NK-WP-0058-T03 step 2: executor --preflight-only

Reachability per endpoint, setup without the window-scoped write role (no Kubernetes or directory
client), then every preflight check (admission, executor, source, trust, registry, window,
approval) with its phase; no consume, emit or write. Exit 0 ready, 4 not. preflight() is now the
same named checks, stopping at the first. Setup reasons keep the clients' fixed texts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

bounded-executor/tests/test_openbao_lanes.py

@@ -113,6 +113,56 @@ class CliLanes(Base):
         self.assertEqual(self.bao.logins, [])
 
 
+class PreflightOnly(CliLanes):
+    """NK-WP-0058-T03: setup and every preflight check, no write role, no consume, every failure named."""
+
+    def run_preflight(self, cfg):
+        (self.root / "cfg.json").write_text(json.dumps(cfg))
+        admission = CLI.X.REPO / "examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml"
+        with contextlib.redirect_stdout(io.StringIO()) as out:
+            code = CLI.main(["--preflight-only", "--admission", str(admission), "--approval-id", "apr-1",
+                             "--config", str(self.root / "cfg.json")])
+        return code, json.loads(out.getvalue())
+
+    def pilot_cfg(self):
+        cfg = self.cfg()
+        cfg.update(executor_identity="service:nk-bind-executor", runtime_principal="p", tenant="platform",
+                   environment="PRODUCTION", approver_subjects={"admin": "sub-admin"}, trust_satisfied=[],
+                   bind={"kv": "platform/workloads/net-kingdom/directory-binds/svc-authelia", "user": "svc-authelia"},
+                   kubernetes={"namespace": "sso", "external_secret": "e", "deployment": "d"})
+        return cfg
+
+    def test_reports_every_check_without_the_write_role_or_any_consume(self):
+        code, report = self.run_preflight(self.pilot_cfg())
+        self.assertEqual(code, 4)
+        self.assertEqual((report["mode"], report["ready"], report["effects"]), ("preflight-only", False, False))
+        self.assertEqual([role for role, _ in self.bao.logins], ["journey-read"])  # never the write role
+        self.assertEqual(self.bao.revoked, ["tok-journey-read-1"])
+        by = {(c["phase"], c["check"]): c for c in report["checks"]}
+        self.assertEqual(by[("setup", "write_lane")]["result"], "skipped")
+        self.assertEqual([c for p, c in by if p == "preflight"],
+                         ["admission", "executor", "source", "trust", "registry", "window", "approval"])
+        self.assertEqual(by[("preflight", "trust")]["reason"], "trust_not_satisfied:runtime_secret_trust")
+        self.assertEqual(by[("preflight", "approval")]["reason"], "approval_binding")  # the fake approval
+        self.assertIn("preflight:approval", report["failures"])
+        self.assertNotIn("/consume", " ".join(p for p, _ in self.bao.reads))
+
+    def test_an_unreachable_endpoint_is_named(self):
+        cfg = self.pilot_cfg()
+        cfg["lldap"]["url"] = "http://127.0.0.1:9"
+        wait = CLI.OPS.wait_reachable
+        self.addCleanup(setattr, CLI.OPS, "wait_reachable", wait)
+        CLI.OPS.wait_reachable = lambda addr, **kw: wait(addr, **{**kw, "timeout": 0.2, "interval": 0.1})
+        code, report = self.run_preflight(cfg)
+        self.assertEqual(code, 4)
+        by = {(c["phase"], c["check"]): c for c in report["checks"]}
+        self.assertEqual(by[("reachability", "lldap")], {"phase": "reachability", "check": "lldap",
+                                                         "result": "fail", "reason": "unreachable"})
+        self.assertEqual(by[("reachability", "openbao")]["result"], "pass")
+        self.assertEqual(by[("setup", "build")]["reason"], "lldap not reachable")
+        self.assertEqual(self.bao.logins, [])
+
+
 class JourneyOnly(Base):
     SEED = "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"