Phase 1: tf runner characterization tests to ≥90% (gate on)

[grubmeshi]

Phase 1 — Characterization tests for tfrun to ≥90% (pre-refactor)

Stacked on refactor/single-go-binary/phase-0-guardrails. Pins the tf runner's current behavior with hermetic, use-case-level scenario tests (black-box through Worker/SingleRunWorker) so they survive the phase-2 DDD refactor, then turns the coverage gate on. Tests-only, with one sanctioned production-file exception (below).

Coverage

• tfrun in-scope statement coverage: 90.2% (gate at 90 via tools/coverage/thresholds.txt).
• Excluded real-I/O adapters (tools/coverage/exclusions.txt): git.go (go-git/exec-git+bash; SSH/Azure need real I/O) and tfbinaries.go (real tofu/terraform release downloads). Everything else counts.
• task test, task lint (golangci-lint v2, 0 issues), and task coverage all green across the three modules.

What is pinned (D9 + use-case matrix)

• CP1 hermetic fixtures: local on-disk git repos replace the live meshstack-hub.git clone; shared runDetailsDTO builder + genuine encrypt/decrypt over the checked-in test key.
• CP2 worker fetch/register failure paths + runner header pins.
• CP3 SingleRunWorker suite (runToken-only auth, constructor defaults, dir-setup branches).
• CP4 inputs/crypto (genuine decrypt round-trip, key-mismatch UX, env encode) + 128MiB artifact cap (in go-meshapi-client).
• CP5/CP6 workspace select/create/delete naming + meshStack HTTP backend fallback (TF_HTTP_*) + init retry / HINT_INIT_FAILED.
• CP7 async runs (single trigger step, final IN_PROGRESS, destroy apply-before-destroy, async failure → FAILED).
• CP8 pre-run script contract ($MESHSTACK_USER_MESSAGE, stdin run JSON) + timeout / exit-status user messages.
• CP9 ReadConfig/NewAuthProvider/ToInternalWithoutDecryption + small enum/status error branches.
• CP10 SSH auth (key parsing, known_hosts 3-method resolution, HostKeyAlgorithms pin) — hermetic, generated keys.
• CP11 GitSource against local repos (branch/tag/commit checkout, missing-path, worktree diagnostics).
• CP12 manager token protocol (done/norun/failed/stop, shutdown re-check).
• CP13 gate-on + straggler branches.

D13 bug inventory (pinned verbatim, fixed in phase 2b)

FIXME(bug): markers for B1, B2, B3, B4, B5, B7, B12, B13. B6/B10 (data races) are structural phase-2 fixes; B8/B9/B11 are inventory-only per the plan.

Sanctioned deltas

• mockedtffacade.go (production file) gained configurable SetEnv/Workspace* test hooks, defaulting to the prior hardcoded behavior — the CP4-CP6 test-infra seam the plan authorizes. This is the only non-_test.go change besides the coverage config files.
• makeLocalGitRepo fixture builder now retries construction on a fresh dir (go-git occasionally returns a transient "reference not found" under full-suite filesystem load); behavior-preserving, eliminates a suite flake.

Cross-plan / D9 correction

• F2: D9's plan-artifact "same-origin URL" check no longer exists (reverted in 88d67d4); only the 128MiB cap is pinned. The high-level D9 pin list should drop the same-origin item.

Do not merge — draft for review.

🤖 Generated with Claude Code

[grubmeshi]

Superseded by #65, which consolidates the plan + all phases 0→7 + the phase-3/5 remediation into a single reviewable PR (with all plan/run artifacts and a code-verified FOLLOW_UP.md). Closing in favor of #65.