From d90a0c0665357c9fda23a3fe9da25a200c74886d Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Wed, 22 Apr 2026 18:49:05 -0400
Subject: [PATCH 1/3] test(runtime): add sourceos-shell service graph contract
 check

---
 tests/sourceos-shell-service-graph-contract.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 tests/sourceos-shell-service-graph-contract.nix

diff --git a/tests/sourceos-shell-service-graph-contract.nix b/tests/sourceos-shell-service-graph-contract.nix
new file mode 100644
index 0000000..adac31a
--- /dev/null
+++ b/tests/sourceos-shell-service-graph-contract.nix
@@ -0,0 +1,12 @@
+{ pkgs ? import <nixpkgs> {} }:
+pkgs.runCommand "sourceos-shell-service-graph-contract" {
+  nativeBuildInputs = [ pkgs.gnugrep ];
+} ''
+  test -f ${../linux/systemd/sourceos-shell.target}
+  grep -q 'sourceos-shell.service sourceos-router.service sourceos-pdf-secure.service sourceos-docd.service' ${../linux/systemd/sourceos-shell.target}
+  grep -q 'systemd.targets.sourceos-shell' ${../modules/nixos/sourceos-shell/default.nix}
+  grep -q 'partOf = \[ "sourceos-shell.target" \]' ${../modules/nixos/sourceos-shell/default.nix}
+  grep -q 'sourceos-shell.target' ${../docs/sourceos-shell-service-graph.md}
+  mkdir -p $out
+  echo validated > $out/result.txt
+''

From 0a5289c251de4262a4f3f0dd5c25ecbe7d9e1d4f Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Wed, 22 Apr 2026 18:49:44 -0400
Subject: [PATCH 2/3] test(runtime): add sourceos-shell service graph contract
 check to flake

---
 flake.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/flake.nix b/flake.nix
index 0d41c44..3a9c42d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -67,6 +67,7 @@
             '';
 
           sourceos-shell-module-contract = import ./tests/sourceos-shell-module-contract.nix { inherit pkgs; };
+          sourceos-shell-service-graph-contract = import ./tests/sourceos-shell-service-graph-contract.nix { inherit pkgs; };
         });
 
       sourceos = {

From 3015d7d6b75fe7aa146112c900f4402d79b8a500 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Wed, 22 Apr 2026 18:51:53 -0400
Subject: [PATCH 3/3] docs(runtime): mention service graph contract check

---
 docs/sourceos-shell-service-graph.md | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/docs/sourceos-shell-service-graph.md b/docs/sourceos-shell-service-graph.md
index 79bb9df..e7df946 100644
--- a/docs/sourceos-shell-service-graph.md
+++ b/docs/sourceos-shell-service-graph.md
@@ -13,6 +13,18 @@ These services are grouped by the `sourceos-shell.target` scaffold.
 
 This target is a Linux realization placeholder that captures the expected runtime grouping before the actual product/runtime repo exists.
 
+## Validation scaffold
+
+The current Linux realization adds a dedicated contract-style check at:
+
+- `tests/sourceos-shell-service-graph-contract.nix`
+
+This check verifies that:
+
+- `sourceos-shell.target` exists
+- the four runtime scaffold services are grouped beneath that target
+- the Nix module expresses the target and `partOf` relationships consistently
+
 ## Follow-on
 
-Once `SourceOS-Linux/sourceos-shell` exists, the placeholder ExecStart values should be replaced with real package/service paths and the current scaffold checks should be upgraded into service-graph checks.
+Once `SourceOS-Linux/sourceos-shell` exists, the placeholder ExecStart values should be replaced with real package/service paths and the current scaffold checks should be upgraded into actual runtime/service-graph checks.