fleetd #668: add the missing validateLeadRollover reachability case

validateAllReachesEveryOneOfTodaysRealValidators now exercises all
eight FleetConfig validators through validateAll(), not seven -
adding a minimal leadRollover: block with no handoverPath as the
eighth fixture. The canary's failure message in
fleetConfigDeclaresExactlyTheseValidatorsToday now also points the
reader at the reachability enumeration, since updating the expected
set alone does not prove validateAll() reaches a newly added
validator.

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyAuthorizationModeTest.java

@@ -1,185 +0,0 @@
-package dev.ltms.fleet;
-
-import dev.ltms.fleet.auth.Authz;
-import dev.ltms.fleet.auth.Principal;
-import dev.ltms.fleet.config.ConfigRef;
-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.guard.SubscriptionGuard;
-import dev.ltms.fleet.herdr.FakeHerdr;
-import dev.ltms.fleet.herdr.HerdrClient;
-import dev.ltms.fleet.mcp.FleetMcp;
-import dev.ltms.fleet.msg.ReplyInbox;
-import io.javalin.Javalin;
-import io.modelcontextprotocol.spec.McpSchema;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.lang.reflect.Method;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Map;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.function.LongSupplier;
-
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * fleetd #672 — pins the {@link FleetMcp.AuthorizationMode} that {@link FleetdAssembly}'s
- * production boot path passes to {@link FleetMcp} at {@code FleetdAssembly.java:481}
- * ({@code AuthorizationMode.ENFORCED}).
- *
- * <p>{@code FleetMcpAuthzTest} already exercises {@code FleetMcp#denyFor} against the CB-505
- * table, but it constructs its own {@link FleetMcp} and chooses its own {@code AuthorizationMode}
- * — it tests the seam, not the producer. This test instead reaches the exact {@link FleetMcp}
- * {@link FleetdAssembly#assembleAndStart} builds (via {@code FleetdRuntime#mcp()}, the same
- * accessor {@code FleetdAssemblyConnectionIdentityTest} uses for {@code identity()}) and asserts
- * the consequence rather than reading the enum back: an unauthorized caller must actually be
- * refused through it, and the primary must still be allowed, so the test cannot pass with the
- * gate wired backwards.
- *
- * <p>{@code FleetMcp#denyFor} is package-private to {@code dev.ltms.fleet.mcp}; this test lives in
- * {@code dev.ltms.fleet}, where {@link FleetdAssembly} and {@code FleetdRuntime#mcp()} live, so it
- * cannot call {@code denyFor} directly. Reflection bridges that package boundary the same way
- * {@code getDeclaredField} does in {@link FleetdAssemblyLeadTabScannerExclusionTest} — the
- * assertion itself still exercises the real policy decision ({@code denyFor} calling
- * {@code Authz.permits}), not a field read.
- */
-class FleetdAssemblyAuthorizationModeTest {
-
-    private static final class TestResourcePorts implements ResourcePorts {
-        final FakeHerdr herdr = new FakeHerdr();
-        Runnable shutdownHook;
-
-        @Override
-        public Map<String, String> environment() {
-            return Map.of();
-        }
-
-        @Override
-        public HerdrClient connectHerdr(Path socketPath) {
-            return herdr;
-        }
-
-        @Override
-        public Fleetd.AmqpOpener replyInboxOpener() {
-            return (uri, prefetch) -> new ReplyInbox() {
-                @Override public void own(String target) { }
-                @Override public void release(String target) { }
-                @Override public void publish(String target, String msgId, String content) { }
-                @Override public List<InboxMessage> peek(String target) { return List.of(); }
-                @Override public boolean ack(String target, String msgId) { return false; }
-            };
-        }
-
-        @Override
-        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
-            return (uri, selfCoordId, prefetch) -> {
-                throw new UnsupportedOperationException(
-                        "leadMailboxOpener must not be called — no coordinator: block is configured");
-            };
-        }
-
-        @Override
-        public LongSupplier nanoClock() {
-            return System::nanoTime;
-        }
-
-        @Override
-        public LongSupplier wallClockNanos() {
-            return System::nanoTime;
-        }
-
-        @Override
-        public ScheduledExecutorService newScheduler(String purpose) {
-            return Executors.newSingleThreadScheduledExecutor();
-        }
-
-        @Override
-        public void addShutdownHook(Runnable hook) {
-            shutdownHook = hook;
-        }
-
-        @Override
-        public void startHttp(Javalin app, String host, int port) {
-            // Do not bind a real port in this assembly test — see FleetdAssemblyLeadTabScannerExclusionTest.
-        }
-
-        @Override
-        public Runnable herdrPollWait() {
-            return () -> {
-                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
-            };
-        }
-    }
-
-    private TestResourcePorts ports;
-
-    @AfterEach
-    void tearDown() {
-        if (ports != null && ports.shutdownHook != null) {
-            ports.shutdownHook.run();
-        }
-    }
-
-    private static FleetConfig writeConfig(Path dir) throws Exception {
-        Path file = dir.resolve("fleetd.yaml");
-        Files.writeString(file, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                idleSleepGuard:
-                  enabled: false
-                health:
-                  enabled: false
-                broker:
-                  uri: "amqp://fake-test-broker/vh"
-                """);
-        return FleetConfig.load(file);
-    }
-
-    private FleetMcp assemble(Path dir) throws Exception {
-        FleetConfig cfg = writeConfig(dir);
-        ports = new TestResourcePorts();
-        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
-                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
-        return runtime.mcp();
-    }
-
-    /**
-     * Invokes the real production {@code FleetMcp#denyFor} by reflection. The method is
-     * package-private to {@code dev.ltms.fleet.mcp}; this is the only seam available to this test
-     * without a full HTTP/servlet round trip (see this class's javadoc). No {@code catch} here can
-     * turn a missing method into a pass — a {@code NoSuchMethodException} propagates out of the
-     * test and fails it loudly if {@code denyFor} is ever renamed or removed.
-     */
-    private static McpSchema.CallToolResult denyFor(FleetMcp mcp, Principal caller, Authz.Action action,
-                                                      String target) throws Exception {
-        Method m = FleetMcp.class.getDeclaredMethod("denyFor", Principal.class, Authz.Action.class, String.class);
-        m.setAccessible(true);
-        return (McpSchema.CallToolResult) m.invoke(mcp, caller, action, target);
-    }
-
-    @Test
-    void productionBootPathRefusesAnUnauthorizedCallerThroughTheAssembledFleetMcp(@TempDir Path dir)
-            throws Exception {
-        FleetMcp mcp = assemble(dir);
-
-        McpSchema.CallToolResult deniedForWorker = denyFor(mcp, Principal.worker("term_a", 200),
-                Authz.Action.SPAWN, "term_a");
-        assertNotNull(deniedForWorker,
-                "FleetdAssembly.java:481 must pass AuthorizationMode.ENFORCED to FleetMcp — a worker "
-                        + "must not be able to fleet_spawn through the assembled production object");
-        assertTrue(deniedForWorker.isError(), "a refusal is returned as an MCP tool error");
-
-        McpSchema.CallToolResult allowedForPrimary = denyFor(mcp, Principal.primary(100),
-                Authz.Action.SPAWN, "term_a");
-        assertNull(allowedForPrimary,
-                "control: the primary must still be allowed to fleet_spawn — otherwise the worker "
-                        + "refusal above would pass even with the gate wired backwards");
-    }
-}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -44,11 +44,11 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  *       seventh validator just to exercise the claim.</li>
  *   <li>{@link #validateAllReachesEveryOneOfTodaysRealValidators()} proves {@link
  *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches seven of today's eight real validators — reusing the exact minimal failing
- *       configurations {@code FleetConfigTest} already established for each one directly, so a
- *       single call to {@code validateAll()} is shown to reproduce every one of those seven
- *       failures. The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here yet —
- *       a pre-existing gap tracked as fleetd #668.</li>
+ *       reaches every one of today's eight real validators — reusing the exact minimal failing
+ *       configurations {@code FleetConfigTest} already established for each one directly, plus a
+ *       dedicated fixture for {@link FleetConfig#validateLeadRollover()}, which no other test
+ *       drives through {@code validateAll()} — so a single call to {@code validateAll()} is shown
+ *       to reproduce every one of those eight failures.</li>
  * </ol>
  *
  * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
@@ -220,6 +220,11 @@ class FleetConfigValidateAllTest {
      * the {@code Set.of} below, so a reader adding or removing one sees this assertion name the new
      * count rather than a silent pass at the old one. The count lives only in that set, not in this
      * method's name, so the two cannot drift apart.
+     *
+     * <p>This assertion alone proves only that the validator exists with the right shape — it
+     * cannot prove {@code validateAll()} actually reaches it. Only {@link
+     * #validateAllReachesEveryOneOfTodaysRealValidators()} proves reachability, which is why this
+     * method's failure message sends the reader there too.
      */
     @Test
     void fleetConfigDeclaresExactlyTheseValidatorsToday() {
@@ -237,11 +242,16 @@ class FleetConfigValidateAllTest {
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
                 "validateModels", "validateLeadRollover", "validatePanePlacementAgainstLeadTabs")),
                 names,
-                "FleetConfig's public validate*() methods changed. Do TWO things, in this "
+                "FleetConfig's public validate*() methods changed. Do THREE things, in this "
                         + "order. First confirm validateAll() still delegates to "
                         + "invokeAllValidators(this) — a hardcoded list there passes every other "
                         + "test in this class, so this assertion is the only place that will ever "
-                        + "make you check. Only then update the expected set to match.");
+                        + "make you check. Second, update the expected set below to match. Third, "
+                        + "add or remove a case for that validator in "
+                        + "validateAllReachesEveryOneOfTodaysRealValidators() below — this "
+                        + "assertion proves only that the validator exists with the right shape, "
+                        + "never that validateAll() reaches it; that enumeration is the test that "
+                        + "does.");
     }
 
     /** A minimal, otherwise-valid file — same shape FleetConfigTest and ConfigRefTest use. */
@@ -265,14 +275,18 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The heart of claim 2: for seven of today's eight real validators, a minimal file that fails
-     * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
-     * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
-     * {@code validateAll()} silently dropped one of these seven from the sweep (e.g. a typo'd name
-     * filter), exactly one of them would start passing when it must not.
+     * The heart of claim 2: for every one of today's eight real validators, a minimal file that
+     * fails ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
+     * directly, or a dedicated minimal fixture where no other test drives that validator through
+     * {@code validateAll()} — must also fail through {@link FleetConfig#validateAll()}. If a
+     * future edit to {@code validateAll()} silently dropped one of these eight from the sweep
+     * (e.g. a typo'd name filter), exactly one of them would start passing when it must not.
      *
-     * <p>The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here — a pre-existing
-     * gap tracked as fleetd #668, not fixed by this change.
+     * <p>This is the single place that proves {@code validateAll()} reaches a given validator.
+     * Adding or removing a validator on {@link FleetConfig} must add or remove a case here, not
+     * only an updated name in {@link #fleetConfigDeclaresExactlyTheseValidatorsToday()}'s expected
+     * set — that assertion proves the validator's shape, never that {@code validateAll()} reaches
+     * it.
      */
     @Test
     void validateAllReachesEveryOneOfTodaysRealValidators(@TempDir Path dir) throws Exception {
@@ -362,6 +376,15 @@ class FleetConfigValidateAllTest {
                     opus:
                       tab: "lead: opus"
                 """, "gx10");
+
+        // validateLeadRollover: a leadRollover: block present with no handoverPath.
+        assertValidateAllRefuses(dir, "lead-rollover.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                leadRollover:
+                  requireOperatorConfirm: false
+                """, "handoverPath");
     }
 
     private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,