perf(test): isolate runtime test support and consolidate CLI contracts

scripts/check-core-boundaries.test.mjs

@@ -12,11 +12,17 @@ import {
   findFeatureGatedTestTargetViolations,
   findProductEntrypointCoreFeatureViolations,
   findReqwestDependencyFeatureViolations,
+  findRuntimeServicesTestSupportFeatureViolations,
   findResolvedReqwestNativeTlsViolations,
   findServicesIntegrationsReqwestFeatureViolations,
   findServicesIntegrationsTokioFeatureViolations,
   findTokioDependencyFeatureViolations,
 } from './core-boundaries/cargo-dependency-boundaries.mjs';
+import {
+  checkCliIntegrationTestTopology,
+  cliIntegrationTestTargets,
+  validateExplicitIntegrationTestTopology,
+} from './core-boundaries/explicit-test-topology.mjs';
 import { crateLayoutRules } from './core-boundaries/rules/crate-layout.mjs';
 
 const ENTRYPOINT = new URL('./check-core-boundaries.mjs', import.meta.url);
@@ -131,6 +137,131 @@ test('matching integration target requirements cover all positive crate features
   );
 });
 
+test('runtime-services test support stays dev-only across dependency and feature edges', () => {
+  const runtimeServicesPath = 'src/crates/execution/runtime-services';
+  const packages = [
+    packageAt('normal-consumer', 'src/apps/normal/Cargo.toml', [
+      pathDependency(runtimeServicesPath, {
+        name: 'bitfun-runtime-services',
+        features: ['test-support'],
+      }),
+    ]),
+    packageAt('build-consumer', 'src/apps/build/Cargo.toml', [
+      pathDependency(runtimeServicesPath, {
+        name: 'bitfun-runtime-services',
+        kind: 'build',
+        features: ['test-support'],
+      }),
+    ]),
+    {
+      ...packageAt('feature-forwarder', 'src/apps/forwarder/Cargo.toml'),
+      features: {
+        preview: ['bitfun-runtime-services/test-support'],
+      },
+    },
+    {
+      ...packageAt('weak-forwarder', 'src/apps/weak/Cargo.toml'),
+      features: {
+        preview: ['bitfun-runtime-services?/test-support'],
+      },
+    },
+    {
+      ...packageAt('renamed-forwarder', 'src/apps/renamed/Cargo.toml', [{
+        ...pathDependency(runtimeServicesPath, {
+          name: 'bitfun-runtime-services',
+          optional: true,
+        }),
+        rename: 'runtime_services',
+      }]),
+      features: {
+        preview: ['runtime_services?/test-support'],
+      },
+    },
+    {
+      ...packageAt(
+        'bitfun-runtime-services',
+        'src/crates/execution/runtime-services/Cargo.toml',
+      ),
+      features: {
+        default: ['test-support'],
+        'test-support': [],
+      },
+    },
+    packageAt('test-consumer', 'src/apps/test/Cargo.toml', [
+      pathDependency(runtimeServicesPath, {
+        name: 'bitfun-runtime-services',
+        kind: 'dev',
+        features: ['test-support'],
+      }),
+    ]),
+  ];
+
+  const violations = findRuntimeServicesTestSupportFeatureViolations(packages);
+
+  assert.equal(violations.length, 6);
+  assert.match(violations[0].message, /normal-consumer.*normal dependency/);
+  assert.match(violations[1].message, /build-consumer.*build dependency/);
+  assert.match(violations[2].message, /feature-forwarder:preview/);
+  assert.match(violations[3].message, /weak-forwarder:preview/);
+  assert.match(violations[4].message, /renamed-forwarder:preview/);
+  assert.match(violations[5].message, /bitfun-runtime-services:default/);
+});
+
+test('runtime-services feature aliases cannot hide test support from default builds', () => {
+  const owner = {
+    ...packageAt(
+      'bitfun-runtime-services',
+      'src/crates/execution/runtime-services/Cargo.toml',
+    ),
+    features: {
+      default: ['testing'],
+      testing: ['test-support'],
+      'test-support': [],
+    },
+  };
+
+  const messages = findRuntimeServicesTestSupportFeatureViolations([owner])
+    .map((violation) => violation.message)
+    .join('\n');
+
+  assert.match(messages, /bitfun-runtime-services:default/);
+  assert.match(messages, /default -> testing -> test-support/);
+  assert.match(messages, /bitfun-runtime-services:testing/);
+});
+
+test('CLI integration tests keep the reviewed three-target topology', () => {
+  const repositoryRoot = fileURLToPath(new URL('..', import.meta.url));
+
+  assert.deepEqual(cliIntegrationTestTargets, [
+    { name: 'acp_stdio_cli', path: 'tests/acp_stdio_cli.rs' },
+    { name: 'cli_command_contracts', path: 'tests/cli_command_contracts.rs' },
+    { name: 'terminal_process_contracts', path: 'tests/terminal_process_contracts.rs' },
+  ]);
+  assert.deepEqual(checkCliIntegrationTestTopology(repositoryRoot), []);
+});
+
+test('runtime-services test support is absent from ordinary library builds', async () => {
+  const [manifest, library] = await Promise.all([
+    readFile(
+      new URL('../src/crates/execution/runtime-services/Cargo.toml', import.meta.url),
+      'utf8',
+    ),
+    readFile(
+      new URL('../src/crates/execution/runtime-services/src/lib.rs', import.meta.url),
+      'utf8',
+    ),
+  ]);
+
+  assert.match(manifest, /^test-support\s*=\s*\[\]\s*$/m);
+  assert.doesNotMatch(manifest, /^required-features\s*=.*test-support.*$/m);
+  assert.match(
+    library,
+    /#\[cfg\(any\(test, feature = "test-support"\)\)\]\s*pub mod test_support;/,
+  );
+  assert.match(library, /#\[cfg\(test\)\]\s*mod runtime_services_contracts;/);
+  assert.equal((library.match(/^pub mod test_support;\s*$/gm) ?? []).length, 1);
+});
+
 test('feature-gated integration targets reject extra umbrella requirements', () => {
   const sourcePath = join(TEST_ROOT, 'tests', 'focused.rs');
   const pkg = {

scripts/core-boundaries/cargo-dependency-boundaries.mjs

@@ -325,6 +325,94 @@ export function findReqwestDependencyFeatureViolations(packages) {
   });
 }
 
+export function findRuntimeServicesTestSupportFeatureViolations(packages) {
+  const violations = [];
+
+  const pathToFeature = (featureGraph, start, target, visiting = new Set()) => {
+    if (start === target) {
+      return [target];
+    }
+    if (visiting.has(start)) {
+      return null;
+    }
+    visiting.add(start);
+    for (const reference of featureGraph[start] ?? []) {
+      if (!Object.hasOwn(featureGraph, reference)) {
+        continue;
+      }
+      const suffix = pathToFeature(featureGraph, reference, target, visiting);
+      if (suffix) {
+        visiting.delete(start);
+        return [start, ...suffix];
+      }
+    }
+    visiting.delete(start);
+    return null;
+  };
+
+  for (const pkg of packages) {
+    const runtimeServiceAliases = new Set(['bitfun-runtime-services']);
+    for (const dependency of pkg.dependencies ?? []) {
+      if (dependency.name !== 'bitfun-runtime-services') {
+        continue;
+      }
+      runtimeServiceAliases.add(dependency.rename ?? dependency.name);
+      if (
+        (dependency.features ?? []).includes('test-support')
+        && dependency.kind !== 'dev'
+      ) {
+        violations.push({
+          path: pkg.manifest_path,
+          line: 1,
+          message:
+            `${pkg.name} must not enable bitfun-runtime-services/test-support for its `
+            + dependencyDescription(dependency),
+        });
+      }
+    }
+
+    for (const [featureName, references] of Object.entries(pkg.features ?? {})) {
+      const testSupportReference = references.find((reference) =>
+        [...runtimeServiceAliases].some(
+          (alias) =>
+            reference === `${alias}/test-support`
+            || reference === `${alias}?/test-support`,
+        ));
+      if (!testSupportReference) {
+        continue;
+      }
+      violations.push({
+        path: pkg.manifest_path,
+        line: 1,
+        message:
+          `${pkg.name}:${featureName} must not expose bitfun-runtime-services/test-support `
+          + 'through a package feature',
+      });
+    }
+
+    if (pkg.name === 'bitfun-runtime-services') {
+      for (const featureName of Object.keys(pkg.features ?? {})) {
+        if (featureName === 'test-support') {
+          continue;
+        }
+        const path = pathToFeature(pkg.features, featureName, 'test-support');
+        if (!path) {
+          continue;
+        }
+        violations.push({
+          path: pkg.manifest_path,
+          line: 1,
+          message:
+            `bitfun-runtime-services:${featureName} must not expose test-support; `
+            + `reachable via ${path.join(' -> ')}`,
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
 export function findResolvedReqwestNativeTlsViolations(records, { root }) {
   const reqwestRecords = records.filter((record) => record.name === 'reqwest');
   if (reqwestRecords.length === 0) {
@@ -1076,6 +1164,7 @@ export function checkCargoDependencyBoundaries({ root, crateLayoutRules }) {
       { root, crateLayoutRules },
     ),
     ...findFeatureGatedTestTargetViolations(packages),
+    ...findRuntimeServicesTestSupportFeatureViolations(packages),
     ...findTokioDependencyFeatureViolations(packages),
     ...findReqwestDependencyFeatureViolations(packages),
     ...findResolvedReqwestNativeTlsViolations(resolvedPackageFeatures, { root }),

scripts/core-boundaries/checker.mjs

@@ -38,6 +38,8 @@ import { checkCargoDependencyBoundariesSafely } from './cargo-dependency-boundar
 import {
   agentRuntimeIntegrationTestTargets,
   checkAgentRuntimeIntegrationTestTopology,
+  checkCliIntegrationTestTopology,
+  cliIntegrationTestTargets,
   validateExplicitIntegrationTestTopology,
 } from './explicit-test-topology.mjs';
 
@@ -121,6 +123,17 @@ function isDependencyListHeader(trimmedLine, options = {}) {
   return new RegExp(`^\\[(?:target\\.[^\\]]+\\.)?${workspacePrefix}(?:dependencies|dev-dependencies|build-dependencies)\\]$`).test(trimmedLine);
 }
 
+function dependencyKindForHeader(trimmedLine, options = {}) {
+  const workspacePrefix = options.includeWorkspace ? '(?:workspace\\.)?' : '';
+  const match = trimmedLine.match(
+    new RegExp(`^\\[(?:target\\.[^\\]]+\\.)?${workspacePrefix}(dependencies|dev-dependencies|build-dependencies)(?:\\.|\\])`),
+  );
+  if (!match || match[1] === 'dependencies') {
+    return 'normal';
+  }
+  return match[1] === 'dev-dependencies' ? 'dev' : 'build';
+}
+
 function dependencyTablePattern(options = {}) {
   const workspacePrefix = options.includeWorkspace ? '(?:workspace\\.)?' : '';
   return new RegExp(`^\\[(?:target\\.[^\\]]+\\.)?${workspacePrefix}(?:dependencies|dev-dependencies|build-dependencies)\\.([A-Za-z0-9_-]+|"[A-Za-z0-9_-]+")\\]$`);
@@ -129,6 +142,7 @@ function dependencyTablePattern(options = {}) {
 function parseManifestDependencies(lines, options = {}) {
   const deps = [];
   let inDependencyList = false;
+  let dependencyListKind = 'normal';
   let currentTable = null;
   let currentInline = null;
   const tablePattern = dependencyTablePattern(options);
@@ -153,12 +167,14 @@ function parseManifestDependencies(lines, options = {}) {
     const headerMatch = trimmed.match(/^\[(.+)]$/);
     if (headerMatch) {
       inDependencyList = isDependencyListHeader(trimmed, options);
+      dependencyListKind = dependencyKindForHeader(trimmed, options);
       currentTable = null;
       const dependencyTableMatch = trimmed.match(tablePattern);
       if (dependencyTableMatch) {
         currentTable = {
           name: dependencyTableMatch[1].replace(/^"|"$/g, ''),
           line: index + 1,
+          kind: dependencyListKind,
           optional: false,
           text: [trimmed],
         };
@@ -185,6 +201,7 @@ function parseManifestDependencies(lines, options = {}) {
       deps.push({
         name,
         line: index + 1,
+        kind: dependencyListKind,
         optional: /\boptional\s*=\s*true\b/.test(trimmed),
         text: [trimmed],
       });
@@ -494,7 +511,8 @@ function checkOptionalDependencyFeatureOwners(crateDir, rule) {
   const manifestPath = join(crateDir, 'Cargo.toml');
   const lines = readText(manifestPath).split(/\r?\n/);
   const deps = parseManifestDependencies(lines);
-  const depsByName = new Map(deps.map((dep) => [dep.name, dep]));
+  const normalDeps = deps.filter((dep) => dep.kind === 'normal');
+  const depsByName = new Map(normalDeps.map((dep) => [dep.name, dep]));
   const features = parseManifestFeatures(lines);
   const declaredOwnerDeps = new Set(rule.dependencies.map((dependency) => dependency.depName));
 
@@ -545,7 +563,7 @@ function checkOptionalDependencyFeatureOwners(crateDir, rule) {
   const profileRule = dependencyProfileRules.find((profile) => profile.crateName === rule.crateName);
   const depsRequiringOwner = new Set(profileRule?.forbiddenNonOptionalDeps ?? []);
   const uncoveredDeps = new Map();
-  for (const dep of deps) {
+  for (const dep of normalDeps) {
     if (!dep.optional || !depsRequiringOwner.has(dep.name) || declaredOwnerDeps.has(dep.name)) {
       continue;
     }
@@ -1092,6 +1110,7 @@ export function runCoreBoundaryCheck() {
       escapeRegex,
       validateExplicitIntegrationTestTopology,
       agentRuntimeIntegrationTestTargets,
+      cliIntegrationTestTargets,
     });
     console.log('Core boundary check self-test passed.');
     return;
@@ -1100,6 +1119,7 @@ export function runCoreBoundaryCheck() {
   checkCrateLayoutRules();
   failures.push(...checkCargoDependencyBoundariesSafely({ root: ROOT, crateLayoutRules }));
   failures.push(...checkAgentRuntimeIntegrationTestTopology(ROOT));
+  failures.push(...checkCliIntegrationTestTopology(ROOT));
 
   for (const rule of forbiddenManifestDependencyRules) {
     checkForbiddenManifestDependencyRule(rule);