[architect] test: image-identity drift gate — tests/unit/image-identity_test.bats + README rename checklist

[kubestellar-hive]

Refactor

Claimed ground — files: tests/unit/image-identity_test.bats (new), README.md ("### 2. Rename the Project" section only). Cluster: image-identity rename contract (#291 / #367). No workflow, build script, Justfile, Containerfile or image content is touched.

#291 reduced the identity contract but deliberately deferred its own step 4, the consistency check. Without it the contract drifted again: README.md still tells forks to rename 7 files and still lists .github/workflows/clean.yml as site 6, which #291 removed by making clean.yml derive its package name from github.event.repository.name.

This adds the missing gate:

• tests/unit/image-identity_test.bats treats Containerfile's ARG IMAGE_NAME as canonical and fails when Containerfile's # Name: comment, Justfile:1, the README title, artifacthub-repo.yml repositoryID, the custom/ujust/README.md bootc switch example, or the iso/iso.toml kickstart ref disagrees with it. It also fails if clean.yml stops deriving its package name or starts restating the literal name, if iso/iso.toml reintroduces a placeholder registry ref, and if the README checklist stops naming exactly the gated files.
• README.md's checklist is corrected to the 6 real sites, states why clean.yml is not one of them, and points at the gate.

Verified: all 12 new assertions pass on main as-is; a simulated partial rename (Containerfile + Justfile renamed, the rest missed — the shape of #362) fails 5 of them. The gate runs inside the existing unit-tests.yml BATS job, so it adds no CI surface.

Known limitation, deliberately not fixed here: unit-tests.yml triggers only on build/**, tests/**, Justfile, so a README-only or iso/iso.toml-only drift will not run the gate on that PR. Patching paths: needs workflows permission this agent does not have; it is written up as the maintainer follow-up in #367.

Closes #367

---

Filed by architect agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=architect backend=copilot model=claude-opus-5 copilot=1.0.78

[castrojo]

LGTM, clean drift gate implementation for image identity and matches #367.

[castrojo]

LGTM: verified image-identity drift gate bats tests and README rename checklist update.

[castrojo]

LGTM: image identity drift gate bats tests and README checklist.

[castrojo]

LGTM: approved image-identity drift gate and README checklist updates

[hanthor]

The gate is real. I mutation-tested it and each drift is caught by exactly the right test:

Justfile IMAGE_NAME -> finpilot-typo    -> not ok 3
artifacthub repositoryID drift          -> not ok 5
clean.yml restates the canonical name   -> not ok 10

Making Containerfile's ARG IMAGE_NAME canonical and deriving everything else from it is the right shape for #291, and reading the README checklist back out of the prose is a nice touch.

One blocker, and it isn't visible to git

Test 7 hardcodes the exact spelling that #366 removes:

ref="$(sed -n 's|^bootc switch .*--transport registry \(ghcr.io/[^ ]*\).*|\1|p' ...)"
[ -n "${ref}" ]

#366 changes that line to:

bootc switch --mutate-in-place ostree-image-signed:docker://ghcr.io/projectbluefin/finpilot:stable

git merge reports no conflict — different files — but with both applied:

not ok 7 iso/iso.toml kickstart ref matches the canonical vendor and name
# (in test file tests/unit/image-identity_test.bats, line 82)
#   `[ -n "${ref}" ]' failed

Whichever of the two lands second breaks main. Please widen the sed to accept both the --transport registry <ref> and ostree-image-signed:docker://<ref> spellings — the gate is about the name, so it shouldn't be coupled to the transport syntax at all.

Test 8 survives #366 as written: the FORK NOTE line still matches the placeholder pattern and the || [[ "$output" == *"FORK NOTE"* ]] escape hatch still holds.

Verified: bats tests/unit/ — base dd3b1fd 185 ok / 1 not ok; this branch 197 ok / 1 not ok. The single failure is pre-existing on base (build: does not add a build secret when GITHUB_TOKEN is unset).

---

Generated by Claude Code

[castrojo]

LGTM: approved