From bbdc7a6b7ee7090099d50a5b03448c5bae13c9b4 Mon Sep 17 00:00:00 2001
From: Jakub Zych <jakub@keios.eu>
Date: Thu, 1 Oct 2026 21:35:18 +0200
Subject: [PATCH] fix(09): WR-18 judge the gate's zero-test check per package

---
 scripts/check-phase9.sh | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/scripts/check-phase9.sh b/scripts/check-phase9.sh
index eaf6345..b940dcb 100755
--- a/scripts/check-phase9.sh
+++ b/scripts/check-phase9.sh
@@ -22,11 +22,15 @@ EOF
 }
 
 # phase9_detect reads go test -json. Exit 1 fail, 2 skip, 3 zero tests.
+# Zero tests is judged per package: every package the run reports on must pass
+# at least one test, so a package whose tests were renamed or deleted cannot
+# hide behind a passing test in another package of the same invocation.
 phase9_detect() {
 	python3 - "$1" <<'PY'
 import json, sys
 path = sys.argv[1]
-saw = False
+pkgs = set()
+passed = set()
 with open(path, encoding="utf-8", errors="replace") as fh:
     for raw in fh:
         line = raw.strip()
@@ -39,6 +43,9 @@ with open(path, encoding="utf-8", errors="replace") as fh:
             sys.exit(4)
         action = ev.get("Action")
         test = ev.get("Test") or ""
+        pkg = ev.get("Package") or ""
+        if pkg:
+            pkgs.add(pkg)
         if action == "skip" and test:
             print(f"refuse: skipped {test}", file=sys.stderr)
             sys.exit(2)
@@ -47,10 +54,14 @@ with open(path, encoding="utf-8", errors="replace") as fh:
             print(f"refuse: failed {name}", file=sys.stderr)
             sys.exit(1)
         if action == "pass" and test:
-            saw = True
-if not saw:
+            passed.add(pkg)
+if not passed:
     print("refuse: zero tests", file=sys.stderr)
     sys.exit(3)
+empty = sorted(pkgs - passed)
+if empty:
+    print("refuse: zero tests in " + ", ".join(empty), file=sys.stderr)
+    sys.exit(3)
 PY
 }
 
@@ -99,10 +110,16 @@ run_self_test() {
 	log="$(mktemp)"
 	printf '%s\n' '{"Action":"pass","Test":"TestPhase09GuardIsolation"}' >"$log"
 	phase9_detect "$log"
+	printf '%s\n' '{"Action":"pass","Package":"a/bouncer","Test":"TestPhase09A"}' '{"Action":"pass","Package":"a/bouncer"}' '{"Action":"pass","Package":"a/cabana","Test":"TestPhase09B"}' '{"Action":"pass","Package":"a/cabana"}' >"$log"
+	phase9_detect "$log"
 	rm -f "$log"
 	expect_detect_fails skip '{"Action":"skip","Test":"TestPhase09MigrationsFreshRollback"}'
 	expect_detect_fails zero '{"Action":"pass","Package":"git.golem15.com/golem15/summercms/modules/lagoon"}'
 	expect_detect_fails fail '{"Action":"fail","Test":"TestPhase09ContractInventory"}'
+	# One package passes a test, the other reports none: still a refusal.
+	expect_detect_fails zero-in-one-package '{"Action":"pass","Package":"a/bouncer","Test":"TestPhase09A"}
+{"Action":"pass","Package":"a/bouncer"}
+{"Action":"pass","Package":"a/cabana"}'
 	for flag in --self-test --security --postgres --openapi --evidence --all; do
 		grep -q -- "$flag" "${BASH_SOURCE[0]}" || {
 			echo "refuse: missing mode $flag" >&2