test: generate the audit store and PKI signer doubles

[retr0h]

Implements rescope-go-code-standards tasks 5.8 and 5.8a. Both doubles were hand-written for interfaces this repository defines, and both had been recorded as relying on an exception. Neither needed one.

captureStore → generated MockStore

The exception it claimed was real — the middleware writes from a bare go func() nothing can join. But the test coped with that by sleeping:

time.Sleep(50 * time.Millisecond)   // ×7

A generated mock can create the join point the test lacked:

store.EXPECT().Write(gomock.Any(), gomock.Any()).
    DoAndReturn(func(_ context.Context, entry audit.Entry) error {
        got = entry
        close(written)
        return tt.storeErr
    })
...
<-written

Seven sleeps removed. The test now waits on the call itself, not on a guess that can be wrong on a loaded runner.

A generated MockStore already existed in internal/audit/mocks/ — the hand-written spy was sitting next to it.

The excluded paths got a real assertion

Previously they slept and then checked nothing had been written. Now:

store.EXPECT().Write(gomock.Any(), gomock.Any()).Times(0)

The middleware returns before spawning the goroutine for excluded and unauthenticated paths, so nothing is racing. A regression that starts auditing /metrics now fails instead of passing because the sleep was long enough to see nothing.

mockPKISigner → generated MockPKISigner

This was kept on the grounds that the test verifies a real signature:

s.True(ed25519.Verify(pubKey, tt.payload, envelope.Signature))

True, and irrelevant — a generated mock delegates to the real implementation:

m.EXPECT().Sign(gomock.Any()).DoAndReturn(func(data []byte) []byte {
    return ed25519.Sign(priv, data)      // real key, real signature
}).AnyTimes()

Two constructors, per the "constructor returning a configured mock" guidance, since twelve call sites needed the pair and some need the controller key reported as their own.

Verification

just test — passes, coverage 100% against a 99.9% gate. No hand-written double remains for an interface this repository defines.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main     #455   +/-   ##
=======================================
  Coverage   99.94%   99.94%           
=======================================
  Files         484      484           
  Lines       24935    24935           
=======================================
  Hits        24921    24921           
  Misses         14       14           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update eb57692...652b169. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.