---
id: w4/m3/t007
title: "Test coverage — meaningful tests for the behavior this milestone shipped"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m3/t005]
---

## Objective

Auth matrix rewritten (bearer/session/precedence/fail-closed/prefix contract); API-key coverage: REST lifecycle incl. double-revoke 404, blank-name 400, 503-without-store; GraphQL create/list/revoke; MCP tools; Hydra store impl against a shape-asserting fake admin. make test green.

## Files

- operator/internal/api/auth_test.go
- apikeys_test.go
