test(recommendations): cover expiry through command output

[cristim]

Scope

Add six expiry regressions through the actual root command, AWS SDK requests against the existing local TLS fixture, and generated CSV. Assert account identities, counts, monetary fields, missing-demand warnings and the exact read-only request allowlist.

Refs LeanerCloud/cloud-commitments-go#70. This is verification layer B, stacked on consumer prerequisite A, #2133. It changes only three test files, 333 lines. No production or dependency changes are included in B, and this PR does not close issue 70.

Exact revision

• Head: f756c6bb925e70b7b2061af28546505364dfe009
• Parent: 6007c4f4fdc767a2a296c09e70999d0f97c6aaae
• Tree: 72cb289ab626f99b21f7ab753f720490246b05bf
• Stacked base: codex/go70-cli-expiry-consumer
• Inherited pkg pin: v0.0.0-20261004010532-e6c7eb87968a
• Inherited AWS pin: v0.0.0-20261004034603-d4b69ab4f8b1

Both published modules retain normal checksum verification, GOWORK=off and no replacement directives.

Author verification

Native macOS arm64, Go 1.26.6. The exact source blobs were bound before and after verification; normal hooks then committed the unchanged staged tree. These are author-run working-source results, not an independent rerun of every gate against the commit.

• Expiry helper/command matrix: 24 passing test events, including all six command scenarios below.
• Retained original command completeness suite: 51 passing test events.
• Full and integration-tag race suites: each 1,043 passes, zero failures, three existing cloud skips.
• Build, vet, lint, tidy-diff and format checks passed. Lint executable /Users/cristi/go/bin/golangci-lint, version 2.10.1.
• Actual native artifact metadata matched both published versions and sums, no replacements, native architecture and Go version. -buildvcs=false avoids unrelated ancestor stamps in linked worktrees; source/tree provenance is externally bound. Artifact SHA-256 54b6cd0a1345d8f5c829e90de510736871479692ea68e96a6a79f6da6ad561bd; help passed.
• Two exact staged reviews and two hook-runner safety passes were clean. All applicable normal commit hooks passed, including gosec and Trivy. Hook log SHA-256 ee9c48881e97088b5706e776a42ffe4314889c4b81133d208382490997fff1a6.

Synthetic command scenario	Counts per account	Total count	Upfront / monthly / savings totals
Pool demand	12, 12, 12	36	3600 / 360 / 3600
Outside window	6, 6, 6	18	1800 / 180 / 1800
Missing demand	2, 2, 2	6	600 / 60 / 600
Filtered subset	18, 18	36	3600 / 360 / 3600
Exact integer boundary	4, 4	8	800 / 80 / 800
Adjacent lower target	3, 3	6	600 / 60 / 600

The missing-demand case asserts exactly one warning naming three skipped recommendations. The other cases assert no missing-demand warning. The fixture rejects unexpected SDK operations, including purchases; these are synthetic provider responses, not live-cloud verification.

Historical aggregate evidence separately reproduced the regression on baseline 652fc94af4593273946ad8d5eafc2ad430496f1e with its original dependencies and retained parent-compatible tests. Seven isolated mutants failed intended assertions with passing controls and restored published-source tests passed. That is historical aggregate evidence, not a new independent committed-B run. B's direct parent A already contains the production fix.

Independent committed-head review

Fresh-context gpt-6-astra found no actionable findings at exact commit f756c6bb925e70b7b2061af28546505364dfe009 and tree 72cb289ab626f99b21f7ab753f720490246b05bf, after checking the complete B diff against published AWS/pkg and SDK contracts.

The reviewer independently ran all six command cases and 50 retained completeness scenarios, plus their parent test events, under native Go 1.26.6 race checks. Four CLI-only overlays caused intended behavioral assertion failures while their controls passed: doubled expiry demand, suppressed missing-demand warning, cleared exact coverage, and omitted account filtering. Restored unmodified command cases passed again. Published modules remained unchanged, with no replacements or module-cache overlays. The direct parent A already contains the fix, so this independent review makes no historical-parent-red claim.

The reviewer inspected rather than reran the author's broad suites, build/vet/lint/tidy/format, artifact and normal-hook evidence. Final HEAD/tree and clean status matched; all owned groups and canonical locks drained. Verdict SHA-256: 40e09699390cb452c2f31d1c89ca0f296855b3e9548785e83e7297c1b23a16d9. This is independent synthetic command-path evidence, not live-cloud acceptance or merge permission.

Remaining gates

• Exact-head Linux CI - Build & Test passed after one guarded manual ci.yml dispatch at f756c6bb925e70b7b2061af28546505364dfe009. All eight jobs succeeded: build/help, workflow lint, code lint, unit tests, Snyk, security scanning, integration tests and the aggregate CI check. The owned watcher terminated exit 0 and was reaped. The stacked feature base does not match the automatic main/develop PR filters; this dispatch does not satisfy the separate pre-commit CI gap below.
• The pre-commit workflow has main-only triggers and no manual dispatch. A's successful pre-commit CI and B's normal local hooks do not establish B pre-commit CI. This missing gate remains explicit; no workflow change or retargeting is proposed to hide it.
• The three skipped cloud tests remain unverified: TestRunTool, TestGetAccountAliasRealFunction, and TestGetAllAWSRegions/Integration_test.
• Real-scenario acceptance remains unresolved. Synthetic command evidence does not waive the repository's acceptance requirement; keep this stack open if that proof is unavailable.
• After accepted producer integration, resolve the actual final main commits and repin, retest and review the CLI. Current feature-commit pins are not final rollout evidence.
• CodeRabbit is explicitly waived in favor of local verification and independent review. No CodeRabbit trigger is requested, and the waiver does not waive acceptance or CI.

No real cloud credentials, purchases, deployments or Windows runs were used. Separate CLI issues #2131 and #2132 remain unchanged. Remaining delivery is tracked by the parent issue and stack; this PR does not claim linked-account inventory or RDS family expiry behavior is fixed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 726af023-a166-45d5-a4b7-b538889a99a5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Coordination: final merged dependency pins from parent24dc60ff56d8b75636b98382643c31b522bbff06 are staged as an additive merge preserving the three command-test files. Two staged review passes and native focused/full/integration/build/vet/lint/artifact checks passed. I am now preparing the normal merge commit, then independent exact-commit replay before publication. No history rewrite, force push, or acceptance waiver.

[cristim]

Published exact merge commit 1ee2d19, tree e9024d734562176647109037d3f9c7ed172a225c. Fresh independent gpt-6-astra full-diff review: no actionable findings. Independent macOS replay passed 17 helper test events, all six root-command CSV scenarios (TOTAL Count 36/18/6/36/8/6), retained completeness 51/51, build/vet/tidy/format and native artifact/module/help checks. Artifact SHA256: 8d89f8888830831369548fd48a74f881baade86f7b5d7e220d13186b5f0a12ad. The source-identical staged author full and integration race suites each passed 1043 events with exactly three existing real-cloud skips; pinned lint passed. Normal merge hooks ran but selected no conflict files, so their natural skips are not fresh scanner evidence. Historical mutation evidence was audited, not independently rerun. All verification uses synthetic SDK/TLS fixtures, not real multi-account acceptance.

Both workflows filter automatic PR runs to main/develop (pre-commit: main only). This stacked base did not trigger either. Existing CI was explicitly dispatched for this head: https://github.com/LeanerCloud/cloud-commitments-cli/actions/runs/37259535270 and is watched. Pre-commit has no workflow_dispatch, so its CI gap remains a hold; no workflow or check was suppressed. Real affected-scenario acceptance also remains required. No merge or real cloud activity performed.

[cristim]

Dispatched build/test CI run37259535270 completed successfully at exact1ee2d192d5ffaef87265d91bff610929b82d0a2c; watcher exited0 and was reaped. This clears that CI workflow only. The feature-base pre-commit CI gap and real affected-scenario acceptance remain open, so this is not a merge-ready claim.