fix: tighten ledger skip CLI auditing

Co-authored-by: genichin <4282227+genichin@users.noreply.github.com>

tests/runtime/test_cli_ledger_skips.py

@@ -91,7 +91,7 @@ def test_ledger_skips_list_outputs_records(monkeypatch, capsys):
     assert out["records"][0]["skip_reason"] == "missing_execution_id"
 
 
-def test_ledger_skips_resolve_marks_record_and_emits_alert(monkeypatch, capsys):
+def test_ledger_skips_resolve_marks_record_and_emits_alert(monkeypatch, tmp_path, capsys):
     class _Store:
         def __init__(self, *_args, **_kwargs):
             pass
@@ -125,7 +125,7 @@ def test_ledger_skips_resolve_marks_record_and_emits_alert(monkeypatch, capsys):
         instance="inst-1",
         yes=True,
         live=False,
-        audit_dir="audit-dir",
+        audit_dir=str(tmp_path),
         config=None,
         config_path=None,
         env_file=None,
@@ -172,3 +172,74 @@ def test_ledger_skips_resolve_live_requires_live_flag(monkeypatch, tmp_path, cap
     audit = json.loads(next(tmp_path.glob("*.json")).read_text(encoding="utf-8"))
     assert audit["request"]["instance"] == "inst-1"
     assert audit["result"]["status"] == "rejected"
+    assert audit["audit_path"].endswith(".json")
+
+
+def test_ledger_skips_resolve_live_requires_yes_and_live(monkeypatch, tmp_path, capsys):
+    monkeypatch.setattr(
+        "trex_core.adapters.persistence.ledger_skip_store.PostgreSQLLedgerSkipStore",
+        lambda *_args, **_kwargs: object(),
+    )
+    args = SimpleNamespace(
+        cmd="ledger",
+        ledger_cmd="skips",
+        ledger_skips_cmd="resolve",
+        skip_key="abc",
+        reason="operator_reconciled",
+        instance="inst-1",
+        yes=False,
+        live=True,
+        audit_dir=str(tmp_path),
+        config=None,
+        config_path=None,
+        env_file=None,
+        json=True,
+        timeout=10.0,
+    )
+
+    rc = cli._cmd_ledger_skips_resolve(args, _cfg(live=True), lambda _: True)
+
+    assert rc == 2
+    err = capsys.readouterr().err
+    assert "--yes --live" in err
+    audit = json.loads(next(tmp_path.glob("*.json")).read_text(encoding="utf-8"))
+    assert audit["result"]["reason"] == "live account requires --yes --live"
+
+
+def test_ledger_skips_resolve_not_found_emits_audit_report(monkeypatch, tmp_path, capsys):
+    class _Store:
+        def __init__(self, *_args, **_kwargs):
+            pass
+
+        def resolve_by_key(self, *_args, **_kwargs):
+            return None
+
+    monkeypatch.setattr(
+        "trex_core.adapters.persistence.ledger_skip_store.PostgreSQLLedgerSkipStore",
+        _Store,
+    )
+    args = SimpleNamespace(
+        cmd="ledger",
+        ledger_cmd="skips",
+        ledger_skips_cmd="resolve",
+        skip_key="missing",
+        reason="operator_reconciled",
+        instance="inst-1",
+        yes=True,
+        live=False,
+        audit_dir=str(tmp_path),
+        config=None,
+        config_path=None,
+        env_file=None,
+        json=False,
+        timeout=10.0,
+    )
+
+    rc = cli._cmd_ledger_skips_resolve(args, _cfg(), lambda _: True)
+
+    assert rc == 1
+    out = json.loads(capsys.readouterr().out)
+    assert out["result"]["status"] == "not_found"
+    assert out["audit_path"].endswith(".json")
+    audit = json.loads(next(tmp_path.glob("*.json")).read_text(encoding="utf-8"))
+    assert audit["audit_path"].endswith(".json")