fix: isolate cookie-aware binary HTTP tests (ticket-017)

project/TICKETS.md

@@ -21,4 +21,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-013** | [`README.md`](./ticket-013/README.md) | - | - | - | - | - |
 | **ticket-014** | [`README.md`](./ticket-014/README.md) | - | - | - | - | - |
 | **ticket-015** | [`README.md`](./ticket-015/README.md) | - | - | - | - | - |
+| **ticket-017** | [`README.md`](./ticket-017/README.md) | - | - |  [`ai-codex.md`](./ticket-017/ai-codex.md) | - | - |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-017/README.md

@@ -0,0 +1,23 @@
+# Ticket 017: Restore binary response test HTTP isolation
+
+- **ID**: ticket-017
+- **Owner**: codex
+- **Status**: IN_PROGRESS
+- **Workflow state**: PUBLICATION
+- **Created**: 2026-10-01
+
+## Goal and scope
+
+The classic interpreter uses a cookie-aware urllib opener. The binary-response
+contract test mocked only urlopen and accidentally contacted example.invalid.
+Mock both HTTP boundaries in the shared fixture without changing product code.
+
+## Acceptance criteria
+
+- [x] AC-01: Binary, SSL/cookie and optional-unreachable contract tests pass.
+- [ ] AC-02: Managed governance gate and GitHub CI pass.
+- [ ] AC-03: Independent protected publication merges the exact tested head.
+
+## Tracking boundary
+
+Scoped test repair; preserve existing runtime behavior and other writers' files.

project/ticket-017/ai-codex.md

@@ -0,0 +1,6 @@
+# Execution authority
+
+SESSION_EXECUTION_AUTHORIZATION: On 2026-10-01 the user requested successive
+repairs, tests and merges. This covers this bounded test repair and independent
+protected publication. Raw Koru logs are preserved with their recorded hashes
+in host-local storage and exact local Git exclusions.

project/ticket-017/intent.json

@@ -0,0 +1,79 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-017",
+  "summary": "Restore binary response test HTTP isolation",
+  "workstream": "core",
+  "classification": {
+    "kind": "BUG",
+    "priority": "P1",
+    "origin": "requested"
+  },
+  "allowedPaths": [
+    "project/ticket-017/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "tests/test_api_binary_responses.py"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null,
+  "delivery": {
+    "acceptedBaseSha": "74f5141237eff330f169d4791a79d38874ff4c73",
+    "targetBranch": "main",
+    "outcome": "Restore isolated binary HTTP evidence tests for cookie-aware classic and unified IR interpreters, then publish through independent protected delivery.",
+    "nonGoals": [
+      "No HTTP runtime behavior changes",
+      "No publication policy changes"
+    ],
+    "complexity": "XS",
+    "estimatedMinutes": 10,
+    "budgets": {
+      "maxImplementationFiles": 1,
+      "maxAffectedComponents": 1,
+      "maxPublicInterfaceChanges": 0,
+      "maxRuntimeDependencies": 0
+    },
+    "architecture": {
+      "status": "accepted",
+      "decision": "Mock the urllib opener boundary alongside urlopen so both HTTP execution paths remain isolated.",
+      "components": [
+        {
+          "name": "http-contract-tests",
+          "paths": [
+            "tests/test_api_binary_responses.py"
+          ]
+        }
+      ],
+      "responsibilityChanges": false,
+      "interfaceChanges": [],
+      "dataChanges": [],
+      "ui": {
+        "impact": "none",
+        "states": [],
+        "evidence": []
+      },
+      "rollback": "Revert the single test helper change."
+    },
+    "runtimeDependencies": [],
+    "validation": [
+      {
+        "criterion": "AC-01",
+        "commands": [
+          "python -m pytest tests/test_api_binary_responses.py tests/test_api_runner_ssl_cookies.py tests/test_api_optional_unreachable.py -q"
+        ],
+        "evidence": "Binary evidence and SSL/cookie/error contracts pass without contacting example.invalid."
+      },
+      {
+        "criterion": "AC-02",
+        "commands": [
+          "bash project/governance-check.sh --actor agent"
+        ],
+        "evidence": "Managed gate passes with zero errors."
+      }
+    ]
+  }
+}

tests/test_api_binary_responses.py

@@ -43,6 +43,10 @@ def _serve(monkeypatch: pytest.MonkeyPatch, response: _Response) -> None:
         "urllib.request.urlopen",
         lambda *_args, **_kwargs: response,
     )
+    monkeypatch.setattr(
+        "urllib.request.OpenerDirector.open",
+        lambda *_args, **_kwargs: response,
+    )
 
 
 def test_json_and_text_keep_their_compatibility_payloads() -> None: