test(runtime): add sourceos-shell service graph contract check

docs/sourceos-shell-service-graph.md

@@ -13,6 +13,18 @@ These services are grouped by the `sourceos-shell.target` scaffold.
 
 This target is a Linux realization placeholder that captures the expected runtime grouping before the actual product/runtime repo exists.
 
+## Validation scaffold
+
+The current Linux realization adds a dedicated contract-style check at:
+
+- `tests/sourceos-shell-service-graph-contract.nix`
+
+This check verifies that:
+
+- `sourceos-shell.target` exists
+- the four runtime scaffold services are grouped beneath that target
+- the Nix module expresses the target and `partOf` relationships consistently
+
 ## Follow-on
 
-Once `SourceOS-Linux/sourceos-shell` exists, the placeholder ExecStart values should be replaced with real package/service paths and the current scaffold checks should be upgraded into service-graph checks.
+Once `SourceOS-Linux/sourceos-shell` exists, the placeholder ExecStart values should be replaced with real package/service paths and the current scaffold checks should be upgraded into actual runtime/service-graph checks.

flake.nix

@@ -67,6 +67,7 @@
             '';
 
           sourceos-shell-module-contract = import ./tests/sourceos-shell-module-contract.nix { inherit pkgs; };
+          sourceos-shell-service-graph-contract = import ./tests/sourceos-shell-service-graph-contract.nix { inherit pkgs; };
         });
 
       sourceos = {

tests/sourceos-shell-service-graph-contract.nix

@@ -0,0 +1,12 @@
+{ pkgs ? import <nixpkgs> {} }:
+pkgs.runCommand "sourceos-shell-service-graph-contract" {
+  nativeBuildInputs = [ pkgs.gnugrep ];
+} ''
+  test -f ${../linux/systemd/sourceos-shell.target}
+  grep -q 'sourceos-shell.service sourceos-router.service sourceos-pdf-secure.service sourceos-docd.service' ${../linux/systemd/sourceos-shell.target}
+  grep -q 'systemd.targets.sourceos-shell' ${../modules/nixos/sourceos-shell/default.nix}
+  grep -q 'partOf = \[ "sourceos-shell.target" \]' ${../modules/nixos/sourceos-shell/default.nix}
+  grep -q 'sourceos-shell.target' ${../docs/sourceos-shell-service-graph.md}
+  mkdir -p $out
+  echo validated > $out/result.txt
+''