ci(windows): qualify host-hardened control-plane suites on native Windows

The required windows-powershell lane ran a curated subset of tests/control_plane_ts, so the suites the project hardened or fixed specifically for native Windows (#6356 host-hardened assertions, #6258 backup durability flush, #6562 checkpoint durability flush) never executed on a Windows host in CI; the checkpoint regression confirmed that gap by shipping with green qualification. Run those suites in the lane under its qualified SQLite runtime and pin the list with a contract test that fails when a suite leaves the lane.

Signed-off-by: JasonBuildAI <jasonbuildai@gmail.com>

Author: JasonBuildAI

.github/workflows/python-tests.yml

@@ -859,6 +859,32 @@ jobs:
           tests/control_plane_ts/local_authority_provider.test.ts
           tests/control_plane_ts/sqlite_runtime_admission.test.ts
 
+      - name: Install the TypeScript suite dependencies
+        # The host-qualified suites import real packages (for example the
+        # skipped PostgreSQL provider still imports `pg`), and this lane never
+        # installed the root dependencies before.
+        run: npm ci --ignore-scripts
+
+      - name: Qualify host-hardened control-plane suites on native Windows
+        # These suites carry the native Windows branches, durability flushes and
+        # host-independent path assertions written by #6258, #6356 and #6562:
+        # the curated lane omitted them, so a Windows-only regression in their
+        # behavior could pass qualification.
+        run: >-
+          node --no-warnings --experimental-sqlite --experimental-strip-types --test
+          tests/control_plane_ts/agent_preferences.test.ts
+          tests/control_plane_ts/authority_archive.test.ts
+          tests/control_plane_ts/canonical_task_lease_renew.test.ts
+          tests/control_plane_ts/checkpoint_artifacts.test.ts
+          tests/control_plane_ts/checkpoint_provider_head.test.ts
+          tests/control_plane_ts/cold_source_import.test.ts
+          tests/control_plane_ts/coordination_runtime_shadow.test.ts
+          tests/control_plane_ts/effect_runtime_snapshot.test.ts
+          tests/control_plane_ts/goal_acceptance_authority.test.ts
+          tests/control_plane_ts/quota_void_commit.test.ts
+          tests/control_plane_ts/shadow_entry_delivery.test.ts
+          tests/control_plane_ts/sqlite_backup.test.ts
+
       - name: Install the frontend dependencies for a source rebuild
         working-directory: apps/presentation/dashboard
         run: npm ci --ignore-scripts

scripts/ci/test_windows_lane_coverage.py

@@ -0,0 +1,60 @@
+"""The native Windows lane must run the suites written for native Windows.
+
+#6356 hardened ten control-plane TypeScript suites so their assertions hold on
+native Windows, #6258 flushed the state-backup archive through writable handles
+and #6562 fixed the checkpoint durability flush; every one of those fixes
+changed behavior that only a native Windows host exercises. The curated
+``windows-powershell`` list still ran none of the suites, so the checkpoint
+regression shipped with green qualification. Pin the suites to that lane: a
+later edit that drops one, or a new one that arrives with the same Windows-only
+behavior, has to update this contract instead of silently losing the coverage.
+"""
+
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+WORKFLOW = ROOT / ".github/workflows/python-tests.yml"
+
+# Suite -> the native Windows fix that made it host-qualified.
+WINDOWS_QUALIFIED_SUITES = (
+    "tests/control_plane_ts/agent_preferences.test.ts",  # #6356
+    "tests/control_plane_ts/authority_archive.test.ts",  # #6356
+    "tests/control_plane_ts/canonical_task_lease_renew.test.ts",  # #6356
+    "tests/control_plane_ts/checkpoint_artifacts.test.ts",  # #6562
+    "tests/control_plane_ts/checkpoint_provider_head.test.ts",  # #6562 family
+    "tests/control_plane_ts/cold_source_import.test.ts",  # #6356
+    "tests/control_plane_ts/coordination_runtime_shadow.test.ts",  # #6356
+    "tests/control_plane_ts/effect_runtime_snapshot.test.ts",  # #6356
+    "tests/control_plane_ts/goal_acceptance_authority.test.ts",  # #6356
+    "tests/control_plane_ts/quota_void_commit.test.ts",  # #6356
+    "tests/control_plane_ts/shadow_entry_delivery.test.ts",  # #6356
+    "tests/control_plane_ts/sqlite_backup.test.ts",  # #6258
+)
+
+
+def windows_lane() -> dict:
+    workflow = yaml.load(WORKFLOW.read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
+    return workflow["jobs"]["windows-powershell"]
+
+
+class WindowsLaneCoverageTests(unittest.TestCase):
+    def test_windows_lane_still_qualifies_every_code_change(self):
+        # The lane is the only native Windows qualification, so it must keep
+        # following the same change classification the other required jobs use.
+        self.assertIn("needs.changes.outputs.python_tests", windows_lane()["if"])
+
+    def test_windows_qualified_suites_exist_and_run_in_the_windows_lane(self):
+        tokens = {token for step in windows_lane()["steps"] for token in step.get("run", "").split()}
+        for suite in WINDOWS_QUALIFIED_SUITES:
+            with self.subTest(suite=suite):
+                self.assertTrue((ROOT / suite).is_file(), f"{suite} is not a suite in this checkout")
+                self.assertIn(suite, tokens, f"{suite} left the native Windows lane")
+
+
+if __name__ == "__main__":
+    unittest.main()