Sync Interlock from Intelligence Flow @ 4006eba0241e

UPSTREAM.json

@@ -78,6 +78,10 @@
     "derive/review.go": "59349539a8dbb8664b89b0f2a3cabc50da03e3975727ccae36bda70d3968f704",
     "derive/schema.go": "4d10bca81110512a10aaf6306d5a5a2ebc4193058b4500cd92022a99b42d4f1e",
     "doc.go": "ffda943422fc0104acff178f17f096df5d9d0e9065e598aa0d817c457edfb198",
+    "e2e/coverage_test.go": "1240b8a56703d3c2b2492ef63049dc4573b769c444549cd693b178c06d3ab136",
+    "e2e/e2e_test.go": "28a8d8c7aa3dfa327b615c00454a438264e2b898abc84fe5c0efb9be0a2fdf3f",
+    "e2e/isolation_test.go": "9498039e244184c8ce2460742af70dd93af9e5eada183119344f2d4d5df222e2",
+    "e2e/parity_test.go": "e44628e98eeee1285a5722ed0ed5193e1c6d927d75eb87f90d3f524d83e65a7a",
     "emitspec_test.go": "b669fc73361f275311221ac450008963885801742fe14d47b12e61e677b67545",
     "engine/engine.go": "8ee1d012bbf9661288507056c7a015ab9d46fb16e9596d4717b38f15af748b8f",
     "engine/engine_test.go": "0291ca081684cd744dec98089a383e1a52093f1c5125a88623dab06d504f73a8",
@@ -112,7 +116,7 @@
   "generator": "operatorstack/interlock:project-upstream",
   "schema_version": 1,
   "source": {
-    "commit": "59ec27984383d0c956b8b6bc0ec26465d5cdd952",
+    "commit": "4006eba0241ef7c9e0df634d083be7f2888e6fdb",
     "path": "labs/21-interlock",
     "repository": "operatorstack/intelligence-flow"
   }

e2e/coverage_test.go

@@ -0,0 +1,98 @@
+package e2e
+
+// control-law: shipped-surface-honors-the-core (coverage obligation)
+//
+// The coverage law that keeps the control law obeyed as the surface grows: read
+// the CLI dispatch switch in cmd/interlock/main.go, extract every subcommand it
+// serves, and require each one to be named in the `covered` map below (each value
+// naming the e2e that exercises it). A new subcommand cannot merge without an e2e
+// entry — the shipped surface can never outgrow its proof. Mirrors Pitot's
+// TestAllAdaptersHaveE2EScripts.
+
+import (
+	"os"
+	"regexp"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// covered maps each real CLI subcommand to the e2e that drives it through the
+// shipped binary. Alias flags (-v, --version, -h, --help) and `help` are not
+// commands and are excluded from the dispatch set below.
+var covered = map[string]string{
+	"init":     "TestJourney_InitTestTamper",
+	"derive":   "TestJourney_Derive",
+	"compile":  "TestJourney_Derive (promotion) + parity fixtures",
+	"check":    "TestSmoke_InfoCommands",
+	"explain":  "TestSmoke_InfoCommands",
+	"decide":   "TestDecideParity_Corpus + TestIsolation_AuthoritySeparation",
+	"publish":  "TestJourney_PublishRoundTrip + TestBrokerParity_Corpus",
+	"simulate": "TestJourney_SimulateReplay",
+	"replay":   "TestJourney_SimulateReplay",
+	"test":     "TestJourney_InitTestTamper + TestJourney_Derive",
+	"demo":     "TestSmoke_InfoCommands",
+	"doctor":   "TestSmoke_InfoCommands",
+	"verify":   "TestSmoke_InfoCommands",
+	"version":  "TestSmoke_InfoCommands",
+}
+
+var caseLabel = regexp.MustCompile(`case\s+((?:"[^"]+"\s*,\s*)*"[^"]+")\s*:`)
+var quoted = regexp.MustCompile(`"([^"]+)"`)
+
+func TestEveryCommandHasE2E(t *testing.T) {
+	src, err := os.ReadFile("../cmd/interlock/main.go")
+	if err != nil {
+		t.Fatalf("read main.go: %v", err)
+	}
+	// Only scan the dispatch switch (main's `switch os.Args[1]`), not the helper
+	// switches (decodePolicy's protocol switch, flag parsing) further down.
+	body := string(src)
+	start := strings.Index(body, "switch os.Args[1]")
+	if start < 0 {
+		t.Fatal("could not locate the CLI dispatch switch")
+	}
+	end := strings.Index(body[start:], "\nfunc ")
+	if end < 0 {
+		end = len(body) - start
+	}
+	dispatch := body[start : start+end]
+
+	commands := map[string]bool{}
+	for _, m := range caseLabel.FindAllStringSubmatch(dispatch, -1) {
+		for _, q := range quoted.FindAllStringSubmatch(m[1], -1) {
+			label := q[1]
+			if strings.HasPrefix(label, "-") || label == "help" {
+				continue // alias flags and help are not commands
+			}
+			commands[label] = true
+		}
+	}
+	if len(commands) == 0 {
+		t.Fatal("extracted no commands from the dispatch switch — regex drift?")
+	}
+
+	var missing []string
+	for cmd := range commands {
+		if _, ok := covered[cmd]; !ok {
+			missing = append(missing, cmd)
+		}
+	}
+	sort.Strings(missing)
+	if len(missing) > 0 {
+		t.Fatalf("these CLI commands have no e2e entry in covered{}: %v\n"+
+			"add an e2e that drives the shipped binary and register it in coverage_test.go", missing)
+	}
+
+	// Also flag stale entries so the map does not rot as commands are removed.
+	var stale []string
+	for cmd := range covered {
+		if !commands[cmd] {
+			stale = append(stale, cmd)
+		}
+	}
+	sort.Strings(stale)
+	if len(stale) > 0 {
+		t.Fatalf("covered{} names commands no longer in the dispatch switch: %v", stale)
+	}
+}