test(cli): orphans.driver-contract.test.ts's production-posture boot depends on a sibling e2e spawn minting the dev crypto key — deterministic red once the e2e tier leaves the queue #16491

Found while landing #16455 (the e2e / live filename tiers move to a nightly run on main; PR #16481). Filed unassigned for triage; not fixed there because that card's ruling forbids editing any test file.

What

packages/cli/src/commands/secret/orphans.driver-contract.test.ts sets process.env.NODE_ENV = 'production' in its beforeAll and boots a real kernel through bootSchemaStack with SettingsServicePlugin. LocalCryptoProvider derives its posture from NODE_ENV alone and, in production, requires OS_SECRET_KEY, OS_DEV_CRYPTO_KEY, or a persisted $HOME/.objectstack/dev-crypto-key. The test provides none of them. It is green today only when an earlier dev-mode boot in the same job has persisted that key file on the runner's home directory — and the only boots that still do so are e2e spawns of bin/run-dev.js that pass no key (for example test/start-port-banner-agreement.e2e.test.ts and test/migrate-meta.e2e.test.ts, which spawn os start). packages/cli/test/helpers/serve-process.ts's header already names this class: "a cross-test ordering coupling through the runner's home directory, and under vitest's parallel workers it is nondeterministic", which is why the helper's own spawns pass OS_SECRET_KEY.

Measured

• Locally (container, no key file, OS_TEST_TIERS=queue, the whole cli package): Test Files 1 failed | 211 passed (212) — the one failure is this test: Error: [LocalCryptoProvider] Refusing to start in production without a stable encryption key.
• The same file alone with OS_DEV_CRYPTO_KEY=$(openssl rand -hex 32): Test Files 1 passed (1) / Tests 5 passed (5); alone without: 1 failed, 5 skipped.
• On CI, PR ci(test): e2e and live filename tiers move to a nightly run on main #16481 (770dd18205, Test Core under OS_TEST_TIERS=queue, no e2e files in the job): Test Core (5/6) = cli slice 1/2, Test Files 1 failed | 106 passed (107), the same refusal, completeness guard OK — https://github.com/objectstack-ai/objectstack/actions/runs/34080518324/job/101614831504
• main's Test Core is green today (run 34079753529), i.e. the coupling currently resolves in the sibling's favour by ordering.

Fix

One line in the test's own beforeAll: set OS_DEV_CRYPTO_KEY (or OS_SECRET_KEY) for the boot it performs, and restore it in afterAll beside NODE_ENV — the same "nothing written, nothing depended on" rule serve-process.ts applies to its children. A CI-wide key in ci.yml would hide this class for every future production-posture test instead of declaring it, and is not the fix.

Refs #16455, PR #16481.

Generated by Claude Code

Generated by Claude Code