RBAC Group-Path Tests 🛡️

Integration tests that pin the static contracts around the RBAC group-path layer shared by every OIDC-enabled role.

The rbac_group_path lookup plugin is the only sanctioned producer of OIDC group paths in this repository. Tests in this directory MUST cover invariants that protect that contract: callsite shape, role declaration consistency, and the ban on inline [RBAC.GROUP.NAME, ...] | path_join constructions introduced by requirement 005.

Tests in this directory MUST NOT cover unrelated OAuth2 or OIDC configuration. Generic OAuth2 / OIDC invariants belong one level up under oauth2_oidc/. Port and domain checks belong under tests/integration/ports/ and tests/integration/domains/.

For framework, directory layout, and make test-integration usage see integration.md.