fix(tests): sync test_railway_runtime audit assertion with sysconfig ci.yml form

Author: Coding-Dev-Tools

tests/test_railway_runtime.py

@@ -75,7 +75,10 @@ def test_railway_image_is_cpu_only_and_installs_only_its_runtime_surface():
 def test_ci_audits_the_stripped_image_without_mutating_it():
     workflow = _text(".github/workflows/ci.yml")
 
-    assert 'docker cp "$container":/usr/local/lib/python3.11/site-packages/.' in workflow
+    # The audit copies the installed site-packages out of a created (not running) container.
+    # The path is resolved dynamically via sysconfig so it survives base-image Python bumps.
+    assert "sysconfig.get_path('purelib')" in workflow or 'sysconfig.get_path("purelib")' in workflow
+    assert 'docker cp "$container:$site_packages/."' in workflow
     assert 'python -m pip_audit --path "$audit_dir"' in workflow
     assert 'python -m pip install --disable-pip-version-check --no-cache-dir' in workflow
     assert 'pip-audit==2.10.1' in workflow
@@ -100,3 +103,29 @@ def test_platform_port_precedes_a_fixed_engraphis_port(monkeypatch):
     assert captured["port"] == 8791
     assert captured["host"] == start_dashboard.os.environ.get("ENGRAPHIS_HOST", "127.0.0.1")
     assert start_dashboard.os.environ["ENGRAPHIS_PORT"] == "8791"
+
+
+def test_launcher_updates_cors_snapshot_after_port_override(monkeypatch):
+    uvicorn = pytest.importorskip("uvicorn")
+    from engraphis import config
+
+    original = (config.settings.host, config.settings.port, config.settings.cors_origins)
+    captured = {}
+    monkeypatch.setenv("ENGRAPHIS_PORT", "8700")
+    monkeypatch.delenv("ENGRAPHIS_CORS_ORIGINS", raising=False)
+    monkeypatch.setattr(start_dashboard, "_port_is_available", lambda *_args: True)
+    monkeypatch.setattr(uvicorn, "run", lambda app, **kwargs: captured.update(kwargs))
+    fake_dashboard = types.ModuleType("engraphis.dashboard_app")
+    fake_dashboard.app = object()
+    monkeypatch.setitem(sys.modules, "engraphis.dashboard_app", fake_dashboard)
+
+    try:
+        start_dashboard.main(["--no-open", "--port", "9000"])
+        assert captured["port"] == 9000
+        assert config.settings.host == "127.0.0.1"
+        assert config.settings.port == 9000
+        assert config.settings.cors_origins == [
+            "http://127.0.0.1:9000", "http://localhost:9000",
+        ]
+    finally:
+        config.settings.host, config.settings.port, config.settings.cors_origins = original