fix(tests): fix veto bug preventing disputed state, add manager notification and dispute-resolution routing

backend/app/domain/test_entity.py

@@ -83,7 +83,10 @@ VALID_TRANSITIONS: dict[TestState, list[TestState]] = {
     TestState.blue_evaluating: [TestState.blue_review],
     TestState.blue_review:     [TestState.in_review, TestState.blue_evaluating],
     TestState.in_review:       [TestState.validated, TestState.rejected, TestState.disputed],
-    TestState.disputed:        [TestState.validated, TestState.rejected],
+    TestState.disputed:        [
+        TestState.validated, TestState.rejected,
+        TestState.red_executing, TestState.blue_evaluating,
+    ],
     TestState.rejected:        [TestState.draft],
     TestState.validated:       [],
 }
@@ -627,6 +630,44 @@ class TestEntity:
         # Call self._events.append()
         self._events.append(DomainEvent("test_reopened"))
 
+    def resolve_dispute_reject(self, target: str) -> None:
+        """Resolve a ``disputed`` test by routing rework to the team at fault.
+
+        Called when the lead who originally approved flips their vote to
+        agree with the rejection. Rather than the generic terminal
+        ``rejected`` state (which forces a full draft restart for both
+        teams), the flipping lead identifies WHICH side's work needs
+        redoing — the test goes straight back to that team's active queue
+        so the other team's work is left untouched.
+
+        Args:
+            target (str): ``"red"`` or ``"blue"`` — which team must redo work.
+
+        Returns:
+            None
+        """
+        target_state = TestState.red_executing if target == "red" else TestState.blue_evaluating
+        self._transition(target_state)
+
+        # Both leads must re-vote once the test reaches in_review again —
+        # clear decisions but keep notes (context for the team doing rework).
+        self.red_validation_status = None
+        self.red_validated_by = None
+        self.red_validated_at = None
+        self.blue_validation_status = None
+        self.blue_validated_by = None
+        self.blue_validated_at = None
+        self.paused_at = None
+
+        if target == "red":
+            self.red_started_at = datetime.utcnow()
+            self.red_paused_seconds = 0
+        else:
+            self.blue_started_at = datetime.utcnow()
+            self.blue_paused_seconds = 0
+
+        self._events.append(DomainEvent("dispute_resolved_to_rework", {"target": target}))
+
     # -- Private -------------------------------------------------------
 
     def _auto_resume(self) -> int:
@@ -694,7 +735,14 @@ class TestEntity:
 
     # Define function _check_dual_validation
     def _check_dual_validation(self) -> None:
-        """Advance the test state once both leads have voted."""
+        """Advance the test state once enough leads have voted.
+
+        A genuine conflict (one lead's *recorded* decision disagreeing with
+        the other's) routes to ``disputed`` — there are two opinions to
+        reconcile. A lone rejection while the other side hasn't voted yet
+        isn't a conflict (nothing to disagree with), so it still vetoes
+        straight to ``rejected`` without waiting for the second vote.
+        """
         r, b = self.red_validation_status, self.blue_validation_status
 
         if r == "approved" and b == "approved":
@@ -702,7 +750,16 @@ class TestEntity:
             # Call self._events.append()
             self._events.append(DomainEvent("dual_validation_approved"))
 
-        elif r == "rejected" or b == "rejected":
-            # Any rejection is a veto — one lead can reject without waiting for the other
+        elif r == "rejected" and b == "rejected":
+            self.state = TestState.rejected
+            self._events.append(DomainEvent("dual_validation_rejected"))
+
+        elif (r == "approved" and b == "rejected") or (r == "rejected" and b == "approved"):
+            self.state = TestState.disputed
+            self._events.append(DomainEvent("dual_validation_disputed"))
+
+        elif r == "rejected" or b == "rejected":
+            # One side rejected while the other hasn't voted yet — no
+            # disagreement to dispute yet, just a straightforward veto.
             self.state = TestState.rejected
             self._events.append(DomainEvent("dual_validation_rejected"))

backend/app/routers/tests.py

@@ -17,6 +17,7 @@ POST   /tests/{id}/submit-blue       — blue_evaluating → blue_review
 POST   /tests/{id}/review-blue       — assigned Blue Lead approves/reopens/flags gap
 POST   /tests/{id}/validate-red      — Red Lead validates
 POST   /tests/{id}/validate-blue     — Blue Lead validates
+POST   /tests/{id}/resolve-dispute   — approver flips to reject, routes to red/blue queue
 POST   /tests/{id}/reopen            — rejected → draft
 GET    /tests/{id}/timeline          — audit-log history for this test
 
@@ -69,6 +70,7 @@ from app.schemas.test import (
     TestRedUpdate,
     TestRedValidate,
     TestRemediationUpdate,
+    TestResolveDispute,
     TestUpdate,
 )
 
@@ -143,6 +145,7 @@ from app.services.test_workflow_service import (
     start_blue_work as wf_start_blue_work,
     validate_as_red_lead as wf_validate_red,
     validate_as_blue_lead as wf_validate_blue,
+    resolve_dispute as wf_resolve_dispute,
     reopen_test as wf_reopen,
     handle_remediation_completed as wf_handle_remediation,
     get_retest_chain as wf_get_retest_chain,
@@ -1158,6 +1161,27 @@ def validate_blue(
     return test
 
 
+# ---------------------------------------------------------------------------
+# POST /tests/{id}/resolve-dispute  —  approver flips to reject, picks a queue
+# ---------------------------------------------------------------------------
+
+
+@router.post("/{test_id}/resolve-dispute", response_model=TestOut)
+def resolve_dispute(
+    test_id: uuid.UUID,
+    payload: TestResolveDispute,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_any_role("red_lead", "blue_lead", "admin")),
+) -> TestOut:
+    """The lead who approved flips their vote to reject, choosing which team must redo the work."""
+    test = crud_get_test_with_technique(db, test_id)
+    with UnitOfWork(db) as uow:
+        test = wf_resolve_dispute(db, test, current_user, payload.target_team, notes=payload.notes)
+        uow.commit()
+    db.refresh(test)
+    return test
+
+
 # ---------------------------------------------------------------------------
 # POST /tests/{id}/reopen  —  rejected → draft
 # ---------------------------------------------------------------------------

backend/app/schemas/test.py

@@ -125,6 +125,16 @@ class TestBlueValidate(BaseModel):
     blue_validation_notes: str | None = None
 
 
+# ── Dispute resolution ───────────────────────────────────────────────
+
+
+class TestResolveDispute(BaseModel):
+    """Payload sent by the approving lead flipping their vote to reject."""
+
+    target_team: str  # "red" | "blue" — which team must redo the work
+    notes: str | None = None
+
+
 # ── Red Lead review gate (pre-Blue-Team) ────────────────────────────
 
 

backend/app/services/test_workflow_service.py

@@ -33,7 +33,11 @@ from app.models.evidence import Evidence
 from app.models.test import Test
 from app.models.user import User
 from app.services.audit_service import log_action
-from app.services.notification_service import notify_test_state_change, create_notification
+from app.services.notification_service import (
+    notify_test_state_change,
+    create_notification,
+    notify_role_with_email,
+)
 
 # Assign logger = logging.getLogger(__name__)
 logger = logging.getLogger(__name__)
@@ -1063,6 +1067,22 @@ def _dispatch_dual_validation_effects(
         elif event.name == "dual_validation_disputed":
             # Notify the lead who APPROVED asking them to review the rejection
             _notify_validation_conflict(db, test, actor)
+            # Notify managers too, in case the dispute stalls and needs escalation
+            try:
+                notify_role_with_email(
+                    db,
+                    role="manager",
+                    type="validation_disputed",
+                    title="Validation dispute needs oversight",
+                    message=(
+                        f'Test "{test.name}" has a validation dispute — one lead approved, '
+                        f'the other rejected. Escalate if it does not resolve.'
+                    ),
+                    entity_type="test",
+                    entity_id=test.id,
+                )
+            except Exception as e:
+                logger.warning("Manager dispute notification failed for test %s: %s", test.id, e, exc_info=True)
 
 
 def _notify_validation_conflict(db: Session, test: Test, actor: User | None) -> None:
@@ -1105,7 +1125,7 @@ def _notify_validation_conflict(db: Session, test: Test, actor: User | None) ->
                 f"or contact {rejector_role} to resolve the disagreement."
             ),
             entity_type="test",
-            entity_id=str(test.id),
+            entity_id=test.id,
         )
     except Exception as e:
         logger.warning(
@@ -1114,6 +1134,70 @@ def _notify_validation_conflict(db: Session, test: Test, actor: User | None) ->
         )
 
 
+def resolve_dispute(db: Session, test: Test, user: User, target_team: str, notes: str | None = None) -> Test:
+    """Resolve a disputed test by flipping the approving vote to reject.
+
+    Called by the lead who originally approved, now agreeing with the other
+    lead's rejection. Unlike a plain rejection, the flipping lead identifies
+    WHICH team's work needs redoing — the test routes straight back to that
+    team's active queue (red_executing or blue_evaluating) instead of the
+    generic 'rejected' state that would force a full draft restart for both
+    teams.
+    """
+    if target_team not in ("red", "blue"):
+        raise InvalidOperationError("target_team must be 'red' or 'blue'")
+
+    if user.role != "admin":
+        is_red_approver = user.role == "red_lead" and test.red_validation_status == "approved"
+        is_blue_approver = user.role == "blue_lead" and test.blue_validation_status == "approved"
+        if not (is_red_approver or is_blue_approver):
+            raise InvalidOperationError(
+                "Only the lead who approved can flip their vote to resolve this dispute"
+            )
+
+    entity = TestEntity.from_orm(test)
+    entity.resolve_dispute_reject(target_team)
+    entity.apply_to(test)
+
+    if target_team == "blue":
+        test.blue_work_started_at = None  # split responsibility: entity doesn't own this field
+
+    db.flush()
+
+    new_state = "red_executing" if target_team == "red" else "blue_evaluating"
+
+    log_action(
+        db, user_id=user.id, action="resolve_dispute",
+        entity_type="test", entity_id=test.id,
+        details={"target_team": target_team, "notes": notes, "test_name": test.name},
+    )
+
+    try:
+        notify_test_state_change(db, test, new_state)
+    except Exception as e:
+        logger.warning("Notification failed for test %s: %s", test.id, e, exc_info=True)
+
+    operator_id = test.red_tech_assignee if target_team == "red" else test.blue_tech_assignee
+    if operator_id and notes:
+        try:
+            create_notification(
+                db, user_id=operator_id, type="test_reopened",
+                title="Test sent back for rework (validation dispute)",
+                message=f'Test "{test.name}" needs rework: {notes[:200]}',
+                entity_type="test", entity_id=test.id,
+            )
+        except Exception as e:
+            logger.warning("Notification failed for test %s: %s", test.id, e, exc_info=True)
+
+    try:
+        from app.services.jira_service import push_test_event
+        push_test_event(db, test, user, new_state)
+    except Exception as e:
+        logger.warning("Jira push failed for test %s: %s", test.id, e, exc_info=True)
+
+    return test
+
+
 # Define function handle_remediation_completed
 def handle_remediation_completed(db: Session, test: Test, user: User) -> Test | None:
     """Create a re-test when remediation is completed.