test(installer): bind execution coverage callers

tools/verify-greenfield-execution-coverage-gate.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: $0 <coverage-checker> <case-manifest> <arm-manifest> <state-root> <run-id>" >&2
+}
+
+[[ "$#" -eq 5 ]] || { usage; exit 2; }
+checker="$1"
+case_manifest="$2"
+arm_manifest="$3"
+state_root="$4"
+run_id="$5"
+
+[[ -f "$checker" ]] \
+  || { echo "[fixture-suite] coverage checker missing: $checker" >&2; exit 2; }
+
+set +e
+bash "$checker" check cases "$case_manifest" "$state_root" "$run_id"
+cases_status=$?
+bash "$checker" check arms "$arm_manifest" "$state_root" "$run_id"
+arms_status=$?
+set -e
+
+if [ "$cases_status" -ne 0 ] || [ "$arms_status" -ne 0 ]; then
+  exit 1
+fi

tools/verify-greenfield-execution-coverage.test.sh

@@ -3,7 +3,9 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SUBJECT="$ROOT/tools/verify-greenfield-execution-coverage.sh"
+GATE="${GREENFIELD_COVERAGE_GATE:-$ROOT/tools/verify-greenfield-execution-coverage-gate.sh}"
 WORKFLOW="$ROOT/.woodpecker/greenfield-install.yml"
+INSTALLER="${GREENFIELD_E2E_INSTALLER:-$ROOT/tools/e2e-install-test.sh}"
 mkdir -p "$ROOT/.mosaic-test-work"
 TMP="$(mktemp -d "$ROOT/.mosaic-test-work/execution-coverage.XXXXXX")"
 selector_control="$ROOT/greenfield-coverage-selector-control.ran"
@@ -75,6 +77,85 @@ done
 production_output="$(bash "$SUBJECT" check cases "$production_manifest" "$production_state" production-1)"
 grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$production_output"
 
+mark_all_cases() {
+  local root="$1" run="$2"
+  for case_name in next-git-present main-git-present next-git-absent; do
+    bash "$SUBJECT" mark cases "$production_manifest" "$root" "$run" "$case_name"
+  done
+}
+
+mark_all_arms() {
+  local root="$1" run="$2"
+  for arm_name in \
+    greenfield-git-present \
+    greenfield-main-git-present \
+    greenfield-remote-installer-contract \
+    greenfield-git-absent; do
+    bash "$SUBJECT" mark arms "$production_arms" "$root" "$run" "$arm_name"
+  done
+}
+
+gate_state="$TMP/gate-state"
+gate_run="truth-table"
+
+# Final aggregation truth table: cases PASS / arms FAIL is red.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+mark_all_cases "$gate_state" "$gate_run"
+for arm_name in greenfield-git-present greenfield-main-git-present greenfield-git-absent; do
+  bash "$SUBJECT" mark arms "$production_arms" "$gate_state" "$gate_run" "$arm_name"
+done
+set +e
+gate_cases_pass_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run" 2>&1)"
+gate_cases_pass_status=$?
+set -e
+[[ "$gate_cases_pass_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$gate_cases_pass_output"
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=3' <<<"$gate_cases_pass_output"
+grep -qF '[fixture-suite] missing_arm=greenfield-remote-installer-contract' <<<"$gate_cases_pass_output"
+
+# Final aggregation truth table: cases FAIL / arms PASS is red.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+for case_name in next-git-present main-git-present; do
+  bash "$SUBJECT" mark cases "$production_manifest" "$gate_state" "$gate_run" "$case_name"
+done
+mark_all_arms "$gate_state" "$gate_run"
+set +e
+gate_arms_pass_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run" 2>&1)"
+gate_arms_pass_status=$?
+set -e
+[[ "$gate_arms_pass_status" -eq 1 ]]
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=2' <<<"$gate_arms_pass_output"
+grep -qF '[fixture-suite] missing_case=next-git-absent' <<<"$gate_arms_pass_output"
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=4' <<<"$gate_arms_pass_output"
+
+# Final aggregation truth table: both FAIL emits both failures and is red.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+for case_name in next-git-present main-git-present; do
+  bash "$SUBJECT" mark cases "$production_manifest" "$gate_state" "$gate_run" "$case_name"
+done
+for arm_name in greenfield-git-present greenfield-main-git-present greenfield-git-absent; do
+  bash "$SUBJECT" mark arms "$production_arms" "$gate_state" "$gate_run" "$arm_name"
+done
+set +e
+gate_both_fail_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run" 2>&1)"
+gate_both_fail_status=$?
+set -e
+[[ "$gate_both_fail_status" -eq 1 ]]
+grep -qF '[fixture-suite] missing_case=next-git-absent' <<<"$gate_both_fail_output"
+grep -qF '[fixture-suite] missing_arm=greenfield-remote-installer-contract' <<<"$gate_both_fail_output"
+
+# Final aggregation truth table: both PASS is green.
+bash "$SUBJECT" init cases "$production_manifest" "$gate_state" "$gate_run"
+bash "$SUBJECT" init arms "$production_arms" "$gate_state" "$gate_run"
+mark_all_cases "$gate_state" "$gate_run"
+mark_all_arms "$gate_state" "$gate_run"
+gate_both_pass_output="$(bash "$GATE" "$SUBJECT" "$production_manifest" "$production_arms" "$gate_state" "$gate_run")"
+grep -qF '[fixture-suite] cases_defined=3 cases_executed=3' <<<"$gate_both_pass_output"
+grep -qF '[fixture-suite] arms_defined=4 arms_executed=4' <<<"$gate_both_pass_output"
+
 # A future manifest case changes the derived set and cannot silently escape coverage.
 printf '%s\n' $'future-case\texit\t1' >> "$manifest"
 set +e
@@ -121,7 +202,24 @@ done
 arm_complete_output="$(bash "$SUBJECT" check arms "$production_arms" "$production_state" production-1)"
 grep -qF '[fixture-suite] arms_defined=4 arms_executed=4' <<<"$arm_complete_output"
 
-# The exact checkout-archive selector excludes coverage state under .mosaic-test-work.
+# Bind archive purity to the production checkout-archive selector before proving its effect.
+python3 - "$INSTALLER" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+text = Path(sys.argv[1]).read_text(encoding="utf-8")
+archive = re.search(
+    r'(?ms)^  tar -C "\$repo_parent" \\\n(?P<selectors>.*?)^    -czf "\$checkout_archive" "\$repo_name"$',
+    text,
+)
+assert archive, "production checkout-archive command not found"
+assert "--exclude='*/.mosaic-test-work'" in archive.group("selectors"), (
+    "production checkout archive does not exclude .mosaic-test-work"
+)
+PY
+
+# The production-bound checkout-archive selector excludes coverage state under .mosaic-test-work.
 : > "$selector_control"
 archive="$TMP/checkout.tar.gz"
 archive_list="$TMP/checkout.list"
@@ -180,8 +278,9 @@ assert ".greenfield-case-state" not in text
 assert ".mosaic-test-work/greenfield-execution-coverage" in text
 final = steps["greenfield-case-denominator"]
 assert "status: [success, failure]" in final
-assert "check cases" in final and "check arms" in final
-assert "cases_status" in final and "arms_status" in final
+assert "bash tools/verify-greenfield-execution-coverage-gate.sh" in final
+assert "check cases" not in final and "check arms" not in final
+assert "cases_status" not in final and "arms_status" not in final
 for dependency in arm_steps:
     assert f"      - {dependency}\n" in final, f"final gate can race {dependency}"
 PY