inferno_core 1.4.3 → 1.4.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 044cfcbc6d3920cfba55d0d63fbf0fb3a1440f4f42a2e45d763beb78f280306a
-  data.tar.gz: 243c006acc71fddd3eb165a2c400a1eab4e515f8c3f4915b27cd60fc8e41e734
+  metadata.gz: 8cffc2d9b151af63840789863f04e8551fd82077351f85d356b5a88f103f28f2
+  data.tar.gz: c6687758255cf5acadb700dfd268ee65f6ab03713dbc17ec412d1240d7f352b7
 SHA512:
-  metadata.gz: a1c934c0c6bb863a66e34b2830807ee274f443323d7c74c10023bf078329abf2bc70d9125f481b388c3e9ac61a647c81a8f6ee6f7c156078a9dc4fc31adcb671
-  data.tar.gz: 6a54d11609e88fadd4c4750966e66a1df705ab1a1c79b8c8c0b99f5d3a19467496c46db740dfb2937610c9c78e8a7bf14db7fe8112c7c8399bb43a16bdcd6937
+  metadata.gz: 0f7ca455177f14a4f0ad5dae5852a7b7441e7ef867e554678b8d55410d623cb7b1d0e4e4432dbd8f1c8cdc085943801d2b98601d9ea776cd1e93f6482a02e3b9
+  data.tar.gz: d4160ba11c06d24fc185c2b4cde86fc36c519499f383c79053246114b2e69d0e5be4504e87ea476f462e1439383f8c1a07a5efcab2701449cbd6458939faa13b

data/lib/inferno/apps/cli/main.rb

@@ -9,6 +9,7 @@ require_relative 'suites'
 require_relative 'new'
 require_relative 'execute'
 require_relative 'execute_script'
+require_relative '../../utils/execution_script_runner'
 require_relative '../../version'
 
 module Inferno
@@ -78,8 +79,31 @@ module Inferno
       desc 'requirements SUBCOMMAND ...ARGS', 'Perform requirements operations'
       subcommand 'requirements', Requirements
 
-      desc 'execute_script YAML_FILE',
-           'Run a session orchestration script defined by a YAML config file.'
+      desc 'execute_script [PATTERN]',
+           'Run one or more session orchestration scripts defined by YAML config file(s).'
+      long_desc <<-LONGDESC
+        Run a session orchestration script defined by a YAML config file.
+
+        PATTERN may be a single YAML file, or it may contain wildcards (e.g. glob
+        patterns like `*` or `**`) to match and run multiple scripts in sequence.
+        When PATTERN matches more than one file, each matching script is run in a
+        separate process; a summary of passed and failed scripts is printed at the
+        end, and the command exits non-zero if any script failed.
+
+        If PATTERN is omitted, it defaults to `execution_scripts/**/*.yaml`, running
+        every script under the execution_scripts directory.
+
+        Examples:
+
+        # Run every script under execution_scripts
+        `bundle exec inferno execute_script`
+
+        # Run a single script
+        `bundle exec inferno execute_script execution_scripts/demo/demo_individual_tests.yaml`
+
+        # Run every script in a directory
+        `bundle exec inferno execute_script "execution_scripts/demo/*.yaml"`
+      LONGDESC
       option :inferno_base_url,
              aliases: ['-I'],
              type: :string,
@@ -113,9 +137,26 @@ module Inferno
              type: :boolean,
              default: false,
              desc: 'Allow execution script steps that run arbitrary shell commands. ' \
-                   'Scripts with command: steps will fail unless this flag is set.'
-      def execute_script(yaml_file)
-        ExecuteScript.new(yaml_file, options).run
+                   'Scripts with command: steps will fail unless this flag is set. ' \
+                   'When PATTERN matches multiple scripts, this also applies to all of them ' \
+                   '(in addition to any individual script whose filename contains "_with_commands").'
+      def execute_script(pattern = 'execution_scripts/**/*.yaml')
+        matches = Dir.glob(pattern).select { |file| file.end_with?('.yaml', '.yml') }.sort
+
+        if matches.length > 1 || (matches.empty? && pattern.match?(/[*?\[\]{}]/))
+          Utils::ExecutionScriptRunner.run_all(
+            pattern:,
+            inferno_base_url: options[:inferno_base_url],
+            allow_commands: options[:allow_commands],
+            compare_messages: options[:compare_messages],
+            compare_result_message: options[:compare_result_message],
+            poll_interval: options[:poll_interval],
+            default_poll_timeout: options[:default_poll_timeout],
+            only_different_messages: options[:only_different_messages]
+          )
+        else
+          ExecuteScript.new(matches.first || pattern, options).run
+        end
       end
 
       desc 'session SUBCOMMAND ...ARGS', 'Perform session operations'

data/lib/inferno/apps/cli/templates/%library_name%.gemspec.tt

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
   # DESCRIPTION
   # spec.homepage      = 'TODO'
   spec.license       = 'Apache-2.0'
-  spec.add_dependency 'inferno_core', '~> <%= Inferno::VERSION %>'
+  spec.add_dependency 'inferno_core', '~> <%= Inferno::VERSION.split('.').first(2).join('.') %>', '>= <%= Inferno::VERSION %>'
   spec.required_ruby_version = Gem::Requirement.new('>= 3.3.6')
   spec.metadata['inferno_test_kit'] = 'true'
   # spec.metadata['homepage_uri'] = spec.homepage

data/lib/inferno/apps/cli/templates/.gitignore

@@ -1,4 +1,4 @@
-/data/*.db
+/data/*.db*
 /data/igs/*.tgz
 /data/redis/**/*.rdb
 /data/redis/**/*.aof

data/lib/inferno/apps/cli/templates/Rakefile.tt

@@ -5,19 +5,6 @@ begin
 rescue LoadError # rubocop:disable Lint/SuppressedException
 end
 
-namespace :execute_scripts do
-  desc 'Run all execution script YAML files against a local Inferno instance (already running). ' \
-       'Optional FILTER env var restricts by File.fnmatch pattern, e.g. FILTER="execution_scripts/demo/*". ' \
-       'Optional INFERNO_BASE_URL env var sets the target Inferno URL, e.g. INFERNO_BASE_URL="http://localhost:4567/"'
-  task :run_all do
-    require 'inferno/utils/execution_script_runner'
-    Inferno::Utils::ExecutionScriptRunner.run_all(
-      pattern: ENV.fetch('FILTER', 'execution_scripts/**/*.yaml'),
-      inferno_base_url: ENV.fetch('INFERNO_BASE_URL', nil)
-    )
-  end
-end
-
 namespace :db do
   desc 'Apply changes to the database'
   task :migrate do

data/lib/inferno/apps/cli/templates/config/nginx.background.conf.tt

@@ -53,36 +53,6 @@ http {
     # the server will close connections after this time
     keepalive_timeout 600;
 
-    location /validator {
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Port $server_port;
-      proxy_redirect off;
-      proxy_set_header Connection '';
-      proxy_http_version 1.1;
-      chunked_transfer_encoding off;
-      proxy_buffering off;
-      proxy_cache off;
-
-      proxy_pass http://fhir_validator_app;
-    }
-
-    location /validatorapi/ {
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Port $server_port;
-      proxy_redirect off;
-      proxy_set_header Connection '';
-      proxy_http_version 1.1;
-      chunked_transfer_encoding off;
-      proxy_buffering off;
-      proxy_cache off;
-
-      proxy_pass http://validator_service:4567/;
-    }
-
     location /hl7validatorapi/ {
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header Host $http_host;

data/lib/inferno/apps/cli/templates/config/nginx.conf.tt

@@ -68,36 +68,6 @@ http {
       proxy_pass http://inferno:4567;
     }
 
-    location /validator {
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Port $server_port;
-      proxy_redirect off;
-      proxy_set_header Connection '';
-      proxy_http_version 1.1;
-      chunked_transfer_encoding off;
-      proxy_buffering off;
-      proxy_cache off;
-
-      proxy_pass http://fhir_validator_app;
-    }
-
-    location /validatorapi/ {
-      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-      proxy_set_header Host $http_host;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Port $server_port;
-      proxy_redirect off;
-      proxy_set_header Connection '';
-      proxy_http_version 1.1;
-      chunked_transfer_encoding off;
-      proxy_buffering off;
-      proxy_cache off;
-
-      proxy_pass http://validator_service:4567/;
-    }
-
     location /hl7validatorapi/ {
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header Host $http_host;

data/lib/inferno/apps/cli/templates/docker-compose.background.yml.tt

@@ -1,4 +1,3 @@
-version: '3'
 services:
   hl7_validator_service:
     image: infernocommunity/inferno-resource-validator
@@ -11,18 +10,6 @@ services:
       # To let the service share your local FHIR package cache,
       # uncomment the below line
       # - ~/.fhir:/home/ktor/.fhir
-  validator_service:
-    image: infernocommunity/fhir-validator-service
-    # Update this path to match your directory structure
-    volumes:
-      - ./data/igs:/home/igs
-  fhir_validator_app:
-    image: infernocommunity/fhir-validator-app
-    depends_on:
-      - validator_service
-    environment:
-      EXTERNAL_VALIDATOR_URL: http://localhost/validatorapi
-      VALIDATOR_BASE_PATH: /validator
   fhirpath:
     image: infernocommunity/fhirpath-service
     ports:
@@ -35,7 +22,7 @@ services:
       - "80:80"
     command: [nginx, '-g', 'daemon off;']
     depends_on:
-      - fhir_validator_app
+      - hl7_validator_service
       - fhirpath
   redis:
     image: redis

data/lib/inferno/apps/cli/templates/docker-compose.yml.tt

@@ -1,4 +1,3 @@
-version: '3'
 services:
   inferno:
     build:
@@ -6,7 +5,7 @@ services:
     volumes:
       - ./data:/opt/inferno/data
     depends_on:
-      - validator_service
+      - hl7_validator_service
   worker:
     build:
       context: ./
@@ -19,14 +18,6 @@ services:
     extends:
       file: docker-compose.background.yml
       service: hl7_validator_service
-  validator_service:
-    extends:
-      file: docker-compose.background.yml
-      service: validator_service
-  fhir_validator_app:
-    extends:
-      file: docker-compose.background.yml
-      service: fhir_validator_app
   fhirpath:
     extends:
       file: docker-compose.background.yml

data/lib/inferno/apps/cli/templates/execution_scripts/%library_name%_script_expected.json.tt

@@ -126,18 +126,10 @@
         "message": "Patient/85: Patient.extension[0]: Unknown extension http://hl7.org/fhir/us/core/StructureDefinition/us-core-race",
         "type": "info"
       },
-      {
-        "message": "Patient/85: Patient.extension[0].extension[0].value.ofType(Coding): The definition for the Code System with URI 'urn:oid:2.16.840.1.113883.6.238' doesn't provide any codes so the code cannot be validated",
-        "type": "info"
-      },
       {
         "message": "Patient/85: Patient.extension[1]: Unknown extension http://hl7.org/fhir/us/core/StructureDefinition/us-core-ethnicity",
         "type": "info"
       },
-      {
-        "message": "Patient/85: Patient.extension[1].extension[0].value.ofType(Coding): The definition for the Code System with URI 'urn:oid:2.16.840.1.113883.6.238' doesn't provide any codes so the code cannot be validated",
-        "type": "info"
-      },
       {
         "message": "Patient/85: Patient.extension[2]: Unknown extension http://hl7.org/fhir/us/core/StructureDefinition/us-core-birthsex",
         "type": "info"

data/lib/inferno/apps/cli/templates/execution_scripts/{README.md.tt → README.md}

@@ -10,7 +10,7 @@ as `tx.fhir.org`.
 
 Execution scripts defined here will
 be [executed](https://inferno-framework.github.io/docs/advanced-test-features/scripting-execution.html#execution)
-automatically on pull requests as a part of the github
+automatically on pull requests as a part of the GitHub
 workflows and can also be executed locally using the
-[`execute_script` CLI](https://inferno-framework.github.io/docs/getting-started/inferno-cli.html#complex-scripted-execution)
-on individual scripts or the `execute_scripts:run_all` rake task.
+[`execute_script` CLI](https://inferno-framework.github.io/docs/getting-started/inferno-cli.html#complex-scripted-execution).
+If no `.yaml` files are found under this directory, the GitHub workflow will be skipped.

data/lib/inferno/apps/cli/templates/lib/%library_name%/requirements/%library_name%_requirements.csv

@@ -0,0 +1,3 @@
+Req Set,ID,URL,Requirement,Conformance,Actors,Sub-Requirement(s),Conditionality,Not Tested Reason,Not Tested Details
+sample_v1,12,www.example.com/page.html#section,Requirement text SHALL go here,SHALL,Server,sample_v1@13,false,Not Tested,We've decided not to test this requirement
+sample_v1,13,www.example.com/page.html#section,"This is a subsrequirement, and it SHOULD be implemented.",SHOULD,Server,,false,,

data/lib/inferno/apps/cli/templates/lib/%library_name%/requirements/README.md

@@ -0,0 +1,12 @@
+# Using Core Requirements Tools
+
+This directory contains [requirement artifacts](https://inferno-framework.github.io/docs/advanced-test-features/requirements.html)
+that contain example requirements that could be linked to tests
+within this test kit and displayed within the UI as justification
+for the tests.
+
+Each `.xlsx` file defined in this directory will contribute towards the
+test kit's requirements and a GitHub workflow executed automatically on pull
+requests checks that these files are in sync with the generated requirement
+list and coverage analysis `.csv` files. If no `.xlsx` files are found in
+this directory, the GitHub workflow will be skipped. 

data/lib/inferno/apps/cli/templates/lib/%library_name%/requirements/generated/%test_suite_id%_requirements_coverage.csv.tt

@@ -0,0 +1 @@
+Req Set,ID,URL,Requirement,Conformance,Actors,Conditionality,Not Tested Reason,Not Tested Details,<%= title_name %> Short ID(s),<%= title_name %> Full ID(s)

data/lib/inferno/apps/cli/templates/spec/%library_name%/patient_group_spec.rb.tt

@@ -46,7 +46,7 @@ RSpec.describe <%= module_name %>::PatientGroup do
       result = run(test, url: url, patient_id: patient_id)
 
       expect(result.result).to eq('fail'), result.result_message
-      expect(result.result_message).to match(/200/)
+      expect(result.result_message).to include('200')
     end
 
     it 'fails if a Patient is not received' do
@@ -57,7 +57,7 @@ RSpec.describe <%= module_name %>::PatientGroup do
       result = run(test, url: url, patient_id: patient_id)
 
       expect(result.result).to eq('fail'), result.result_message
-      expect(result.result_message).to match(/Patient/)
+      expect(result.result_message).to include('Patient')
     end
 
     it 'fails if the id received does not match the one requested' do
@@ -68,7 +68,7 @@ RSpec.describe <%= module_name %>::PatientGroup do
       result = run(test, url: url, patient_id: patient_id)
 
       expect(result.result).to eq('fail'), result.result_message
-      expect(result.result_message).to match(/resource with id/)
+      expect(result.result_message).to include('resource with id')
     end
   end
 

data/lib/inferno/config/boot/suites.rb

@@ -1,3 +1,36 @@
+module Inferno
+  module Config
+    module Boot
+      # Extracted from the :suites provider below so the enable_when
+      # validation can be unit tested against plain Test/TestGroup/TestSuite
+      # classes, instead of requiring a full application boot (which only
+      # happens once per process) just to exercise the raise.
+      module Suites
+        module_function
+
+        # A circular or undefined enable_when dependency means the input
+        # involved can never be enabled, so this is treated as fatal at load
+        # time rather than left for developers to discover once the suite is
+        # already running. `enable_when` is uninheritable, so a problem local
+        # to a group or test can be hidden from the suite's own merged view if
+        # a parent re-declares the same input name without repeating
+        # `enable_when` -- checking every runnable in the tree, not just the
+        # suite, is what catches that case.
+        def check_enable_when_errors!(descendant)
+          [*descendant.all_descendants.reverse, descendant].each do |runnable|
+            enable_when_errors = runnable.enable_when_problem_messages
+            next if enable_when_errors.empty?
+
+            raise StandardError,
+                  "Error initializing test suite #{descendant.name} (id: #{descendant.id}) " \
+                  "in '#{runnable.title || runnable.id}' (id: #{runnable.id}):\n- #{enable_when_errors.join("\n- ")}"
+          end
+        end
+      end
+    end
+  end
+end
+
 Inferno::Application.register_provider(:suites) do
   prepare do
     target_container.start :logging
@@ -46,6 +79,8 @@ Inferno::Application.register_provider(:suites) do
         raise StandardError, "Error initializing test suite #{descendant.name}: test suite ID is not set"
       end
 
+      Inferno::Config::Boot::Suites.check_enable_when_errors!(descendant)
+
       # This will lock the short IDs if a short ID map for this suite is present
       descendant.assign_short_ids
     end

data/lib/inferno/dsl/fhir_resource_validation.rb

@@ -55,6 +55,19 @@ module Inferno
           @validator_session_repo ||= Inferno::Repositories::ValidatorSessions.new
         end
 
+        # Environment variable that, when set to a truthy-looking value,
+        # enables verbose validation logging (the validationContext sent
+        # with each request, and the resulting issues including which were
+        # filtered out) through Inferno's normal application logger, tagged
+        # with the validator definition and, when available, the test
+        # session and test that triggered the request.
+        VALIDATOR_DEBUG_LOGGING_ENV_VAR = 'FHIR_RESOURCE_VALIDATOR_DEBUG_LOGGING'.freeze
+
+        # @private
+        def debug_logging_enabled?
+          ENV.fetch(VALIDATOR_DEBUG_LOGGING_ENV_VAR, nil).present?
+        end
+
         # Set the url of the validator service
         #
         # @param validator_url [String]
@@ -212,6 +225,36 @@ module Inferno
           }
         end
 
+        # Environment variable that, when set, enables terminology server
+        # request logging by the validator itself. Its value is sent as
+        # `txLog` in the validationContext of every validation request,
+        # telling the validator where to log the terminology server
+        # requests it makes. Note that the log will appear within
+        # the container running the validator.
+        TX_LOG_ENV_VAR = 'FHIR_RESOURCE_VALIDATOR_TX_LOG'.freeze
+
+        # @private
+        def tx_log
+          ENV.fetch(TX_LOG_ENV_VAR, nil).presence
+        end
+
+        # @private
+        # Builds the validationContext sent with a request for the given
+        # profile. Pulled out on its own (rather than inlined in
+        # `wrap_target_for_hl7_wrapper`) so the same, resource-content-free
+        # context can also be used for logging in `log_validation_result`.
+        #
+        # @param profile_url [String]
+        # @return [Hash]
+        def build_validation_context(profile_url)
+          context = {
+            **validation_context.definition,
+            profiles: [profile_url]
+          }
+          context[:txLog] = tx_log if tx_log
+          context
+        end
+
         # @private
         # Used internally by perform_additional_validation
         def additional_validations
@@ -334,6 +377,7 @@ module Inferno
 
           # 4. Mark resources as filtered
           mark_issues_for_filtering(issues)
+          log_validation_result(profile_url, issues, runnable) if debug_logging_enabled?
 
           # 5. Add error messages to runnable
           filtered_issues = issues.reject(&:filtered)
@@ -447,12 +491,57 @@ module Inferno
         # @private
         def call_validator(target, profile_url)
           request_body = wrap_target_for_hl7_wrapper(target, profile_url)
+
           Faraday.new(
             url,
             request: { timeout: 600 }
           ).post('validate', request_body, content_type: 'application/json')
         end
 
+        # @private
+        # Logs the validationContext and expansionParameters sent with a
+        # request together with the resulting issues (including which were
+        # filtered out) in a single entry, tagged with enough context to
+        # trace it back to the validator definition and triggering test run.
+        #
+        # Deliberately omits the resource content itself (sent separately as
+        # `filesToValidate`): only the small, non-PHI-bearing
+        # validationContext and expansionParameters are logged, not the full
+        # request body.
+        #
+        # @param profile_url [String] the profile URL validated against
+        # @param issues [Array<ValidatorIssue>] the resulting issues, already marked for filtering
+        # @param runnable [Object] the runnable (typically a Test) that triggered the request
+        def log_validation_result(profile_url, issues, runnable)
+          payload = {
+            validator_name: name,
+            test_suite_id: test_suite_id,
+            test_session_id: runnable.respond_to?(:test_session_id) ? runnable.test_session_id : nil,
+            test_id: runnable.id,
+            validation_context: build_validation_context(profile_url),
+            expansion_parameters:,
+            issues: issues.map { |issue| issue_summary(issue) }
+          }.compact
+
+          Application[:logger].info("FHIR validation result: #{payload.to_json}")
+        end
+
+        # @private
+        # Recursively builds a loggable summary of a validation issue,
+        # including nested slice_info, without any resource content.
+        #
+        # @param issue [ValidatorIssue]
+        # @return [Hash]
+        def issue_summary(issue)
+          {
+            severity: issue.severity,
+            location: issue.location,
+            message: issue.message,
+            filtered: issue.filtered,
+            slice_info: issue.slice_info.any? ? issue.slice_info.map { |nested| issue_summary(nested) } : nil
+          }.compact
+        end
+
         # @private
         # Post an object to the validation service for validating.
         # Returns the raw validator response body.
@@ -703,10 +792,7 @@ module Inferno
             end
 
           wrapped_resource = {
-            context_key => {
-              **validation_context.definition,
-              profiles: [profile_url]
-            },
+            context_key => build_validation_context(profile_url),
             filesToValidate: [
               {
                 fileName: "#{profile_url.split('/').last}.json",

data/lib/inferno/dsl/input_output_handling.rb

@@ -16,7 +16,8 @@ module Inferno
       # @option input_params [Hash] :options Possible input option formats based on input type
       # @option options [Array] :list_options Array of options for input formats
       #   that require a list of possible values (radio and checkbox)
-      # @option input_params [Hash] :enable_when Conditions for showing the input. Must be a Hash
+      # @option input_params [Hash] :enable_when Conditions for showing the input and determining
+      #   whether it is required. Must be a Hash
       #   with String :input_name (the name of the controlling input) and String :value (the value
       #   that triggers visibility). For checkbox inputs the value must be a JSON-encoded sorted
       #   array, e.g. '["a","b"]'.
@@ -97,9 +98,12 @@ module Inferno
       end
 
       # @private
-      def required_inputs(selected_suite_options)
-        available_inputs(selected_suite_options)
-          .reject { |_, input| input.optional }
+      def required_inputs(selected_suite_options, submitted_inputs = nil)
+        input_values = (submitted_inputs || []).to_h { |input| [input[:name].to_s, input[:value]] }
+
+        available = available_inputs(selected_suite_options)
+        available
+          .reject { |_, input| input.optional || !input.enabled?(input_values, available) }
           .map { |_, input| input.name }
       end
 
@@ -107,7 +111,10 @@ module Inferno
       def missing_inputs(submitted_inputs, selected_suite_options)
         submitted_inputs = [] if submitted_inputs.nil?
 
-        required_inputs(selected_suite_options).map(&:to_s) - submitted_inputs.map { |input| input[:name] }
+        required_input_names = required_inputs(selected_suite_options, submitted_inputs).map(&:to_s)
+        submitted_input_names = submitted_inputs.map { |input| input[:name] }
+
+        required_input_names - submitted_input_names
       end
 
       # Define a particular order for inputs to be presented in the API/UI
@@ -204,6 +211,95 @@ module Inferno
 
         order_available_inputs(child_inputs.merge(available_inputs))
       end
+
+      # @private
+      # Automatically detect, among this runnable's own inputs: circular
+      # `enable_when` dependencies (e.g. input `a` is enabled_when `b`, which
+      # is itself enabled_when `a`), and `enable_when` conditions that
+      # reference an input not declared on this same runnable (e.g. a typo'd
+      # `input_name`). Both silently evaluate as permanently disabled at
+      # runtime with no other diagnostic (see `Entities::Input#enabled?`'s
+      # `visited` guard and its `input_values.key?` check), so they're
+      # treated as fatal at load time instead. Note `enable_when` is an
+      # uninheritable attribute -- it only has meaning, and can only
+      # reference another input, at the level it's declared -- so a problem
+      # local to a group or test can be masked if a parent re-declares the
+      # same input name without repeating `enable_when`; checking every
+      # runnable in the tree (not just the suite) is what catches those.
+      def enable_when_problem_messages
+        inputs_by_name = enable_when_local_inputs
+        edges = enable_when_edges(inputs_by_name)
+
+        enable_when_undefined_reference_messages(edges, inputs_by_name) + enable_when_calculated_cycle_messages(edges)
+      end
+
+      # @private
+      # Flags any `enable_when.input_name` that doesn't name an input
+      # declared on this same runnable.
+      def enable_when_undefined_reference_messages(edges, inputs_by_name)
+        local_names = inputs_by_name.values.map(&:name)
+
+        edges.filter_map do |name, referenced_name|
+          next if local_names.include?(referenced_name)
+
+          "Input '#{name}' has an enable_when condition that references '#{referenced_name}', " \
+            'which is not an input defined on the same test/group/suite.'
+        end
+      end
+
+      # @private
+      def enable_when_calculated_cycle_messages(edges)
+        globally_visited = {}
+
+        edges.each_key.filter_map do |start_name|
+          next if globally_visited[start_name]
+
+          cycle = follow_enable_when_chain(start_name, edges, globally_visited)
+          next unless cycle
+
+          chain = (cycle + [cycle.first]).join(' -> ')
+          "Circular enable_when dependency detected in input '#{cycle.first}': #{chain}. "
+        end
+      end
+
+      # @private
+      # Maps each input's name to the name of the input it depends on via
+      # `enable_when`, for every input in this runnable that has one.
+      # `enable_when` is uninheritable (see `Entities::Input::UNINHERITABLE_ATTRIBUTES`),
+      # so it's unaffected by the child merge in `available_inputs` -- reading
+      # straight from this runnable's own local input config avoids that
+      # merge's subtree walk entirely.
+      def enable_when_edges(inputs_by_name = enable_when_local_inputs)
+        inputs_by_name.each_with_object({}) do |(_, input), depends_on|
+          depends_on[input.name] = input.enable_when[:input_name] if input.enable_when.present?
+        end
+      end
+
+      # @private
+      def enable_when_local_inputs
+        config.inputs.slice(*inputs)
+      end
+
+      # @private
+      # Follows the `enable_when` chain starting at `start_name`, marking
+      # every node visited along the way. Returns the cycle (as an array of
+      # input names) if one is found, otherwise nil.
+      def follow_enable_when_chain(start_name, depends_on, globally_visited)
+        path = []
+        node = start_name
+
+        until node.nil? || globally_visited[node]
+          break if path.index(node)
+
+          path << node
+          node = depends_on[node]
+        end
+
+        path.each { |name| globally_visited[name] = true }
+
+        cycle_start_index = path.index(node)
+        cycle_start_index && path[cycle_start_index..]
+      end
     end
   end
 end