code-coordinator 0.5.222__tar.gz → 0.5.224__tar.gz

{code_coordinator-0.5.222 → code_coordinator-0.5.224}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.222
+Version: 0.5.224
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.222 → code_coordinator-0.5.224}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.222
+Version: 0.5.224
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.222 → code_coordinator-0.5.224}/code_coordinator.egg-info/SOURCES.txt

@@ -483,6 +483,7 @@ tests/test_deploy_coord_web_dist.py
 tests/test_deploy_coord_web_rollback.py
 tests/test_deploy_drive_queue_unit.py
 tests/test_deploy_manifest.py
+tests/test_deploy_notify_unit.py
 tests/test_deploy_units_lane.py
 tests/test_deploy_web_unit.py
 tests/test_deps.py

{code_coordinator-0.5.222 → code_coordinator-0.5.224}/code_coordinator.egg-info/scm_file_list.json

@@ -553,6 +553,7 @@
     "tests/test_deploy_coord_web_rollback.py",
     "tests/test_deploy_drive_queue_unit.py",
     "tests/test_deploy_manifest.py",
+    "tests/test_deploy_notify_unit.py",
     "tests/test_deploy_units_lane.py",
     "tests/test_deploy_web_unit.py",
     "tests/test_deps.py",

{code_coordinator-0.5.222 → code_coordinator-0.5.224}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.222",
+  "tag": "0.5.224",
   "distance": 0,
-  "node": "g0a0c97af031f26980c629e83e6ab895bfca5a393",
+  "node": "gcb4f4b8b669bb9319880ac1b1b10496b1131b557",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-22"

{code_coordinator-0.5.222 → code_coordinator-0.5.224/coord}/deploy/coord-notify.service

@@ -48,6 +48,22 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
+# #2561: this unit carried NO Environment=PATH= at all, so every subprocess
+# `coord notify` spawns — the #2464 out-of-band confirmation pass
+# (coord/confirm_test.py) re-running the repo's real build+test, and any
+# `coord_argv()` (coord/drive.py) escalation resolving `shutil.which("coord")`
+# — ran under systemd's bare user-manager PATH
+# (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:
+# /usr/local/games:/snap/bin), which does NOT contain ~/.local/bin (where the
+# pinned `coord` shim lives) or ~/.cargo/bin (where rustup puts `cargo`). That
+# let this daemon's confirmation runs resolve a *different* toolchain than a
+# dev shell or coord-serve.service would for the identical command — and cost
+# a real dispatch when it refuted a genuinely clean CC#2556 branch over a
+# PATH-dependent test assertion having nothing to do with the diff under
+# review. Byte-identical to coord-serve.service's line (same host, same role
+# family, same #1831/#1117 reasoning — see that unit's comment for why each
+# entry is there and why the ordering matters).
+Environment=PATH=%h/.cargo/bin:%h/.local/bin:%h/src/code-coordinator/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
 ExecStart=%h/.coord-venv/bin/coord notify --config %h/.coord/coordinator.yml
 # #2464: sized off `coord.confirm_test.notify_client_timeout_seconds()` — the
 # HTTP timeout the CLI gives its `/notify` POST — plus slack, because this is

{code_coordinator-0.5.222/coord → code_coordinator-0.5.224}/deploy/coord-notify.service

@@ -48,6 +48,22 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
+# #2561: this unit carried NO Environment=PATH= at all, so every subprocess
+# `coord notify` spawns — the #2464 out-of-band confirmation pass
+# (coord/confirm_test.py) re-running the repo's real build+test, and any
+# `coord_argv()` (coord/drive.py) escalation resolving `shutil.which("coord")`
+# — ran under systemd's bare user-manager PATH
+# (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:
+# /usr/local/games:/snap/bin), which does NOT contain ~/.local/bin (where the
+# pinned `coord` shim lives) or ~/.cargo/bin (where rustup puts `cargo`). That
+# let this daemon's confirmation runs resolve a *different* toolchain than a
+# dev shell or coord-serve.service would for the identical command — and cost
+# a real dispatch when it refuted a genuinely clean CC#2556 branch over a
+# PATH-dependent test assertion having nothing to do with the diff under
+# review. Byte-identical to coord-serve.service's line (same host, same role
+# family, same #1831/#1117 reasoning — see that unit's comment for why each
+# entry is there and why the ordering matters).
+Environment=PATH=%h/.cargo/bin:%h/.local/bin:%h/src/code-coordinator/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
 ExecStart=%h/.coord-venv/bin/coord notify --config %h/.coord/coordinator.yml
 # #2464: sized off `coord.confirm_test.notify_client_timeout_seconds()` — the
 # HTTP timeout the CLI gives its `/notify` POST — plus slack, because this is

{code_coordinator-0.5.222 → code_coordinator-0.5.224}/scripts/coord-test-runner.sh

@@ -829,6 +829,32 @@ run_python() {
         return $?
     fi
 
+    # #2562: the isolation re-run above is not all-or-nothing evidence — its
+    # own `FAILED ` lines say EXACTLY which node ids survived. Rebuild
+    # $failed from those before doing anything else: a test that dropped out
+    # PASSED in isolation and is by definition the flake case this whole
+    # block exists to catch. Handing the ORIGINAL (unpruned) set to the
+    # baseline comparison below is the bug this closes — one genuine failure
+    # was keeping a flake in the set, and the baseline comparison is itself
+    # all-or-nothing (#2170's unanimity), so the flake alone could suppress a
+    # correct BASELINE-RED downgrade.
+    local still_failed
+    still_failed="$(grep '^FAILED ' "$rerun" | awk '{print $2}' | sort -u || true)"
+    if [[ -z "$still_failed" ]]; then
+        # Non-zero exit but no parseable FAILED lines — e.g. a collection/
+        # import error on the isolated re-run. Nothing to prune against;
+        # fall back to the original set rather than claim a pruning that
+        # did not happen.
+        still_failed="$failed"
+    fi
+    local pruned_count; pruned_count="$(printf '%s\n' "$still_failed" | grep -c . || true)"
+    if [[ "$pruned_count" -lt "$count" ]]; then
+        log "$((count - pruned_count)) of $count failing test(s) passed in isolation — treating as flakes, comparing the remaining $pruned_count against the baseline"
+        FLAKES+=("python:$((count - pruned_count))")
+    fi
+    failed="$still_failed"
+    count="$pruned_count"
+
     # Not a flake. Before calling it the branch's fault, ask the question the
     # Test gate is actually asked: is this worse than $BASE_REF on THIS machine?
     # (#2170 — see the baseline section above for why this only ever downgrades

{code_coordinator-0.5.222 → code_coordinator-0.5.224}/tests/test_coord_test_runner_baseline.py

@@ -97,6 +97,15 @@ if [[ "$1" == "-m" && "$2" == "pytest" ]]; then
             printf '%s passed\n' "2"
             exit 0
         fi
+        # #2562: a PARTIAL isolation re-run — one node id genuinely still
+        # fails, the rest passed. Distinct from FAKE_RERUN_PASSES (all pass,
+        # exit 0) and from the "no override" default (everything in
+        # FAKE_BRANCH_FAILED fails again, as if isolation changed nothing).
+        if [[ "$_targeted" -eq 1 && -n "${FAKE_RERUN_STILL_FAILING:-}" ]]; then
+            _emit_failed "$FAKE_RERUN_STILL_FAILING"
+            printf '1 failed, 1 passed\n'
+            exit 1
+        fi
         _emit_failed "${FAKE_BRANCH_FAILED:-}"
         printf '2 failed\n'
         exit 1
@@ -393,6 +402,74 @@ def test_a_flake_is_still_a_flake_and_never_consults_the_baseline(repo: Path) ->
     assert "baseline:" not in result.stdout + result.stderr
 
 
+# ── #2562: partial-flake pruning feeds baseline comparison ──────────────────
+#
+# The all-or-nothing bug: `pytest $failed` re-ran the whole failing set
+# together, so ONE genuine failure alongside a flake kept the flake in
+# `$failed` — and that poisoned set then went to `python_baseline_is_red`,
+# itself unanimity-gated, where the flake (which passes on the baseline same
+# as everywhere else) short-circuited a correct BASELINE-RED downgrade. The
+# fix rebuilds `$failed` from the isolation re-run's own `FAILED ` lines
+# before doing anything else with it.
+
+
+def test_mixed_flake_and_genuine_prunes_to_baseline_red(repo: Path) -> None:
+    """{genuine, flake} prunes to {genuine}, and BASELINE-RED fires on just
+    that remainder — the exact CC#2556 shape from the issue: a real flake
+    sitting next to a test that fails identically on the merge-base must not
+    suppress the downgrade.
+    """
+    result = _run(
+        repo,
+        # Isolation re-run: test_one still fails, test_two (the flake) passed
+        # and dropped out.
+        FAKE_RERUN_STILL_FAILING="tests/test_ambient.py::test_one",
+        # Baseline reproduces the one that's left.
+        FAKE_BASELINE_FAILED="tests/test_ambient.py::test_one",
+    )
+
+    assert result.returncode == 4, (result.returncode, result.stdout, result.stderr)
+    assert "RESULT: BASELINE-RED (python)" in result.stdout
+    assert "1 of 2 failing test(s) passed in isolation" in result.stdout
+    assert "comparing the remaining 1 against the baseline" in result.stdout
+    assert "BASELINE-RED(python): all 1 failing test(s) fail identically" in result.stdout
+    # The pruned flake must not appear as part of the (now genuine-only) set.
+    assert "tests/test_ambient.py::test_one" in result.stdout
+    assert "RESULT: FAIL" not in result.stdout
+
+
+def test_mixed_flake_and_genuine_prunes_to_a_smaller_genuine_fail(repo: Path) -> None:
+    """Same pruning, but the remainder is NOT baseline-red: still a FAIL, but
+    for the pruned count and node id only — the reported list must match
+    what actually failed on the isolation re-run, not the original set.
+    """
+    result = _run(
+        repo,
+        FAKE_RERUN_STILL_FAILING="tests/test_ambient.py::test_one",
+        # FAKE_BASELINE_FAILED unset ⇒ baseline is green for test_one too.
+    )
+
+    assert result.returncode == 1
+    assert "RESULT: FAIL (python)" in result.stdout
+    assert "BASELINE-RED" not in result.stdout
+    assert "1 of 2 failing test(s) passed in isolation" in result.stdout
+    assert "FAIL(python): 1 test(s) fail on re-run — genuine" in result.stdout
+    assert "tests/test_ambient.py::test_one" in result.stdout
+    assert "tests/test_ambient.py::test_two" not in (
+        result.stdout.split("FAIL(python): 1 test(s) fail on re-run — genuine")[1]
+    )
+
+
+def test_all_genuine_failing_set_is_unaffected_by_pruning(repo: Path) -> None:
+    """Both failures still fail in isolation ⇒ nothing pruned, and behaviour
+    matches the pre-#2562 baseline-red path exactly (no pruning log line)."""
+    result = _run(repo, FAKE_BASELINE_FAILED=BRANCH_FAILED)
+
+    assert result.returncode == 4
+    assert "RESULT: BASELINE-RED (python)" in result.stdout
+    assert "passed in isolation" not in result.stdout
+
+
 # ── #2180 review fix: the Test stage must agree with CI on tests/acceptance ─
 #
 # Before this fix, `--ignore=tests/acceptance` dropped the sealed cli-pytest

code_coordinator-0.5.224/tests/test_deploy_notify_unit.py

@@ -0,0 +1,119 @@
+"""Regression guard for `deploy/coord-notify.service` (#2561 `Environment=PATH`).
+
+Mirrors `tests/test_deploy_drive_queue_unit.py`'s `Environment=PATH=` section
+for `coord-notify.service`'s own #2561 fix: this unit carried NO
+`Environment=PATH=` at all, so every subprocess it spawns —
+`coord_argv()`-resolved escalation dispatch, and the #2464 out-of-band
+confirmation pass (`coord.confirm_test`) re-running the repo's own build/test
+commands — ran under systemd's bare user-manager PATH instead of the pinned
+release. That silent divergence refuted a genuinely clean branch (CC#2556)
+over a PATH-dependent test assertion having nothing to do with the diff under
+review. See `deploy/coord-notify.service`'s own header comment for the full
+story, and `deploy/coord-serve.service`'s for why each PATH entry is there —
+this unit's line is byte-identical to that one's (same host, same daemon
+family), unlike `coord-drive-queue.service`'s bespoke #2314 ordering.
+"""
+
+from __future__ import annotations
+
+import configparser
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+UNIT_PATH = REPO_ROOT / "deploy" / "coord-notify.service"
+SERVE_UNIT_PATH = REPO_ROOT / "deploy" / "coord-serve.service"
+
+
+def _parse_unit(path: Path) -> configparser.RawConfigParser:
+    # RawConfigParser (not ConfigParser): systemd's `%h`/`%%` specifiers
+    # collide with configparser's default `%`-interpolation syntax and raise
+    # otherwise (e.g. the `ExecStart=` line below).
+    cp = configparser.RawConfigParser(strict=False)
+    cp.read(path)
+    return cp
+
+
+def _unit_path_entries(path: Path) -> list[str]:
+    """*path*'s `Environment=PATH=` value, split into entries.
+
+    Asserts its presence first: an absent directive is the exact #2561
+    regression (the unit then silently inherits the user manager's default),
+    and a bare KeyError from configparser would not say so.
+    """
+    unit = _parse_unit(path)
+    assert unit.has_option("Service", "Environment"), (
+        f"{path.name} declares no Environment=PATH= — it will inherit the "
+        "systemd user manager's default PATH, which has neither "
+        "~/.local/bin (the pinned `coord` shim) nor ~/.cargo/bin, so every "
+        "coord_argv()-resolved subprocess it spawns silently resolves a "
+        "different toolchain than a dev shell would (#2561)."
+    )
+    value = unit.get("Service", "Environment")
+    assert value.startswith("PATH="), value
+    return value[len("PATH=") :].split(":")
+
+
+def test_still_a_oneshot_unit() -> None:
+    """The fix's reasoning (systemd's default PATH, not a login shell's)
+    assumes `Type=oneshot`. If this ever changes, re-derive rather than
+    silently carry the assumption forward."""
+    unit = _parse_unit(UNIT_PATH)
+    assert unit.get("Service", "Type") == "oneshot"
+
+
+def test_local_bin_is_on_the_path() -> None:
+    """The actual #2561 fix. `~/.local/bin/coord` is the pinned-release
+    shim (a symlink onto `~/.coord-venv/bin/coord`); without it on PATH,
+    `coord_argv()`'s `shutil.which("coord")` falls back to
+    `[sys.executable, "-m", "coord.cli"]`, a different argv shape that
+    downstream code (and tests asserting on it) do not expect."""
+    assert "%h/.local/bin" in _unit_path_entries(UNIT_PATH)
+
+
+def test_cargo_bin_is_on_the_path() -> None:
+    """rustup installs `cargo` at ~/.cargo/bin and nowhere else — the #2464
+    confirmation pass this unit runs re-executes the repo's own
+    `build_command`/`test_command`, which is `cargo build`/`cargo test` for a
+    `tui/**`-touching branch."""
+    assert "%h/.cargo/bin" in _unit_path_entries(UNIT_PATH)
+
+
+def test_path_is_a_superset_of_the_systemd_user_default() -> None:
+    """Declaring an explicit PATH *replaces* the inherited one, so anything
+    this unit reaches today via the user manager's default must be carried
+    over explicitly or the fix trades one silent breakage for another."""
+    entries = set(_unit_path_entries(UNIT_PATH))
+    # `systemctl --user show-environment` default, minus the games dirs.
+    inherited = [
+        "/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin",
+        "/sbin", "/bin", "/snap/bin",
+    ]
+    missing = [e for e in inherited if e not in entries]
+    assert not missing, f"PATH drops inherited entries: {missing}"
+
+
+def test_path_has_no_editable_checkout_shadow() -> None:
+    """Enforce #1831's rule with #1831's own detector rather than by eye: no
+    `.venv/bin` entry may precede ~/.local/bin or ~/.coord-venv/bin, or the
+    `unit_drift` health check goes CRIT on this unit the moment it installs."""
+    from coord.health.checks.unit_drift import find_path_shadow
+
+    assert find_path_shadow(UNIT_PATH.read_text()) is None
+
+
+def test_path_matches_coord_serve_byte_for_byte() -> None:
+    """#2561 asked for byte-identity with `coord-serve.service`'s line —
+    same host, same daemon family, same #1831/#1117 reasoning for each entry.
+    Unlike `coord-drive-queue.service` (a deliberately different, #2314-driven
+    ordering), there is no reason for this unit's PATH to diverge from
+    `coord-serve.service`'s."""
+    assert _unit_path_entries(UNIT_PATH) == _unit_path_entries(SERVE_UNIT_PATH)
+
+
+def test_path_comment_names_the_issue() -> None:
+    """Same rationale as `test_deploy_drive_queue_unit.py`'s comment guard —
+    the reasoning for why this line must never be dropped stays attached to
+    it."""
+    text = UNIT_PATH.read_text()
+    assert "#2561" in text
+    assert "Environment=PATH=" in text

code_coordinator-0.5.224/tests/test_packaged_deploy_units.py

@@ -0,0 +1,179 @@
+"""`coord/deploy/` must stay byte-identical to the repo-root `deploy/` (#1927).
+
+The unit-drift check (`coord/health/checks/unit_drift.py`) diffs each host's
+installed systemd unit against the units *packaged with the installed
+release*. Those live under `coord/deploy/` so they ship in the wheel — a
+reference that cannot drift with the host's git checkout.
+
+The reviewed source of truth is still the repo-root `deploy/`: it is what
+every unit header, doc and provisioning script names, and what the other
+`tests/test_deploy_*.py` modules read. The packaged copy is exactly that,
+copied. This module is what stops the copy from going stale — the failure
+mode is silent and nasty, because a stale packaged unit would make the
+release *look* verified while comparing against the wrong file.
+
+Nothing here needs a fleet, a config or a clock: it is a repo-layout
+assertion.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+SOURCE_DIR = REPO_ROOT / "deploy"
+PACKAGED_DIR = REPO_ROOT / "coord" / "deploy"
+
+UNIT_GLOBS = ("*.service", "*.timer")
+
+# #2561: units whose ExecStart runs a `coord` subcommand that itself launches
+# FURTHER `coord` subprocesses via `coord_argv()` (coord/drive.py) —
+# `shutil.which("coord")`, i.e. resolved from *this unit's own* PATH, not a
+# login shell's. `coord-notify.service` runs the #2464 out-of-band
+# confirmation pass and escalation dispatch; `coord-drive-queue.service`
+# launches `coord drive --tmux` / `coord merge --only` from
+# coord/commands/drive_queue.py. Both went a release cycle with NO
+# `Environment=PATH=` at all, so that resolution silently fell through
+# systemd's bare user-manager PATH (no ~/.local/bin, no ~/.cargo/bin) instead
+# of the pinned release — a real dispatch got refuted over it (#2561's CC#2556
+# incident). `coord-serve.service` and `coord-agent.service` are the other two
+# daemons already on this list; they got their PATH fix in earlier issues
+# (#1831/#1671) and are included here so this test guards them too, not just
+# the two #2561 named.
+#
+# `coord-web.service`, `coord-db-backup.service`,
+# `coord-release-propagate.service` and `coord-release-window.service` are
+# DELIBERATELY not in this set — #2561 asked that the other four units get a
+# considered "does this need it" rather than an accident, not that this test
+# assume the answer. Auditing them is follow-up work, not something to fold in
+# here silently.
+_COORD_ARGV_SPAWNING_UNITS = frozenset(
+    {
+        "coord-notify.service",
+        "coord-drive-queue.service",
+        "coord-serve.service",
+        "coord-agent.service",
+    }
+)
+
+_PATH_LINE_RE = re.compile(r"^Environment\s*=\s*PATH=(.*)$", re.MULTILINE)
+
+# A PATH entry resolving to the pinned release — `~/.local/bin/coord` is a
+# symlink onto `~/.coord-venv/bin/coord` (see deploy/coord-serve.service's
+# header comment). Either makes `shutil.which("coord")` find the real binary
+# instead of coord_argv()'s `python -m coord.cli` fallback.
+_RELEASE_MARKERS = ("/.local/bin", "/.coord-venv/bin")
+
+
+def _units(directory: Path) -> dict[str, Path]:
+    out: dict[str, Path] = {}
+    for pattern in UNIT_GLOBS:
+        for path in directory.glob(pattern):
+            out[path.name] = path
+    return out
+
+
+SOURCE_UNITS = _units(SOURCE_DIR)
+
+
+def test_source_deploy_dir_has_units() -> None:
+    """Guards the guard: an empty source dir would make every other
+    assertion here vacuously true."""
+    assert "coord-serve.service" in SOURCE_UNITS
+    assert "coord-agent.service" in SOURCE_UNITS
+
+
+def test_packaged_dir_covers_every_source_unit() -> None:
+    missing = sorted(set(SOURCE_UNITS) - set(_units(PACKAGED_DIR)))
+    assert not missing, (
+        f"deploy/ has units the wheel would not ship: {missing}. "
+        "Run: cp deploy/*.service deploy/*.timer coord/deploy/"
+    )
+
+
+def test_packaged_dir_has_no_units_of_its_own() -> None:
+    extra = sorted(set(_units(PACKAGED_DIR)) - set(SOURCE_UNITS))
+    assert not extra, (
+        f"coord/deploy/ carries units deploy/ does not: {extra}. The "
+        "repo-root deploy/ is the reviewed source of truth; delete these or "
+        "add them there."
+    )
+
+
+@pytest.mark.parametrize("name", sorted(SOURCE_UNITS))
+def test_packaged_unit_is_byte_identical(name: str) -> None:
+    """A drifted copy is worse than no copy: the check would report a
+    confident green against the wrong reference."""
+    packaged = PACKAGED_DIR / name
+    assert packaged.exists(), f"missing coord/deploy/{name}"
+    assert packaged.read_bytes() == (SOURCE_DIR / name).read_bytes(), (
+        f"coord/deploy/{name} has drifted from deploy/{name}. deploy/ is the "
+        f"source of truth — run: cp deploy/{name} coord/deploy/{name}"
+    )
+
+
+def test_pyproject_ships_the_packaged_units() -> None:
+    """The copy is only worth having if setuptools puts it in the wheel."""
+    import tomllib
+
+    data = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text())
+    patterns = data["tool"]["setuptools"]["package-data"]["coord"]
+    assert any(p.startswith("deploy/") for p in patterns), (
+        "coord/deploy/ is not in [tool.setuptools.package-data]; the wheel "
+        "would ship no reference units and every host would fall back to its "
+        "own unverified checkout (#1927)"
+    )
+
+
+def test_coord_argv_spawning_units_are_known_source_units() -> None:
+    """Guards the guard: a typo'd/renamed entry in the set below would make
+    every assertion in :func:`test_coord_argv_spawning_unit_declares_path`
+    vacuously true for that unit."""
+    missing = sorted(_COORD_ARGV_SPAWNING_UNITS - set(SOURCE_UNITS))
+    assert not missing, (
+        f"_COORD_ARGV_SPAWNING_UNITS names units deploy/ does not have: {missing}"
+    )
+
+
+@pytest.mark.parametrize("name", sorted(_COORD_ARGV_SPAWNING_UNITS))
+def test_coord_argv_spawning_unit_declares_path(name: str) -> None:
+    """#2561: `coord-notify.service` and `coord-drive-queue.service` carried
+    NO `Environment=PATH=` at all, so `coord_argv()`'s `shutil.which("coord")`
+    (coord/drive.py) resolved every subprocess they spawn — the #2464
+    confirmation pass, escalation dispatch, `coord drive --tmux` — under
+    systemd's bare user-manager PATH instead of the pinned release. That
+    silent divergence refuted a genuinely clean branch (CC#2556) over a
+    PATH-dependent test assertion unrelated to the diff under review.
+
+    This is a byte-existence/marker check, not a byte-identity one: unlike
+    `test_packaged_unit_is_byte_identical`, the units in
+    `_COORD_ARGV_SPAWNING_UNITS` do NOT all carry the same PATH= value as each
+    other (coord-drive-queue.service's #2314 pin ordering is deliberately
+    different from coord-serve.service's #1117 repo-venv entry) — only that
+    each one HAS a PATH= line, and that line lets `shutil.which("coord")`
+    reach the pinned release rather than falling through to it.
+    """
+    text = (SOURCE_DIR / name).read_text()
+    matches = _PATH_LINE_RE.findall(text)
+    assert matches, (
+        f"deploy/{name} declares no Environment=PATH= — every subprocess it "
+        "spawns via coord_argv() falls back to systemd's bare user-manager "
+        "PATH, which does not contain ~/.local/bin or ~/.cargo/bin (#2561). "
+        "Add one — see deploy/coord-serve.service's line for the reasoning."
+    )
+    # Only the LAST directive takes effect if the unit repeats the key,
+    # mirroring coord.health.checks.unit_drift.find_path_shadow.
+    entries = [e for e in matches[-1].split(":") if e]
+    has_release_marker = any(
+        entry.rstrip("/").endswith(marker)
+        for entry in entries
+        for marker in _RELEASE_MARKERS
+    )
+    assert has_release_marker, (
+        f"deploy/{name}'s Environment=PATH= ({matches[-1]!r}) contains none of "
+        f"{_RELEASE_MARKERS} — shutil.which(\"coord\") in subprocesses this "
+        "unit spawns cannot resolve the pinned release (#2561)."
+    )

code_coordinator-0.5.222/tests/test_packaged_deploy_units.py

@@ -1,89 +0,0 @@
-"""`coord/deploy/` must stay byte-identical to the repo-root `deploy/` (#1927).
-
-The unit-drift check (`coord/health/checks/unit_drift.py`) diffs each host's
-installed systemd unit against the units *packaged with the installed
-release*. Those live under `coord/deploy/` so they ship in the wheel — a
-reference that cannot drift with the host's git checkout.
-
-The reviewed source of truth is still the repo-root `deploy/`: it is what
-every unit header, doc and provisioning script names, and what the other
-`tests/test_deploy_*.py` modules read. The packaged copy is exactly that,
-copied. This module is what stops the copy from going stale — the failure
-mode is silent and nasty, because a stale packaged unit would make the
-release *look* verified while comparing against the wrong file.
-
-Nothing here needs a fleet, a config or a clock: it is a repo-layout
-assertion.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-
-REPO_ROOT = Path(__file__).resolve().parent.parent
-SOURCE_DIR = REPO_ROOT / "deploy"
-PACKAGED_DIR = REPO_ROOT / "coord" / "deploy"
-
-UNIT_GLOBS = ("*.service", "*.timer")
-
-
-def _units(directory: Path) -> dict[str, Path]:
-    out: dict[str, Path] = {}
-    for pattern in UNIT_GLOBS:
-        for path in directory.glob(pattern):
-            out[path.name] = path
-    return out
-
-
-SOURCE_UNITS = _units(SOURCE_DIR)
-
-
-def test_source_deploy_dir_has_units() -> None:
-    """Guards the guard: an empty source dir would make every other
-    assertion here vacuously true."""
-    assert "coord-serve.service" in SOURCE_UNITS
-    assert "coord-agent.service" in SOURCE_UNITS
-
-
-def test_packaged_dir_covers_every_source_unit() -> None:
-    missing = sorted(set(SOURCE_UNITS) - set(_units(PACKAGED_DIR)))
-    assert not missing, (
-        f"deploy/ has units the wheel would not ship: {missing}. "
-        "Run: cp deploy/*.service deploy/*.timer coord/deploy/"
-    )
-
-
-def test_packaged_dir_has_no_units_of_its_own() -> None:
-    extra = sorted(set(_units(PACKAGED_DIR)) - set(SOURCE_UNITS))
-    assert not extra, (
-        f"coord/deploy/ carries units deploy/ does not: {extra}. The "
-        "repo-root deploy/ is the reviewed source of truth; delete these or "
-        "add them there."
-    )
-
-
-@pytest.mark.parametrize("name", sorted(SOURCE_UNITS))
-def test_packaged_unit_is_byte_identical(name: str) -> None:
-    """A drifted copy is worse than no copy: the check would report a
-    confident green against the wrong reference."""
-    packaged = PACKAGED_DIR / name
-    assert packaged.exists(), f"missing coord/deploy/{name}"
-    assert packaged.read_bytes() == (SOURCE_DIR / name).read_bytes(), (
-        f"coord/deploy/{name} has drifted from deploy/{name}. deploy/ is the "
-        f"source of truth — run: cp deploy/{name} coord/deploy/{name}"
-    )
-
-
-def test_pyproject_ships_the_packaged_units() -> None:
-    """The copy is only worth having if setuptools puts it in the wheel."""
-    import tomllib
-
-    data = tomllib.loads((REPO_ROOT / "pyproject.toml").read_text())
-    patterns = data["tool"]["setuptools"]["package-data"]["coord"]
-    assert any(p.startswith("deploy/") for p in patterns), (
-        "coord/deploy/ is not in [tool.setuptools.package-data]; the wheel "
-        "would ship no reference units and every host would fall back to its "
-        "own unverified checkout (#1927)"
-    )