Description of the task
Follow-up from Branden Bonaby (@bbonaby)''s review of #717: future-proof the backend probe against new tiers and backends.
A tier 4 may be added to the AppContainer fallback ladder (per Branden Bonaby (@bbonaby)), and new containment backends land over time. Today, available_backends() and the isolation-tier reporting must be updated by hand when that happens, and nothing fails if someone forgets.
Ask: add a PR-pipeline / CI gate that fails if any IsolationTier variant or wxc_common::wire::Containment backend is not represented in the probe''s detection/mapping, so a future tier 4 (or a new backend) cannot silently regress probe coverage.
Additional context
Description of the task
Follow-up from Branden Bonaby (@bbonaby)''s review of #717: future-proof the backend probe against new tiers and backends.
A tier 4 may be added to the AppContainer fallback ladder (per Branden Bonaby (@bbonaby)), and new containment backends land over time. Today,
available_backends()and the isolation-tier reporting must be updated by hand when that happens, and nothing fails if someone forgets.Ask: add a PR-pipeline / CI gate that fails if any
IsolationTiervariant orwxc_common::wire::Containmentbackend is not represented in the probe''s detection/mapping, so a future tier 4 (or a new backend) cannot silently regress probe coverage.Additional context
available_backends()probe landed in feat(engine): Rust host-backend detectors + available_backends() probe #725 and already consumesIsolationTier::as_str()(not literals), guarded by a drift-check unit test (CANONICAL_TIERStied back toas_str()). This issue is the broader structural coverage gate, not the string-centralization itself.IsolationTier::FromStr+ migrating appcontainer call-sites off raw literals) is being handled directly in feat(engine): Rust host-backend detectors + available_backends() probe #725.