Harden CLI and configuration contract coverage

internal/cli/production_contract_test.go

@@ -111,6 +111,31 @@ func TestProductionCatalogCoversMaintainedConfigurations(t *testing.T) {
 	}
 }
 
+func TestDefaultCLICompositionResolvesMaintainedConfigurations(t *testing.T) {
+	catalog, err := effectiveCatalog(Options{})
+	if err != nil {
+		t.Fatalf("resolve default catalog: %v", err)
+	}
+	if isEmptyCatalog(catalog) {
+		t.Fatal("default catalog is empty")
+	}
+	registries, err := effectiveRegistries(Options{})
+	if err != nil {
+		t.Fatalf("resolve default registries: %v", err)
+	}
+	if isEmptyRegistries(registries) {
+		t.Fatal("default registries are empty")
+	}
+
+	for _, example := range maintainedExampleFiles(t) {
+		var stdout, stderr strings.Builder
+		code := RunWithOptions([]string{"config", "validate", "--config", example.path, "--pipeline", "dnd-session"}, &stdout, &stderr, Options{LookupEnv: emptyLookup})
+		if code != 0 || stderr.Len() != 0 {
+			t.Fatalf("validate maintained %s config with defaults: code=%d stdout=%q stderr=%q", example.name, code, stdout.String(), stderr.String())
+		}
+	}
+}
+
 func TestProductionPromptAssetsPrepareWithoutProviderCredentials(t *testing.T) {
 	components := productionTestComponents(t)
 	cfg := config.Default()