Add fixture-count consistency checks for compliance fixture READMEs

pkg/cli/forecast_compliance_fixtures_formal_test.go

@@ -32,6 +32,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"sort"
 	"testing"
 	"time"
 
@@ -650,3 +651,43 @@ func TestFormal_FC_P10_MonteCarloInputCompleteness(t *testing.T) {
 		})
 	}
 }
+
+// documentedForecastFixtures mirrors the baseline fixture ("Fixture Files" section)
+// plus the "Available Additional Fixtures" table in
+// specs/forecast-compliance-fixtures/README.md. This list MUST be kept in sync with
+// the JSON files present in the fixture directory; a mismatch signals that the
+// README, the fixture directory, or this test has drifted out of sync.
+var documentedForecastFixtures = []string{
+	"run_summary_minimal.json",
+	"run_summary_zero_et.json",
+	"run_summary_failed.json",
+	"run_summary_high_et.json",
+	"run_summary_cancelled.json",
+}
+
+// TestFormal_FixtureCountConsistency verifies that the fixture files documented in
+// specs/forecast-compliance-fixtures/README.md exactly match the `.json` files
+// present in the fixture directory, so the README table cannot silently drift from
+// the fixtures actually exercised by the tests above.
+func TestFormal_FixtureCountConsistency(t *testing.T) {
+	dir := fixtureDir(t)
+	entries, err := os.ReadDir(dir)
+	require.NoError(t, err, "failed to read forecast compliance fixture directory")
+
+	var onDisk []string
+	for _, entry := range entries {
+		if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" {
+			continue
+		}
+		onDisk = append(onDisk, entry.Name())
+	}
+
+	documented := append([]string(nil), documentedForecastFixtures...)
+	sort.Strings(documented)
+	sort.Strings(onDisk)
+
+	assert.Equal(t, documented, onDisk,
+		"fixture files on disk in %s must match the README's documented fixture list exactly "+
+			"(update both the README and documentedForecastFixtures when fixtures change)",
+		dir)
+}

pkg/workflow/github_mcp_access_control_formal_test.go

@@ -493,3 +493,49 @@ func TestFormal_FixtureRunner(t *testing.T) {
 
 	require.Positive(t, totalScenarios, "fixture runner found no scenarios — check fixture directory path")
 }
+
+// documentedComplianceFixtures mirrors the "Compliance Fixtures" table in
+// specs/github-mcp-access-control-compliance/README.md. This list MUST be kept in
+// sync with both the README table and the fixture files present on disk; a
+// mismatch here signals that the spec, the fixture directory, or this test has
+// drifted out of sync with one of the others.
+var documentedComplianceFixtures = []string{
+	"exact-match-allow.yaml",
+	"wildcard-deny.yaml",
+	"empty-repos-block.yaml",
+	"role-deny.yaml",
+	"tool-name-filter.yaml",
+	"blocked-user-deny.yaml",
+	"private-repo-block.yaml",
+	"integrity-level-block.yaml",
+	"combined-filter-allow.yaml",
+	"combined-blocked-integrity.yaml",
+}
+
+// TestFormal_FixtureCountConsistency verifies that the fixture files documented in
+// specs/github-mcp-access-control-compliance/README.md's "Compliance Fixtures" table
+// exactly match the `.yaml` files present in the fixture directory, so the README
+// table cannot silently drift from the fixtures actually exercised by
+// TestFormal_FixtureRunner.
+func TestFormal_FixtureCountConsistency(t *testing.T) {
+	fixtureDir := filepath.Join("..", "..", "specs", "github-mcp-access-control-compliance")
+	entries, err := os.ReadDir(fixtureDir)
+	require.NoError(t, err, "failed to read compliance fixture directory")
+
+	var onDisk []string
+	for _, entry := range entries {
+		if entry.IsDir() || filepath.Ext(entry.Name()) != ".yaml" {
+			continue
+		}
+		onDisk = append(onDisk, entry.Name())
+	}
+
+	documented := slices.Clone(documentedComplianceFixtures)
+	slices.Sort(documented)
+	slices.Sort(onDisk)
+
+	assert.Equal(t, documented, onDisk,
+		"fixture files on disk in %s must match the README's documented fixture list exactly "+
+			"(add/remove entries in both the README table and documentedComplianceFixtures when fixtures change)",
+		fixtureDir)
+}