Feature-coverage audit: close e2e/fleet coverage gaps (2026-06-29)

[joshua-temple]

Coverage map (UNIT/E2E/FLEET/UNCOVERED) from current code (b1ff53f), 83 e2e scenarios + 11 fleet suites. STRONG overall (generate/hotfix/rollback/promote/release double-covered). Gaps, prioritized: HIGH - branch-protection apply is UNIT-ONLY, no tier verifies real-GitHub application (fleet only bypasses protection) -> add fleet assertion. MED - status consistency --fix verb UNIT-ONLY (operator command never run live, though shared self-heal is fleet-proven) -> fleet/e2e [cross-cuts the doc audit]; rollout strategy max_parallel/fail_fast UNIT-ONLY, no e2e on the deploy-strategy block -> e2e; per-component reserve (#176) UNIT-ONLY unlike sibling reserves (scenarios 23-26) -> e2e for parity. LOW-MED - auto-promote rc->publish handoff has no dedicated scenario (self-dogfooded only). Confirmed dual-covered: hotfix orphan self-heal (act + 4env Step 3g). Report: ~/llm/plans/cascade/2026-06-29-feature-coverage-audit.md

[joshua-temple]

Gaps #2-#5 closed in code:

• feat: first-class cross-repo deploy targets (GitOps mirror pattern) #2 status consistency --fix: e2e scenario 42 (test(e2e): add scenarios 42-44 covering consistency-fix, rollout strategy, and components reserve #414) - asserts orphan deleted, diverged env untouched; confirmed --fix is strictly git.
• feat: vendor-neutral metrics emission for orchestrate and promote runs #3 rollout strategy: e2e scenario 43 (test(e2e): add scenarios 42-44 covering consistency-fix, rollout strategy, and components reserve #414) - asserts generated promote.yaml renders fail-fast/max-parallel.
• feat: starter template / cascade init scaffold #4 components reserve: e2e scenario 44 (test(e2e): add scenarios 42-44 covering consistency-fix, rollout strategy, and components reserve #414) + the missing componentConfig schema entry.
• feat: emit branch-protection.json from manifest #5 auto-promote handoff: resolve decision core extracted to a tested script + 9 unit cases (test(release): cover the auto-promote resolve decision logic #415).

Remaining: #1 branch-protection - the new cascade-example-branch-protection repo + fleet wiring (#413) are staged; pending the CASCADE_STATE_TOKEN secret on the new repo before the fleet run can validate the live ruleset assertion.

[joshua-temple]

Gap #1 (branch-protection apply) closed via #416, with a course-correction. The real-GitHub fleet approach was abandoned: applying branch protection requires repo-admin authority (the PUT .../protection endpoint; GITHUB_TOKEN provably cannot do it, and requiring an admin PAT is an adoption blocker). Instead, cascade branch-protection gained an opt-in --apply --token --repo --branch --api-url path so an operator applies with a scoped token, proven by httptest mock-GitHub-server integration tests (the act+gitea harness cannot host GitHub's branch-protection endpoint; gitea's API shape differs). All five coverage gaps now addressed: #2-#4 (#414), #5 (#415), #1 (#416).

[joshua-temple]

Closing: all five feature-coverage gaps are addressed and merged.

• feat: canary / blue-green deploy strategy modeling #1 branch-protection apply: landed as the cascade branch-protection --apply --token CLI capability + httptest mock-server coverage (feat(branch-protection): add --apply to apply protection with a scoped token #416). Redecided from the original real-GitHub fleet-repo approach, which required repo-admin (an adoption blocker); the act+gitea harness cannot host GitHub's branch-protection endpoint, so the mock-server integration test is the faithful hermetic proof.
• feat: first-class cross-repo deploy targets (GitOps mirror pattern) #2 status consistency --fix: e2e scenario 42 (test(e2e): add scenarios 42-44 covering consistency-fix, rollout strategy, and components reserve #414), Docker-validated; confirmed --fix is strictly git.
• feat: vendor-neutral metrics emission for orchestrate and promote runs #3 rollout strategy: e2e scenario 43 (test(e2e): add scenarios 42-44 covering consistency-fix, rollout strategy, and components reserve #414).
• feat: starter template / cascade init scaffold #4 components reserve: e2e scenario 44 (test(e2e): add scenarios 42-44 covering consistency-fix, rollout strategy, and components reserve #414) + the componentConfig schema entry.
• feat: emit branch-protection.json from manifest #5 auto-promote handoff: resolve decision core extracted to a tested script (test(release): cover the auto-promote resolve decision logic #415).

Coverage-matrix stays at 11 (no new fleet repo, since #1 became a CLI capability).