Harden CLI and configuration contract coverage

internal/cli/production_contract_test.go

@@ -111,6 +111,31 @@ func TestProductionCatalogCoversMaintainedConfigurations(t *testing.T) {
 	}
 }
 
+func TestDefaultCLICompositionResolvesMaintainedConfigurations(t *testing.T) {
+	catalog, err := effectiveCatalog(Options{})
+	if err != nil {
+		t.Fatalf("resolve default catalog: %v", err)
+	}
+	if isEmptyCatalog(catalog) {
+		t.Fatal("default catalog is empty")
+	}
+	registries, err := effectiveRegistries(Options{})
+	if err != nil {
+		t.Fatalf("resolve default registries: %v", err)
+	}
+	if isEmptyRegistries(registries) {
+		t.Fatal("default registries are empty")
+	}
+
+	for _, example := range maintainedExampleFiles(t) {
+		var stdout, stderr strings.Builder
+		code := RunWithOptions([]string{"config", "validate", "--config", example.path, "--pipeline", "dnd-session"}, &stdout, &stderr, Options{LookupEnv: emptyLookup})
+		if code != 0 || stderr.Len() != 0 {
+			t.Fatalf("validate maintained %s config with defaults: code=%d stdout=%q stderr=%q", example.name, code, stdout.String(), stderr.String())
+		}
+	}
+}
+
 func TestProductionPromptAssetsPrepareWithoutProviderCredentials(t *testing.T) {
 	components := productionTestComponents(t)
 	cfg := config.Default()

internal/core/config/env_contract_test.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"errors"
 	"reflect"
 	"strings"
 	"testing"
@@ -144,6 +145,42 @@ cache:
 	}
 }
 
+func TestDefaultCacheRootsRejectInvalidUserCacheResolvers(t *testing.T) {
+	tests := []struct {
+		name     string
+		resolver func() (string, error)
+		want     string
+	}{
+		{name: "nil resolver", want: "must not be nil"},
+		{
+			name: "resolver failure",
+			resolver: func() (string, error) {
+				return "", errors.New("cache home unavailable")
+			},
+			want: "resolve user cache directory",
+		},
+		{name: "empty directory", resolver: func() (string, error) { return "  ", nil }, want: "must not be empty"},
+	}
+	families := []struct {
+		name string
+		root func(func() (string, error)) (string, error)
+	}{
+		{name: "chunk plans", root: DefaultChunkPlanRoot},
+		{name: "checkpoints", root: DefaultCheckpointRoot},
+	}
+
+	for _, family := range families {
+		for _, tt := range tests {
+			t.Run(family.name+"/"+tt.name, func(t *testing.T) {
+				_, err := family.root(tt.resolver)
+				if err == nil || !strings.Contains(err.Error(), tt.want) {
+					t.Fatalf("error = %v, want substring %q", err, tt.want)
+				}
+			})
+		}
+	}
+}
+
 func TestEnvEmptyDirectoryOverridesAreErrors(t *testing.T) {
 	tests := []string{
 		"NOTARIUS_OUTPUT_DIR",