 404 |" in text
     assert "no signing key" in text
-    assert "—" not in text
+    assert "\u2014" not in text
     assert "**" not in text
     assert "Not covered by this run" in text