Implemented and validated the separate Monero observation-worker path

tests/custody-db-args.test.ts

@@ -1,6 +1,6 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { parseCustodyDbArguments } from '../server/market/custody-db-args.ts';
+import { assertCustodyDbActionAllowedOnNetwork, parseCustodyDbArguments } from '../server/market/custody-db-args.ts';
 
 test('custody database CLI parses two-argument deposit operations without shifting arguments', () => {
   assert.deepEqual(parseCustodyDbArguments(['deposit-prepare-credit', 'a'.repeat(64), `${'b'.repeat(64)}:${'c'.repeat(64)}`]), {
@@ -9,6 +9,17 @@ test('custody database CLI parses two-argument deposit operations without shifti
   assert.deepEqual(parseCustodyDbArguments(['deposit-prepare-resolve-hold', 'credit-id', 'hold-id']), {
     action: 'deposit-prepare-resolve-hold', argument: 'credit-id', extraArgument: 'hold-id',
   });
+  assert.deepEqual(parseCustodyDbArguments(['grant-monero-observer-runtime', 'monero_observer']), {
+    action: 'grant-monero-observer-runtime', argument: 'monero_observer', extraArgument: undefined,
+  });
+});
+
+test('mainnet custody CLI permits only the observation-role grant', () => {
+  assert.doesNotThrow(() => assertCustodyDbActionAllowedOnNetwork('grant-monero-observer-runtime', true));
+  for (const action of ['migrate', 'grant-runtime', 'grant-monero-credit-runtime', 'audit', 'deposit-release'] as const) {
+    assert.throws(() => assertCustodyDbActionAllowedOnNetwork(action, true), /only the separately scoped/i);
+    assert.doesNotThrow(() => assertCustodyDbActionAllowedOnNetwork(action, false));
+  }
 });
 
 test('custody database CLI rejects unknown, missing, empty, and excess arguments', () => {