test(gateway): bind qualification to immutable Protocol

gateway/qualification_contract_test.go

@@ -39,6 +39,21 @@ func TestQualificationCatalogMatchesSection7(t *testing.T) {
 	}
 }
 
+func TestQualificationProtocolVersionIsExplicitAndImmutable(t *testing.T) {
+	const version = "v1.0.0-phase3c-gateway-rc.6"
+	t.Setenv("VERSEVDI_QUALIFICATION_PROTOCOL_VERSION", version)
+	got, err := qualificationProtocolVersion()
+	if err != nil || got != version {
+		t.Fatalf("qualificationProtocolVersion() = %q, want %q", got, version)
+	}
+	for _, invalid := range []string{"", "unknown", "v1", " v1.0.0", "v1.0.0+mutable"} {
+		t.Setenv("VERSEVDI_QUALIFICATION_PROTOCOL_VERSION", invalid)
+		if _, err := qualificationProtocolVersion(); err == nil {
+			t.Fatalf("qualificationProtocolVersion() accepted %q", invalid)
+		}
+	}
+}
+
 func TestQualificationOutputAndStatisticsFailClosed(t *testing.T) {
 	if err := validateQualificationOutputDir("relative/evidence"); err == nil {
 		t.Fatal("relative evidence directory was accepted")

gateway/qualification_harness_test.go

@@ -14,8 +14,8 @@ import (
 	"math"
 	"os"
 	"path/filepath"
+	"regexp"
 	"runtime"
-	"runtime/debug"
 	"sort"
 	"strings"
 	"testing"
@@ -585,17 +585,13 @@ func qualificationMaximumFiveSecondBytes(deliveries []syntheticPacerDelivery) in
 	return maximum
 }
 
-func qualificationProtocolVersion() string {
-	info, ok := debug.ReadBuildInfo()
-	if !ok {
-		return "unknown"
+func qualificationProtocolVersion() (string, error) {
+	version := os.Getenv("VERSEVDI_QUALIFICATION_PROTOCOL_VERSION")
+	valid, err := regexp.MatchString(`^v[0-9]+\.[0-9]+\.[0-9]+-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*$`, version)
+	if err != nil || !valid {
+		return "", errors.New("VERSEVDI_QUALIFICATION_PROTOCOL_VERSION must be an immutable prerelease tag")
 	}
-	for _, dependency := range info.Deps {
-		if dependency.Path == "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol" {
-			return dependency.Version
-		}
-	}
-	return "unknown"
+	return version, nil
 }
 
 func qualificationCandidateCommit() (string, error) {
@@ -633,6 +629,10 @@ func TestSection7Qualification(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	protocolVersion, err := qualificationProtocolVersion()
+	if err != nil {
+		t.Fatal(err)
+	}
 	if err := os.Mkdir(output, 0o750); err != nil {
 		t.Fatalf("create new qualification evidence directory: %v", err)
 	}
@@ -641,8 +641,11 @@ func TestSection7Qualification(t *testing.T) {
 	qualificationTraverseProfiles(t, media)
 	manifest := qualificationManifest{
 		Status: "running", ToolVersion: qualificationToolVersion,
-		Command:         fmt.Sprintf("VERSEVDI_QUALIFICATION_DIR=%s VERSEVDI_QUALIFICATION_COMMIT=%s GOWORK=off go test ./gateway -run '^TestSection7Qualification$' -count=1 -timeout 45m -v", output, commit),
-		CandidateCommit: commit, ProtocolVersion: qualificationProtocolVersion(),
+		Command: fmt.Sprintf(
+			"VERSEVDI_QUALIFICATION_DIR=%s VERSEVDI_QUALIFICATION_COMMIT=%s VERSEVDI_QUALIFICATION_PROTOCOL_VERSION=%s GOWORK=off go test ./gateway -run '^TestSection7Qualification$' -count=1 -timeout 45m -v",
+			output, commit, protocolVersion,
+		),
+		CandidateCommit: commit, ProtocolVersion: protocolVersion,
 		StartedAt: started.Format(time.RFC3339Nano), GoVersion: runtime.Version(),
 		OS: runtime.GOOS, Architecture: runtime.GOARCH,
 		Topology:        "bounded fixture provider -> gateway framing and mTLS/QUIC transport -> fixture client",