parity-matrix.yaml

# =============================================================================
# @devcontainers/cli — Parity Matrix TS ↔ Go
# Complementary source to cli-flags-inventory.yaml
# Goal: reduce iterations by separating parity by lanes and by small cases
# =============================================================================

meta:
  generated_for_branch: go-rewrite
  scope:
    languages: [ts, go]
    commands: [features-info, read-configuration, exec, run-user-commands, set-up, up, build]
  lanes:
    contract:
      description: "Parsing, required args, enums, error formats, output shape"
      docker_required: false
    semantic:
      description: "Logical behavior with fixtures or controlled metadata"
      docker_required: mixed
    runtime:
      description: "Flows with real Docker, compose, lifecycle, buildx"
      docker_required: true
  statuses:
    - missing
    - mismatch
    - match
    - blocked-infra
    - deferred-runtime

execution_order:
  - phase: 1
    lane: contract
    commands: [features-info, read-configuration, exec, run-user-commands, set-up]
    reason: "Highest return on cost; detects contract gaps without Docker noise"
  - phase: 2
    lane: contract
    commands: [up, build]
    reason: "Closes out validations and envelopes before runtime"
  - phase: 3
    lane: semantic
    commands: [features-info, read-configuration, exec, run-user-commands]
    reason: "Detects partially wired flags or divergent semantics"
  - phase: 4
    lane: runtime
    commands: [set-up, up]
    reason: "Minimal happy path and error path"
  - phase: 5
    lane: runtime
    commands: [build]
    reason: "Highest infrastructure noise; leave for last"

normalization:
  stdout_json:
    - sort_keys
    - drop_nulls
    - drop_absolute_paths
    - drop_volatile_ids
  stderr:
    - redact_timestamps
    - redact_host_paths
    - redact_container_ids
    - optionally_non_fatal
  assertions:
    - exit_code
    - stdout_normalized
    - stderr_normalized

initial_cases:
  - id: features-info.invalid-mode
    lane: contract
    command: features-info
    priority: p0
    docker_required: false
    ts_cmd: "features info invalid ghcr.io/devcontainers/features/go"
    asserts: [exit_code, stderr_normalized]
    class: mode-validation
    current_status: match
    notes: "Keep as a guardrail; previously missing in Go"

  - id: features-info.manifest-json
    lane: contract
    command: features-info
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/go --output-format json"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match

  - id: features-info.tags-json
    lane: contract
    command: features-info
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "features info tags ghcr.io/devcontainers/features/go --output-format json"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match

  - id: features-info.dependencies-text
    lane: semantic
    command: features-info
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "features info dependencies ghcr.io/devcontainers/features/go"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: dependency-graph
    current_status: match
    notes: "The normalized output now converges in the A/B comparison"

  - id: features-info.invalid-output-format
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/go --output-format yaml"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: features-info.invalid-log-level
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/go --log-level warning"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: features-info.invalid-feature-id-text
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest not-a-feature-id"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match

  - id: features-info.invalid-feature-id-json
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest not-a-feature-id --output-format json"
    asserts: [exit_code, stdout_normalized]
    class: parse-validation
    current_status: match

  # --- Cases that pin down divergences uncovered by the coverage audit ---
  - id: up.invalid-workspace-mount-consistency
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --workspace-mount-consistency bogus"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "TS validates the yargs enum [consistent,cached,delegated]; Go previously passed the raw value to docker."

  - id: features-publish.invalid-log-level
    lane: contract
    command: features-publish
    priority: p1
    docker_required: false
    ts_cmd: "features publish src/test/configs --namespace o/r --log-level bogus"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "TS rejects --log-level outside [info,debug,trace]; Go previously defaulted to Info and continued."

  - id: features.resolve-dependencies-no-features
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features resolve-dependencies --workspace-folder src/test/configs/image"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "config with no features → TS errors to stderr exit 1; Go previously printed {installOrder:[]} exit 0."

  # --- Wave A: new cases (some uncovered divergences, now fixed) ---
  - id: features-publish.missing-required
    lane: contract
    command: features-publish
    priority: p1
    docker_required: false
    ts_cmd: "features publish src/test/configs"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match
    notes: "TS: 'Missing required argument: namespace'. Go emitted the cobra phrasing (MarkFlagRequired); now publishCollection validates an empty namespace with the same message."

  - id: templates.publish-missing-namespace
    lane: contract
    command: templates
    priority: p1
    docker_required: false
    ts_cmd: "templates publish src/test/configs"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match
    notes: "Identical to features-publish.missing-required: message 'Missing required argument: namespace'."

  - id: up.invalid-default-user-env-probe
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --default-user-env-probe bogus"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "TS rejects the yargs enum; Go validates the same enum before touching Docker."

  - id: build.compose-output-not-supported
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --output type=local"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match
    notes: "compose + --output → TS throws '--output not supported.'"

  - id: features.test-reject-global-scenarios-and-features
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features test --global-scenarios-only --features x"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "Mutual exclusion. Go emitted different wording; now it uses the oracle's ('Cannot combine --global-scenarios-only and --features')."

  - id: features.test-reject-skip-scenarios-and-global-scenarios
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features test --skip-scenarios --global-scenarios-only"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "Go aligned with the oracle's text+order ('Cannot combine --skip-scenarios and --global-scenarios-only')."

  - id: templates.apply-invalid-template-args-exit1
    lane: contract
    command: templates
    priority: p1
    docker_required: false
    ts_cmd: "templates apply --template-id ghcr.io/x/y:1 --template-args [1,2,3]"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "Go emitted the parser detail; now a fixed message 'Invalid template arguments provided.' like TS."

  - id: set-up.invalid-remote-env
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --remote-env BROKEN"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match
    notes: "set-up did not validate --remote-env; now it calls validateRemoteEnvs like its sibling commands."

  # --- Wave A batch 2: new cases (6 more divergences fixed) ---
  - id: upgrade.err-invalid-target-version-format
    lane: contract
    command: upgrade
    priority: p1
    docker_required: false
    ts_cmd: "upgrade --workspace-folder src/test/configs/image-with-features --feature ghcr.io/devcontainers/features/node --target-version abc"
    asserts: [exit_code, stderr_normalized]
    class: version-validation
    current_status: match
    notes: "TS validates in yargs .check() before the handler: --target-version must be x / x.y / x.y.z. 'abc' => exit 1 'Invalid version 'abc'.  Must be in the form of 'x', 'x.y', or 'x.y.z''. Go previously declared --feature/--target-version as hidden but never read them (normal upgrade, exit 0); now RunE validates the format with the same regex and text."

  - id: upgrade.err-feature-without-target-version
    lane: contract
    command: upgrade
    priority: p1
    docker_required: false
    ts_cmd: "upgrade --workspace-folder src/test/configs/image-with-features --feature ghcr.io/devcontainers/features/node"
    asserts: [exit_code, stderr_normalized]
    class: version-validation
    current_status: match
    notes: "XOR from yargs .check(): --feature and --target-version must be used together. Only --feature => exit 1 'The '--target-version' and '--feature' flag must be used together.'. Go ignored both flags; now RunE applies the XOR with the same message."

  - id: outdated.image-with-features-text
    lane: runtime
    command: outdated
    priority: p1
    network_required: true
    ts_cmd: "outdated --workspace-folder src/test/configs/image-with-features --output-format text"
    asserts: [exit_code, stdout_normalized]
    class: outdated-runtime
    current_status: match
    notes: "outdated --output-format text: the Feature column is the full userFeatureId without tag (getFeatureIdWithoutVersion), rows follow the config's insertion order, and the format is the npm text-table (minimum widths, 2-space separator, left-aligned, no trailing spaces). Go previously shortened to the last 2 segments with tag, sorted alphabetically (map), and padded to %-50s with trailing spaces."

  - id: features.package-single-feature-success
    lane: runtime
    command: features-package
    priority: p1
    docker_required: false
    ts_cmd: "features package reference/src/test/container-features/example-v2-features-sets/simple/src/color -o ${PKG_OUT} -f"
    setup_cmd: "PKG_OUT=/tmp/parity-pkg-single-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${PKG_OUT}; echo PKG_OUT=$PKG_OUT"
    verify_cmd: "test -f ${PKG_OUT}/devcontainer-feature-color.tgz && test -f ${PKG_OUT}/devcontainer-collection.json && printf ok"
    cleanup_cmd: "rm -rf ${PKG_OUT}"
    asserts: [exit_code, stdout_normalized]
    class: collection-packaging
    current_status: match
    notes: "--target points to a folder for a SINGLE feature (devcontainer-feature.json + install.sh directly). TS dispatches packageSingleFeature (exit 0: tgz + a 1-element collection); Go iterated only subdirectories → empty collection → 'Failed to package'. Fix: packageCollection detects the metadata in the root folder and packages it as single."

  - id: features.test-missing-src-test-folders
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features test --project-folder src/test/configs/image"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "project-folder with neither src/ nor test/. TS prints the banner and then the error to STDOUT (chalk.red, prefix '[-]') and exits 1; Go wrote the error to STDERR via the logger and without a banner. Fix: banner before the check + error to STDOUT with the exact text ('does not contain the required ''src'' and ''test'' folders.'). Both sides leave STDERR empty, so extractErrorReason canonicalizes to '' on both and stderr_normalized matches. stdout_normalized is not asserted: the TS banner carries the literal version 'vX.Y.Z' that the normalizer does not scrub (it would need a version-scrub, wave B)."

  - id: build.no-lockfile-frozen-lockfile-mutually-exclusive
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --no-lockfile --frozen-lockfile"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "TS registers --no-lockfile/--frozen-lockfile as public and rejects all 3 no-lockfile+frozen combinations ('--no-lockfile and --frozen-lockfile are mutually exclusive.'). Go previously registered only the hidden --experimental-* → 'unknown flag: --no-lockfile'."

  - id: exec.workspace-image-nonzero-exit
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} sh -c \"exit 7\""
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code]
    class: container-runtime
    current_status: match
    notes: "exec propagates the remote command's exit code (sh -c 'exit 7' -> exit 7 on both CLIs). Only exit_code is asserted: stdout is empty on both; stderr differs (Go emits a banner + bash noise 'no job control', TS does not)."

  - id: exec.container-not-found
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --id-label parity.case=missing echo hi"
    asserts: [exit_code, stderr_normalized]
    class: container-runtime
    current_status: match
    notes: "With no container running: both CLIs fail with 'Dev container not found.' exit 1. extractErrorReason normalizes Go's banner and TS's stack trace to the same reason."

  - id: templates.publish-collection-success
    lane: runtime
    command: templates
    priority: p1
    docker_required: true
    setup_cmd: "REG_NAME=parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE}; docker rm -f $REG_NAME >/dev/null 2>&1; docker run -d --name $REG_NAME -p 127.0.0.1::5000 registry:3 >/dev/null; PORT=$(docker port $REG_NAME 5000/tcp | head -1 | sed s/.*://); curl -s --retry 30 --retry-delay 1 --retry-connrefused http://localhost:$PORT/v2/ >/dev/null 2>&1; echo REGISTRY=localhost:$PORT"
    cleanup_cmd: "docker rm -f parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    ts_cmd: "templates publish reference/src/test/container-templates/example-templates-sets/simple/src -r ${REGISTRY} -n octocat/templates"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "publishes the template collection (alpine, cpp, mytemplate, node-mongo) to a LOCAL registry:3, one per side started in setup_cmd with host 'localhost' (not 127.0.0.1) so that the TS OCI client uses plain HTTP. The random host port is captured via echo REGISTRY=localhost:PORT (the harness reSetupEnv injects it into the ts_cmd env). stdout = result-map JSON { id: {publishedTags:[1,1.0,1.0.0,latest], digest, version} }; the tarball digest differs between sides (Go tar vs node-tar) but is scrubbed to sha256:<HASH>, and the keys are ordered by normalizeValue. Each side uses its own fresh registry -> deterministic publishedTags."

  - id: upgrade.write-lockfile-to-disk-success
    lane: runtime
    command: upgrade
    priority: p1
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; cp -R reference/src/test/configs/image-with-features/. $WORKSPACE/; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "cat ${WORKSPACE}/.devcontainer-lock.json"
    cleanup_cmd: "rm -rf /tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "upgrade --workspace-folder ${WORKSPACE}"
    asserts: [exit_code]
    class: upgrade-runtime
    current_status: match
    compare_hashes: true
    notes: "upgrade WITHOUT --dry-run persists the lockfile to disk (.devcontainer-lock.json next to .devcontainer.json, getLockfilePath) and does not emit JSON to stdout; the verify_cmd cats the produced lockfile. Each side works on an isolated tmp copy of the image-with-features fixture. Both resolve the features against ghcr.io to the same digests (sha256 scrubbed by normalization anyway)."

  - id: read-configuration.missing-required
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "read-configuration"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match

  - id: read-configuration.invalid-log-level
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "Aligned in Go with info|debug|trace"

  - id: read-configuration.invalid-log-format
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: read-configuration.fixture-image
    lane: semantic
    command: read-configuration
    priority: p0
    docker_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stdout_normalized]
    class: baseline-fixture
    current_status: match

  - id: read-configuration.features-configuration
    lane: semantic
    command: read-configuration
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image-with-features --include-features-configuration"
    asserts: [exit_code, stdout_normalized]
    class: feature-resolution
    current_status: match
    compare_hashes: true
    compare_nulls: true

  - id: read-configuration.host-variable-substitution
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/varsub-host"
    asserts: [exit_code, stdout_normalized]
    class: variable-substitution
    current_status: match
    notes: "Host substitution cross-command (no command owns it): ${localEnv:X} present and absent, ${localWorkspaceFolderBasename}."

  - id: read-configuration.compose-path-terminal
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/compose-with-name --docker-compose-path docker-compose --terminal-columns 80 --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match
    notes: "Verified with the Go matrix; requires an environment with operational Docker/compose for revalidations"

  - id: read-configuration.subfolder-config
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/dockerfile-without-features --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json"
    asserts: [exit_code, stdout_normalized]
    class: baseline-fixture
    current_status: match

  - id: read-configuration.invalid-id-label
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --id-label broken"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match

  - id: read-configuration.terminal-columns-implies-rows
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --terminal-columns 80"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: read-configuration.terminal-rows-implies-columns
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --terminal-rows 24"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: exec.missing-required
    lane: contract
    command: exec
    priority: p0
    docker_required: false
    ts_cmd: "exec echo hello"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match

  - id: exec.invalid-id-label
    lane: contract
    command: exec
    priority: p0
    docker_required: false
    ts_cmd: "exec --id-label broken echo hello"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match

  - id: exec.invalid-remote-env
    lane: contract
    command: exec
    priority: p0
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --remote-env broken echo hello"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match

  - id: exec.invalid-log-format
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --log-format yaml echo hello"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: exec.invalid-log-level
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --log-level warning echo hello"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: exec.wired-flags
    lane: semantic
    command: exec
    priority: p0
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --docker-compose-path docker-compose --default-user-env-probe loginShell --terminal-columns 80 --terminal-rows 24 echo hello"
    asserts: [exit_code]
    class: wired-flags
    current_status: match
    notes: "The current A/B comparison shows no observable divergence for this contract"

  - id: exec.terminal-columns-implies-rows
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --terminal-columns 80 echo hello"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: exec.terminal-rows-implies-columns
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --terminal-rows 24 echo hello"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: run-user-commands.missing-required
    lane: contract
    command: run-user-commands
    priority: p0
    docker_required: false
    ts_cmd: "run-user-commands"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: run-user-commands.invalid-remote-env
    lane: contract
    command: run-user-commands
    priority: p0
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --remote-env broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: run-user-commands.invalid-default-user-env-probe
    lane: contract
    command: run-user-commands
    priority: p0
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --default-user-env-probe broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: run-user-commands.stop-for-personalization
    lane: semantic
    command: run-user-commands
    priority: p0
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --container-id fake123 --stop-for-personalization"
    asserts: [exit_code]
    class: lifecycle-semantics
    current_status: match
    notes: "Both fail with container not found; flag is accepted without error"

  - id: run-user-commands.invalid-id-label
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --id-label broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: run-user-commands.invalid-log-format
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: run-user-commands.invalid-log-level
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: run-user-commands.terminal-columns-implies-rows
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --terminal-columns 80"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: run-user-commands.terminal-rows-implies-columns
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: run-user-commands.config-not-found
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder path-that-does-not-exist"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match

  - id: set-up.missing-container-id
    lane: contract
    command: set-up
    priority: p0
    docker_required: false
    ts_cmd: "set-up"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: set-up.invalid-default-user-env-probe
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --default-user-env-probe broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: set-up.invalid-log-format
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: set-up.invalid-log-level
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: set-up.terminal-columns-implies-rows
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --terminal-columns 80"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: set-up.terminal-rows-implies-columns
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: up.invalid-buildkit
    lane: contract
    command: up
    priority: p0
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.invalid-gpu-availability
    lane: contract
    command: up
    priority: p0
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --gpu-availability broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.invalid-update-remote-user-uid-default
    lane: contract
    command: up
    priority: p0
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --update-remote-user-uid-default broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.invalid-buildkit
    lane: contract
    command: build
    priority: p0
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.invalid-log-format
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.invalid-log-level
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.missing-workspace-folder
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: build.config-not-found
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder path-that-does-not-exist"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match

  - id: build.platform-without-dockerfile
    lane: contract
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --platform linux/amd64"
    asserts: [exit_code, stdout_normalized]
    class: cross-flag-validation
    current_status: match

  - id: build.buildkit-never-platform-failure
    lane: contract
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --platform linux/amd64"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match
    notes: "TS attempts a docker pull before reaching the discriminating validation; it is not a hermetic contract case. It requires Docker/network and should be promoted to match only after an effective comparison."

  - id: build.compose-platform-not-supported
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --platform linux/amd64"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match

  - id: build.compose-cache-to-not-supported
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --cache-to=type=local,dest=/tmp/test-build-cache"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match

  - id: up.invalid-log-format
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.invalid-log-level
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.missing-workspace-or-id-label
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: up.missing-workspace-or-override-config
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --id-label test=value"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: up.invalid-id-label
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --id-label broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: up.invalid-remote-env
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --remote-env broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: up.invalid-mount
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --mount broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: up.terminal-columns-implies-rows
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --terminal-columns 80"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: up.terminal-rows-implies-columns
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: up.config-not-found
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder path-that-does-not-exist"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match

  - id: read-configuration.container-config-success
    lane: runtime
    command: read-configuration
    priority: p0
    docker_required: true
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json --include-merged-configuration"
    setup_cmd: "CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: read-configuration.container-metadata-success
    lane: runtime
    command: read-configuration
    priority: p0
    docker_required: true
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --include-merged-configuration"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d -e TEST_CE=TEST_VALUE2 ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.container-config-success
    lane: runtime
    command: exec
    priority: p0
    docker_required: true
    ts_cmd: "exec --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json echo parity-output"
    setup_cmd: "CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.container-metadata-success
    lane: runtime
    command: exec
    priority: p0
    docker_required: true
    ts_cmd: "exec --container-id ${CONTAINER_ID} echo parity-output"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-image-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} echo parity-output"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-image-json-raw-output-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --log-format json --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} echo parity-output"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "B9: with --log-format json the command's output goes as `raw` events in the log stream (stderr), not to stdout. stdout stays empty on both (Go previously printed it to stdout). The stream is not asserted (Go uses the Docker SDK → fewer `Run:` events than TS)."

  - id: exec.workspace-compose-success
    no_compose_isolation: true
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/compose-image-without-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} echo parity-output"
    setup_cmd: "COMPOSE_PROJECT_NAME=parityexec${PARITY_SIDE}; export COMPOSE_PROJECT_NAME; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; echo COMPOSE_PROJECT_NAME=$COMPOSE_PROJECT_NAME"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-without-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-image-with-features-hello-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image-with-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} hello"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-dockerfile-with-features-hello-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/dockerfile-with-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} hello"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-dockerfile-with-target-marker-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/dockerfile-with-target --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} cat /var/test-marker"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-compose-image-with-features-hello-success
    no_compose_isolation: true
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/compose-image-with-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} hello"
    setup_cmd: "COMPOSE_PROJECT_NAME=parityexecfeatures; export COMPOSE_PROJECT_NAME; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; echo COMPOSE_PROJECT_NAME=$COMPOSE_PROJECT_NAME"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: run-user-commands.container-config-success
    lane: runtime
    command: run-user-commands
    priority: p0
    docker_required: true
    ts_cmd: "run-user-commands --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json"
    setup_cmd: "CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postAttachCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.workspace-image-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; CONTAINER_ID=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.skip-post-attach-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/dockerfile-with-parallel-commands --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --skip-post-attach"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-with-parallel-commands --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-with-parallel-commands --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; CONTAINER_ID=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} /bin/sh -lc 'test -f /tmp/postCreateCommand1.testmarker && test -f /tmp/postCreateCommand2.testmarker && test -f /tmp/postStartCommand1.testmarker && test -f /tmp/postStartCommand2.testmarker && ! test -f /tmp/postAttachCommand1.testmarker && ! test -f /tmp/postAttachCommand2.testmarker && printf ok'"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.workspace-secrets-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "WORKSPACE=/tmp/parity-secrets-run-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/secrets-lifecycle/. ${WORKSPACE}; SECRETS_FILE=${WORKSPACE}/test-secrets-temp.json; printf '%s' '{\"SECRET1\":\"SecretValue1\",\"MASK_IT\":\"cycle\"}' > ${SECRETS_FILE}; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; find ${WORKSPACE} -name '*.testMarker' -delete; echo WORKSPACE=$WORKSPACE; echo SECRETS_FILE=$SECRETS_FILE; CONTAINER_ID=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "cat ${WORKSPACE}/secret.postCreateCommand.testMarker | grep '^SECRET1=SecretValue1$'"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.workspace-subfolder-config-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/dockerfile-without-features --container-id ${CONTAINER_ID} --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-without-features --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-without-features --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; CONTAINER_ID=$(docker ps -q --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /subfolderConfigPostCreateCommand.txt && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "Closed out by preserving the failed lifecycle command and emitting the TS envelope for hooks (`postCreateCommand from devcontainer.json failed.`)."

  - id: run-user-commands.container-metadata-success
    lane: runtime
    command: run-user-commands
    priority: p0
    docker_required: true
    ts_cmd: "run-user-commands --container-id ${CONTAINER_ID}"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: set-up.container-config-success
    lane: runtime
    command: set-up
    priority: p0
    docker_required: true
    ts_cmd: "set-up --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json --include-configuration --include-merged-configuration"
    setup_cmd: "CONTAINER_ID=$(docker run -d -e TEST_CE=TEST_VALUE alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postAttachCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: set-up.container-metadata-success
    lane: runtime
    command: set-up
    priority: p0
    docker_required: true
    ts_cmd: "set-up --container-id ${CONTAINER_ID} --include-configuration --include-merged-configuration"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d -e TEST_CE=TEST_VALUE2 ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: up.image-success
    lane: runtime
    command: up
    priority: p0
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Unblocked by fixing the docker events parser in the TS oracle (accept Action=start and JSON without a trailing newline)"

  - id: up.image-reuses-base-image-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{.Config.Image}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-with-name-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "docker compose --project-name custom-project-name down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-image-without-features-success
    lane: runtime
    command: up
    priority: p0
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-labels-devcontainer-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker inspect --format '{{ index .Config.Labels \"parity.case\" }}' ${CONTAINER_ID})\" = \"${PARITY_CASE_ID}-${PARITY_SIDE}\" && test -n \"$(docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID})\" && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "B16: the compose container carries the custom --id-label and the devcontainer.metadata label (previously Go did not set devcontainer.* labels on compose → discovery/exec broken). Verifies that the app service's id-label matches and that the metadata label exists, in Go and TS."

  - id: up.app-port-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/app-port --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "P=$(docker inspect --format '{{json .HostConfig.PortBindings}}' ${CONTAINER_ID}); echo \"$P\" | grep -q '\"HostPort\":\"3000\"' && echo \"$P\" | grep -q '\"HostPort\":\"8080\"' && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "appPort → PortBindings (127.0.0.1:N:N for numbers, verbatim for strings). Previously Go did not publish ports."

  - id: up.override-command-false-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/override-command-false --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{json .Config.Cmd}}' ${CONTAINER_ID} | grep -q 'redis-server' && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "overrideCommand:false → the image's entrypoint+cmd (redis-server) are appended to the keep-alive script (exec \"$@\"). Previously Go discarded the image's CMD (sleep loop)."

  - id: up.workspace-mount-custom-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/workspace-mount-custom --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{range .Mounts}}{{.Source}}:{{.Destination}} {{end}}' ${CONTAINER_ID} | grep -q '/tmp:/custom-ws' && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "custom workspaceMount respected (previously Go always bound the workspace-folder to the default)."

  - id: up.compose-dockerfile-without-features-success
    lane: runtime
    command: up
    priority: p0
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-image-without-features-minimal-reuses-base-image-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{.Config.Image}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-without-features-minimal/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-with-name-using-env-var-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name-using-env-var --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo CUSTOM_NAME=custom-name-with-env-var"
    cleanup_cmd: "docker compose --project-name custom-name-with-env-var down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-with-name-devcontainer-env-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name-using-env-var --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo CUSTOM_NAME=devcontainer"
    cleanup_cmd: "docker compose --project-name devcontainer down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-with-name-custom-yaml-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name-and-custom-yaml --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "docker compose --project-name custom-project-name-custom-yaml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-without-name-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-without-name --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "docker compose --project-name compose-without-name_devcontainer down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.subfolder-config-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/dockerfile-without-features --buildkit=never --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /subfolderConfigPostCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-post-create-remote-env-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --include-configuration --include-merged-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out by aligning `configuration.configFilePath` and filling `mergedConfiguration` with config fields (`image`, `runArgs`) in Go"

  - id: up.image-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --omit-config-remote-env-from-metadata --include-configuration --include-merged-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-features-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-image-without-features-minimal-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-without-features-minimal/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dockerfile-without-features-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/dockerfile-without-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-image-with-features-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "docker pull --platform linux/amd64 mongo:latest >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Unblocked by pinning the harness setup with `docker pull --platform linux/amd64 mongo:latest` before compose."

  - id: up.compose-dockerfile-with-features-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "docker pull --platform linux/amd64 mongo:latest >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out after aligning the metadata of Dockerfile+features builds; the setup keeps `docker pull --platform linux/amd64 mongo:latest` to avoid platform drift in compose."

  - id: up.compose-dockerfile-without-features-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-without-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-without-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-metadata-container-env-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-metadata-containerEnv --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} bash -lc 'printf \"%s\\n%s\\n%s\\n\" \"$JAVA_HOME\" \"$VAR_WITH_SPACES\" \"$(eval \\\"$ENV_WITH_COMMAND\\\")\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-features-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-features --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-git-feature-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-git-feature --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker exec ${CONTAINER_ID} git --version"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' 'env | sort > /tmp/.dotfileEnvs' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-with-secrets-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --secrets-file ${SECRETS_FILE} --log-level trace --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-secrets-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' 'env | sort > /tmp/.dotfileEnvs' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; SECRETS_FILE=${WORKSPACE}/test-secrets-temp.json; printf '%s' '{\"SECRET1\":\"SecretValue1\",\"MASK_IT\":\"container\"}' > ${SECRETS_FILE}; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo SECRETS_FILE=$SECRETS_FILE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && grep -q \"^SECRET1=SecretValue1$\" /tmp/.dotfileEnvs && grep -q \"^TEST_REMOTE_ENV=Value 1$\" /tmp/.dotfileEnvs && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-custom-install-relative-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command ./install.sh --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-rel-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-custom-install-absolute-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command /home/node/dotfiles/install.sh --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-abs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-non-executable-install-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command .run-my-dotfiles-script --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-nonexec-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/.run-my-dotfiles-script; chmod 0644 ${DOTFILES_REPO}/.run-my-dotfiles-script; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add .run-my-dotfiles-script; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-custom-install-filename-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command install.sh --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-file-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-non-executable-absolute-install-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command /home/node/dotfiles/.run-my-dotfiles-script --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-nonexec-abs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/.run-my-dotfiles-script; chmod 0644 ${DOTFILES_REPO}/.run-my-dotfiles-script; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add .run-my-dotfiles-script; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-dockerfile-with-features-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out by fixing the compose entrypoint generated by Go so that it uses real line breaks and keeps the container alive"

  - id: up.compose-dockerfile-with-features-reuse-stopped-container-with-persisted-overrides-success
    no_compose_isolation: true
    serial: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER}"
    setup_cmd: "docker pull --platform linux/amd64 mongo:latest >/dev/null; USER_DATA_FOLDER=/tmp/parity-user-data-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${USER_DATA_FOLDER}; mkdir -p ${USER_DATA_FOLDER}; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; fi; ORIGINAL_CONTAINER_ID=$(docker ps -aq --filter label=com.docker.compose.project=compose-dockerfile-with-features_devcontainer --filter label=com.docker.compose.service=app | head -n1); docker compose --project-name compose-dockerfile-with-features_devcontainer stop >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64; echo USER_DATA_FOLDER=${USER_DATA_FOLDER}; echo ORIGINAL_CONTAINER_ID=${ORIGINAL_CONTAINER_ID}"
    verify_cmd: "test \"${CONTAINER_ID#$ORIGINAL_CONTAINER_ID}\" != \"${CONTAINER_ID}\" && test \"$(find ${USER_DATA_FOLDER}/docker-compose -maxdepth 1 -type f | wc -l | tr -d ' ')\" = \"2\" && find ${USER_DATA_FOLDER}/docker-compose -maxdepth 1 -type f -name 'docker-compose.devcontainer.build-*' | grep -q . && find ${USER_DATA_FOLDER}/docker-compose -maxdepth 1 -type f -name 'docker-compose.devcontainer.containerFeatures-*' | grep -q . && printf ok"
    cleanup_cmd: "docker compose --project-name compose-dockerfile-with-features_devcontainer -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true; rm -rf ${USER_DATA_FOLDER}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Reuse of a stopped compose container with persisted overrides. The divergence observed before (TS failed the second `docker compose up --no-recreate`) was an artifact of the setup with the old TS path; with the setup pointing to the TS submodule, Go and TS match."

  - id: up.compose-dockerfile-with-features-reuse-stopped-container-without-persisted-overrides-success
    no_compose_isolation: true
    serial: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER}"
    setup_cmd: "docker pull --platform linux/amd64 mongo:latest >/dev/null; USER_DATA_FOLDER=/tmp/parity-user-data-reset-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${USER_DATA_FOLDER}; mkdir -p ${USER_DATA_FOLDER}; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; fi; ORIGINAL_CONTAINER_ID=$(docker ps -aq --filter label=com.docker.compose.project=compose-dockerfile-with-features_devcontainer --filter label=com.docker.compose.service=app | head -n1); docker compose --project-name compose-dockerfile-with-features_devcontainer stop >/dev/null; rm -rf ${USER_DATA_FOLDER}; mkdir -p ${USER_DATA_FOLDER}; echo DOCKER_DEFAULT_PLATFORM=linux/amd64; echo USER_DATA_FOLDER=${USER_DATA_FOLDER}; echo ORIGINAL_CONTAINER_ID=${ORIGINAL_CONTAINER_ID}"
    verify_cmd: "docker inspect ${CONTAINER_ID} >/dev/null && printf ok"
    cleanup_cmd: "docker compose --project-name compose-dockerfile-with-features_devcontainer -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true; rm -rf ${USER_DATA_FOLDER}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out as coverage of a re-run without persisted overrides. The assertion of exact container ID reuse was too strict: both sides may recreate."

  - id: up.compose-container-env-issue-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-containerEnv-issue --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} bash -lc 'printf \"%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n\" \"$SOME_PATH\" \"$VAR_WITH_SPACES\" \"$(eval \\\"$ENV_WITH_COMMAND\\\")\" \"$ROSCONSOLE_FORMAT\" \"$VAR_WITH_QUOTES_WE_WANT_TO_KEEP\" \"$VAR_WITH_DOLLAR_SIGN\" \"$VAR_WITH_BACK_SLASH\"'"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/image-containerEnv-issue/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-mounts-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-mounts --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/home/test_devcontainer_config\"}}{{.Type}}:{{.Destination}}:{{if ne .Name \"undefined\"}}ok{{else}}bad{{end}}{{end}}{{end}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-image-with-mounts-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-with-mounts --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo COMPOSE_PROJECT_NAME=paritymounts"
    verify_cmd: "docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/home/test_devcontainer_config\"}}{{.Type}}:{{.Destination}}:{{if ne .Name \"undefined\"}}ok{{else}}bad{{end}}{{end}}{{end}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-with-mounts/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-parallel-initialize-command-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-init-${PARITY_CASE_ID}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-parallel-initialize-command/. ${WORKSPACE}; find ${WORKSPACE} -name '*.testMarker' -delete; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "test -f ${WORKSPACE}/initializeCommand.1.testMarker && test -f ${WORKSPACE}/initializeCommand.2.testMarker && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dockerfile-with-parallel-commands-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/dockerfile-with-parallel-commands --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} /bin/sh -lc 'test -f /tmp/postCreateCommand1.testmarker && test -f /tmp/postCreateCommand2.testmarker && test -f /tmp/postStartCommand1.testmarker && test -f /tmp/postStartCommand2.testmarker && test -f /tmp/postAttachCommand1.testmarker && test -f /tmp/postAttachCommand2.testmarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-dockerfile-with-target-post-commands-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-target --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo COMPOSE_PROJECT_NAME=paritytarget"
    verify_cmd: "docker exec ${CONTAINER_ID} /bin/sh -lc 'test -f /tmp/postCreateCommand.testmarker && test -f /tmp/postStartCommand.testmarker && test -f /tmp/postAttachCommand.testmarker && printf ok'"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-with-target/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUID --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-only-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDOnly --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo LOCAL_GID=$(id -g)"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-disabled-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUID --update-remote-user-uid-default never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc '[ \"$(id -u)\" = \"1234\" ] && [ \"$(id -g)\" = \"4321\" ] && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-amd64-platform-option-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDamd64-platform-option --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-arm64-platform-option-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64-platform-option --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.update-uid-amd64-dockerfile-platform-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDamd64 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-arm64-dockerfile-platform-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.update-uid-arm64v8-dockerfile-platform-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64v8 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.update-uid-arm64v8-platform-option-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64v8-platform-option --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.workspace-secrets-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-secrets-up-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/secrets-lifecycle/. ${WORKSPACE}; SECRETS_FILE=${WORKSPACE}/test-secrets-temp.json; printf '%s' '{\"SECRET1\":\"SecretValue1\"}' > ${SECRETS_FILE}; echo WORKSPACE=$WORKSPACE; echo SECRETS_FILE=$SECRETS_FILE"
    verify_cmd: "cat ${WORKSPACE}/secret.postCreateCommand.testMarker | grep '^SECRET1=SecretValue1$'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: build.image-success
    lane: runtime
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness to align the builder with the local base image"

  - id: build.image-metadata-label-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.image-metadata-local-features-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-metadata --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64; DOCKER_DEFAULT_PLATFORM=linux/amd64 docker build -q -t image-metadata-test-base src/test/configs/image-metadata/base-image >/dev/null"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'baseFeature' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'localFeatureA' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'localFeatureB' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.skip-persisting-customizations-from-features-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-metadata --buildkit=never --skip-persisting-customizations-from-features --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64; DOCKER_DEFAULT_PLATFORM=linux/amd64 docker build -q -t image-metadata-test-base src/test/configs/image-metadata/base-image >/dev/null"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'localFeatureA' && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'extensionA' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.labels-success
    lane: runtime
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/example --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE} --label name=label-test --label type=multiple-labels"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.local-feature-failure
    lane: runtime
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-local-feature --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: build-runtime
    current_status: match

  - id: build.no-cache-features-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-features --image-name ${IMAGE_NAME} --no-cache"
    setup_cmd: "BASE_IMAGE=mcr.microsoft.com/devcontainers/typescript-node:1-18-bookworm; ORIGINAL_IMAGE=parity-${PARITY_CASE_ID}-${PARITY_SIDE}-original; CACHED_IMAGE=parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cached; TARGET_IMAGE=parity-${PARITY_CASE_ID}-${PARITY_SIDE}-nocache; docker pull ${BASE_IMAGE} >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} build --workspace-folder src/test/configs/image-with-features --image-name ${ORIGINAL_IMAGE} >/dev/null; ${PARITY_CLI_TS} build --workspace-folder src/test/configs/image-with-features --image-name ${CACHED_IMAGE} >/dev/null; else ${PARITY_CLI_GO} build --workspace-folder src/test/configs/image-with-features --image-name ${ORIGINAL_IMAGE} >/dev/null; ${PARITY_CLI_GO} build --workspace-folder src/test/configs/image-with-features --image-name ${CACHED_IMAGE} >/dev/null; fi; echo BASE_IMAGE=${BASE_IMAGE}; echo IMAGE_NAME=${TARGET_IMAGE}; echo ORIGINAL_IMAGE=${ORIGINAL_IMAGE}; echo CACHED_IMAGE=${CACHED_IMAGE}; echo CACHE_COMPARE_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cache-compare"
    verify_cmd: "docker inspect --type image ${IMAGE_NAME} >/dev/null && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} ${ORIGINAL_IMAGE} ${CACHED_IMAGE} >/dev/null 2>&1 || true; rm -rf ${CACHE_COMPARE_PATH}"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out as execution coverage of `--no-cache` with features. The layer comparison was too strict for buildx and failed on both sides."

  - id: build.compose-dockerfile-multi-image-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-Dockerfile-alpine --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2 >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.dockerfile-multi-image-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-features --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2 >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.image-multi-image-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2 >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.push-and-output-failure
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --output type=oci,dest=output.tar --push true"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: build-runtime
    current_status: match

  - id: build.compose-image-without-features-minimal-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.compose-image-without-features-minimal-metadata-label-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.subfolder-config-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-without-features --buildkit=never --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^SUBFOLDER_CONFIG_IMAGE_ENV=true$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.apply-build-options-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"test_build_options\" }}' ${IMAGE_NAME}"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.image-extra-cache-from-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --cache-from ubuntu:latest --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "docker pull ubuntu:latest >/dev/null"
    verify_cmd: "docker inspect --type image ${IMAGE_NAME} >/dev/null && printf ok"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out using a valid cache source (`ubuntu:latest`); the nonexistent remote ref blocked TS before comparing Go."

  - id: build.image-metadata-container-env-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-metadata-containerEnv --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker run --rm ${IMAGE_NAME} bash -lc 'printf \"%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n\" \"$JAVA_HOME\" \"$VAR_WITH_SPACES\" \"$VAR_WITH_LOTS_OF_SPACES\" \"$VAR_WITH_QUOTES_WE_WANT_TO_KEEP\" \"$VAR_WITH_DOLLAR_SIGN\" \"$VAR_WITH_BACK_SLASH\" \"$ENV_WITH_COMMAND\"'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.compose-image-extra-cache-from-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --cache-from ghcr.io/devcontainers/notFound --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.output-oci-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --output type=oci,dest=${OUTPUT_PATH}"
    setup_cmd: "BUILDER_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; OUTPUT_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}.tar; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true; docker buildx create --name ${BUILDER_NAME} >/dev/null; docker buildx inspect --bootstrap ${BUILDER_NAME} >/dev/null; echo BUILDER_NAME=$BUILDER_NAME; echo BUILDX_BUILDER=$BUILDER_NAME; echo OUTPUT_PATH=$OUTPUT_PATH; echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test -s ${OUTPUT_PATH}"
    cleanup_cmd: "rm -f ${OUTPUT_PATH}; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.cache-to-local-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-features --log-level trace --cache-to=type=local,dest=${CACHE_PATH}"
    setup_cmd: "BUILDER_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; CACHE_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cache; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true; docker buildx create --name ${BUILDER_NAME} --driver docker-container >/dev/null; docker buildx inspect --bootstrap ${BUILDER_NAME} >/dev/null; echo BUILDER_NAME=$BUILDER_NAME; echo BUILDX_BUILDER=$BUILDER_NAME; echo CACHE_PATH=$CACHE_PATH"
    verify_cmd: "test -f ${CACHE_PATH}/index.json"
    cleanup_cmd: "rm -rf ${CACHE_PATH}; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.cache-to-local-image-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-features --log-level trace --cache-to=type=local,dest=${CACHE_PATH}"
    setup_cmd: "BUILDER_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; CACHE_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cache; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true; docker buildx create --name ${BUILDER_NAME} --driver docker-container >/dev/null; docker buildx inspect --bootstrap ${BUILDER_NAME} >/dev/null; echo BUILDER_NAME=$BUILDER_NAME; echo BUILDX_BUILDER=$BUILDER_NAME; echo CACHE_PATH=$CACHE_PATH"
    verify_cmd: "test -f ${CACHE_PATH}/index.json"
    cleanup_cmd: "rm -rf ${CACHE_PATH}; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out by aligning the default name of `image` builds with features: without `--image-name`, TS returns `<folder>-features`."

  - id: build.platform-supported-dockerfile-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --platform linux/amd64 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "test \"$(docker inspect --format '{{.Architecture}}' ${IMAGE_NAME})\" = \"amd64\" && docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$' >/dev/null && test \"$(docker inspect --format '{{ index .Config.Labels \"test_build_options\" }}' ${IMAGE_NAME})\" = \"success\" && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'ghcr.io/devcontainers/feature-starter/hello:1' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'ghcr.io/devcontainers/features/docker-in-docker:2' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'postCreateCommand' && printf ok"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out by correctly resolving the base image of the Dockerfile target, preserving base+config+features metadata and comparing the result's semantics instead of a full `docker inspect`."

  - id: build.platform-supported-image-with-features-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-features --platform linux/amd64 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.unsupported-platform-failure
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --platform fake/platform"
    asserts: [exit_code]
    expect_infra_failure: true
    class: build-runtime
    current_status: match
    notes: "Invalid platform → both exit 1 (the failure IS the expected behavior). The error text
      is at the docker level and env-specific (Go `docker build` 'no match for platform
      in manifest'; TS `buildx` 'Command failed'), so only exit_code is asserted. With
      expect_infra_failure the harness compares exit codes instead of skipping via isInfraError."

  - id: build.compose-image-with-features-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: templates.apply-docker-existing-success
    lane: runtime
    command: templates
    priority: p1
    network_required: true
    ts_cmd: "templates apply --workspace-folder /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE} --template-id ghcr.io/devcontainers/templates/docker-existing-docker-compose:latest"
    setup_cmd: "rm -rf /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}; mkdir -p /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}; echo TMPL_DIR=/tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "test -f ${TMPL_DIR}/.devcontainer/devcontainer.json && test -f ${TMPL_DIR}/.devcontainer/docker-compose.yml && ! test -f ${TMPL_DIR}/devcontainer-template.json && ! test -f ${TMPL_DIR}/README.md && printf ok"
    cleanup_cmd: "rm -rf /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "templates apply extracts the tarball and applies the files (previously {\"files\":null}); it omits devcontainer-template.json/README/NOTES and applies option defaults + ${templateOption:x} substitution."

  - id: outdated.image-with-features-success
    lane: runtime
    command: outdated
    priority: p1
    network_required: true
    ts_cmd: "outdated --workspace-folder src/test/configs/image-with-features --output-format json"
    asserts: [exit_code, stdout_normalized]
    class: outdated-runtime
    current_status: match
    notes: "outdated resolves current/wanted/latest (+ wantedMajor/latestMajor) per feature; key = full userFeatureId (with tag). Both sides query the same registry, so latest matches between them."

  - id: upgrade.image-with-features-success
    lane: runtime
    command: upgrade
    priority: p1
    network_required: true
    ts_cmd: "upgrade --workspace-folder src/test/configs/image-with-features --dry-run"
    asserts: [exit_code, stdout_normalized]
    class: upgrade-runtime
    current_status: match
    notes: "upgrade --dry-run emits the lockfile to stdout; version = concrete resolved version (not the tag), resolved = resource@digest, integrity = digest."

  - id: features.generate-docs-success
    lane: runtime
    command: features
    priority: p1
    ts_cmd: "features generate-docs -p ${GENDOCS_DIR} -n owner/repo --github-owner o --github-repo r"
    setup_cmd: "GENDOCS_DIR=/tmp/parity-gendocs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $GENDOCS_DIR; cp -R reference/src/test/container-features/example-v2-features-sets/simple/src $GENDOCS_DIR; echo GENDOCS_DIR=$GENDOCS_DIR"
    verify_cmd: "cat ${GENDOCS_DIR}/color/README.md ${GENDOCS_DIR}/hello/README.md"
    cleanup_cmd: "rm -rf /tmp/parity-gendocs-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "generate-docs writes a README.md per feature (empty stdout); the verify compares the generated content. Faithful port of the TS template (columns 'Options Id|Description|Type|Default Value' in insertion order, deprecated/legacyIds header, customizations, NOTES.md)."

  - id: templates.generate-docs-success
    lane: runtime
    command: templates
    priority: p1
    ts_cmd: "templates generate-docs -p ${GENDOCS_DIR} --github-owner o --github-repo r"
    setup_cmd: "GENDOCS_DIR=/tmp/parity-tmpldocs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $GENDOCS_DIR; cp -R reference/src/test/container-templates/example-templates-sets/simple/src $GENDOCS_DIR; echo GENDOCS_DIR=$GENDOCS_DIR"
    verify_cmd: "cat ${GENDOCS_DIR}/alpine/README.md ${GENDOCS_DIR}/node-mongo/README.md"
    cleanup_cmd: "rm -rf /tmp/parity-tmpldocs-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "templates generate-docs uses TEMPLATE_README_TEMPLATE (without Registry/Namespace/Version/Customizations)."

  - id: features-info.manifest-text-success
    lane: runtime
    command: features-info
    priority: p1
    network_required: true
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/node:2.1.0"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "info manifest (text): box fitted to the title (encloseStringInBox), and the manifest re-indented from raw bytes preserves the annotation order (sha256 scrubbed by normalization)."

  - id: features-info.tags-text-success
    lane: runtime
    command: features-info
    priority: p1
    network_required: true
    ts_cmd: "features info tags ghcr.io/devcontainers/features/node"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "info tags (text): tags joined with '\\n   ' (first flush, the rest indented by 3). Both sides query the same registry."

  - id: features.package-collection-success
    lane: runtime
    command: features
    priority: p1
    ts_cmd: "features package ${PKG_DIR} -o ${PKG_DIR}/out -f"
    setup_cmd: "PKG_DIR=/tmp/parity-pkg-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $PKG_DIR; cp -R reference/src/test/container-features/example-v2-features-sets/simple/src $PKG_DIR; echo PKG_DIR=$PKG_DIR"
    verify_cmd: "cat ${PKG_DIR}/out/devcontainer-collection.json"
    cleanup_cmd: "rm -rf /tmp/parity-pkg-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "features package generates devcontainer-collection.json ({sourceInformation, features:[…]}, 4-space) preserving the key order of devcontainer-feature.json (orderedmap). The verify compares that JSON; the tarball digest may differ (Go header encoding vs node-tar) but the file-list matches."

  - id: features.resolve-dependencies-success
    lane: runtime
    command: features
    priority: p1
    network_required: true
    ts_cmd: "features resolve-dependencies --workspace-folder src/test/configs/image-with-features"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    compare_hashes: true
    compare_nulls: true
    notes: "stdout = mermaid graph + installOrder JSON. The mermaid is generated with roundPriority 0 (TS default) and feature id alias (fallback to ref.ID when the annotation is missing); node hashes are scrubbed by reMermaidNode. installOrder resolved via ComputeInstallationOrder."

  - id: templates.metadata-success
    lane: runtime
    command: templates
    priority: p1
    network_required: true
    ts_cmd: "templates metadata ghcr.io/devcontainers/templates/typescript-node"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "templates metadata emits the dev.containers.metadata annotation compacted, preserving the source key order (json.Compact, not a re-marshal that would sort them). Both sides query the same registry."

  - id: features.test-single-scenario-success
    lane: runtime
    command: features
    priority: p1
    docker_required: true
    network_required: true
    serial: true
    setup_cmd: "for n in 1 2 3; do docker pull mcr.microsoft.com/devcontainers/base:ubuntu >/dev/null 2>&1 && break; sleep 5; done; echo prepulled"
    ts_cmd: "features test --project-folder reference/src/test/container-features/example-v2-features-sets/simple --features color --skip-autogenerated --filter specific_color_scenario --base-image mcr.microsoft.com/devcontainers/base:ubuntu"
    asserts: [exit_code]
    class: features-runtime
    current_status: match
    notes: "Comparative E2E of a real scenario: builds the local feature, creates a container, runs specific_color_scenario.sh, reports the result and cleans up by label. asserts reduced to [exit_code]: the features-test stdout is a verbose, non-deterministic ANSI stream (the scenario script's output) that is not a byte-for-byte comparable surface; success/failure is discriminated by exit_code. The workspace is made accessible (chmod 0777) before the scenario runs, matching the TS CLI, so a non-root remoteUser can enter it regardless of host↔container UID mapping."

groups:
  mode-validation:
    rationale: "Close a whole family of contract bugs with a single sweep"
  enum-validation:
    rationale: "Aligns Cobra with yargs on choice flags"
  format-validation:
    rationale: "Reduces early divergences and false positives in runtime"
  wired-flags:
    rationale: "Detects flags that are exposed but have no effect"
  lifecycle-semantics:
    rationale: "Isolates real behavioral differences in hooks"
  dependency-graph:
    rationale: "Captures the remaining divergence in features info dependencies"
  container-runtime:
    rationale: "Compares commands against real containers with configuration or metadata loaded"
  lifecycle-runtime:
    rationale: "Validates real hooks and JSON envelopes over live containers"
  up-runtime:
    rationale: "Covers real container creation and compose project name"
  build-runtime:
    rationale: "Covers real builds, tagging, and compose/dockerfile paths"