fix: files manually

kab_ingestion/governance.py

@@ -9,3 +9,14 @@ def publish(batch, publisher, tenant_id):
 def deletion(ids,publisher,tenant_id): publisher.delete(ids,tenant_id); return {"deleted":len(ids),"tenant_id":tenant_id,"at":now()}
 
 def audit(event,run_id,tenant_id): return {"event":event,"run_id":run_id,"tenant_id":tenant_id,"at":now()}
+
+class GovernedPublisher:
+    def __init__(self, publisher, audit_log=None):
+        self.publisher = publisher
+        self.audit_log = audit_log if audit_log is not None else []
+
+    def publish(self, batch):
+        for doc in getattr(batch, "documents", []):
+            if getattr(doc, "tenant_id", None) != getattr(batch, "tenant_id", None):
+                raise PermissionError("Tenant isolation failure")
+        return publish(getattr(batch, "documents", []), self.publisher, batch.tenant_id)