Feature: Autonomy Guardrail Service – coverage boost
  Targets uncovered code paths in autonomy_guardrail_service.py to
  increase line coverage for lines 173, 191-194, 211, 259, 266,
  285-288, 310, 371-372, 404-405, and 517.

  # ---- check_tool_budget: budget blocked path (lines 173, 191-194) ----

  Scenario: Service budget check blocks when budget is exceeded and logs warning
    Given a guardrail service with tool_budget 10.0 for plan "budget-block"
    When I check tool budget via the coverage service for plan "budget-block" with cost 15.0
    Then the coverage budget check should return False
    And the audit trail for coverage plan "budget-block" should record a budget_blocked event

  Scenario: Service budget check blocks when cumulative spend exceeds budget
    Given a guardrail service with tool_budget 20.0 for plan "budget-cumul"
    When I successfully check tool budget for plan "budget-cumul" with cost 12.0
    And I check tool budget via the coverage service for plan "budget-cumul" with cost 12.0
    Then the coverage budget check should return False

  # ---- check_wall_clock: no guardrails configured (line 211) ----

  Scenario: Service wall-clock check returns True for unconfigured plan
    Given a fresh guardrail service for coverage
    When I check wall-clock via the coverage service for plan "no-wc-plan"
    Then the coverage wall-clock check should return True

  # ---- check_actor_tool_calls: no guardrails configured (line 259) ----

  Scenario: Service actor tool-call check returns True for unconfigured plan
    Given a fresh guardrail service for coverage
    When I check actor tool calls via the coverage service for plan "no-actor-plan" with 50 calls
    Then the coverage actor check should return True

  # ---- check_actor_tool_calls: blocked path (lines 266, 285-288) ----

  Scenario: Service actor tool-call check blocks when limit exceeded and logs warning
    Given a guardrail service with actor tool-call limit 3 for plan "actor-block"
    When I check actor tool calls via the coverage service for plan "actor-block" with 5 calls
    Then the coverage actor check should return False
    And the audit trail for coverage plan "actor-block" should record an actor_limit_blocked event

  Scenario: Service actor tool-call check blocks at exact limit
    Given a guardrail service with actor tool-call limit 3 for plan "actor-exact"
    When I check actor tool calls via the coverage service for plan "actor-exact" with 3 calls
    Then the coverage actor check should return False

  # ---- check_retries_per_failure: no guardrails configured (line 310) ----

  Scenario: Service retries check returns True for unconfigured plan
    Given a fresh guardrail service for coverage
    When I check retries via the coverage service for plan "no-retry-plan" with 10 retries
    Then the coverage retry check should return True

  # ---- check_confirmation_required: not required path (lines 371-372) ----

  Scenario: Service confirmation check grants access for non-listed operation
    Given a guardrail service with confirmations "deploy,delete" for plan "confirm-grant"
    When I check confirmation via the coverage service for plan "confirm-grant" operation "read"
    Then the coverage confirmation check should return False
    And the audit trail for coverage plan "confirm-grant" should record a confirmation_granted event

  # ---- record_enforcement public method (lines 404-405) ----

  Scenario: Public record_enforcement persists an audit entry
    Given a fresh guardrail service for coverage
    When I call record_enforcement for plan "rec-plan" with a step_allowed entry
    Then the audit trail for coverage plan "rec-plan" should have 1 entries

  # ---- _record_enforcement_locked: creates new trail (line 517) ----

  Scenario: record_enforcement creates audit trail for plan with no prior trail
    Given a fresh guardrail service for coverage
    When I call record_enforcement for plan "new-trail" with a budget_allowed entry
    Then the audit trail for coverage plan "new-trail" should have 1 entries
    And the first entry for coverage plan "new-trail" should be budget_allowed