parity-matrix.yaml

# =============================================================================
# @devcontainers/cli — Parity Matrix TS ↔ Go
# Complementary source to cli-flags-inventory.yaml
# Goal: reduce iterations by separating parity by lanes and by small cases
# =============================================================================

meta:
  generated_for_branch: go-rewrite
  scope:
    languages: [ts, go]
    commands: [features-info, read-configuration, exec, run-user-commands, set-up, up, build]
    global_flags: [oci-auth-hardening, allow-cross-origin-auth-host]
  lanes:
    contract:
      description: "Parsing, required args, enums, error formats, output shape"
      docker_required: false
    semantic:
      description: "Logical behavior with fixtures or controlled metadata"
      docker_required: mixed
    runtime:
      description: "Flows with real Docker, compose, lifecycle, buildx"
      docker_required: true
  statuses:
    - missing
    - mismatch
    - match
    - blocked-infra
    - deferred-runtime

execution_order:
  - phase: 1
    lane: contract
    commands: [features-info, read-configuration, exec, run-user-commands, set-up]
    reason: "Highest return on cost; detects contract gaps without Docker noise"
  - phase: 2
    lane: contract
    commands: [up, build]
    reason: "Closes out validations and envelopes before runtime"
  - phase: 3
    lane: semantic
    commands: [features-info, read-configuration, exec, run-user-commands]
    reason: "Detects partially wired flags or divergent semantics"
  - phase: 4
    lane: runtime
    commands: [set-up, up]
    reason: "Minimal happy path and error path"
  - phase: 5
    lane: runtime
    commands: [build]
    reason: "Highest infrastructure noise; leave for last"

normalization:
  stdout_json:
    - sort_keys
    - drop_nulls
    - drop_absolute_paths
    - drop_volatile_ids
  stderr:
    - redact_timestamps
    - redact_host_paths
    - redact_container_ids
    - optionally_non_fatal
  assertions:
    - exit_code
    - stdout_normalized
    - stderr_normalized

initial_cases:
  - id: features-info.invalid-mode
    lane: contract
    command: features-info
    priority: p0
    docker_required: false
    ts_cmd: "features info invalid ghcr.io/devcontainers/features/go"
    asserts: [exit_code, stderr_normalized]
    class: mode-validation
    current_status: match
    notes: "Keep as a guardrail; previously missing in Go"

  - id: features-info.manifest-json
    lane: contract
    command: features-info
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/go --output-format json"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match

  - id: features-info.tags-json
    lane: contract
    command: features-info
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "features info tags ghcr.io/devcontainers/features/go --output-format json"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match

  - id: features-info.dependencies-text
    lane: semantic
    command: features-info
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "features info dependencies ghcr.io/devcontainers/features/go"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: dependency-graph
    current_status: match
    notes: "The normalized output now converges in the A/B comparison"

  - id: features-info.invalid-output-format
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/go --output-format yaml"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: features-info.invalid-log-level
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/go --log-level warning"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: features-info.invalid-feature-id-text
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest not-a-feature-id"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match

  - id: features-info.invalid-feature-id-json
    lane: contract
    command: features-info
    priority: p1
    docker_required: false
    ts_cmd: "features info manifest not-a-feature-id --output-format json"
    asserts: [exit_code, stdout_normalized]
    class: parse-validation
    current_status: match

  # --- Cases that pin down divergences uncovered by the coverage audit ---
  - id: up.invalid-workspace-mount-consistency
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --workspace-mount-consistency bogus"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "TS validates the yargs enum [consistent,cached,delegated]; Go previously passed the raw value to docker."

  - id: features-publish.invalid-log-level
    lane: contract
    command: features-publish
    priority: p1
    docker_required: false
    ts_cmd: "features publish src/test/configs --namespace o/r --log-level bogus"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "TS rejects --log-level outside [info,debug,trace]; Go previously defaulted to Info and continued."

  - id: features.resolve-dependencies-no-features
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features resolve-dependencies --workspace-folder src/test/configs/image"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "config with no features → TS errors to stderr exit 1; Go previously printed {installOrder:[]} exit 0."

  - id: features.resolve-dependencies-malformed-lockfile-error
    lane: contract
    command: features
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/feat/devcontainer-feature.json; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./feat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' '{\"features\":{} x' > $WORKSPACE/.devcontainer/devcontainer-lock.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "features resolve-dependencies --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: lockfile-error
    current_status: match
    notes: "readLockfile rethrows JSON.parse's SyntaxError and runAsyncHandler console.errors it: 'SyntaxError: Expected ',' or '}' after property value in JSON at position 15 (line 1 column 16)' on stderr, exit 1, nothing on stdout. Go used to ignore the lockfile and print the graph."

  # --- Wave A: new cases (some uncovered divergences, now fixed) ---
  - id: features-publish.missing-required
    lane: contract
    command: features-publish
    priority: p1
    docker_required: false
    ts_cmd: "features publish src/test/configs"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match
    notes: "TS: 'Missing required argument: namespace'. Go emitted the cobra phrasing (MarkFlagRequired); now publishCollection validates an empty namespace with the same message."

  - id: templates.publish-missing-namespace
    lane: contract
    command: templates
    priority: p1
    docker_required: false
    ts_cmd: "templates publish src/test/configs"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match
    notes: "Identical to features-publish.missing-required: message 'Missing required argument: namespace'."

  - id: up.invalid-default-user-env-probe
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --default-user-env-probe bogus"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "TS rejects the yargs enum; Go validates the same enum before touching Docker."

  - id: build.compose-output-not-supported
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --output type=local"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match
    notes: "compose + --output → TS throws '--output not supported.'"

  - id: features.test-reject-global-scenarios-and-features
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features test --global-scenarios-only --features x"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "Mutual exclusion. Go emitted different wording; now it uses the oracle's ('Cannot combine --global-scenarios-only and --features')."

  - id: features.test-reject-skip-scenarios-and-global-scenarios
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features test --skip-scenarios --global-scenarios-only"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "Go aligned with the oracle's text+order ('Cannot combine --skip-scenarios and --global-scenarios-only')."

  - id: templates.apply-invalid-template-args-exit1
    lane: contract
    command: templates
    priority: p1
    docker_required: false
    ts_cmd: "templates apply --template-id ghcr.io/x/y:1 --template-args [1,2,3]"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "Go emitted the parser detail; now a fixed message 'Invalid template arguments provided.' like TS."

  - id: set-up.invalid-remote-env
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --remote-env BROKEN"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match
    notes: "set-up did not validate --remote-env; now it calls validateRemoteEnvs like its sibling commands."

  # --- Wave A batch 2: new cases (6 more divergences fixed) ---
  - id: upgrade.err-invalid-target-version-format
    lane: contract
    command: upgrade
    priority: p1
    docker_required: false
    ts_cmd: "upgrade --workspace-folder src/test/configs/image-with-features --feature ghcr.io/devcontainers/features/node --target-version abc"
    asserts: [exit_code, stderr_normalized]
    class: version-validation
    current_status: match
    notes: "TS validates in yargs .check() before the handler: --target-version must be x / x.y / x.y.z. 'abc' => exit 1 'Invalid version 'abc'.  Must be in the form of 'x', 'x.y', or 'x.y.z''. Go previously declared --feature/--target-version as hidden but never read them (normal upgrade, exit 0); now RunE validates the format with the same regex and text."

  - id: upgrade.err-feature-without-target-version
    lane: contract
    command: upgrade
    priority: p1
    docker_required: false
    ts_cmd: "upgrade --workspace-folder src/test/configs/image-with-features --feature ghcr.io/devcontainers/features/node"
    asserts: [exit_code, stderr_normalized]
    class: version-validation
    current_status: match
    notes: "XOR from yargs .check(): --feature and --target-version must be used together. Only --feature => exit 1 'The '--target-version' and '--feature' flag must be used together.'. Go ignored both flags; now RunE applies the XOR with the same message."

  - id: upgrade.err-invalid-log-level
    lane: contract
    command: upgrade
    priority: p1
    docker_required: false
    ts_cmd: "upgrade --workspace-folder src/test/configs/image-with-features --log-level warn --feature ghcr.io/devcontainers/features/node"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match
    notes: "upgrade's --log-level is a yargs choice of error/info/debug/trace (featuresUpgradeOptions), checked before .check(): 'warn' => exit 1 with the invalid-choice error, not the --feature/--target-version one. Go accepted any value and ran."

  - id: upgrade.err-no-features
    lane: contract
    command: upgrade
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\"}' > $WORKSPACE/.devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "test ! -e ${WORKSPACE}/.devcontainer-lock.json"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "upgrade --workspace-folder ${WORKSPACE}"
    asserts: [exit_code]
    class: upgrade-runtime
    current_status: match
    notes: "Without Features generateFeaturesConfig returns undefined and upgrade throws ContainerError 'Failed to update lockfile' (upgradeCommand.ts): exit 1 and no lockfile written (verify_cmd). TS logs the inspected error object, whose last line is '}', so only the exit code is compared; TestUpgradeFailsWithoutFeatures holds the message. Go wrote {\"features\":{}} and exited 0."

  - id: outdated.json-not-a-terminal-success
    lane: contract
    command: outdated
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/feat/devcontainer-feature.json; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./feat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "outdated --workspace-folder ${WORKSPACE} --output-format json"
    asserts: [exit_code, stdout_text]
    class: outdated
    current_status: match
    notes: "outdated writes JSON.stringify(outdated, undefined, process.stdout.isTTY ? '  ' : undefined): with stdout not a terminal, as here, the result is one unindented line ({\"features\":{}}, a local Feature having no versions). Go used to indent it always."

  - id: outdated.text-without-features-success
    lane: contract
    command: outdated
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "outdated --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stdout_text]
    class: outdated
    current_status: match
    notes: "Without Features, loadVersionInfo returns no Features and outdated writes its text table with no rows: the header alone ('Feature  Current  Wanted  Latest'). Go used to print 'No features configured.'."

  - id: outdated.malformed-lockfile-error
    lane: contract
    command: outdated
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"ghcr.io/devcontainers/features/node:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' 'not json' > $WORKSPACE/.devcontainer/devcontainer-lock.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "outdated --workspace-folder ${WORKSPACE} --output-format json"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: lockfile-error
    current_status: match
    notes: "readLockfile rethrows JSON.parse's SyntaxError; outdated's catch logs its stack at debug level and exits 1, so at the default log level stdout and stderr say nothing (TS prints only its banner). Go used to ignore the lockfile and report the versions."

  - id: outdated.image-with-features-text
    lane: runtime
    command: outdated
    priority: p1
    network_required: true
    ts_cmd: "outdated --workspace-folder src/test/configs/image-with-features --output-format text"
    asserts: [exit_code, stdout_normalized]
    class: outdated-runtime
    current_status: match
    notes: "outdated --output-format text: the Feature column is the full userFeatureId without tag (getFeatureIdWithoutVersion), rows follow the config's insertion order, and the format is the npm text-table (minimum widths, 2-space separator, left-aligned, no trailing spaces). Go previously shortened to the last 2 segments with tag, sorted alphabetically (map), and padded to %-50s with trailing spaces."

  - id: features.package-single-feature-success
    lane: runtime
    command: features-package
    priority: p1
    docker_required: false
    ts_cmd: "features package reference/src/test/container-features/example-v2-features-sets/simple/src/color -o ${PKG_OUT} -f"
    setup_cmd: "PKG_OUT=/tmp/parity-pkg-single-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${PKG_OUT}; echo PKG_OUT=$PKG_OUT"
    verify_cmd: "test -f ${PKG_OUT}/devcontainer-feature-color.tgz && test -f ${PKG_OUT}/devcontainer-collection.json && printf ok"
    cleanup_cmd: "rm -rf ${PKG_OUT}"
    asserts: [exit_code, stdout_normalized]
    class: collection-packaging
    current_status: match
    notes: "--target points to a folder for a SINGLE feature (devcontainer-feature.json + install.sh directly). TS dispatches packageSingleFeature (exit 0: tgz + a 1-element collection); Go iterated only subdirectories → empty collection → 'Failed to package'. Fix: packageCollection detects the metadata in the root folder and packages it as single."

  - id: features.test-missing-src-test-folders
    lane: contract
    command: features
    priority: p1
    docker_required: false
    ts_cmd: "features test --project-folder src/test/configs/image"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "project-folder with neither src/ nor test/. TS prints the banner and then the error to STDOUT (chalk.red, prefix '[-]') and exits 1; Go wrote the error to STDERR via the logger and without a banner. Fix: banner before the check + error to STDOUT with the exact text ('does not contain the required ''src'' and ''test'' folders.'). Both sides leave STDERR empty, so extractErrorReason canonicalizes to '' on both and stderr_normalized matches. stdout_normalized is not asserted: the TS banner carries the literal version 'vX.Y.Z' that the normalizer does not scrub (it would need a version-scrub, wave B)."

  - id: build.no-lockfile-frozen-lockfile-mutually-exclusive
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --no-lockfile --frozen-lockfile"
    asserts: [exit_code, stderr_normalized]
    class: parse-validation
    current_status: match
    notes: "TS registers --no-lockfile/--frozen-lockfile as public and rejects all 3 no-lockfile+frozen combinations ('--no-lockfile and --frozen-lockfile are mutually exclusive.'). Go previously registered only the hidden --experimental-* → 'unknown flag: --no-lockfile'."

  - id: exec.workspace-image-nonzero-exit
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} sh -c \"exit 7\""
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code]
    class: container-runtime
    current_status: match
    notes: "exec propagates the remote command's exit code (sh -c 'exit 7' -> exit 7 on both CLIs). Only exit_code is asserted: stdout is empty on both; stderr differs (Go emits a banner + bash noise 'no job control', TS does not)."

  - id: exec.container-not-found
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --id-label parity.case=missing echo hi"
    asserts: [exit_code, stderr_normalized]
    class: container-runtime
    current_status: match
    notes: "With no container running: both CLIs fail with 'Dev container not found.' exit 1. extractErrorReason normalizes Go's banner and TS's stack trace to the same reason."

  - id: templates.publish-collection-success
    lane: runtime
    command: templates
    priority: p1
    docker_required: true
    setup_cmd: "REG_NAME=parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE}; docker rm -f $REG_NAME >/dev/null 2>&1; docker run -d --name $REG_NAME -p 127.0.0.1::5000 registry:3 >/dev/null; PORT=$(docker port $REG_NAME 5000/tcp | head -1 | sed s/.*://); curl -s --retry 30 --retry-delay 1 --retry-connrefused http://localhost:$PORT/v2/ >/dev/null 2>&1; echo REGISTRY=localhost:$PORT"
    cleanup_cmd: "docker rm -f parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    ts_cmd: "templates publish reference/src/test/container-templates/example-templates-sets/simple/src -r ${REGISTRY} -n octocat/templates"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "publishes the template collection (alpine, cpp, mytemplate, node-mongo) to a LOCAL registry:3, one per side started in setup_cmd with host 'localhost' (not 127.0.0.1) so that the TS OCI client uses plain HTTP. The random host port is captured via echo REGISTRY=localhost:PORT (the harness reSetupEnv injects it into the ts_cmd env). stdout = result-map JSON { id: {publishedTags:[1,1.0,1.0.0,latest], digest, version} }; the tarball digest differs between sides (Go tar vs node-tar) but is scrubbed to sha256:<HASH>, and the keys are ordered by normalizeValue. Each side uses its own fresh registry -> deterministic publishedTags."

  - id: features-publish.legacy-ids-single-segment-namespace-success
    lane: runtime
    command: features-publish
    priority: p1
    docker_required: true
    setup_cmd: "REG_NAME=parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE}; docker rm -f $REG_NAME >/dev/null 2>&1; docker run -d --name $REG_NAME -p 127.0.0.1::5000 registry:3 >/dev/null; PORT=$(docker port $REG_NAME 5000/tcp | head -1 | sed s/.*://); curl -s --retry 30 --retry-delay 1 --retry-connrefused http://localhost:$PORT/v2/ >/dev/null 2>&1; echo REGISTRY=localhost:$PORT"
    verify_cmd: "curl -s http://${REGISTRY}/v2/myorg/tags/list"
    cleanup_cmd: "docker rm -f parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    ts_cmd: "features publish reference/src/test/container-features/example-v2-features-sets/renaming-feature/src -r ${REGISTRY} -n myorg"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "renaming-feature publishes hello and new-color; new-color's legacyIds (color, old-color) are republished and reported inside the item as publishedLegacyIds (featuresCLI/publish.ts), not as items of their own. The one-segment namespace is a valid collection (getCollectionRef): verify_cmd lists the collection's tags (latest). Go used to report the aliases as items and to skip the collection metadata for a one-segment namespace."

  - id: features-publish.already-published-success
    lane: runtime
    command: features-publish
    priority: p1
    docker_required: true
    setup_cmd: "REG_NAME=parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE}; docker rm -f $REG_NAME >/dev/null 2>&1; docker run -d --name $REG_NAME -p 127.0.0.1::5000 registry:3 >/dev/null; PORT=$(docker port $REG_NAME 5000/tcp | head -1 | sed s/.*://); curl -s --retry 30 --retry-delay 1 --retry-connrefused http://localhost:$PORT/v2/ >/dev/null 2>&1; ${PARITY_CLI_TS} features publish reference/src/test/container-features/example-v2-features-sets/renaming-feature/src -r localhost:$PORT -n myorg >/dev/null 2>&1; echo REGISTRY=localhost:$PORT"
    cleanup_cmd: "docker rm -f parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    ts_cmd: "features publish reference/src/test/container-features/example-v2-features-sets/renaming-feature/src -r ${REGISTRY} -n myorg"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "setup_cmd publishes the collection once (with the oracle); publishing the same versions again skips each item, which TS reports as an empty object: {hello:{}, new-color:{}}. Go used to report {digest:'', publishedTags:[]}."

  - id: build.disallowed-feature-error
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"ghcr.io/devcontainers/features/node:1\":{},\"ghcr.io/devcontainers/features/disallowed-feature:1\":{},\"ghcr.io/chrmarti/test-features/test-disallowed-feature\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "build --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    compare_nulls: true
    notes: "The containers.dev control manifest disallows ghcr.io/devcontainers/features/disallowed-feature. The first disallowed feature in the config's key order is reported (TS Object.keys), and build's error envelope carries only outcome/message/description (devContainersSpecCLI.ts build)."

  - id: up.disallowed-feature-error
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"ghcr.io/devcontainers/features/node:1\":{},\"ghcr.io/devcontainers/features/disallowed-feature:1\":{},\"ghcr.io/chrmarti/test-features/test-disallowed-feature\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    compare_nulls: true
    notes: "up reports disallowedFeatureId, didStopContainer (false: no container) and learnMoreUrl (disallowedFeatures.ts, doProvision). Go used to emit only the description, and to report a random one of two disallowed features."

  - id: up.disallowed-feature-stops-running-container
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"ghcr.io/devcontainers/features/node:1\":{},\"ghcr.io/devcontainers/features/disallowed-feature:1\":{},\"ghcr.io/chrmarti/test-features/test-disallowed-feature\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; docker run -d --label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} alpine:3 sleep infinity >/dev/null; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "docker inspect -f '{{.State.Status}}' $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE})"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    compare_nulls: true
    notes: "A running container with the workspace's id labels is stopped (docker stop -t 0), the description says so and didStopContainer is true; verify_cmd shows it exited. Go used to take the --id-label shortcut, reuse the container and report success without reading the config."

  - id: up.id-label-only-existing-container-error
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "docker run -d --label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} alpine:3 sleep infinity >/dev/null"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; true"
    ts_cmd: "up --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "TS reads the config before looking for a container (configContainer.ts): with no workspace and no config it fails with 'No dev container config and no workspace found.' even though --id-label finds a container. Go used to reuse the container and report success with an empty remoteWorkspaceFolder."

  - id: build.malformed-lockfile-error
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/feat/devcontainer-feature.json; printf '#!/bin/sh\\necho installed\\n' > $WORKSPACE/.devcontainer/feat/install.sh; chmod +x $WORKSPACE/.devcontainer/feat/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./feat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' 'not json' > $WORKSPACE/.devcontainer/devcontainer-lock.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "build --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: lockfile-error
    current_status: match
    notes: "readLockfile rethrows JSON.parse's SyntaxError while the Features are resolved; build wraps it in a ContainerError: message the SyntaxError's, description 'An error occurred building the container.'. Go used to ignore the lockfile and build."

  - id: up.malformed-lockfile-error
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/feat/devcontainer-feature.json; printf '#!/bin/sh\\necho installed\\n' > $WORKSPACE/.devcontainer/feat/install.sh; chmod +x $WORKSPACE/.devcontainer/feat/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./feat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' 'not json' > $WORKSPACE/.devcontainer/devcontainer-lock.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: lockfile-error
    current_status: match
    notes: "As build.malformed-lockfile-error, with up's description 'An error occurred setting up the container.'; no container is created."

  - id: build.compose-malformed-lockfile-error
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/feat/devcontainer-feature.json; printf '#!/bin/sh\\necho installed\\n' > $WORKSPACE/.devcontainer/feat/install.sh; chmod +x $WORKSPACE/.devcontainer/feat/install.sh; printf 'services:\\n  app:\\n    image: alpine:3\\n    command: sleep infinity\\n' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/workspace\",\"features\":{\"./feat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' 'not json' > $WORKSPACE/.devcontainer/devcontainer-lock.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "build --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: lockfile-error
    current_status: match
    notes: "A Compose configuration reads the lockfile while its Features are resolved for the build override; readLockfile's SyntaxError is build's message under 'An error occurred building the container.'. Go used to ignore the lockfile and build."

  - id: up.compose-malformed-lockfile-error
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/feat/devcontainer-feature.json; printf '#!/bin/sh\\necho installed\\n' > $WORKSPACE/.devcontainer/feat/install.sh; chmod +x $WORKSPACE/.devcontainer/feat/install.sh; printf 'services:\\n  app:\\n    image: alpine:3\\n    command: sleep infinity\\n' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/workspace\",\"features\":{\"./feat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' 'not json' > $WORKSPACE/.devcontainer/devcontainer-lock.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: lockfile-error
    current_status: match
    notes: "As build.compose-malformed-lockfile-error, with up's description 'An error occurred setting up the container.'; no service is started."

  - id: up.config-without-workspace-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\"}' > $WORKSPACE/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "docker inspect -f 'mounts=[{{range .Mounts}}{{.Destination}} {{end}}] wd={{.Config.WorkingDir}}' $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE})"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --config ${WORKSPACE}/devcontainer.json --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "With --config and no --workspace-folder there is no workspace: nothing is mounted and remoteWorkspaceFolder is left out (getWorkspaceConfiguration with an undefined workspace). Go used to mount '' at /workspaces/. and report remoteWorkspaceFolder '/workspaces/.'."

  - id: up.feature-hook-failure-error
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/myfeat; printf '%s' '{\"id\":\"myfeat\",\"version\":\"1.0.0\",\"postCreateCommand\":\"exit 3\"}' > $WORKSPACE/.devcontainer/myfeat/devcontainer-feature.json; printf '#!/bin/sh\necho installed\n' > $WORKSPACE/.devcontainer/myfeat/install.sh; chmod +x $WORKSPACE/.devcontainer/myfeat/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./myfeat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "A Feature's failing postCreateCommand: description 'postCreateCommand from Feature ./myfeat failed.', message the command's error, and the containerId (injectHeadless.ts runLifecycleCommand, ContainerError message = originalError.message). Go used to say 'from devcontainer.json' and leave the container out."

  - id: up.parallel-hook-failure-error
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/myfeat; printf '%s' '{\"image\":\"alpine:3\",\"postCreateCommand\":{\"a\":\"true\",\"b\":\"exit 4\"}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "An object postCreateCommand whose b command fails: 'b of postCreateCommand from devcontainer.json failed.'. Go used to drop the command's name."

  - id: run-user-commands.hook-failure-error
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/myfeat; printf '%s' '{\"id\":\"myfeat\",\"version\":\"1.0.0\",\"postCreateCommand\":\"exit 3\"}' > $WORKSPACE/.devcontainer/myfeat/devcontainer-feature.json; printf '#!/bin/sh\necho installed\n' > $WORKSPACE/.devcontainer/myfeat/install.sh; chmod +x $WORKSPACE/.devcontainer/myfeat/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./myfeat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; ${PARITY_CLI_TS} up --workspace-folder $WORKSPACE --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --skip-post-create >/dev/null 2>&1; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "run-user-commands --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "The container was created with --skip-post-create, so postCreateCommand runs here and fails: TS run-user-commands reports only message and description, with the Feature origin. Go used to say 'from devcontainer.json'."

  - id: run-user-commands.after-failed-post-create-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/myfeat; printf '%s' '{\"id\":\"myfeat\",\"version\":\"1.0.0\",\"postCreateCommand\":\"exit 3\"}' > $WORKSPACE/.devcontainer/myfeat/devcontainer-feature.json; printf '#!/bin/sh\necho installed\n' > $WORKSPACE/.devcontainer/myfeat/install.sh; chmod +x $WORKSPACE/.devcontainer/myfeat/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./myfeat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; ${PARITY_CLI_TS} up --workspace-folder $WORKSPACE --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "run-user-commands --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "up already ran (and failed) postCreateCommand; its marker was written before it ran (updateMarkerFile), so run-user-commands does not run it again and succeeds with result done. Go used no markers in run-user-commands and failed again."

  - id: set-up.after-failed-post-create-success
    lane: runtime
    command: set-up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/myfeat; printf '%s' '{\"id\":\"myfeat\",\"version\":\"1.0.0\",\"postCreateCommand\":\"exit 3\"}' > $WORKSPACE/.devcontainer/myfeat/devcontainer-feature.json; printf '#!/bin/sh\necho installed\n' > $WORKSPACE/.devcontainer/myfeat/install.sh; chmod +x $WORKSPACE/.devcontainer/myfeat/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./myfeat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; ${PARITY_CLI_TS} up --workspace-folder $WORKSPACE --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; CONTAINER=$(docker ps -q --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); echo CONTAINER=$CONTAINER; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "set-up --container-id ${CONTAINER}"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "set-up shares runLifecycleHooks with up: the marker up wrote keeps the failed postCreateCommand from running again. Go used no markers in set-up and reported 'An error occurred running user commands: ...'."

  - id: up.container-entrypoint-and-command-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "docker inspect -f '{{json .Config.Entrypoint}} {{json .Config.Cmd}}' $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE})"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "The container's keep-alive script is TS spawnDevContainer's byte for byte: with no Feature entrypoint, an empty line stands between trap and exec. Go used to drop that line, so the containers' Cmd differed."

  - id: templates.publish-template-metadata-success
    lane: runtime
    command: templates
    priority: p1
    docker_required: true
    setup_cmd: "REG_NAME=parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE}; docker rm -f $REG_NAME >/dev/null 2>&1; docker run -d --name $REG_NAME -p 127.0.0.1::5000 registry:3 >/dev/null; PORT=$(docker port $REG_NAME 5000/tcp | head -1 | sed s/.*://); curl -s --retry 30 --retry-delay 1 --retry-connrefused http://localhost:$PORT/v2/ >/dev/null 2>&1; echo REGISTRY=localhost:$PORT"
    verify_cmd: "for t in alpine node-mongo; do ${PARITY_CLI_TS} templates metadata ${REGISTRY}/octocat/templates/$t 2>/dev/null | tail -1 | node -e 'let s=\"\";process.stdin.on(\"data\",d=>s+=d).on(\"end\",()=>{const o=JSON.parse(s);o.files.sort();console.log(JSON.stringify(o))})'; done"
    cleanup_cmd: "docker rm -f parity-reg-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    ts_cmd: "templates publish reference/src/test/container-templates/example-templates-sets/simple/src -r ${REGISTRY} -n octocat/templates"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "The published dev.containers.metadata annotation carries what TS addsAdditionalTemplateProps adds while packaging: type, files, fileCount and featureIds. verify_cmd reads each side's annotation with the oracle and sorts files: TS recursive-readdir lists them in the order their asynchronous stat calls complete, which is not defined. Go used to publish the template JSON without them."

  - id: features-package.legacy-ids-current-id-success
    lane: contract
    command: features-package
    priority: p1
    docker_required: false
    setup_cmd: "OUT=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $OUT; echo OUT=$OUT"
    verify_cmd: "cat ${OUT}/devcontainer-collection.json; tar -xOf ${OUT}/devcontainer-feature-new-color.tgz ./devcontainer-feature.json"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "features package reference/src/test/container-features/example-v2-features-sets/renaming-feature/src -o ${OUT}"
    asserts: [exit_code]
    class: features-package
    current_status: match
    notes: "new-color lists legacyIds, so TS addsAdditionalFeatureProps adds currentId to its metadata and rewrites the packaged devcontainer-feature.json as JSON.stringify(…, null, 4). Go used to package the file untouched and leave currentId out."

  - id: features-package.parent-of-src-error
    lane: contract
    command: features-package
    priority: p1
    docker_required: false
    setup_cmd: "OUT=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $OUT; echo OUT=$OUT"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "features package reference/src/test/container-features/example-v2-features-sets/renaming-feature -o ${OUT}"
    asserts: [exit_code, stderr_normalized]
    class: features-package
    current_status: match
    notes: "TS does not descend into src/: the only entry, src, has no devcontainer-feature.json, so it is skipped with a warning and the package fails (exit 1). Go used to descend into src/ and succeed."

  - id: features-package.missing-install-sh-error
    lane: contract
    command: features-package
    priority: p1
    docker_required: false
    setup_cmd: "OUT=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $OUT; mkdir -p $OUT/src/a; printf '%s' '{\"id\":\"a\",\"version\":\"1.0.0\",\"name\":\"A\"}' > $OUT/src/a/devcontainer-feature.json; echo OUT=$OUT"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "features package ${OUT}/src -o ${OUT}/out"
    asserts: [exit_code, stderr_normalized]
    class: features-package
    current_status: match
    notes: "A Feature without install.sh fails the package: 'Feature a is missing an install.sh', then 'Failed to package features', exit 1. Go used to package it."

  - id: features-package.existing-output-error
    lane: contract
    command: features-package
    priority: p1
    docker_required: false
    setup_cmd: "OUT=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $OUT; mkdir -p $OUT/out; echo OUT=$OUT"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "features package reference/src/test/container-features/example-v2-features-sets/renaming-feature/src -o ${OUT}/out"
    asserts: [exit_code, stderr_normalized]
    class: features-package
    current_status: match
    notes: "An output folder that exists is an error unless -f is passed: '(!) ERR: Output directory ... already exists. Manually delete, or pass -f to continue.', exit 1. Go used to package into it."

  - id: features-package.missing-target
    lane: contract
    command: features-package
    priority: p1
    docker_required: false
    ts_cmd: "features package"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match
    notes: "TS declares <target> as a required positional: yargs stops with 'Not enough non-option arguments: got 0, need at least 1' (exit 1). Go used to default it to the current folder."

  - id: features-publish.missing-target
    lane: contract
    command: features-publish
    priority: p1
    docker_required: false
    ts_cmd: "features publish -n x"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match
    notes: "TS declares <target> as a required positional: yargs stops with 'Not enough non-option arguments: got 0, need at least 1' (exit 1). Go used to default it to the current folder."

  - id: templates.publish-missing-target
    lane: contract
    command: templates
    priority: p1
    docker_required: false
    ts_cmd: "templates publish -n x"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match
    notes: "TS declares <target> as a required positional: yargs stops with 'Not enough non-option arguments: got 0, need at least 1' (exit 1). Go used to default it to the current folder."

  - id: up.compose-image-without-features-wraps-entrypoint-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect -f '{{json .Config.Entrypoint}} {{json .Config.Cmd}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-without-features/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "TS startContainer always writes the containerFeatures override (dockerCompose.ts generateFeaturesComposeOverrideContent), with or without Features: the service entrypoint becomes the keep-alive script followed by the image's entrypoint, and the compose command is kept. Go only wrote it with Features, so the container ran the bare image entrypoint."

  - id: up.compose-merged-runtime-properties-without-features-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s\\n' 'services:' '  app:' '    image: alpine:3' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/\",\"updateRemoteUserUID\":false,\"capAdd\":[\"SYS_PTRACE\"],\"securityOpt\":[\"seccomp=unconfined\"],\"privileged\":true,\"init\":true,\"containerUser\":\"nobody\",\"containerEnv\":{\"FOO\":\"a$b c\"},\"mounts\":[\"type=volume,source=paritydata,target=/data\"]}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker inspect -f '{{json .HostConfig.CapAdd}} {{json .HostConfig.SecurityOpt}} {{.HostConfig.Privileged}} {{json .HostConfig.Init}} {{.Config.User}} {{range .Mounts}}{{.Type}}:{{.Name}}:{{.Destination}} {{end}}' ${CONTAINER_ID}; docker inspect -f '{{range .Config.Env}}{{println .}}{{end}}' ${CONTAINER_ID} | grep '^FOO='"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 --volumes >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Without Features TS still applies the merged capAdd, securityOpt, privileged, init, containerUser, containerEnv and mounts through the containerFeatures override (dockerCompose.ts generateFeaturesComposeOverrideContent). Go applied only containerEnv and mounts, in separate overrides."

  - id: up.compose-dockerfile-without-features-update-uid-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s\\n' 'FROM alpine:3' 'RUN adduser -D -u 4321 dev' > $WORKSPACE/.devcontainer/Dockerfile; printf '%s\\n' 'services:' '  app:' '    build: .' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/\",\"remoteUser\":\"dev\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "printf 'uid=%s ' \"$(docker exec ${CONTAINER_ID} id -u dev)\"; I=$(docker inspect -f '{{.Image}}' ${CONTAINER_ID}); test -n \"$(docker image inspect -f '{{index .Config.Labels \"devcontainer.metadata\"}}' $I)\" && printf 'image-metadata=ok'"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "TS builds a Dockerfile service through a build override even without Features (getImageBuildOptions adds the devcontainer.metadata label to the image) and then runs updateRemoteUserUID on the built image (dockerCompose.ts startContainer). Go built the service unchanged and never remapped the remote user's UID for compose."

  - id: up.compose-image-with-local-feature-image-name-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/myfeature; printf '%s\\n' 'services:' '  app:' '    image: alpine:3' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"id\":\"myfeature\",\"version\":\"1.0.0\",\"name\":\"myfeature\"}' > $WORKSPACE/.devcontainer/myfeature/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'touch /feature-marker' > $WORKSPACE/.devcontainer/myfeature/install.sh; chmod +x $WORKSPACE/.devcontainer/myfeature/install.sh; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/\",\"features\":{\"./myfeature\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker inspect -f '{{.Config.Image}}' ${CONTAINER_ID}; docker exec ${CONTAINER_ID} test -f /feature-marker && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "An image-only service with Features is built by `docker compose build` through a build override that tags the folder image name (TS buildAndExtendDockerCompose: `image: getFolderImageName`, `FROM <image> AS dev_container_auto_added_stage_label`, Features content from the temp image without BuildKit). Go built it with a separate docker build tagged <image>-features. The workspace path is side-independent so both sides compute the same folder image name."

  - id: read-configuration.legacy-feature-id-error
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder reference/src/test/configs/image-with-local-feature --include-merged-configuration"
    asserts: [exit_code, stderr_normalized]
    class: features
    current_status: match
    notes: "A bare Feature id ('myfeature') is a legacy id TS rejects ('Legacy feature myfeature not supported...'), exit 1 with no result. Go used to drop the Feature error silently and print a configuration without the Feature."

  - id: read-configuration.local-feature-outside-devcontainer-error
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer $WORKSPACE/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/feat/devcontainer-feature.json; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"../feat\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-merged-configuration"
    asserts: [exit_code, stdout_normalized]
    class: features
    current_status: match
    notes: "A local Feature must lie in the workspace's .devcontainer folder (processFeatureIdentifier, containerFeaturesConfiguration.ts): '../feat' logs 'Local file path parse error. Resolved path must be a child of the .devcontainer/ folder.' and the Feature fails as one that could not be processed, exit 1 with no result. Go used to resolve the folder next to the configuration wherever it was and print a configuration with the Feature. stderr is not compared: Go also logs the thrown error at error level, which TS's read-configuration catch writes at debug level, a divergence common to every read-configuration failure."

  - id: build.local-feature-absolute-path-error
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/feat/devcontainer-feature.json; printf '#!/bin/sh\\necho installed\\n' > $WORKSPACE/.devcontainer/feat/install.sh; chmod +x $WORKSPACE/.devcontainer/feat/install.sh; printf '{\"image\":\"alpine:3\",\"features\":{\"%s/.devcontainer/feat\":{}}}' $WORKSPACE > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "build --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: features
    current_status: match
    notes: "An absolute Feature id is a local Feature (getFeatureIdType: './', '../' or '/') that processFeatureIdentifier refuses, even for a folder inside .devcontainer: it logs 'An Absolute path to a local feature is not allowed.' and build reports {\"outcome\":\"error\",\"message\":\"ERR: Feature '<path>' could not be processed.  You may not have permission ...\",\"description\":\"An error occurred building the container.\"}, exit 1. Go used to take it for a legacy id and fail with the legacy Feature error."

  - id: build.local-feature-config-outside-devcontainer-error
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/feat; printf '%s' '{\"id\":\"feat\",\"version\":\"1.0.0\"}' > $WORKSPACE/feat/devcontainer-feature.json; printf '#!/bin/sh\\n' > $WORKSPACE/feat/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./feat\":{}}}' > $WORKSPACE/.devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "build --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: features
    current_status: match
    notes: "With the configuration at the workspace root (.devcontainer.json), './feat' resolves outside the .devcontainer folder, which processFeatureIdentifier refuses; build reports the plain Error buildDependencyGraph throws as its message: {\"outcome\":\"error\",\"message\":\"ERR: Feature './feat' could not be processed.  You may not have permission ...\",\"description\":\"An error occurred building the container.\"}, exit 1. Go used to build the Feature."

  - id: up.update-uid-remote-user-from-image-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; IMG=parity-uid-meta-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/img $WORKSPACE/.devcontainer; printf 'FROM debian:latest\\nRUN groupadd --gid 4321 foo && useradd --uid 1234 --gid 4321 --create-home foo\\nLABEL devcontainer.metadata=\\047[{\\042remoteUser\\042:\\042foo\\042}]\\047\\n' > $WORKSPACE/img/Dockerfile; docker build -q -t $IMG $WORKSPACE/img >/dev/null; printf '{\\042image\\042:\\042%s\\042}' $IMG > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -c 'printf %s:%s $(id -u) $(id -g)'"
    cleanup_cmd: "docker rm -f $(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}) >/dev/null 2>&1; docker rmi -f parity-uid-meta-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code]
    class: up-runtime
    current_status: match
    notes: "The remote user comes from the image's devcontainer.metadata label, not the config: TS updateRemoteUserUID decides on the merged configuration, so foo is remapped to the host UID/GID. Go used to read only the config's remoteUser and left foo at 1234:4321."

  - id: read-configuration.merged-dockerfile-registry-base-success
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    network_required: true
    serial: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; docker rmi -f mcr.microsoft.com/devcontainers/base:alpine-3.19 >/dev/null 2>&1; printf 'ARG VARIANT=3.18\\nFROM mcr.microsoft.com/devcontainers/base:alpine-${VARIANT}\\n' > $WORKSPACE/.devcontainer/Dockerfile; printf '%s' '{\"build\":{\"dockerfile\":\"Dockerfile\",\"args\":{\"VARIANT\":\"3.19\"}},\"remoteEnv\":{\"A\":\"b\"}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "docker image inspect mcr.microsoft.com/devcontainers/base:alpine-3.19 >/dev/null 2>&1 && echo base-image-pulled || echo base-image-not-pulled"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-merged-configuration"
    asserts: [exit_code, stdout_normalized]
    class: merged-configuration
    current_status: match
    notes: "Without a container, mergedConfiguration starts from the Dockerfile's base image (getImageBuildInfo -> internalGetImageBuildInfoFromDockerfile, imageMetadata.ts): the FROM is resolved with the build args (VARIANT=3.19) and the image, absent locally, is read from its registry (inspectDockerImage -> inspectImageInRegistry, utils.ts) without pulling it, so its devcontainer.metadata gives remoteUser vscode. The verify_cmd checks the image was not pulled. Go used to skip the base image and leave remoteUser out. serial: the image must stay absent locally."

  - id: read-configuration.merged-image-registry-features-success
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    network_required: true
    serial: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; docker rmi -f mcr.microsoft.com/devcontainers/javascript-node:1-20-bookworm >/dev/null 2>&1; printf '%s' '{\"image\":\"mcr.microsoft.com/devcontainers/javascript-node:1-20-bookworm\",\"features\":{\"ghcr.io/devcontainers/features/github-cli:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "docker image inspect mcr.microsoft.com/devcontainers/javascript-node:1-20-bookworm >/dev/null 2>&1 && echo image-pulled || echo image-not-pulled"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-merged-configuration"
    asserts: [exit_code, stdout_normalized]
    class: merged-configuration
    current_status: match
    notes: "An image config whose image is not present locally: getImageBuildInfoFromImage reads the config from the registry (image index entry for the host platform), so mergedConfiguration carries the image's remoteUser node and its customizations (dbaeumer.vscode-eslint) plus the Feature's metadata (getDevcontainerMetadata). Go used to inspect only the local image and lose the image metadata. serial: the image must stay absent locally."

  - id: read-configuration.merged-compose-build-registry-base-success
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    network_required: true
    serial: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; docker rmi -f mcr.microsoft.com/devcontainers/javascript-node:1-20-bookworm >/dev/null 2>&1; printf 'FROM mcr.microsoft.com/devcontainers/javascript-node:1-20-bookworm\\nUSER root\\n' > $WORKSPACE/.devcontainer/Dockerfile; printf 'services:\\n  app:\\n    build:\\n      context: .\\n      dockerfile: Dockerfile\\n    command: sleep infinity\\n' > $WORKSPACE/.devcontainer/compose.yml; printf '%s' '{\"dockerComposeFile\":\"compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/workspace\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "docker image inspect mcr.microsoft.com/devcontainers/javascript-node:1-20-bookworm >/dev/null 2>&1 && echo base-image-pulled || echo base-image-not-pulled"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-merged-configuration"
    asserts: [exit_code, stdout_normalized]
    class: merged-configuration
    current_status: match
    notes: "A compose service built from a Dockerfile: getImageBuildInfo reads `docker compose config`, takes the service's build (getBuildInfoForService) and reads the Dockerfile's base image from its registry, so mergedConfiguration has remoteUser node and the image's customizations. Go used to skip compose configs. serial: the image must stay absent locally."

  - id: read-configuration.merged-dockerfile-not-found
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"build\":{\"dockerfile\":\"missing.Dockerfile\"}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-merged-configuration"
    asserts: [exit_code, stdout_normalized]
    class: merged-configuration
    current_status: match
    notes: "getImageBuildInfo throws 'Dockerfile (<path>) not found.' when the configured Dockerfile is missing: exit 1 and no result on stdout. Go used to print a merged configuration without the image metadata."

  - id: read-configuration.merged-image-missing
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"remoteUser\":\"me\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-merged-configuration"
    asserts: [exit_code, stdout_normalized]
    class: merged-configuration
    current_status: match
    notes: "A config with no image, Dockerfile or compose file: getImageBuildInfo throws 'No image information specified in devcontainer.json.', exit 1 and no result on stdout. Go used to print a merged configuration."

  - id: build.features-staging-layout-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; IMG=parity-feat-base-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/img $WORKSPACE/.devcontainer/hello; printf 'FROM alpine:3\\nLABEL devcontainer.metadata=\\047[{\"remoteUser\":\"nobody\"}]\\047\\n' > $WORKSPACE/img/Dockerfile; docker build -q -t $IMG $WORKSPACE/img >/dev/null; printf '%s' '{\"id\":\"hello\",\"version\":\"1.0.0\",\"name\":\"Hello\",\"options\":{\"zeta\":{\"type\":\"string\",\"default\":\"z\"},\"greeting\":{\"type\":\"string\",\"default\":\"hi\"},\"alpha\":{\"type\":\"boolean\",\"default\":true}},\"containerEnv\":{\"HELLO_HOME\":\"/opt/hello\"}}' > $WORKSPACE/.devcontainer/hello/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'set -e' '{ pwd; ls -A; cat ../devcontainer-features.builtin.env; env | grep -E \"^(_CONTAINER_USER|_REMOTE_USER|_CONTAINER_USER_HOME|_REMOTE_USER_HOME|ZETA|GREETING|ALPHA|HELLO_HOME)=\" | sort; } > /feature-out.txt' > $WORKSPACE/.devcontainer/hello/install.sh; chmod +x $WORKSPACE/.devcontainer/hello/install.sh; printf '{\"image\":\"%s\",\"containerEnv\":{\"CFG_VAR\":\"a$b\"},\"features\":{\"./hello\":{\"greeting\":\"yo\"}}}' $IMG > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker run --rm ${IMAGE_NAME} sh -c 'cat /feature-out.txt; echo ---; ls -A /tmp/dev-container-features; cat /tmp/dev-container-features/devcontainer-features.builtin.env'; docker image inspect -f '{{.Config.User}} {{json .Config.Env}}' ${IMAGE_NAME}"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} parity-feat-base-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "BuildKit Features build (TS getFeaturesBuildOptions + getFeatureLayers, containerFeaturesConfiguration.ts): the Feature is staged at its consecutiveId (hello_0), bind-mounted from the dev_containers_feature_content_source build context, copied to /tmp/dev-container-features/hello_0 and installed through devcontainer-features-install.sh, which sources ../devcontainer-features.builtin.env (_CONTAINER_USER/_REMOTE_USER plus the _*_HOME lines the first RUN appends) and devcontainer-features.env (options in devcontainer-feature.json order); the folder is removed afterwards, the builtin env stays. The Feature's containerEnv and the config's containerEnv are ENV lines and the image keeps its own user (USER $_DEV_CONTAINERS_IMAGE_USER). Go used to copy _dev_container_feature_0 to /tmp/build-features and run install.sh with inline env prefixes, so ../devcontainer-features.builtin.env did not exist."

  - id: build.features-staging-layout-no-buildkit-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; IMG=parity-feat-base-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/img $WORKSPACE/.devcontainer/hello; printf 'FROM alpine:3\\nLABEL devcontainer.metadata=\\047[{\"remoteUser\":\"nobody\"}]\\047\\n' > $WORKSPACE/img/Dockerfile; docker build -q -t $IMG $WORKSPACE/img >/dev/null; printf '%s' '{\"id\":\"hello\",\"version\":\"1.0.0\",\"name\":\"Hello\",\"options\":{\"zeta\":{\"type\":\"string\",\"default\":\"z\"},\"greeting\":{\"type\":\"string\",\"default\":\"hi\"},\"alpha\":{\"type\":\"boolean\",\"default\":true}},\"containerEnv\":{\"HELLO_HOME\":\"/opt/hello\"}}' > $WORKSPACE/.devcontainer/hello/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'set -e' '{ pwd; ls -A; cat ../devcontainer-features.builtin.env; env | grep -E \"^(_CONTAINER_USER|_REMOTE_USER|_CONTAINER_USER_HOME|_REMOTE_USER_HOME|ZETA|GREETING|ALPHA|HELLO_HOME)=\" | sort; } > /feature-out.txt' > $WORKSPACE/.devcontainer/hello/install.sh; chmod +x $WORKSPACE/.devcontainer/hello/install.sh; printf '{\"image\":\"%s\",\"containerEnv\":{\"CFG_VAR\":\"a$b\"},\"features\":{\"./hello\":{\"greeting\":\"yo\"}}}' $IMG > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker run --rm ${IMAGE_NAME} sh -c 'cat /feature-out.txt; echo ---; ls -A /tmp/dev-container-features /tmp/dev-container-features/hello_0; cd /tmp/dev-container-features/hello_0 && cat devcontainer-features.env && echo && cat devcontainer-features-install.sh'; docker image inspect -f '{{.Config.User}} {{json .Config.Env}}' ${IMAGE_NAME}"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} parity-feat-base-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Without BuildKit, TS builds the dev_container_feature_content_temp image from the features folder and COPYs /tmp/build-features/hello_0 to /tmp/dev-container-features/hello_0 (kept in the image), so verify_cmd also compares the staged devcontainer-features.env and the devcontainer-features-install.sh banner (getFeatureInstallWrapperScript). Go used to copy from the build context to /tmp/build-features/_dev_container_feature_0."

  - id: up.compose-features-staging-layout-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; IMG=parity-feat-base-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/img $WORKSPACE/.devcontainer/hello; printf 'FROM alpine:3\\nLABEL devcontainer.metadata=\\047[{\"remoteUser\":\"nobody\"}]\\047\\n' > $WORKSPACE/img/Dockerfile; docker build -q -t $IMG $WORKSPACE/img >/dev/null; printf '%s' '{\"id\":\"hello\",\"version\":\"1.0.0\",\"name\":\"Hello\",\"options\":{\"zeta\":{\"type\":\"string\",\"default\":\"z\"},\"greeting\":{\"type\":\"string\",\"default\":\"hi\"},\"alpha\":{\"type\":\"boolean\",\"default\":true}},\"containerEnv\":{\"HELLO_HOME\":\"/opt/hello\"}}' > $WORKSPACE/.devcontainer/hello/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'set -e' '{ pwd; ls -A; cat ../devcontainer-features.builtin.env; env | grep -E \"^(_CONTAINER_USER|_REMOTE_USER|_CONTAINER_USER_HOME|_REMOTE_USER_HOME|ZETA|GREETING|ALPHA|HELLO_HOME)=\" | sort; } > /feature-out.txt' > $WORKSPACE/.devcontainer/hello/install.sh; chmod +x $WORKSPACE/.devcontainer/hello/install.sh; printf 'services:\\n  app:\\n    image: %s\\n    command: sleep infinity\\n' $IMG > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/\",\"containerEnv\":{\"CFG_VAR\":\"a$b\"},\"features\":{\"./hello\":{\"greeting\":\"yo\"}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --skip-post-create --update-remote-user-uid-default never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -c 'cat /feature-out.txt; echo ---; ls -A /tmp/dev-container-features; cat /tmp/dev-container-features/devcontainer-features.builtin.env'; docker image inspect -f '{{.Config.User}} {{json .Config.Env}}' $(docker inspect -f '{{.Image}}' ${CONTAINER_ID})"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1; docker rmi -f parity-feat-base-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    asserts: [exit_code]
    class: up-runtime
    current_status: match
    notes: "The compose service's Features Dockerfile (appended to `FROM <image> AS dev_container_auto_added_stage_label`) has the same structure as the image build's: builtin env, consecutiveId folders, install wrapper, the Feature's containerEnv and, like TS getFeaturesBuildOptions, the config's containerEnv as ENV lines (CFG_VAR). Go used the _dev_container_feature_<i> layout and left the config's containerEnv out of the compose image."

  - id: read-configuration.container-id-missing-error
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    ts_cmd: "read-configuration --container-id devcontainer-cli-parity-no-such-container"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "A --container-id that cannot be inspected fails read-configuration: TS findContainerAndIdLabels runs inspectContainer, whose `docker inspect` failure throws, so the command exits 1 with nothing on stdout. Go used to ignore the inspect failure and print the configuration."

  - id: exec.config-remote-user-probe-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; IMG=parity-exec-user-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/img $WORKSPACE/.devcontainer; printf 'FROM debian:latest\\nRUN useradd --create-home foo\\n' > $WORKSPACE/img/Dockerfile; docker build -q -t $IMG $WORKSPACE/img >/dev/null; printf '{\\042image\\042:\\042%s\\042}' $IMG > $WORKSPACE/.devcontainer/devcontainer.json; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder $WORKSPACE --skip-post-create --update-remote-user-uid-default never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder $WORKSPACE --skip-post-create --update-remote-user-uid-default never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null; fi; printf '{\\042image\\042:\\042%s\\042,\\042remoteUser\\042:\\042foo\\042}' $IMG > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "exec --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} sh -c 'printf %s:%s:%s \"$HOME\" \"$(id -un)\" \"$PATH\"'"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; docker rmi -f parity-exec-user-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "The container is created without a remoteUser and the config then names foo. exec probes the user environment as the merged configuration's remoteUser (devContainersSpecCLI.ts exec: getImageMetadataFromContainer adds the config's remoteUser, createContainerProperties(..., mergedConfig.remoteUser)), so the probed HOME and PATH are foo's. Go probed as the container's metadata user (root here) and only ran the command as foo, passing root's HOME=/root and PATH."

  - id: read-configuration.legacy-wrong-types
    lane: semantic
    command: read-configuration
    priority: p2
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/legacy-wrong-types"
    asserts: [exit_code, stdout_normalized]
    class: config-parsing
    current_status: match
    notes: "TS validates no property type: a falsy \"extensions\" and a \"devPort\" that customizations.vscode already sets stay in the configuration as written. Go failed the typed decode (exit 1, 'cannot unmarshal')."

  - id: set-up.config-without-workspace
    lane: runtime
    command: set-up
    priority: p1
    docker_required: true
    ts_cmd: "set-up --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-workspace-variables/devcontainer.json --include-configuration --include-merged-configuration --skip-post-create"
    setup_cmd: "CONTAINER_ID=$(docker run -d -e TEST_CE=TEST_VALUE alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "TS doSetUp reads --config with no workspace: ${localWorkspaceFolder}, its basename and (without workspaceFolder) ${containerWorkspaceFolder} stay as written, and properties the typed config has no field for are reported. Go resolved them against the current directory ('.', '/workspaces/.') and dropped the untyped properties."

  - id: set-up.missing-config
    lane: runtime
    command: set-up
    priority: p1
    docker_required: true
    ts_cmd: "set-up --container-id parity-no-such-container --config src/test/configs/set-up-with-workspace-variables/missing.json"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "TS reads --config before it looks for the container: 'Dev container config (...) not found.' and exit 1. Go ignored a config that did not load (and reported the missing container first)."

  - id: read-configuration.terminal-rows-zero-implies-columns
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --terminal-rows 0"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match
    notes: "yargs .implies() tests whether the implied flag is present (validation.js keyExists: hasOwnProperty), not its value, so a 0 counts as given. Go tested the value (> 0) and let a lone 0 through."

  - id: up.terminal-columns-zero-implies-rows
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --terminal-columns 0"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match
    notes: "yargs .implies() tests whether the implied flag is present (validation.js keyExists: hasOwnProperty), not its value, so a 0 counts as given. Go tested the value (> 0) and let a lone 0 through."

  - id: set-up.terminal-rows-zero-implies-columns
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --terminal-rows 0"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match
    notes: "yargs .implies() tests whether the implied flag is present (validation.js keyExists: hasOwnProperty), not its value, so a 0 counts as given. Go tested the value (> 0) and let a lone 0 through."

  - id: run-user-commands.terminal-columns-zero-implies-rows
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --terminal-columns 0"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match
    notes: "yargs .implies() tests whether the implied flag is present (validation.js keyExists: hasOwnProperty), not its value, so a 0 counts as given. Go tested the value (> 0) and let a lone 0 through."

  - id: exec.terminal-rows-zero-implies-columns
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --terminal-rows 0 echo hello"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match
    notes: "yargs .implies() tests whether the implied flag is present (validation.js keyExists: hasOwnProperty), not its value, so a 0 counts as given. Go tested the value (> 0) and let a lone 0 through."

  - id: outdated.terminal-rows-zero-implies-columns
    lane: contract
    command: outdated
    priority: p1
    docker_required: false
    ts_cmd: "outdated --workspace-folder src/test/configs/image --terminal-rows 0"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match
    notes: "yargs .implies() tests whether the implied flag is present (validation.js keyExists: hasOwnProperty), not its value, so a 0 counts as given. Go tested the value (> 0) and let a lone 0 through."

  - id: outdated.terminal-columns-implies-rows
    lane: contract
    command: outdated
    priority: p1
    docker_required: false
    ts_cmd: "outdated --workspace-folder src/test/configs/image --terminal-columns 80"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match
    notes: "TS outdated declares terminal-columns/terminal-rows with implies, as its siblings do (devContainersSpecCLI.ts outdatedOptions); Go outdated did not check the pair at all."

  - id: build.compose-image-name-is-a-string-without-image-name
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Without --image-name, TS doBuild reports a Compose build's image as a string (imageNameResult = originalImageName); with it, as the array of --image-name values. Go always wrote an array. The image keeps the name the sibling compose-image-without-features-minimal cases give it, so no cleanup removes it from under them."

  - id: up.compose-without-workspace-folder-uses-root-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s\\n' 'services:' '  app:' '    image: alpine:3' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"postCreateCommand\":\"pwd > /tmp/post-create; echo ${containerWorkspaceFolder} >> /tmp/post-create\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /tmp/post-create; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then CLI=${PARITY_CLI_TS}; else CLI=${PARITY_CLI_GO}; fi; $CLI exec --workspace-folder ${WORKSPACE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} pwd 2>/dev/null"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    key_order: [""]
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "A compose configuration without workspaceFolder works in `/` (TS getWorkspaceConfiguration returns getRemoteWorkspaceFolder, `config.workspaceFolder || '/'`, dockerCompose.ts): up's remoteWorkspaceFolder, ${containerWorkspaceFolder}, the lifecycle commands' cwd and exec's cwd. Go used /workspaces/<basename>, a folder the compose service never mounts."

  - id: build.frozen-lockfile-missing-failure
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --buildkit=never --frozen-lockfile"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: lockfile
    current_status: match
    notes: "--frozen-lockfile without a lockfile fails with TS writeLockfile's 'Lockfile does not exist.' (lockfile.ts), wrapped as the build's ContainerError: message is that text, description 'An error occurred building the container.'. Go skipped the check when no lockfile existed and built the image."

  - id: up.frozen-lockfile-mismatch-failure
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"features\":{\"stale\":{}}}' > $WORKSPACE/.devcontainer/devcontainer-lock.json; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --frozen-lockfile --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: lockfile
    current_status: match
    notes: "A stale lockfile with --frozen-lockfile fails with TS's 'Lockfile does not match.' as the message and 'An error occurred setting up the container.' as the description. Go reported 'An error occurred setting up the container: install features: lockfile: lockfile does not match' in both."

  - id: up.compose-frozen-lockfile-missing-failure
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s\\n' 'services:' '  app:' '    image: alpine:3' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"features\":{\"./f\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --frozen-lockfile --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: lockfile
    current_status: match
    notes: "The compose path checks the frozen lockfile too (TS generateFeaturesConfig -> writeLockfile, wrapped by dockerCompose.ts as 'An error occurred setting up the container.'). Go skipped it when no lockfile existed and started the service."

  - id: read-configuration.features-configuration-local-feature-key-order-success
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f $WORKSPACE/.devcontainer/g; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\",\"name\":\"F\",\"options\":{\"a\":{\"type\":\"string\",\"default\":\"z\"}},\"containerEnv\":{\"K\":\"v\"},\"customizations\":{\"vscode\":{\"extensions\":[\"e\"]}},\"installsAfter\":[\"./g\"]}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"version\":\"2.0.0\",\"id\":\"g\"}' > $WORKSPACE/.devcontainer/g/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/g/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{\"a\":\"b\"},\"./g\":true}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-features-configuration"
    key_order: ["featuresConfiguration.featureSets.0.features.0", "featuresConfiguration.featureSets.1.features.0"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "A Feature entry is TS's {...featureJson, ...feature} (applyFeatureConfigToFeature): devcontainer-feature.json's properties in its order, then those processFeatureIdentifier and fetchFeatures set that it lacks ({id, name, value, included}, then cachePath and consecutiveId), so value follows the metadata's properties. g's metadata lists version before id and has no name, which then follows it. Go wrote the struct's order (value after consecutiveId, containerEnv and customizations last)."

  - id: read-configuration.features-configuration-local-feature-metadata-success
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/h; printf '%s' '{\"version\":\"1.0.0\",\"id\":\"h\",\"keywords\":[\"k\"],\"options\":{\"z\":{\"type\":\"string\",\"default\":\"1\"},\"a\":{\"default\":true,\"type\":\"boolean\"},\"e\":{}},\"x\":1,\"x\":2,\"10\":\"ten\",\"2\":\"two\",\"extensions\":[\"ext1\"],\"settings\":{\"s\":1,\"u\":1},\"customizations\":{\"vscode\":{\"extensions\":[\"e0\"],\"settings\":{\"t\":2,\"s\":3}}},\"num\":1.50,\"empty\":{}}' > $WORKSPACE/.devcontainer/h/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/h/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./h\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-features-configuration"
    key_order: ["featuresConfiguration", "featuresConfiguration.featureSets.0", "featuresConfiguration.featureSets.0.sourceInformation", "featuresConfiguration.featureSets.0.features.0", "featuresConfiguration.featureSets.0.features.0.options", "featuresConfiguration.featureSets.0.features.0.options.z", "featuresConfiguration.featureSets.0.features.0.options.a", "featuresConfiguration.featureSets.0.features.0.customizations.vscode", "featuresConfiguration.featureSets.0.features.0.customizations.vscode.settings"]
    asserts: [exit_code, stdout_normalized, stdout_text]
    class: output-shape
    current_status: match
    notes: "A local Feature entry is devcontainer-feature.json as JSON.parse reads it, every property kept (keywords, x, empty, an empty option), a repeated one at its first position with its last value, the array-index properties 2 and 10 first, numbers as JS writes them (1.5), and the options' properties in the file's order; then name, value, included, cachePath and consecutiveId (processFeatureIdentifier, fetchFeatures). updateFromOldProperties (containerFeaturesConfiguration.ts) moves extensions and settings into customizations.vscode, settings spread under vscode's. Go used to write only the properties it has fields for, in the struct's order, with options sorted and the deprecated properties dropped."

  - id: read-configuration.features-configuration-oci-feature-key-order-success
    lane: runtime
    command: read-configuration
    priority: p1
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"ghcr.io/devcontainers/features/github-cli:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-features-configuration"
    key_order: ["featuresConfiguration.featureSets.0", "featuresConfiguration.featureSets.0.sourceInformation", "featuresConfiguration.featureSets.0.sourceInformation.manifest", "featuresConfiguration.featureSets.0.sourceInformation.manifest.config", "featuresConfiguration.featureSets.0.sourceInformation.manifest.annotations", "featuresConfiguration.featureSets.0.sourceInformation.featureRef", "featuresConfiguration.featureSets.0.features.0", "featuresConfiguration.featureSets.0.features.0.options", "featuresConfiguration.featureSets.0.features.0.options.version"]
    asserts: [exit_code, stdout_normalized, stdout_text]
    class: output-shape
    current_status: match
    notes: "An OCI Feature set as TS writes it: sourceInformation in tryGetOCIFeatureSet's order (type, manifest, manifestDigest, featureRef, userFeatureId, userFeatureIdWithoutVersion), the manifest as the registry served it (JSON.parse of its body), featureRef in getRef's order, then internalVersion before computedDigest (applyFeatureConfigToFeature). The Feature is the annotation's metadata spread over {id, included, value} and that over the layer's devcontainer-feature.json, so its options keep the published order. Go used to re-serialize the manifest and featureRef with sorted keys and write the Feature in the struct's order."

  - id: read-configuration.features-configuration-oci-feature-pinned-success
    lane: runtime
    command: read-configuration
    priority: p1
    network_required: true
    ts_cmd: "read-configuration --workspace-folder reference/src/test/container-features/configs/lockfile-frozen --include-features-configuration"
    key_order: ["featuresConfiguration.featureSets.0.sourceInformation.featureRef", "featuresConfiguration.featureSets.0.features.0", "featuresConfiguration.featureSets.1.sourceInformation.featureRef"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "Both Features are pinned by the fixture's lockfile. featureRef is parsed from the reference as written (tryGetOCIFeatureSet), so it keeps tag and version 1 though the manifest is fetched by the lockfile's digest. color's published metadata names it new-color: the Feature's id, and so its consecutiveId and cachePath (new-color_0), are the metadata's (buildDependencyGraph spreads it over the Feature). Go used to report the pinned digest in featureRef, without the tag, and name the folder after the reference's id (color_0)."

  - id: read-configuration.features-configuration-oci-feature-digest-success
    lane: runtime
    command: read-configuration
    priority: p1
    network_required: true
    ts_cmd: "read-configuration --workspace-folder reference/src/test/container-features/configs/dockerfile-with-v2-oci-features --include-features-configuration"
    key_order: ["featuresConfiguration.featureSets.0.sourceInformation.featureRef", "featuresConfiguration.featureSets.1.sourceInformation.featureRef", "featuresConfiguration.featureSets.2.sourceInformation.featureRef", "featuresConfiguration.featureSets.0.features.0", "featuresConfiguration.featureSets.1.features.0", "featuresConfiguration.featureSets.2.features.0"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "A digest reference's featureRef has digest and version, no tag (getRef), next to the legacy ids terraform and node mapped to their published Features."

  - id: read-configuration.key-order-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"name\":\"ko\",\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"features\":{\"./f\":{}},\"containerEnv\":{\"K\":\"v\"},\"postCreateCommand\":\"true\",\"forwardPorts\":[3000],\"capAdd\":[\"SYS_PTRACE\"]}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-features-configuration --include-merged-configuration"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    key_order: ["", "configuration", "featuresConfiguration", "mergedConfiguration"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "JSON.stringify writes properties in insertion order: the result as readConfiguration's literal lists them, the configuration in its document's order with configFilePath last, featuresConfiguration as FeaturesConfig's literal (featureSets, dstFolder), mergedConfiguration as mergeConfiguration builds it (the configuration without replaceProperties, then the properties it sets). Go wrote every object with sorted keys. Nested user objects keep sorted keys (docs/DIVERGENCES.md)."

  - id: up.include-configurations-key-order-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"name\":\"ko\",\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"features\":{\"./f\":{}},\"containerEnv\":{\"K\":\"v\"},\"postCreateCommand\":\"true\",\"forwardPorts\":[3000],\"capAdd\":[\"SYS_PTRACE\"]}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --include-configuration --include-merged-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    key_order: ["", "configuration", "mergedConfiguration"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "up's result follows doProvision's literal (outcome, then launch's containerId, composeProjectName, remoteUser, remoteWorkspaceFolder, configuration, mergedConfiguration, ociAuthDiagnostics), its configuration the document's order and its mergedConfiguration mergeConfiguration's. Go wrote sorted keys. The content is compared too: with --id-label, TS writes configFilePath's fsPath here because processing the Features reads the lockfile next to the configuration (getLockfilePath reads configFilePath.fsPath, and vscode-uri's toJSON writes fsPath once something read it)."

  - id: read-configuration.json-stringify-escapes-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"postCreateCommand\":\"a && b <x> \\u2028\\u2029 \\\\u0026\",\"containerEnv\":{\"<K&>\":\"v\"}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --include-merged-configuration"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized, stdout_text]
    class: output-shape
    current_status: match
    notes: "JSON.stringify writes &, <, > and U+2028/U+2029 in strings as they are; encoding/json escapes them (\\u0026, \\u003c, \\u003e, \\u2028, \\u2029), which stdout_normalized's JSON parse cannot see. stdout_text compares the raw bytes. An escaped backslash followed by u0026 stays as written. A lone surrogate escape is not covered: Go's JSON decoder turns it into U+FFFD (docs/DIVERGENCES.md)."

  - id: up.config-file-fspath-without-id-label-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --include-configuration --include-merged-configuration"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=devcontainer.local_folder=${WORKSPACE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "Without --id-label, TS resolveWithLocalFolder passes configPath.fsPath to findContainerAndIdLabels (configContainer.ts), and vscode-uri's toJSON writes fsPath once something read it, so both configurations' configFilePath have fsPath. Go left it out of every up result."

  - id: up.config-file-fspath-id-label-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\"}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --include-configuration --include-merged-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "With --id-label, a configuration found in the workspace (vscode-fileHost, read through CLIHostDocuments, which uses uriToFsPath) and no Features, nothing in TS's up reads configFilePath.fsPath, so its URI has no fsPath. Guards against writing it always."

  - id: up.compose-config-file-fspath-features-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s\\n' 'services:' '  app:' '    image: alpine:3' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"workspaceFolder\":\"/\",\"remoteUser\":\"root\",\"features\":{\"./f\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --skip-post-create --include-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "A compose configuration with Features: TS generateFeaturesConfig reads the lockfile next to the configuration (getLockfilePath reads configFilePath.fsPath), so even with --id-label the configuration's configFilePath has fsPath (vscode-uri's toJSON writes it once read). Go left it out."

  - id: read-configuration.override-config-scheme-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\"}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\"}' > $WORKSPACE/override.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --override-config ${WORKSPACE}/override.json"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "TS makes a file URI of --config only: with --override-config, configFilePath is the configuration found in the workspace (getDevContainerConfigPathIn), with the vscode-fileHost scheme. Go wrote the file scheme whenever --override-config or --container-id was given."

  - id: read-configuration.override-config-without-workspace-config-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{}}}' > $WORKSPACE/override.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --override-config ${WORKSPACE}/override.json --include-features-configuration"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: config-parsing
    current_status: match
    notes: "A workspace without a devcontainer.json: TS names its default path, <workspace>/.devcontainer/devcontainer.json, as configFilePath (getDefaultDevContainerConfigPath) and reads the override in its place, so the override's local Feature ./f resolves in .devcontainer. Go named the override as configFilePath and looked for ./f next to it, failing the command."

  - id: up.override-config-scheme-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\"}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\"}' > $WORKSPACE/override.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --override-config ${WORKSPACE}/override.json --buildkit=never --include-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "up keeps the configuration found in the workspace as configFilePath, with the vscode-fileHost scheme, when --override-config is given; readDocument reads the override, not it, so with --id-label its URI has no fsPath. Go wrote the file scheme."

  - id: read-configuration.git-worktree-common-dir-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir"
    cleanup_cmd: "rm -rf ${BASE}; true"
    key_order: ["workspace"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "A Git worktree whose .git file names its gitdir by a relative path: with --mount-git-worktree-common-dir, TS getWorkspaceConfiguration (utils.ts) adds additionalMountString, the bind mount of the common dir, and read-configuration writes it in workspace after workspaceFolder and workspaceMount. Go kept the mount for up but left it out of the result."

  - id: up.git-worktree-common-dir-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker inspect -f '{{range .Mounts}}{{.Type}}:{{.Source}}:{{.Destination}} {{end}}' ${CONTAINER_ID}"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${BASE}; true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "up mounts the additionalMountString read-configuration reports: TS spawnDevContainer passes it as a --mount after the workspace mount (singleContainer.ts), so the container has the worktree and its common dir."

  - id: read-configuration.git-worktree-common-dir-custom-workspace-mount-and-folder-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"workspaceMount\":\"type=bind,source=${localWorkspaceFolder},target=/src/wt\",\"workspaceFolder\":\"/src/wt\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir"
    cleanup_cmd: "rm -rf ${BASE}; true"
    key_order: ["workspace"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "TS getWorkspaceConfiguration (utils.ts) computes the common-dir mount together with the workspace mount, only when the config leaves workspaceFolder or workspaceMount unset: with both set, read-configuration reports no additionalMountString. Go added one relative to the custom mount's target."

  - id: read-configuration.git-worktree-common-dir-custom-workspace-mount-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"workspaceMount\":\"type=volume,source=parity-wt,target=/src/wt\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir"
    cleanup_cmd: "rm -rf ${BASE}; true"
    key_order: ["workspace"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "A custom workspaceMount (here a volume) without workspaceFolder: TS getWorkspaceConfiguration (utils.ts) still computes the worktree layout, so workspaceFolder and the additionalMountString target derive from /workspaces/<segments>, not from the custom mount's target. Go resolved the common dir relative to the custom target."

  - id: up.git-worktree-common-dir-custom-workspace-mount-and-folder-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"workspaceMount\":\"type=bind,source=${localWorkspaceFolder},target=/src/wt\",\"workspaceFolder\":\"/src/wt\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker inspect -f '{{range .Mounts}}{{.Type}}:{{.Source}}:{{.Destination}} {{end}}' ${CONTAINER_ID}"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${BASE}; true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "With workspaceMount and workspaceFolder both set, TS spawnDevContainer gets no additionalMountString (getWorkspaceConfiguration, utils.ts), so the container has only the custom workspace mount. Go also mounted the common dir."

  - id: read-configuration.git-worktree-common-dir-empty-workspace-mount-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"workspaceMount\":\"\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir"
    cleanup_cmd: "rm -rf ${BASE}; true"
    key_order: ["workspace"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "An empty workspaceMount is set: TS readDevContainerConfigFile (configContainer.ts) tests `'workspaceMount' in config`, so read-configuration reports workspaceMount as \"\" beside the computed workspaceFolder and additionalMountString. Go replaced it with the computed bind mount."

  - id: read-configuration.git-worktree-common-dir-null-workspace-mount-and-folder-success
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"workspaceMount\":null,\"workspaceFolder\":\"/src/wt\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "read-configuration --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir"
    cleanup_cmd: "rm -rf ${BASE}; true"
    key_order: ["workspace"]
    asserts: [exit_code, stdout_normalized]
    class: output-shape
    current_status: match
    notes: "A null workspaceMount with workspaceFolder: TS getWorkspaceConfiguration (utils.ts) counts the property as set, so it computes neither the workspace mount nor the common-dir mount, and read-configuration reports workspaceMount as null. Go computed both."

  - id: up.git-worktree-common-dir-empty-workspace-mount-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "BASE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $BASE; mkdir -p $BASE; git init -q $BASE/repo && git -C $BASE/repo -c user.email=p@p -c user.name=p commit -q --allow-empty -m init && git -C $BASE/repo worktree add -q ../wt && printf '%s\\n' 'gitdir: ../repo/.git/worktrees/wt' > $BASE/wt/.git; mkdir -p $BASE/wt/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteUser\":\"root\",\"workspaceMount\":\"\"}' > $BASE/wt/.devcontainer/devcontainer.json; echo WORKSPACE=$BASE/wt; echo BASE=$BASE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --mount-git-worktree-common-dir --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker inspect -f '{{range .Mounts}}{{.Type}}:{{.Source}}:{{.Destination}} {{end}}' ${CONTAINER_ID}"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${BASE}; true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "An empty workspaceMount mounts no workspace: TS spawnDevContainer (singleContainer.ts) passes no --mount for a falsy workspaceMount, so the container has only the worktree common dir. Go bind-mounted the workspace folder."

  - id: build.lockfile-written-by-default-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{},\"ghcr.io/devcontainers/feature-starter/hello:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "cat ${WORKSPACE}/.devcontainer/devcontainer-lock.json"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: lockfile
    current_status: match
    compare_hashes: true
    notes: "TS writes devcontainer-lock.json on every build with Features unless --no-lockfile is given (containerFeaturesConfiguration.ts generateFeaturesConfig -> writeLockfile, which creates the file); it records the OCI Feature, pinned to its digest, and leaves the local one out. Go wrote it only with --experimental-lockfile or --frozen-lockfile."

  - id: build.no-lockfile-writes-none-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{},\"ghcr.io/devcontainers/feature-starter/hello:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --buildkit=never --no-lockfile --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "ls -A ${WORKSPACE}/.devcontainer"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: lockfile
    current_status: match
    notes: "--no-lockfile disables writing the lockfile (generateFeaturesConfig skips writeLockfile): the configuration folder holds no devcontainer-lock.json after the build."

  - id: build.dot-devcontainer-lockfile-path-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./.devcontainer/f\":{}}}' > $WORKSPACE/.devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "cd ${WORKSPACE} && ls -A . .devcontainer && cat .devcontainer-lock.json"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: lockfile
    current_status: match
    notes: "A .devcontainer.json gets .devcontainer-lock.json next to it (lockfile.ts getLockfilePath); with only a local Feature (under .devcontainer/, where TS requires it) the lockfile's features map is empty, and TS still writes it."

  - id: up.lockfile-rewrites-stale-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"features\":{\"stale\":{}}}' > $WORKSPACE/.devcontainer/devcontainer-lock.json; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{},\"ghcr.io/devcontainers/feature-starter/hello:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "cat ${WORKSPACE}/.devcontainer/devcontainer-lock.json"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: lockfile
    current_status: match
    compare_hashes: true
    notes: "up rewrites a stale lockfile with the resolved Features by default (writeLockfile replaces content whose JSON.parse -> JSON.stringify differs). Go left an existing lockfile alone without a lockfile flag."

  - id: up.no-lockfile-leaves-lockfile-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s' '{\"features\":{\"stale\":{}}}' > $WORKSPACE/.devcontainer/devcontainer-lock.json; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./f\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --no-lockfile --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "cat ${WORKSPACE}/.devcontainer/devcontainer-lock.json"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: lockfile
    current_status: match
    notes: "--no-lockfile neither reads nor writes the lockfile: a stale one is left as it was."

  - id: up.compose-lockfile-written-by-default-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s\\n' 'services:' '  app:' '    image: alpine:3' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"features\":{\"./f\":{},\"ghcr.io/devcontainers/feature-starter/hello:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "cat ${WORKSPACE}/.devcontainer/devcontainer-lock.json"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f ${WORKSPACE}/.devcontainer/docker-compose.yml down -t 0 >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: lockfile
    current_status: match
    compare_hashes: true
    notes: "The Compose path resolves the Features through the same generateFeaturesConfig (dockerCompose.ts -> getExtendImageBuildInfo) and writes the lockfile by default. Go wrote it only with a lockfile flag."

  - id: build.compose-no-lockfile-writes-none-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/f; printf '%s' '{\"id\":\"f\",\"version\":\"1.0.0\"}' > $WORKSPACE/.devcontainer/f/devcontainer-feature.json; printf '%s\\n' '#!/bin/sh' 'true' > $WORKSPACE/.devcontainer/f/install.sh; chmod +x $WORKSPACE/.devcontainer/f/install.sh; printf '%s\\n' 'services:' '  app:' '    image: alpine:3' '    command: sleep infinity' > $WORKSPACE/.devcontainer/docker-compose.yml; printf '%s' '{\"dockerComposeFile\":\"docker-compose.yml\",\"service\":\"app\",\"features\":{\"./f\":{},\"ghcr.io/devcontainers/feature-starter/hello:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --buildkit=never --no-lockfile --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "ls -A ${WORKSPACE}/.devcontainer"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: lockfile
    current_status: match
    notes: "A Compose build with --no-lockfile writes no lockfile."

  - id: build.absolute-dockerfile-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer $WORKSPACE/df; printf '%s\\n' 'FROM alpine:3' 'COPY marker /marker' > $WORKSPACE/df/Dockerfile; echo absolute > $WORKSPACE/df/marker; printf '{\"build\":{\"dockerfile\":\"%s/df/Dockerfile\"}}' $WORKSPACE > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker run --rm parity-${PARITY_CASE_ID}-${PARITY_SIDE} cat /marker"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: build-runtime
    current_status: match
    notes: "An absolute build.dockerfile is used where it is (configuration.ts getDockerfilePath resolves it against the configuration's folder, which keeps an absolute path), and without build.context the context is its folder (utils.ts getDockerContextPath). Go joined it onto the configuration's folder and failed reading '<config dir>/<absolute path>'."

  - id: build.subfolder-dockerfile-default-context-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/sub; printf '%s\\n' 'FROM alpine:3' 'COPY marker /marker' > $WORKSPACE/.devcontainer/sub/Dockerfile; echo subfolder > $WORKSPACE/.devcontainer/sub/marker; printf '%s' '{\"build\":{\"dockerfile\":\"sub/Dockerfile\"}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "build --workspace-folder ${WORKSPACE} --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker run --rm parity-${PARITY_CASE_ID}-${PARITY_SIDE} cat /marker"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code]
    class: build-runtime
    current_status: match
    notes: "Without build.context the context is the Dockerfile's folder (utils.ts getDockerContextPath: parentURI(getDockerfilePath)), not the configuration's: COPY finds the file next to sub/Dockerfile. Go used the configuration's folder and the COPY failed."

  - id: upgrade.write-lockfile-to-disk-success
    lane: runtime
    command: upgrade
    priority: p1
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; cp -R reference/src/test/configs/image-with-features/. $WORKSPACE/; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "cat ${WORKSPACE}/.devcontainer-lock.json"
    cleanup_cmd: "rm -rf /tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "upgrade --workspace-folder ${WORKSPACE}"
    asserts: [exit_code]
    class: upgrade-runtime
    current_status: match
    compare_hashes: true
    notes: "upgrade WITHOUT --dry-run persists the lockfile to disk (.devcontainer-lock.json next to .devcontainer.json, getLockfilePath) and does not emit JSON to stdout; the verify_cmd cats the produced lockfile. Each side works on an isolated tmp copy of the image-with-features fixture. Both resolve the features against ghcr.io to the same digests (sha256 scrubbed by normalization anyway)."

  - id: upgrade.err-unresolvable-feature
    lane: runtime
    command: upgrade
    priority: p1
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"ghcr.io/devcontainers/features/node:1\":{},\"ghcr.io/devcontainers/features/doesnotexist-parity:1\":{}}}' > $WORKSPACE/.devcontainer.json; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "test ! -e ${WORKSPACE}/.devcontainer-lock.json"
    cleanup_cmd: "rm -rf /tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "upgrade --workspace-folder ${WORKSPACE}"
    asserts: [exit_code, stderr_normalized]
    class: upgrade-runtime
    current_status: match
    notes: "upgrade resolves the Features through generateFeaturesConfig (readFeaturesConfig), so a Feature whose manifest cannot be fetched fails the command: exit 1 with 'ERR: Feature '<id>' could not be processed. ...' and no lockfile written (verify_cmd). Go skipped the Feature, wrote a lockfile without it and exited 0."

  - id: upgrade.feature-dependencies-success
    lane: runtime
    command: upgrade
    priority: p1
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer/lf; printf '%s' '{\"image\":\"alpine:3\",\"features\":{\"./lf\":{},\"ghcr.io/devcontainers/features/git:1\":{}}}' > $WORKSPACE/.devcontainer/devcontainer.json; printf '%s' '{\"id\":\"lf\",\"version\":\"0.1.0\",\"dependsOn\":{\"ghcr.io/devcontainers/features/common-utils:2\":{}}}' > $WORKSPACE/.devcontainer/lf/devcontainer-feature.json; printf 'echo hi\\n' > $WORKSPACE/.devcontainer/lf/install.sh; echo WORKSPACE=$WORKSPACE"
    cleanup_cmd: "rm -rf /tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "upgrade --workspace-folder ${WORKSPACE} --dry-run"
    asserts: [exit_code, stdout_normalized]
    class: upgrade-runtime
    current_status: match
    notes: "The lockfile holds every resolved OCI Feature, the dependencies a Feature's dependsOn pulls in among them (generateFeaturesConfig computes the dependency graph): a local Feature depending on common-utils:2 adds common-utils:2 to the lockfile, while the local Feature itself is left out. Go looked up only the configured Features and missed common-utils."

  - id: upgrade.feature-target-version-success
    lane: runtime
    command: upgrade
    priority: p1
    network_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; cp -R reference/src/test/configs/image-with-features/. $WORKSPACE/; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "cat ${WORKSPACE}/.devcontainer.json"
    cleanup_cmd: "rm -rf /tmp/parity-upgrade-${PARITY_CASE_ID}-${PARITY_SIDE}"
    ts_cmd: "upgrade --workspace-folder ${WORKSPACE} --dry-run --feature ghcr.io/devcontainers/features/docker-in-docker:2.5 --target-version 1"
    asserts: [exit_code, stdout_normalized]
    class: upgrade-runtime
    current_status: match
    notes: "--feature/--target-version first rewrite the Feature's key in devcontainer.json to '<id without version>:<target>' (updateFeatureVersionInConfig), even with --dry-run, and the lockfile is generated from the configuration read again: docker-in-docker:2 becomes docker-in-docker:1 in the file (verify_cmd) and in the printed lockfile. Go validated the flags but never applied them."

  - id: read-configuration.missing-required
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "read-configuration"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match

  - id: read-configuration.invalid-log-level
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match
    notes: "Aligned in Go with info|debug|trace"

  - id: read-configuration.invalid-log-format
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: read-configuration.fixture-image
    lane: semantic
    command: read-configuration
    priority: p0
    docker_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stdout_normalized]
    class: baseline-fixture
    current_status: match

  - id: read-configuration.features-configuration
    lane: semantic
    command: read-configuration
    priority: p0
    docker_required: false
    network_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image-with-features --include-features-configuration"
    asserts: [exit_code, stdout_normalized]
    class: feature-resolution
    current_status: match
    compare_hashes: true
    compare_nulls: true

  - id: read-configuration.host-variable-substitution
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/varsub-host"
    asserts: [exit_code, stdout_normalized]
    class: variable-substitution
    current_status: match
    notes: "Host substitution cross-command (no command owns it): ${localEnv:X} present and absent, ${localWorkspaceFolderBasename}."

  - id: read-configuration.compose-path-terminal
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/compose-with-name --docker-compose-path docker-compose --terminal-columns 80 --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match
    notes: "Verified with the Go matrix; requires an environment with operational Docker/compose for revalidations"

  - id: read-configuration.subfolder-config
    lane: semantic
    command: read-configuration
    priority: p1
    docker_required: true
    ts_cmd: "read-configuration --workspace-folder src/test/configs/dockerfile-without-features --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json"
    asserts: [exit_code, stdout_normalized]
    class: baseline-fixture
    current_status: match

  - id: read-configuration.invalid-id-label
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --id-label broken"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match

  - id: read-configuration.oci-auth-hardening-accepted
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "--oci-auth-hardening read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stdout_normalized]
    class: global-flags
    current_status: match
    notes: "0.89 global flag: accepted before the command name and the output carries the ociAuthDiagnostics envelope field (all false when no registry is contacted)."

  - id: read-configuration.cross-origin-auth-host-requires-hardening
    lane: contract
    command: read-configuration
    priority: p0
    docker_required: false
    ts_cmd: "--allow-cross-origin-auth-host registry.example=auth.example read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stderr_normalized]
    class: global-flags
    current_status: match
    notes: "0.89 yargs .check(): --allow-cross-origin-auth-host requires --oci-auth-hardening."

  - id: read-configuration.cross-origin-auth-host-invalid-pair
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "--oci-auth-hardening --allow-cross-origin-auth-host bad read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stderr_normalized]
    class: global-flags
    current_status: match
    notes: "0.89: each entry must be '<registry-host>=<auth-host>'."

  - id: read-configuration.cross-origin-auth-host-invalid-authority
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "--oci-auth-hardening --allow-cross-origin-auth-host a/b=c read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stderr_normalized]
    class: global-flags
    current_status: match
    notes: "0.89: both sides of the mapping must be bare authorities."

  - id: read-configuration.global-options-consume-one-argument
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "--oci-auth-hardening --allow-cross-origin-auth-host registry.example=auth.example read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stdout_normalized]
    class: global-flags
    current_status: match
    notes: "Mirrors the oracle's own 'Global options consume exactly one argument' test (src/test/cli.test.ts), asserted on read-configuration because yargs and cobra render --help differently: the repeatable flag must consume exactly one value and leave the subcommand intact."

  - id: read-configuration.terminal-columns-implies-rows
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --terminal-columns 80"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: read-configuration.terminal-rows-implies-columns
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image --terminal-rows 24"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: exec.missing-required
    lane: contract
    command: exec
    priority: p0
    docker_required: false
    ts_cmd: "exec echo hello"
    asserts: [exit_code, stderr_normalized]
    class: required-args
    current_status: match

  - id: exec.invalid-id-label
    lane: contract
    command: exec
    priority: p0
    docker_required: false
    ts_cmd: "exec --id-label broken echo hello"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match

  - id: exec.invalid-remote-env
    lane: contract
    command: exec
    priority: p0
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --remote-env broken echo hello"
    asserts: [exit_code, stderr_normalized]
    class: format-validation
    current_status: match

  - id: exec.invalid-log-format
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --log-format yaml echo hello"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: exec.invalid-log-level
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --log-level warning echo hello"
    asserts: [exit_code, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: exec.wired-flags
    lane: semantic
    command: exec
    priority: p0
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --docker-compose-path docker-compose --default-user-env-probe loginShell --terminal-columns 80 --terminal-rows 24 echo hello"
    asserts: [exit_code]
    class: wired-flags
    current_status: match
    notes: "The current A/B comparison shows no observable divergence for this contract"

  - id: exec.terminal-columns-implies-rows
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --terminal-columns 80 echo hello"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: exec.terminal-rows-implies-columns
    lane: contract
    command: exec
    priority: p1
    docker_required: false
    ts_cmd: "exec --workspace-folder src/test/configs/image --terminal-rows 24 echo hello"
    asserts: [exit_code, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: run-user-commands.missing-required
    lane: contract
    command: run-user-commands
    priority: p0
    docker_required: false
    ts_cmd: "run-user-commands"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: run-user-commands.invalid-remote-env
    lane: contract
    command: run-user-commands
    priority: p0
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --remote-env broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: run-user-commands.invalid-default-user-env-probe
    lane: contract
    command: run-user-commands
    priority: p0
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --default-user-env-probe broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: run-user-commands.stop-for-personalization
    lane: semantic
    command: run-user-commands
    priority: p0
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --container-id fake123 --stop-for-personalization"
    asserts: [exit_code]
    class: lifecycle-semantics
    current_status: match
    notes: "Both fail with container not found; flag is accepted without error"

  - id: run-user-commands.invalid-id-label
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --id-label broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: run-user-commands.invalid-log-format
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: run-user-commands.invalid-log-level
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: run-user-commands.terminal-columns-implies-rows
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --terminal-columns 80"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: run-user-commands.terminal-rows-implies-columns
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: run-user-commands.config-not-found
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder path-that-does-not-exist"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match

  - id: set-up.missing-container-id
    lane: contract
    command: set-up
    priority: p0
    docker_required: false
    ts_cmd: "set-up"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: set-up.invalid-default-user-env-probe
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --default-user-env-probe broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: set-up.invalid-log-format
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: set-up.invalid-log-level
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: set-up.terminal-columns-implies-rows
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --terminal-columns 80"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: set-up.terminal-rows-implies-columns
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    ts_cmd: "set-up --container-id fake --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: up.invalid-buildkit
    lane: contract
    command: up
    priority: p0
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.invalid-gpu-availability
    lane: contract
    command: up
    priority: p0
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --gpu-availability broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.invalid-update-remote-user-uid-default
    lane: contract
    command: up
    priority: p0
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --update-remote-user-uid-default broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.invalid-buildkit
    lane: contract
    command: build
    priority: p0
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.invalid-log-format
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.invalid-log-level
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: build.missing-workspace-folder
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: build.config-not-found
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder path-that-does-not-exist"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match

  - id: build.platform-without-dockerfile
    lane: contract
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --platform linux/amd64"
    asserts: [exit_code, stdout_normalized]
    class: cross-flag-validation
    current_status: match

  - id: build.buildkit-never-platform-failure
    lock: feature-content-image
    lane: contract
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --platform linux/amd64"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match
    notes: "TS attempts a docker pull before reaching the discriminating validation; it is not a hermetic contract case. It requires Docker/network and should be promoted to match only after an effective comparison."

  - id: build.compose-platform-not-supported
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --platform linux/amd64"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match

  - id: build.compose-cache-to-not-supported
    lane: contract
    command: build
    priority: p1
    docker_required: false
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --cache-to=type=local,dest=/tmp/test-build-cache"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: wired-flags
    current_status: match

  - id: up.invalid-log-format
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --log-format yaml"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.invalid-log-level
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --log-level warning"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: enum-validation
    current_status: match

  - id: up.missing-workspace-or-id-label
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: up.missing-workspace-or-override-config
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --id-label test=value"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: required-args
    current_status: match

  - id: up.invalid-id-label
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --id-label broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: up.invalid-remote-env
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --remote-env broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: up.invalid-mount
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --mount broken"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: format-validation
    current_status: match

  - id: up.terminal-columns-implies-rows
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --terminal-columns 80"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: up.terminal-rows-implies-columns
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --terminal-rows 24"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: implies-validation
    current_status: match

  - id: up.config-not-found
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder path-that-does-not-exist"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match

  - id: up.override-config-missing-error
    lane: contract
    command: up
    priority: p1
    docker_required: false
    ts_cmd: "up --workspace-folder src/test/configs/image --override-config path-that-does-not-exist.json"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match
    notes: "TS reads the override in place of the configuration (readDocument(overrideConfigFile ?? configFile)), so a missing override is the configuration not found, named by the configuration's path: 'Dev container config (<workspace>/.devcontainer/devcontainer.json) not found.' Go failed with 'read override config …: no such file or directory'."

  - id: run-user-commands.override-config-missing-error
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    ts_cmd: "run-user-commands --workspace-folder path-that-does-not-exist --override-config path-that-does-not-exist.json"
    asserts: [exit_code, stdout_normalized]
    class: required-args
    current_status: match
    notes: "A workspace without a devcontainer.json and a missing override: TS names the workspace's default config path (getDefaultDevContainerConfigPath) as not found. Go named the override in a read error."

  - id: read-configuration.id-label-lookup-failure
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    setup_cmd: "echo DOCKER_HOST=unix:///nonexistent/devcontainer-cli-parity.sock"
    ts_cmd: "read-configuration --id-label parity.case=lookup --override-config src/test/configs/image/.devcontainer.json"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "A container lookup that fails fails read-configuration: TS findContainerAndIdLabels runs findDevContainer's `docker ps -q -a --filter label=…`, whose failure throws ('Command failed: docker ps …', logged), so the command exits 1 with nothing on stdout. Go ignored the failed lookup and printed the configuration."

  - id: read-configuration.workspace-lookup-failure
    lane: contract
    command: read-configuration
    priority: p1
    docker_required: false
    setup_cmd: "echo DOCKER_HOST=unix:///nonexistent/devcontainer-cli-parity.sock"
    ts_cmd: "read-configuration --workspace-folder src/test/configs/image"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "The workspace's container lookup (devcontainer.local_folder and devcontainer.config_file labels) fails the command the same way when Docker cannot answer: exit 1, nothing on stdout."

  - id: up.host-variable-without-name-error
    lane: contract
    command: up
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"containerEnv\":{\"A\":\"${localEnv}\"}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE}"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: config-parsing
    current_status: match
    notes: "A ${localEnv} without a variable name is TS's ContainerError \"'${localEnv}' in devcontainer.json can not be resolved because no environment variable name is given.\" (variableSubstitution.ts), as both message and description. Go prefixed it with 'apply host substitutions: '."

  - id: set-up.host-variable-without-name-error
    lane: contract
    command: set-up
    priority: p1
    docker_required: false
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"containerEnv\":{\"A\":\"${localEnv}\"}}' > $WORKSPACE/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "set-up --container-id parity-no-such-container --config ${WORKSPACE}/devcontainer.json"
    cleanup_cmd: "rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: config-parsing
    current_status: match
    notes: "set-up reads --config before it looks for the container; the unresolvable variable is a ContainerError, so its description is its own text. Go described it as 'An error occurred running user commands in the container.' and prefixed the message with 'apply host substitutions: '."

  - id: run-user-commands.workspace-lookup-failure
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    setup_cmd: "echo DOCKER_HOST=unix:///nonexistent/devcontainer-cli-parity.sock"
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "A container lookup that fails is TS findContainerAndIdLabels' error: 'Command failed: docker ps -q -a --filter label=devcontainer.local_folder=… --filter label=devcontainer.config_file=…' as the message, 'An error occurred running user commands in the container.' as the description. Go reported 'Dev container not found.' and looked up by the local folder alone."

  - id: run-user-commands.id-label-lookup-failure
    lane: contract
    command: run-user-commands
    priority: p1
    docker_required: false
    setup_cmd: "echo DOCKER_HOST=unix:///nonexistent/devcontainer-cli-parity.sock"
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --id-label parity.case=lookup"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "The --id-label lookup fails the same way, its message naming the id label filter."

  - id: read-configuration.container-config-success
    lane: runtime
    command: read-configuration
    priority: p0
    docker_required: true
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json --include-merged-configuration"
    setup_cmd: "CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: read-configuration.container-id-override-config-without-workspace-success
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"name\":\"${localWorkspaceFolder}|${containerWorkspaceFolder}|${containerEnv:FOO}\"}' > $WORKSPACE/override.json; CONTAINER_ID=$(docker run -d -e FOO=bar alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --override-config ${WORKSPACE}/override.json"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "--container-id without --workspace-folder has no workspace, so TS's configuration is the override itself (configPath = overrideConfigFile, a file URI): it is printed with ${containerEnv:…} resolved from the container and the workspace variables left as written. Go loaded no configuration and printed an empty one."

  - id: read-configuration.container-id-config-workspace-without-folder-success
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"workspaceFolder\":\"/wf\",\"workspaceMount\":\"type=bind,source=/a,target=/wf\"}' > $WORKSPACE/devcontainer.json; CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --config ${WORKSPACE}/devcontainer.json"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "Without a workspace, TS getWorkspaceConfiguration keeps the configuration's own workspaceFolder and workspaceMount, and read-configuration prints them as the workspace. Go printed an empty workspace whenever --container-id came without --workspace-folder."

  - id: read-configuration.container-id-devcontainer-id-success
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"name\":\"${devcontainerId}\"}' > $WORKSPACE/override.json; CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --override-config ${WORKSPACE}/override.json"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "With a container, TS readConfiguration resolves ${devcontainerId} in the configuration from the container's id labels (beforeContainerSubstitute), here devcontainer.local_folder=undefined: no workspace folder, and a container without a config file label. Go left ${devcontainerId} as written."

  - id: read-configuration.container-id-undefined-id-labels-success
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "CONTAINER_ID=$(docker run -d -l devcontainer.config_file=/parity/devcontainer.json -l 'devcontainer.metadata=[{\"remoteEnv\":{\"DID\":\"${devcontainerId}\"}}]' alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --include-merged-configuration"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "--container-id alone has neither a workspace folder nor a configuration, so TS findContainerAndIdLabels' labels are devcontainer.local_folder=undefined and, for a container with a config file label, devcontainer.config_file=undefined (template literals of undefined); the container metadata's ${devcontainerId} is computed from them. Go used empty values, a different id."

  - id: read-configuration.container-metadata-success
    lane: runtime
    command: read-configuration
    priority: p0
    docker_required: true
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --include-merged-configuration"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d -e TEST_CE=TEST_VALUE2 ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.container-config-success
    lane: runtime
    command: exec
    priority: p0
    docker_required: true
    ts_cmd: "exec --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json echo parity-output"
    setup_cmd: "CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.container-id-config-without-workspace-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"remoteEnv\":{\"PARITY_A\":\"from-config\"}}' > $WORKSPACE/devcontainer.json; CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "exec --container-id ${CONTAINER_ID} --config ${WORKSPACE}/devcontainer.json printenv PARITY_A"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "TS exec reads --config without --workspace-folder (configPath = configFile), so the configuration's remoteEnv reaches the command. Go read a configuration only with --workspace-folder, and printenv found nothing (exit 1)."

  - id: exec.container-id-config-missing-error
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    setup_cmd: "CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "exec --container-id ${CONTAINER_ID} --config /tmp/parity-no-such-config/devcontainer.json true"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "A --config that does not exist fails exec even with --container-id: TS throws 'Dev container config (…) not found.' before it looks at the container. Go ignored the load error with --container-id and ran the command."

  - id: read-configuration.container-env-without-name-error
    lane: runtime
    command: read-configuration
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"remoteEnv\":{\"A\":\"${containerEnv}\"}}' > $WORKSPACE/devcontainer.json; CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "read-configuration --container-id ${CONTAINER_ID} --config ${WORKSPACE}/devcontainer.json"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "A ${containerEnv} without a name is TS's ContainerError; read-configuration fails with it like any error: logged, exit 1, nothing on stdout. Go wrote an error envelope on stdout."

  - id: set-up.container-env-without-name-error
    lane: runtime
    command: set-up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"remoteEnv\":{\"A\":\"${containerEnv}\"}}' > $WORKSPACE/devcontainer.json; CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "set-up --container-id ${CONTAINER_ID} --config ${WORKSPACE}/devcontainer.json --skip-post-create"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "TS setupInContainer substitutes the container's environment into the configuration whether or not it is reported, so set-up fails with the ContainerError \"'${containerEnv}' in devcontainer.json can not be resolved …\" as message and description. Go reported success without --include-configuration, and with it prefixed the message with 'resolve configuration container variables: ' and named no file."

  - id: exec.container-env-without-name-error
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"postCreateCommand\":\"echo ${containerEnv}\"}' > $WORKSPACE/devcontainer.json; CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "exec --container-id ${CONTAINER_ID} --config ${WORKSPACE}/devcontainer.json true"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "TS exec substitutes the container's environment into the whole merged configuration before it runs the command, so an unresolvable variable anywhere in it (here postCreateCommand) fails exec (exit 1). Go substituted remoteEnv alone and ran the command."

  - id: run-user-commands.container-env-without-name-error
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE; printf '%s' '{\"image\":\"alpine:3\",\"remoteEnv\":{\"A\":\"${containerEnv}\"}}' > $WORKSPACE/devcontainer.json; CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo WORKSPACE=$WORKSPACE; echo CONTAINER_ID=$CONTAINER_ID"
    ts_cmd: "run-user-commands --container-id ${CONTAINER_ID} --config ${WORKSPACE}/devcontainer.json"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "TS doRunUserCommands substitutes the container's environment into the configuration first and reports the ContainerError as message and description. Go ran the commands and reported success."

  - id: up.container-env-without-name-error
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    setup_cmd: "WORKSPACE=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $WORKSPACE; mkdir -p $WORKSPACE/.devcontainer; printf '%s' '{\"image\":\"alpine:3\",\"remoteEnv\":{\"A\":\"${containerEnv}\"}}' > $WORKSPACE/.devcontainer/devcontainer.json; echo WORKSPACE=$WORKSPACE"
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1; rm -rf ${WORKSPACE}; true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match
    notes: "TS setupInContainer substitutes the container's environment into the configuration and the merged configuration once the container runs, even with --skip-post-create: up fails with the ContainerError and the container's id. Go reported success."

  - id: exec.container-metadata-success
    lane: runtime
    command: exec
    priority: p0
    docker_required: true
    ts_cmd: "exec --container-id ${CONTAINER_ID} echo parity-output"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-image-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} echo parity-output"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-image-json-raw-output-success
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image --log-format json --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} echo parity-output"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "B9: with --log-format json the command's output goes as `raw` events in the log stream (stderr), not to stdout. stdout stays empty on both (Go previously printed it to stdout). The stream is not asserted (Go uses the Docker SDK → fewer `Run:` events than TS)."

  - id: exec.workspace-compose-success
    no_compose_isolation: true
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/compose-image-without-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} echo parity-output"
    setup_cmd: "COMPOSE_PROJECT_NAME=parityexec${PARITY_SIDE}; export COMPOSE_PROJECT_NAME; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; echo COMPOSE_PROJECT_NAME=$COMPOSE_PROJECT_NAME"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-without-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-image-with-features-hello-success
    lock: feature-content-image
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/image-with-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} hello"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-dockerfile-with-features-hello-success
    lock: feature-content-image
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/dockerfile-with-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} hello"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-dockerfile-with-target-marker-success
    lock: feature-content-image
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/dockerfile-with-target --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} cat /var/test-marker"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: exec.workspace-compose-image-with-features-hello-success
    lock: feature-content-image
    no_compose_isolation: true
    lane: runtime
    command: exec
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "exec --workspace-folder src/test/configs/compose-image-with-features --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} hello"
    setup_cmd: "COMPOSE_PROJECT_NAME=parityexecfeatures; export COMPOSE_PROJECT_NAME; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else DOCKER_DEFAULT_PLATFORM=linux/amd64 ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; echo COMPOSE_PROJECT_NAME=$COMPOSE_PROJECT_NAME"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: container-runtime
    current_status: match

  - id: run-user-commands.container-config-success
    lane: runtime
    command: run-user-commands
    priority: p0
    docker_required: true
    ts_cmd: "run-user-commands --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json"
    setup_cmd: "CONTAINER_ID=$(docker run -d alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postAttachCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.workspace-image-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/image --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; CONTAINER_ID=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.skip-post-attach-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/dockerfile-with-parallel-commands --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --skip-post-attach"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-with-parallel-commands --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-with-parallel-commands --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; CONTAINER_ID=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} /bin/sh -lc 'test -f /tmp/postCreateCommand1.testmarker && test -f /tmp/postCreateCommand2.testmarker && test -f /tmp/postStartCommand1.testmarker && test -f /tmp/postStartCommand2.testmarker && ! test -f /tmp/postAttachCommand1.testmarker && ! test -f /tmp/postAttachCommand2.testmarker && printf ok'"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.workspace-secrets-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "WORKSPACE=/tmp/parity-secrets-run-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/secrets-lifecycle/. ${WORKSPACE}; SECRETS_FILE=${WORKSPACE}/test-secrets-temp.json; printf '%s' '{\"SECRET1\":\"SecretValue1\",\"MASK_IT\":\"cycle\"}' > ${SECRETS_FILE}; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; find ${WORKSPACE} -name '*.testMarker' -delete; echo WORKSPACE=$WORKSPACE; echo SECRETS_FILE=$SECRETS_FILE; CONTAINER_ID=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "cat ${WORKSPACE}/secret.postCreateCommand.testMarker | grep '^SECRET1=SecretValue1$'"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: run-user-commands.workspace-subfolder-config-success
    lane: runtime
    command: run-user-commands
    priority: p1
    docker_required: true
    ts_cmd: "run-user-commands --workspace-folder src/test/configs/dockerfile-without-features --container-id ${CONTAINER_ID} --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json"
    setup_cmd: "if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/dockerfile-without-features --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/dockerfile-without-features --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container >/dev/null; fi; CONTAINER_ID=$(docker ps -q --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} | head -n1); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /subfolderConfigPostCreateCommand.txt && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match
    notes: "Closed out by preserving the failed lifecycle command and emitting the TS envelope for hooks (`postCreateCommand from devcontainer.json failed.`)."

  - id: run-user-commands.container-metadata-success
    lane: runtime
    command: run-user-commands
    priority: p0
    docker_required: true
    ts_cmd: "run-user-commands --container-id ${CONTAINER_ID}"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: set-up.container-config-success
    lane: runtime
    command: set-up
    priority: p0
    docker_required: true
    ts_cmd: "set-up --container-id ${CONTAINER_ID} --config src/test/configs/set-up-with-config/devcontainer.json --include-configuration --include-merged-configuration"
    setup_cmd: "CONTAINER_ID=$(docker run -d -e TEST_CE=TEST_VALUE alpine:3.17 sleep inf); echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postAttachCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    key_order: ["", "configuration", "mergedConfiguration"]
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: set-up.container-metadata-success
    lane: runtime
    command: set-up
    priority: p0
    docker_required: true
    ts_cmd: "set-up --container-id ${CONTAINER_ID} --include-configuration --include-merged-configuration"
    setup_cmd: "IMAGE_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; docker build -q -t ${IMAGE_NAME} src/test/configs/set-up-with-metadata >/dev/null; CONTAINER_ID=$(docker run -d -e TEST_CE=TEST_VALUE2 ${IMAGE_NAME} sleep inf); echo IMAGE_NAME=$IMAGE_NAME; echo CONTAINER_ID=$CONTAINER_ID"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: lifecycle-runtime
    current_status: match

  - id: up.image-success
    lane: runtime
    command: up
    priority: p0
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    key_order: [""]
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Unblocked by fixing the docker events parser in the TS oracle (accept Action=start and JSON without a trailing newline)"

  - id: up.image-reuses-base-image-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{.Config.Image}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-with-name-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "docker compose --project-name custom-project-name down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-image-without-features-success
    lane: runtime
    command: up
    priority: p0
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-labels-devcontainer-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker inspect --format '{{ index .Config.Labels \"parity.case\" }}' ${CONTAINER_ID})\" = \"${PARITY_CASE_ID}-${PARITY_SIDE}\" && test -n \"$(docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID})\" && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "B16: the compose container carries the custom --id-label and the devcontainer.metadata label (previously Go did not set devcontainer.* labels on compose → discovery/exec broken). Verifies that the app service's id-label matches and that the metadata label exists, in Go and TS."

  - id: up.app-port-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/app-port --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "P=$(docker inspect --format '{{json .HostConfig.PortBindings}}' ${CONTAINER_ID}); echo \"$P\" | grep -q '\"HostPort\":\"31300\"' && echo \"$P\" | grep -q '\"HostPort\":\"31808\"' && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "appPort → PortBindings (127.0.0.1:N:N for numbers, verbatim for strings). Previously Go did not publish ports."

  - id: up.override-command-false-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/override-command-false --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{json .Config.Cmd}}' ${CONTAINER_ID} | grep -q 'redis-server' && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "overrideCommand:false → the image's entrypoint+cmd (redis-server) are appended to the keep-alive script (exec \"$@\"). Previously Go discarded the image's CMD (sleep loop)."

  - id: up.workspace-mount-custom-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/workspace-mount-custom --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{range .Mounts}}{{.Source}}:{{.Destination}} {{end}}' ${CONTAINER_ID} | grep -q '/tmp:/custom-ws' && printf ok"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "custom workspaceMount respected (previously Go always bound the workspace-folder to the default)."

  - id: up.compose-dockerfile-without-features-success
    lane: runtime
    command: up
    priority: p0
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-without-features --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "IDS=$(docker ps -aq --filter label=parity.case=${PARITY_CASE_ID}-${PARITY_SIDE}); [ -n \"$IDS\" ] && docker rm -f $IDS >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-image-without-features-minimal-reuses-base-image-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{.Config.Image}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-without-features-minimal/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-with-name-using-env-var-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name-using-env-var --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo CUSTOM_NAME=custom-name-with-env-var"
    cleanup_cmd: "docker compose --project-name custom-name-with-env-var down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-with-name-devcontainer-env-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name-using-env-var --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo CUSTOM_NAME=devcontainer"
    cleanup_cmd: "docker compose --project-name devcontainer down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-with-name-custom-yaml-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-with-name-and-custom-yaml --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "docker compose --project-name custom-project-name-custom-yaml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.compose-without-name-success
    no_compose_isolation: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-without-name --buildkit=never --skip-post-create --docker-compose-path trigger-compose-v2 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    cleanup_cmd: "docker compose --project-name compose-without-name_devcontainer down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Passes after the fix in the TS oracle for docker events"

  - id: up.subfolder-config-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/dockerfile-without-features --buildkit=never --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker exec ${CONTAINER_ID} test -f /subfolderConfigPostCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-post-create-remote-env-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --include-configuration --include-merged-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out by aligning `configuration.configFilePath` and filling `mergedConfiguration` with config fields (`image`, `runArgs`) in Go"

  - id: up.image-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image --buildkit=never --omit-config-remote-env-from-metadata --include-configuration --include-merged-configuration --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-features-omit-config-remote-env-from-metadata-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-image-without-features-minimal-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-without-features-minimal/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dockerfile-without-features-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/dockerfile-without-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-image-with-features-omit-config-remote-env-from-metadata-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "docker pull --platform linux/amd64 redis:alpine >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Unblocked by pinning the harness setup with `docker pull --platform linux/amd64 redis:alpine` (the fixture's db service) before compose."

  - id: up.compose-dockerfile-with-features-omit-config-remote-env-from-metadata-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "docker pull --platform linux/amd64 redis:alpine >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out after aligning the metadata of Dockerfile+features builds; the setup keeps `docker pull --platform linux/amd64 redis:alpine` (the fixture's db service) to avoid platform drift in compose."

  - id: up.compose-dockerfile-without-features-omit-config-remote-env-from-metadata-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-without-features --buildkit=never --omit-config-remote-env-from-metadata --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "test \"$(docker exec ${CONTAINER_ID} cat /postCreateCommand.txt)\" = \"Val: ENV\" && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${CONTAINER_ID} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-without-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-metadata-container-env-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-metadata-containerEnv --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} bash -lc 'printf \"%s\\n%s\\n%s\\n\" \"$JAVA_HOME\" \"$VAR_WITH_SPACES\" \"$(eval \\\"$ENV_WITH_COMMAND\\\")\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-features-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-features --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-git-feature-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-git-feature --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker exec ${CONTAINER_ID} git --version"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' 'env | sort > /tmp/.dotfileEnvs' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-with-secrets-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --secrets-file ${SECRETS_FILE} --log-level trace --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-secrets-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' 'env | sort > /tmp/.dotfileEnvs' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; SECRETS_FILE=${WORKSPACE}/test-secrets-temp.json; printf '%s' '{\"SECRET1\":\"SecretValue1\",\"MASK_IT\":\"container\"}' > ${SECRETS_FILE}; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo SECRETS_FILE=$SECRETS_FILE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && grep -q \"^SECRET1=SecretValue1$\" /tmp/.dotfileEnvs && grep -q \"^TEST_REMOTE_ENV=Value 1$\" /tmp/.dotfileEnvs && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-custom-install-relative-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command ./install.sh --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-rel-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-custom-install-absolute-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command /home/node/dotfiles/install.sh --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-abs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-non-executable-install-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command .run-my-dotfiles-script --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-nonexec-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/.run-my-dotfiles-script; chmod 0644 ${DOTFILES_REPO}/.run-my-dotfiles-script; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add .run-my-dotfiles-script; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-custom-install-filename-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command install.sh --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-file-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/install.sh; chmod +x ${DOTFILES_REPO}/install.sh; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add install.sh; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dotfiles-local-non-executable-absolute-install-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --dotfiles-repository ${REMOTE_DOTFILES_REPO} --dotfiles-install-command /home/node/dotfiles/.run-my-dotfiles-script --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-dotfiles-nonexec-abs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-git-feature/. ${WORKSPACE}; DOTFILES_REPO=${WORKSPACE}/dotfiles-repo; mkdir -p ${DOTFILES_REPO}; printf '%s\n' '#!/bin/sh' 'touch /tmp/.dotfilesMarker' > ${DOTFILES_REPO}/.run-my-dotfiles-script; chmod 0644 ${DOTFILES_REPO}/.run-my-dotfiles-script; git -C ${DOTFILES_REPO} init -q; git -C ${DOTFILES_REPO} config user.email parity@example.com; git -C ${DOTFILES_REPO} config user.name parity; git -C ${DOTFILES_REPO} add .run-my-dotfiles-script; git -C ${DOTFILES_REPO} commit -qm init; REMOTE_DOTFILES_REPO=file:///workspaces/$(basename ${WORKSPACE})/dotfiles-repo; echo WORKSPACE=$WORKSPACE; echo REMOTE_DOTFILES_REPO=$REMOTE_DOTFILES_REPO"
    verify_cmd: "docker exec ${CONTAINER_ID} sh -lc 'test -f /tmp/.dotfilesMarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-dockerfile-with-features-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} cat /postCreateCommand.txt"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out by fixing the compose entrypoint generated by Go so that it uses real line breaks and keeps the container alive"

  - id: up.compose-dockerfile-with-features-reuse-stopped-container-with-persisted-overrides-success
    lock: feature-content-image
    no_compose_isolation: true
    serial: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER}"
    setup_cmd: "docker pull --platform linux/amd64 redis:alpine >/dev/null; USER_DATA_FOLDER=/tmp/parity-user-data-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${USER_DATA_FOLDER}; mkdir -p ${USER_DATA_FOLDER}; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; fi; ORIGINAL_CONTAINER_ID=$(docker ps -aq --filter label=com.docker.compose.project=compose-dockerfile-with-features_devcontainer --filter label=com.docker.compose.service=app | head -n1); docker compose --project-name compose-dockerfile-with-features_devcontainer stop >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64; echo USER_DATA_FOLDER=${USER_DATA_FOLDER}; echo ORIGINAL_CONTAINER_ID=${ORIGINAL_CONTAINER_ID}"
    verify_cmd: "test \"${CONTAINER_ID#$ORIGINAL_CONTAINER_ID}\" != \"${CONTAINER_ID}\" && test \"$(find ${USER_DATA_FOLDER}/docker-compose -maxdepth 1 -type f | wc -l | tr -d ' ')\" = \"2\" && find ${USER_DATA_FOLDER}/docker-compose -maxdepth 1 -type f -name 'docker-compose.devcontainer.build-*' | grep -q . && find ${USER_DATA_FOLDER}/docker-compose -maxdepth 1 -type f -name 'docker-compose.devcontainer.containerFeatures-*' | grep -q . && printf ok"
    cleanup_cmd: "docker compose --project-name compose-dockerfile-with-features_devcontainer -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true; rm -rf ${USER_DATA_FOLDER}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Reuse of a stopped compose container with persisted overrides. The divergence observed before (TS failed the second `docker compose up --no-recreate`) was an artifact of the setup with the old TS path; with the setup pointing to the TS submodule, Go and TS match."

  - id: up.compose-dockerfile-with-features-reuse-stopped-container-without-persisted-overrides-success
    lock: feature-content-image
    no_compose_isolation: true
    serial: true
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER}"
    setup_cmd: "docker pull --platform linux/amd64 redis:alpine >/dev/null; USER_DATA_FOLDER=/tmp/parity-user-data-reset-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${USER_DATA_FOLDER}; mkdir -p ${USER_DATA_FOLDER}; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; else ${PARITY_CLI_GO} up --workspace-folder src/test/configs/compose-Dockerfile-with-features --buildkit=never --user-data-folder ${USER_DATA_FOLDER} --remove-existing-container >/dev/null; fi; ORIGINAL_CONTAINER_ID=$(docker ps -aq --filter label=com.docker.compose.project=compose-dockerfile-with-features_devcontainer --filter label=com.docker.compose.service=app | head -n1); docker compose --project-name compose-dockerfile-with-features_devcontainer stop >/dev/null; rm -rf ${USER_DATA_FOLDER}; mkdir -p ${USER_DATA_FOLDER}; echo DOCKER_DEFAULT_PLATFORM=linux/amd64; echo USER_DATA_FOLDER=${USER_DATA_FOLDER}; echo ORIGINAL_CONTAINER_ID=${ORIGINAL_CONTAINER_ID}"
    verify_cmd: "docker inspect ${CONTAINER_ID} >/dev/null && printf ok"
    cleanup_cmd: "docker compose --project-name compose-dockerfile-with-features_devcontainer -f src/test/configs/compose-Dockerfile-with-features/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true; rm -rf ${USER_DATA_FOLDER}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    notes: "Closed out as coverage of a re-run without persisted overrides. The assertion of exact container ID reuse was too strict: both sides may recreate."

  - id: up.compose-container-env-issue-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-containerEnv-issue --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} bash -lc 'printf \"%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n\" \"$SOME_PATH\" \"$VAR_WITH_SPACES\" \"$(eval \\\"$ENV_WITH_COMMAND\\\")\" \"$ROSCONSOLE_FORMAT\" \"$VAR_WITH_QUOTES_WE_WANT_TO_KEEP\" \"$VAR_WITH_DOLLAR_SIGN\" \"$VAR_WITH_BACK_SLASH\"'"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/image-containerEnv-issue/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-mounts-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/image-with-mounts --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/home/test_devcontainer_config\"}}{{.Type}}:{{.Destination}}:{{if ne .Name \"undefined\"}}ok{{else}}bad{{end}}{{end}}{{end}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-image-with-mounts-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-image-with-mounts --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo COMPOSE_PROJECT_NAME=paritymounts"
    verify_cmd: "docker inspect --format '{{range .Mounts}}{{if eq .Destination \"/home/test_devcontainer_config\"}}{{.Type}}:{{.Destination}}:{{if ne .Name \"undefined\"}}ok{{else}}bad{{end}}{{end}}{{end}}' ${CONTAINER_ID}"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-image-with-mounts/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.image-with-parallel-initialize-command-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --buildkit=never --skip-post-create --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-init-${PARITY_CASE_ID}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/image-with-parallel-initialize-command/. ${WORKSPACE}; find ${WORKSPACE} -name '*.testMarker' -delete; echo WORKSPACE=$WORKSPACE"
    verify_cmd: "test -f ${WORKSPACE}/initializeCommand.1.testMarker && test -f ${WORKSPACE}/initializeCommand.2.testMarker && printf ok"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.dockerfile-with-parallel-commands-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/dockerfile-with-parallel-commands --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec ${CONTAINER_ID} /bin/sh -lc 'test -f /tmp/postCreateCommand1.testmarker && test -f /tmp/postCreateCommand2.testmarker && test -f /tmp/postStartCommand1.testmarker && test -f /tmp/postStartCommand2.testmarker && test -f /tmp/postAttachCommand1.testmarker && test -f /tmp/postAttachCommand2.testmarker && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.compose-dockerfile-with-target-post-commands-success
    lock: feature-content-image
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "up --workspace-folder src/test/configs/compose-Dockerfile-with-target --buildkit=never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo COMPOSE_PROJECT_NAME=paritytarget"
    verify_cmd: "docker exec ${CONTAINER_ID} /bin/sh -lc 'test -f /tmp/postCreateCommand.testmarker && test -f /tmp/postStartCommand.testmarker && test -f /tmp/postAttachCommand.testmarker && printf ok'"
    cleanup_cmd: "docker compose --project-name ${COMPOSE_PROJECT_NAME} -f src/test/configs/compose-Dockerfile-with-target/.devcontainer/docker-compose.yml down >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUID --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-only-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDOnly --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "echo LOCAL_GID=$(id -g)"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-disabled-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUID --update-remote-user-uid-default never --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc '[ \"$(id -u)\" = \"1234\" ] && [ \"$(id -g)\" = \"4321\" ] && printf ok'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-amd64-platform-option-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDamd64-platform-option --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-arm64-platform-option-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64-platform-option --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.update-uid-amd64-dockerfile-platform-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDamd64 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: up.update-uid-arm64-dockerfile-platform-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.update-uid-arm64v8-dockerfile-platform-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64v8 --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.update-uid-arm64v8-platform-option-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder src/test/configs/updateUIDarm64v8-platform-option --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    verify_cmd: "docker exec -u foo ${CONTAINER_ID} sh -lc 'printf \"%s:%s\" \"$(id -u)\" \"$(id -g)\"'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match
    arm64_required: true

  - id: up.workspace-secrets-success
    lane: runtime
    command: up
    priority: p1
    docker_required: true
    ts_cmd: "up --workspace-folder ${WORKSPACE} --log-level trace --secrets-file ${SECRETS_FILE} --id-label parity.case=${PARITY_CASE_ID}-${PARITY_SIDE} --remove-existing-container"
    setup_cmd: "WORKSPACE=/tmp/parity-secrets-up-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf ${WORKSPACE}; mkdir -p ${WORKSPACE}; cp -R src/test/configs/secrets-lifecycle/. ${WORKSPACE}; SECRETS_FILE=${WORKSPACE}/test-secrets-temp.json; printf '%s' '{\"SECRET1\":\"SecretValue1\"}' > ${SECRETS_FILE}; echo WORKSPACE=$WORKSPACE; echo SECRETS_FILE=$SECRETS_FILE"
    verify_cmd: "cat ${WORKSPACE}/secret.postCreateCommand.testMarker | grep '^SECRET1=SecretValue1$'"
    cleanup_cmd: "docker rm -f ${CONTAINER_ID} >/dev/null 2>&1 || true; rm -rf ${WORKSPACE}"
    asserts: [exit_code, stdout_normalized]
    class: up-runtime
    current_status: match

  - id: build.image-success
    lane: runtime
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    key_order: [""]
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness to align the builder with the local base image"

  - id: build.image-metadata-label-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.image-metadata-local-features-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-metadata --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64; DOCKER_DEFAULT_PLATFORM=linux/amd64 docker build -q -t image-metadata-test-base src/test/configs/image-metadata/base-image >/dev/null"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'baseFeature' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'localFeatureA' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'localFeatureB' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.skip-persisting-customizations-from-features-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-metadata --buildkit=never --skip-persisting-customizations-from-features --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64; DOCKER_DEFAULT_PLATFORM=linux/amd64 docker build -q -t image-metadata-test-base src/test/configs/image-metadata/base-image >/dev/null"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'localFeatureA' && ! docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'extensionA' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.labels-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/example --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE} --label name=label-test --label type=multiple-labels"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.local-feature-failure
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p0
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-local-feature --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: build-runtime
    current_status: match

  - id: build.no-cache-features-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-features --image-name ${IMAGE_NAME} --no-cache"
    setup_cmd: "BASE_IMAGE=mcr.microsoft.com/devcontainers/typescript-node:1-18-bookworm; ORIGINAL_IMAGE=parity-${PARITY_CASE_ID}-${PARITY_SIDE}-original; CACHED_IMAGE=parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cached; TARGET_IMAGE=parity-${PARITY_CASE_ID}-${PARITY_SIDE}-nocache; docker pull ${BASE_IMAGE} >/dev/null; echo DOCKER_DEFAULT_PLATFORM=linux/amd64; if [ \"${PARITY_SIDE}\" = \"ts\" ]; then ${PARITY_CLI_TS} build --workspace-folder src/test/configs/image-with-features --image-name ${ORIGINAL_IMAGE} >/dev/null; ${PARITY_CLI_TS} build --workspace-folder src/test/configs/image-with-features --image-name ${CACHED_IMAGE} >/dev/null; else ${PARITY_CLI_GO} build --workspace-folder src/test/configs/image-with-features --image-name ${ORIGINAL_IMAGE} >/dev/null; ${PARITY_CLI_GO} build --workspace-folder src/test/configs/image-with-features --image-name ${CACHED_IMAGE} >/dev/null; fi; echo BASE_IMAGE=${BASE_IMAGE}; echo IMAGE_NAME=${TARGET_IMAGE}; echo ORIGINAL_IMAGE=${ORIGINAL_IMAGE}; echo CACHED_IMAGE=${CACHED_IMAGE}; echo CACHE_COMPARE_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cache-compare"
    verify_cmd: "docker inspect --type image ${IMAGE_NAME} >/dev/null && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} ${ORIGINAL_IMAGE} ${CACHED_IMAGE} >/dev/null 2>&1 || true; rm -rf ${CACHE_COMPARE_PATH}"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out as execution coverage of `--no-cache` with features. The layer comparison was too strict for buildx and failed on both sides."

  - id: build.compose-dockerfile-multi-image-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-Dockerfile-alpine --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2 >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.dockerfile-multi-image-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-features --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2 >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.image-multi-image-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE}-1 parity-${PARITY_CASE_ID}-${PARITY_SIDE}-2 >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.push-and-output-failure
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --output type=oci,dest=output.tar --push true"
    asserts: [exit_code, stdout_normalized, stderr_normalized]
    class: build-runtime
    current_status: match

  - id: build.compose-image-without-features-minimal-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.compose-image-without-features-minimal-metadata-label-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-without-features-minimal --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'TEST_ESCAPING' && printf ok"
    cleanup_cmd: "docker rmi -f ${IMAGE_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.subfolder-config-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-without-features --buildkit=never --config src/test/configs/dockerfile-without-features/.devcontainer/subfolder/devcontainer.json --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^SUBFOLDER_CONFIG_IMAGE_ENV=true$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Passes in parity runtime by pinning DOCKER_DEFAULT_PLATFORM=linux/amd64 from the harness"

  - id: build.apply-build-options-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{ index .Config.Labels \"test_build_options\" }}' ${IMAGE_NAME}"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.image-extra-cache-from-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image --cache-from ubuntu:latest --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "docker pull ubuntu:latest >/dev/null"
    verify_cmd: "docker inspect --type image ${IMAGE_NAME} >/dev/null && printf ok"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out using a valid cache source (`ubuntu:latest`); the nonexistent remote ref blocked TS before comparing Go."

  - id: build.image-metadata-container-env-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-metadata-containerEnv --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "docker run --rm ${IMAGE_NAME} bash -lc 'printf \"%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n\" \"$JAVA_HOME\" \"$VAR_WITH_SPACES\" \"$VAR_WITH_LOTS_OF_SPACES\" \"$VAR_WITH_QUOTES_WE_WANT_TO_KEEP\" \"$VAR_WITH_DOLLAR_SIGN\" \"$VAR_WITH_BACK_SLASH\" \"$ENV_WITH_COMMAND\"'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.compose-image-extra-cache-from-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --cache-from ghcr.io/devcontainers/notFound --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.output-oci-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --output type=oci,dest=${OUTPUT_PATH}"
    setup_cmd: "BUILDER_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; OUTPUT_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}.tar; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true; docker buildx create --name ${BUILDER_NAME} >/dev/null; docker buildx inspect --bootstrap ${BUILDER_NAME} >/dev/null; echo BUILDER_NAME=$BUILDER_NAME; echo BUILDX_BUILDER=$BUILDER_NAME; echo OUTPUT_PATH=$OUTPUT_PATH; echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "test -s ${OUTPUT_PATH}"
    cleanup_cmd: "rm -f ${OUTPUT_PATH}; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.cache-to-local-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-features --log-level trace --cache-to=type=local,dest=${CACHE_PATH}"
    setup_cmd: "BUILDER_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; CACHE_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cache; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true; docker buildx create --name ${BUILDER_NAME} --driver docker-container >/dev/null; docker buildx inspect --bootstrap ${BUILDER_NAME} >/dev/null; echo BUILDER_NAME=$BUILDER_NAME; echo BUILDX_BUILDER=$BUILDER_NAME; echo CACHE_PATH=$CACHE_PATH"
    verify_cmd: "test -f ${CACHE_PATH}/index.json"
    cleanup_cmd: "rm -rf ${CACHE_PATH}; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.cache-to-local-image-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-features --log-level trace --cache-to=type=local,dest=${CACHE_PATH}"
    setup_cmd: "BUILDER_NAME=parity-${PARITY_CASE_ID}-${PARITY_SIDE}; CACHE_PATH=/tmp/parity-${PARITY_CASE_ID}-${PARITY_SIDE}-cache; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true; docker buildx create --name ${BUILDER_NAME} --driver docker-container >/dev/null; docker buildx inspect --bootstrap ${BUILDER_NAME} >/dev/null; echo BUILDER_NAME=$BUILDER_NAME; echo BUILDX_BUILDER=$BUILDER_NAME; echo CACHE_PATH=$CACHE_PATH"
    verify_cmd: "test -f ${CACHE_PATH}/index.json"
    cleanup_cmd: "rm -rf ${CACHE_PATH}; docker buildx rm ${BUILDER_NAME} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out by aligning the default name of `image` builds with features: without `--image-name`, TS returns `<folder>-features`."

  - id: build.platform-supported-dockerfile-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --platform linux/amd64 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "test \"$(docker inspect --format '{{.Architecture}}' ${IMAGE_NAME})\" = \"amd64\" && docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$' >/dev/null && test \"$(docker inspect --format '{{ index .Config.Labels \"test_build_options\" }}' ${IMAGE_NAME})\" = \"success\" && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'ghcr.io/devcontainers/feature-starter/hello:1' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'ghcr.io/devcontainers/features/docker-in-docker:2' && docker inspect --format '{{ index .Config.Labels \"devcontainer.metadata\" }}' ${IMAGE_NAME} | grep -q 'postCreateCommand' && printf ok"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match
    notes: "Closed out by correctly resolving the base image of the Dockerfile target, preserving base+config+features metadata and comparing the result's semantics instead of a full `docker inspect`."

  - id: build.platform-supported-image-with-features-success
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/image-with-features --platform linux/amd64 --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: build.unsupported-platform-failure
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    ts_cmd: "build --workspace-folder src/test/configs/dockerfile-with-target --platform fake/platform"
    asserts: [exit_code]
    expect_infra_failure: true
    class: build-runtime
    current_status: match
    notes: "Invalid platform → both exit 1 (the failure IS the expected behavior). The error text
      is at the docker level and env-specific (Go `docker build` 'no match for platform
      in manifest'; TS `buildx` 'Command failed'), so only exit_code is asserted. With
      expect_infra_failure the harness compares exit codes instead of skipping via isInfraError."

  - id: build.compose-image-with-features-success
    lock: feature-content-image
    lane: runtime
    command: build
    priority: p1
    docker_required: true
    network_required: true
    ts_cmd: "build --workspace-folder src/test/configs/compose-image-with-features --buildkit=never --image-name parity-${PARITY_CASE_ID}-${PARITY_SIDE}"
    setup_cmd: "echo DOCKER_DEFAULT_PLATFORM=linux/amd64"
    verify_cmd: "docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' ${IMAGE_NAME} | grep '^DOCKER_BUILDKIT=1$'"
    cleanup_cmd: "docker rmi -f parity-${PARITY_CASE_ID}-${PARITY_SIDE} >/dev/null 2>&1 || true"
    asserts: [exit_code, stdout_normalized]
    class: build-runtime
    current_status: match

  - id: templates.apply-docker-existing-success
    lane: runtime
    command: templates
    priority: p1
    network_required: true
    ts_cmd: "templates apply --workspace-folder /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE} --template-id ghcr.io/devcontainers/templates/docker-existing-docker-compose:latest"
    setup_cmd: "rm -rf /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}; mkdir -p /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}; echo TMPL_DIR=/tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}"
    verify_cmd: "test -f ${TMPL_DIR}/.devcontainer/devcontainer.json && test -f ${TMPL_DIR}/.devcontainer/docker-compose.yml && ! test -f ${TMPL_DIR}/devcontainer-template.json && ! test -f ${TMPL_DIR}/README.md && printf ok"
    cleanup_cmd: "rm -rf /tmp/parity-tmpl-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "templates apply extracts the tarball and applies the files (previously {\"files\":null}); it omits devcontainer-template.json/README/NOTES and applies option defaults + ${templateOption:x} substitution."

  - id: outdated.image-with-features-success
    lane: runtime
    command: outdated
    priority: p1
    network_required: true
    ts_cmd: "outdated --workspace-folder src/test/configs/image-with-features --output-format json"
    asserts: [exit_code, stdout_normalized, stdout_text]
    key_order: ["features"]
    class: outdated-runtime
    current_status: match
    notes: "outdated resolves current/wanted/latest (+ wantedMajor/latestMajor) per feature; key = full userFeatureId (with tag). Both sides query the same registry, so latest matches between them. The Features follow the configuration's order (loadVersionInfo reorders resolved.features), which stdout_text and key_order pin; Go used to sort them by id."

  - id: upgrade.image-with-features-success
    lane: runtime
    command: upgrade
    priority: p1
    network_required: true
    ts_cmd: "upgrade --workspace-folder src/test/configs/image-with-features --dry-run"
    asserts: [exit_code, stdout_normalized]
    class: upgrade-runtime
    current_status: match
    notes: "upgrade --dry-run emits the lockfile to stdout; version = concrete resolved version (not the tag), resolved = resource@digest, integrity = digest."

  - id: features.generate-docs-success
    lane: runtime
    command: features
    priority: p1
    ts_cmd: "features generate-docs -p ${GENDOCS_DIR} -n owner/repo --github-owner o --github-repo r"
    setup_cmd: "GENDOCS_DIR=/tmp/parity-gendocs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $GENDOCS_DIR; cp -R reference/src/test/container-features/example-v2-features-sets/simple/src $GENDOCS_DIR; echo GENDOCS_DIR=$GENDOCS_DIR"
    verify_cmd: "cat ${GENDOCS_DIR}/color/README.md ${GENDOCS_DIR}/hello/README.md"
    cleanup_cmd: "rm -rf /tmp/parity-gendocs-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "generate-docs writes a README.md per feature (empty stdout); the verify compares the generated content. Faithful port of the TS template (columns 'Options Id|Description|Type|Default Value' in insertion order, deprecated/legacyIds header, customizations, NOTES.md)."

  - id: templates.generate-docs-success
    lane: runtime
    command: templates
    priority: p1
    ts_cmd: "templates generate-docs -p ${GENDOCS_DIR} --github-owner o --github-repo r"
    setup_cmd: "GENDOCS_DIR=/tmp/parity-tmpldocs-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $GENDOCS_DIR; cp -R reference/src/test/container-templates/example-templates-sets/simple/src $GENDOCS_DIR; echo GENDOCS_DIR=$GENDOCS_DIR"
    verify_cmd: "cat ${GENDOCS_DIR}/alpine/README.md ${GENDOCS_DIR}/node-mongo/README.md"
    cleanup_cmd: "rm -rf /tmp/parity-tmpldocs-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "templates generate-docs uses TEMPLATE_README_TEMPLATE (without Registry/Namespace/Version/Customizations)."

  - id: features-info.manifest-text-success
    lane: runtime
    command: features-info
    priority: p1
    network_required: true
    ts_cmd: "features info manifest ghcr.io/devcontainers/features/node:2.1.0"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "info manifest (text): box fitted to the title (encloseStringInBox), and the manifest re-indented from raw bytes preserves the annotation order (sha256 scrubbed by normalization)."

  - id: features-info.tags-text-success
    lane: runtime
    command: features-info
    priority: p1
    network_required: true
    ts_cmd: "features info tags ghcr.io/devcontainers/features/node"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "info tags (text): tags joined with '\\n   ' (first flush, the rest indented by 3). Both sides query the same registry."

  - id: features.package-collection-success
    lane: runtime
    command: features
    priority: p1
    ts_cmd: "features package ${PKG_DIR} -o ${PKG_DIR}/out -f"
    setup_cmd: "PKG_DIR=/tmp/parity-pkg-${PARITY_CASE_ID}-${PARITY_SIDE}; rm -rf $PKG_DIR; cp -R reference/src/test/container-features/example-v2-features-sets/simple/src $PKG_DIR; echo PKG_DIR=$PKG_DIR"
    verify_cmd: "cat ${PKG_DIR}/out/devcontainer-collection.json"
    cleanup_cmd: "rm -rf /tmp/parity-pkg-${PARITY_CASE_ID}-${PARITY_SIDE}"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    notes: "features package generates devcontainer-collection.json ({sourceInformation, features:[…]}, 4-space) preserving the key order of devcontainer-feature.json (orderedmap). The verify compares that JSON; the tarball digest may differ (Go header encoding vs node-tar) but the file-list matches."

  - id: features.resolve-dependencies-success
    lane: runtime
    command: features
    priority: p1
    network_required: true
    ts_cmd: "features resolve-dependencies --workspace-folder src/test/configs/image-with-features"
    asserts: [exit_code, stdout_normalized]
    class: features-runtime
    current_status: match
    compare_hashes: true
    compare_nulls: true
    notes: "stdout = mermaid graph + installOrder JSON. The mermaid is generated with roundPriority 0 (TS default) and feature id alias (fallback to ref.ID when the annotation is missing); node hashes are scrubbed by reMermaidNode. installOrder resolved via ComputeInstallationOrder."

  - id: templates.metadata-success
    lane: runtime
    command: templates
    priority: p1
    network_required: true
    ts_cmd: "templates metadata ghcr.io/devcontainers/templates/typescript-node"
    asserts: [exit_code, stdout_normalized]
    class: templates-runtime
    current_status: match
    notes: "templates metadata emits the dev.containers.metadata annotation compacted, preserving the source key order (json.Compact, not a re-marshal that would sort them). Both sides query the same registry."

  - id: features.test-single-scenario-success
    lane: runtime
    command: features
    priority: p1
    docker_required: true
    network_required: true
    serial: true
    setup_cmd: "for n in 1 2 3; do docker pull mcr.microsoft.com/devcontainers/base:ubuntu >/dev/null 2>&1 && break; sleep 5; done; echo prepulled"
    ts_cmd: "features test --project-folder reference/src/test/container-features/example-v2-features-sets/simple --features color --skip-autogenerated --filter specific_color_scenario --base-image mcr.microsoft.com/devcontainers/base:ubuntu"
    asserts: [exit_code]
    class: features-runtime
    current_status: match
    notes: "Comparative E2E of a real scenario: builds the local feature, creates a container, runs specific_color_scenario.sh, reports the result and cleans up by label. asserts reduced to [exit_code]: the features-test stdout is a verbose, non-deterministic ANSI stream (the scenario script's output) that is not a byte-for-byte comparable surface; success/failure is discriminated by exit_code. The workspace is made accessible (chmod 0777) before the scenario runs, matching the TS CLI, so a non-root remoteUser can enter it regardless of host↔container UID mapping."

groups:
  mode-validation:
    rationale: "Close a whole family of contract bugs with a single sweep"
  enum-validation:
    rationale: "Aligns Cobra with yargs on choice flags"
  format-validation:
    rationale: "Reduces early divergences and false positives in runtime"
  wired-flags:
    rationale: "Detects flags that are exposed but have no effect"
  lifecycle-semantics:
    rationale: "Isolates real behavioral differences in hooks"
  dependency-graph:
    rationale: "Captures the remaining divergence in features info dependencies"
  container-runtime:
    rationale: "Compares commands against real containers with configuration or metadata loaded"
  lifecycle-runtime:
    rationale: "Validates real hooks and JSON envelopes over live containers"
  up-runtime:
    rationale: "Covers real container creation and compose project name"
  build-runtime:
    rationale: "Covers real builds, tagging, and compose/dockerfile paths"