Files
roboco/tests/unit/foundation/test_board_programs.py
401f8a2cc9 feat(board): Board Programs — the complete twelve-program catalog (Phases 1-3) (#699)
* feat(board): Pest Control — the first project-scoped Board Program

The Product Owner hunts latent defects (what the org records but nobody
reads): a weekly cycle — accelerated off-schedule when the trailing-7-day
rework rate crosses pest_rework_threshold, with the cheap dedup/scope gates
evaluated before the metrics queries — opens one held exploration task
against the least-recently-explored opted-in project (deterministic
round-robin; opted_in_projects gains a stable ORDER BY), with server-
assembled evidence in the spawn prompt (rework hotspots, recurring-findings
and waived-minor ledger aggregates, all capped) plus prior-cycle LEARN
context. The PO calls the new PO-only propose_bug_hunt verb once: ≤5 items,
evidence required per item, targets validated against pest_control
participation. CEO decides per item — approve materializes a BACKLOG task
(source pest_control, never auto-starts), reject records the reason; both
feed the LEARN ledger by exploration task id; all-terminal completes the
cycle. Telegram queue pushes carry working Approve/Reject handlers
mirroring the roadmap kind. Doctrine: board.md Pest Control section +
product-owner verb entry + regenerated verb tables.

* feat(panel): Pest Control review queue

Command Center gains the pest review queue (per-item approve/reject with
reason, mirroring the roadmap queue); the Programs card and the project
settings participates-in checkboxes pick the new program up registry-driven
— the settings section renders for the first time now that a project-scoped
program exists.

* feat(board): Periscope — HoM market-research brief program

Weekly org-scoped cycle: a solo HoM spawn researches the market (web
research with mandatory source URLs — uncited findings are rejected) and
files one structured brief via the new HoM-only propose_market_brief verb:
headline, cited findings, threats/opportunities, positioning note, all
soup-checked and screened through the injection guard at persist time
(web-derived text later reaches prompts; flags recorded, content never
dropped). A brief is a report, not a proposal: the verb completes the
exploration in the same call (the x_feature asymmetry), the cycle ledger
auto-closes, and the CEO gets a best-effort notification with no
approve/reject surface (periscope deliberately never joins Telegram's
action kinds). The latest brief is injected into the roadmap exploration
prompt — Periscope feeds Printer, the first cross-role program input.

* feat(panel): Market Briefs tab (read-only)

Business page gains a Market Briefs tab listing Periscope briefs —
headline, cited findings, threats/opportunities — read-only by design; a
report has nothing to approve.

* feat(board): Coroner — event-triggered Auditor postmortems

The first EVENT program: no cron — three best-effort hooks open an autopsy
when a task bounces to its 3rd revision (the audit chokepoint), is
cancelled after work started, or is budget-blocked; all gated on arming +
one-open-autopsy dedup, none can fail the underlying transition. A solo
Auditor spawn reads the incident (server-assembled findings + transition
context) and files one propose_postmortem: incident summary, root cause,
failed stage (validated against the real status vocabulary), and ONE
process change — a playbook-kind change drafts via PlaybookService
directly into the normal pending-curation queue; the briefed draft_playbook
manifest grant was deliberately NOT added, preserving the existing
'auditor curates but never drafts' invariant test. Complete-at-propose
(report asymmetry), cycle ledger auto-closes, CEO notified link-only.
Integrated as a union with Periscope across the shared program surfaces.

* feat(panel): Coroner postmortems card

Read-only postmortems list under Business → Programs — incident, root
cause, failed stage, process change; nothing to approve, the process-change
artifact (a draft playbook) rides the existing curation queue.

* feat(board): Sentinel — Auditor drift-watch quality reports

Weekly org-scoped cycle: a solo Auditor spawn receives a server-assembled
drift context (waived-findings trend, open findings by severity,
conventions-violation hotspots, top spend — all capped, pure ORM) and files
one propose_quality_report: headline, 1-7 area-validated items with
evidence and suggested actions, overall assessment. Report semantics —
complete-at-propose, cycle auto-closes, CEO notified display-only (never on
Telegram's approve/reject surface); items are structured so a later
convert-to-task control is cheap. Integration adopts Sentinel's module-
level dict-dispatch for board-program routing (xenon-driven), folding all
prior programs in; app router mounting extracted to a helper for the same
budget.

* feat(panel): Quality Reports tab (read-only)

Business page gains the Sentinel quality-reports tab — headline, per-area
observations with evidence and suggested actions; read-only, a report has
nothing to approve.

* feat(board): Spackle — gap-fill audit program

Biweekly project-scoped PO cycle over the half-shipped surface area: API
routes without panel surfaces (and vice versa), armed flags without docs,
docs promises the code doesn't keep, dead-end tabs — the inventory diffing
is the PO's own read-tool work, ordered by the spawn prompt with file:line
citations required; the server injects only prior-cycle LEARN and the
rotation target. Rotation is now a shared module-level helper
(pick_rotation_target, parameterized by source) both project-scoped
engines use — pest_control delegates to it, behavior-identical, with a
cross-pollution test proving the two programs' rotations stay independent.
propose_gap_fill mirrors the bug-hunt verb (≤5 items, two-sided evidence
required, participation gate); per-item CEO decide materializes BACKLOG
source=spackle tasks; full Telegram kind incl. approve/reject handlers.
All seven program routers now mount from one helper.

* feat(panel): Spackle gap-fill review queue

Command Center gains the gap-fill queue mirroring the pest-control one —
per-item approve/reject with the two-sided gap evidence rendered.

* feat(board): Scales — monthly portfolio rebalance

Org-scoped PO cycle over the stale backlog: the spawn receives a capped
stale-task snapshot (BACKLOG/PENDING unclaimed >30 days) plus the charter
and prior-cycle LEARN, and files one propose_rebalance — 1-7 items, each a
resolvable task_ref with action reprioritize (validated new priority) or
cancel, rationale required. Per-item CEO decide: approve EXECUTES the
action (audited priority update, or the normal cancel path) — the first
program whose materializer mutates existing tasks instead of creating
them; reject records the reason; LEARN by exploration task id;
all-terminal completes the cycle. Full Telegram decide-kind wiring.
Integrated as the eight-program union (registry, dict dispatch, routers
helper, teardown enumerations).

* feat(panel): Scales rebalance review queue

Command Center gains the rebalance queue — per-item approve/reject with
the action, target task, and rationale rendered.

* feat(board): Mirror — quarterly positioning audit

Project-scoped HoM cycle over messaging surfaces: README claims vs shipped
reality, docs-site promises vs code, charter alignment — the audit is the
HoM's own read-tool work with citations required; the server injects the
charter, prior-cycle LEARN, and the shared rotation target. propose_
messaging_fixes mirrors the gap-fill verb (≤5 items, drift evidence naming
claim + contradicting reality, participation gate); per-item CEO decide
materializes BACKLOG source=mirror documentation tasks; full Telegram
decide-kind wiring. Nine-program union across the shared surfaces.

* feat(panel): Mirror messaging-fixes review queue

* feat(board): Megaphone — HoM standing editorial calendar

Cron cycle (3 days, org-scoped, gated on X credentials — drafting content
nobody can post is pointless): the HoM receives a shipped-this-week digest
plus Unreleased changelog bullets and files one propose_editorial_post
(angle-validated, ≤280, brand voice) that materializes a held x_editorial
draft through the SAME X-queue origination chokepoint release posts use —
zero new approval surface, notifications and CEO decide for free.
Complete-at-propose; cycle auto-closes. Ten-program union.

* feat(panel): x_editorial source labels in the X queue surfaces

* feat(board): Librarian — proactive playbook mining

Biweekly org-scoped Auditor cycle: mines recurring non-private learning
journals (≥2-count grouping with a recency fallback) against the existing
playbook-title inventory and files one propose_playbook_drafts — 1-3
drafts, each with the repeated-pattern evidence that justifies it,
duplicate titles rejected in-batch and against the live store. Drafts are
created via PlaybookService directly (the Coroner precedent — the
'auditor curates but never drafts' do-verb invariant stays intact and
tested) and land in the normal pending-curation queue the Auditor's own
triage already surfaces; no new panel surface. Complete-at-propose;
display-only CEO notification. Eleven-program union.

* feat(board): War Room — release campaign planning

EVENT program with a REAL originator (unlike coroner's stub): a release
publish hooks a campaign brief beside the release-post seam, and the CEO's
run-now originates on demand — the cron loop never fires it. The HoM
designs a 2-6 post arc (teaser → launch → follow-up → spotlight; 280-cap,
future strictly-ascending publish_after, stage vocabulary) and one
propose_campaign call materializes each post as a held x_campaign draft
through the X-queue chokepoint. V1 is manual-cadence by design: publish_
after renders as queue guidance and the CEO approves each post at its
moment — nothing auto-posts, ever; the auto-schedule upgrade is a
documented ceiling. Twelve-program union: full registry complete.

* feat(panel): x_campaign labels + publish-after guidance in the X queue

* feat(board): Barfly — adjacent-conversation replies

Cron cycle (2 days, org-scoped, X-credentials gated): the engine searches
X for conversations where RoboCo is relevant but unmentioned (new OAuth-
signed search_recent on the client; queries + candidate cap configurable),
screens every fetched tweet through the injection guard (stored unclamped
— a clamp was truncating the candidate under the envelope, caught by the
dev's own tests), dedupes via the existing x_seen_mentions ledger (no
migration; also prevents double-drafting against the mentions poll), and
opens one held HoM exploration carrying the screened candidates. propose_
conversation_replies enforces candidate-id-only replies (≤5, 280-cap);
each materializes a held x_barfly draft through the X-queue chokepoint,
threaded via a new in_reply_to seam on post_tweet that only x_barfly
drafts use. The X redraft machinery is now dict-dispatch over per-source
extractors with reply-ref carry for x_barfly. Thirteen-program registry.
War Room's test fakes gained the new abstract search_recent stub.

* feat(board): Dogfood — the PO walks the product

The fourteenth and final registry entry, completing the catalog. EVENT
program (release-publish hook beside the war-room hook + CEO run-now, both
through the same real originator; the cron loop never fires it), project-
scoped with shared rotation. The permission surface is the careful part:
the PO's dogfood spawn — and ONLY that spawn — gets the Playwright MCP
mounted, via a task-scoped fail-closed probe mirroring the video-authoring
precedent (a PO spawned for roadmap/pest/scales never sees browser tools;
tested both ways); the PM agent image bakes chromium unconditionally like
the ux image, the mount stays task-gated in code. The walk targets the
rotation target's live surfaces (panel_base_url only when the target is
the org's own project, honest degradation otherwise); propose_friction_
fixes files ≤5 walked-path-evidenced items; per-item CEO decide
materializes BACKLOG source=dogfood tasks; full Telegram decide kind.
Also: megaphone/librarian/war_room arming keys restored to the settings
validator — their panel toggles would have been rejected (dropped in
earlier unions; the same silent-arming class the drill killed once
already).

* feat(panel): Dogfood friction review queue

* chore(board): final whole-branch sweep fixes

The night's closing adversarial pass over the integrated fourteen-program
registry found ONE functional defect — the war-room test fakes' post_tweet
predated Barfly's in_reply_to_tweet_id kwarg (LSP violation, the only red
in an otherwise fully green gate) — plus doc/test drift, all fixed: the
source-parity test completes to fourteen (spackle/mirror were silently
absent while its neighboring comment claimed full coverage), the PO
identity doc gains its missing Dogfood verb, the auditor quick-list gains
propose_postmortem, three stale comments corrected (rotation docstring,
panel registry header, X source enumerations), the dogfood release-hook
gains the exception-swallow test its four sibling hooks already had, and
the CHANGELOG's Unreleased section documents the whole Board Programs
train. Full make quality: exit 0, all gates green.

* docs: full documentation sweep for the Board Programs train

CLAUDE.md's roadmap-engine entry superseded by the Board Program registry
entry (all fourteen programs, arming, scoping, LEARN, guardrails) with the
role verb tables and playwright row refreshed; docs/rag gains the agent-
facing architecture doc plus full propose_* call-shape sections in the
three board role docs, and corrects the strategy-engine section to shipped
reality (only idle→roadmap is wired); docs/map covers the registry + all
twelve engines with flags, gotchas, and drift notes. The 0.27.0 reference
inventory confirmed only the release-executor's canonical set carries the
version — left for the 0.28.0 cut.

* feat(board): human titles + descriptions on every program surface

Raw registry keys rendered as bare panel labels — an operator reading
x_feature had no idea what enabling or running it does. The registry
dataclass gains title/description (test-enforced non-empty for every
entry, unique titles), the API passes them through, and every surface
renders title-with-description-tooltip instead of the key: the Programs
card (label, toggle hint, run-now toast), and the project settings
participates-in/excluded-from checkboxes.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
2026-07-25 17:13:32 +02:00

365 lines
12 KiB
Python

"""tests/unit/foundation/test_board_programs.py"""
from datetime import UTC, datetime, timedelta
import pytest
from roboco.config import Settings
from roboco.foundation.policy.board_programs import (
PROGRAMS,
WEEK_SECONDS,
BoardProgram,
TriggerKind,
program_due,
project_participates,
validate_board_programs_field,
)
def test_x_feature_default_interval_matches_settings_field_default() -> None:
"""Guards the registry cadence and the live due-check's cadence
(``Settings.x_feature_spotlight_interval_seconds``) from drifting apart
again — reads the pydantic field default, never a live env-configured
instance, so this can't pass by accident in a differently-configured
environment."""
field_default = Settings.model_fields["x_feature_spotlight_interval_seconds"]
assert PROGRAMS["x_feature"].default_interval_seconds == field_default.default
def test_registry_carries_the_two_migrated_programs() -> None:
assert {"roadmap", "x_feature"} <= set(PROGRAMS)
rm = PROGRAMS["roadmap"]
assert rm.role == "product_owner"
assert rm.source == "board_roadmap"
assert rm.trigger is TriggerKind.CRON
xf = PROGRAMS["x_feature"]
assert xf.role == "head_marketing"
assert xf.source == "x_feature_exploration"
_PEST_CONTROL_MAX_ITEMS_PER_CYCLE = 5
def test_registry_carries_pest_control() -> None:
pc = PROGRAMS["pest_control"]
assert pc.role == "product_owner"
assert pc.source == "board_pest_control"
assert pc.trigger is TriggerKind.CRON
assert pc.scope == "project"
assert pc.max_items_per_cycle == _PEST_CONTROL_MAX_ITEMS_PER_CYCLE
def test_registry_carries_periscope() -> None:
p = PROGRAMS["periscope"]
assert p.role == "head_marketing"
assert p.source == "board_periscope"
assert p.trigger is TriggerKind.CRON
assert p.scope == "org"
assert p.default_interval_seconds == WEEK_SECONDS
_SCALES_MAX_ITEMS_PER_CYCLE = 7
def test_registry_carries_scales() -> None:
s = PROGRAMS["scales"]
assert s.role == "product_owner"
assert s.source == "board_scales"
assert s.trigger is TriggerKind.CRON
assert s.scope == "org"
assert s.max_items_per_cycle == _SCALES_MAX_ITEMS_PER_CYCLE
assert s.default_interval_seconds == 30 * 24 * 3600
def test_registry_carries_coroner() -> None:
c = PROGRAMS["coroner"]
assert c.role == "auditor"
assert c.source == "board_coroner"
assert c.trigger is TriggerKind.EVENT
assert c.scope == "org"
def test_coroner_is_never_cron_due() -> None:
"""An EVENT program is never cron-due regardless of how long it's been
since the last cycle opened — mirrors test_program_due_event_never_cron_
fires but against the real registered entry."""
assert not program_due(
PROGRAMS["coroner"],
now=datetime(2026, 7, 24, tzinfo=UTC),
last_opened_at=None,
interval_override=None,
)
def test_registry_carries_sentinel() -> None:
s = PROGRAMS["sentinel"]
assert s.role == "auditor"
assert s.source == "board_sentinel"
assert s.trigger is TriggerKind.CRON
assert s.scope == "org"
assert s.default_interval_seconds == WEEK_SECONDS
_SPACKLE_MAX_ITEMS_PER_CYCLE = 5
def test_registry_carries_spackle() -> None:
sp = PROGRAMS["spackle"]
assert sp.role == "product_owner"
assert sp.source == "board_spackle"
assert sp.trigger is TriggerKind.CRON
assert sp.scope == "project"
assert sp.max_items_per_cycle == _SPACKLE_MAX_ITEMS_PER_CYCLE
assert sp.default_interval_seconds == 2 * WEEK_SECONDS
_MIRROR_MAX_ITEMS_PER_CYCLE = 5
_QUARTER_SECONDS = 90 * 24 * 3600
def test_registry_carries_mirror() -> None:
m = PROGRAMS["mirror"]
assert m.role == "head_marketing"
assert m.source == "board_mirror"
assert m.trigger is TriggerKind.CRON
assert m.scope == "project"
assert m.max_items_per_cycle == _MIRROR_MAX_ITEMS_PER_CYCLE
assert m.default_interval_seconds == _QUARTER_SECONDS
def test_registry_carries_megaphone() -> None:
mg = PROGRAMS["megaphone"]
assert mg.role == "head_marketing"
assert mg.source == "board_megaphone"
assert mg.trigger is TriggerKind.CRON
assert mg.scope == "org"
assert mg.default_interval_seconds == 3 * 24 * 3600
_LIBRARIAN_MAX_ITEMS_PER_CYCLE = 3
def test_registry_carries_librarian() -> None:
p = PROGRAMS["librarian"]
assert p.role == "auditor"
assert p.source == "board_librarian"
assert p.trigger is TriggerKind.CRON
assert p.scope == "org"
assert p.max_items_per_cycle == _LIBRARIAN_MAX_ITEMS_PER_CYCLE
assert p.default_interval_seconds == 2 * WEEK_SECONDS
_WAR_ROOM_MAX_POSTS_PER_CAMPAIGN = 6
def test_registry_carries_war_room() -> None:
wr = PROGRAMS["war_room"]
assert wr.role == "head_marketing"
assert wr.source == "board_war_room"
assert wr.trigger is TriggerKind.EVENT
assert wr.scope == "org"
assert wr.max_items_per_cycle == _WAR_ROOM_MAX_POSTS_PER_CAMPAIGN
def test_war_room_is_never_cron_due() -> None:
"""An EVENT program is never cron-due regardless of how long it's been
since the last cycle opened — mirrors test_coroner_is_never_cron_due.
Unlike Coroner, War Room's ``_ORIGINATORS`` entry is a REAL originator
(see test_board_program_engine.py), so this test is what actually proves
the loop still never drives it — the trigger-kind guard, not a stub."""
assert not program_due(
PROGRAMS["war_room"],
now=datetime(2026, 7, 24, tzinfo=UTC),
last_opened_at=None,
interval_override=None,
)
_DOGFOOD_MAX_ITEMS_PER_CYCLE = 5
def test_registry_carries_dogfood() -> None:
d = PROGRAMS["dogfood"]
assert d.role == "product_owner"
assert d.source == "board_dogfood"
assert d.trigger is TriggerKind.EVENT
assert d.scope == "project"
assert d.max_items_per_cycle == _DOGFOOD_MAX_ITEMS_PER_CYCLE
def test_dogfood_is_never_cron_due() -> None:
"""An EVENT program is never cron-due regardless of how long it's been
since the last cycle opened — mirrors test_coroner_is_never_cron_due,
but against Dogfood: unlike Coroner it DOES have a real originator (see
roboco.services.board_programs._originate_dogfood), so this asserts the
cron loop's own gate refuses it, not that no originator exists."""
assert not program_due(
PROGRAMS["dogfood"],
now=datetime(2026, 7, 24, tzinfo=UTC),
last_opened_at=None,
interval_override=None,
)
_BARFLY_MAX_ITEMS_PER_CYCLE = 5
def test_registry_carries_barfly() -> None:
b = PROGRAMS["barfly"]
assert b.role == "head_marketing"
assert b.source == "board_barfly"
assert b.trigger is TriggerKind.CRON
assert b.scope == "org"
assert b.max_items_per_cycle == _BARFLY_MAX_ITEMS_PER_CYCLE
assert b.default_interval_seconds == 2 * 24 * 3600
def test_registry_carries_fourteen_programs() -> None:
"""Locks the union so a future addition/removal is deliberate — matches
the count-whatever-your-base-has-plus-war_room shape the other
registry-parity tests already exercise per-key."""
assert set(PROGRAMS) == {
"roadmap",
"x_feature",
"pest_control",
"periscope",
"coroner",
"sentinel",
"spackle",
"scales",
"mirror",
"megaphone",
"librarian",
"war_room",
"barfly",
"dogfood",
}
_MIN_DESCRIPTION_CHARS = 40
def test_every_registry_entry_has_human_title_and_description() -> None:
"""The panel renders title/description, never the raw key — a registry
entry shipping without them regresses the card to unreadable keys."""
for key, program in PROGRAMS.items():
assert program.title.strip(), f"{key} has no title"
assert len(program.description.strip()) >= _MIN_DESCRIPTION_CHARS, (
f"{key} description too thin"
)
titles = [p.title for p in PROGRAMS.values()]
assert len(set(titles)) == len(titles), "duplicate program titles"
def test_program_due_cron_interval() -> None:
now = datetime(2026, 7, 24, tzinfo=UTC)
p = PROGRAMS["roadmap"]
assert program_due(p, now=now, last_opened_at=None, interval_override=None)
recent = now - timedelta(seconds=10)
assert not program_due(p, now=now, last_opened_at=recent, interval_override=None)
old = now - timedelta(seconds=p.default_interval_seconds + 1)
assert program_due(p, now=now, last_opened_at=old, interval_override=None)
def test_program_due_event_never_cron_fires() -> None:
p = BoardProgram(
key="k",
role="auditor",
trigger=TriggerKind.EVENT,
source="s",
default_interval_seconds=0,
)
assert not program_due(
p,
now=datetime(2026, 7, 24, tzinfo=UTC),
last_opened_at=None,
interval_override=None,
)
def test_program_due_interval_override_wins_over_default() -> None:
now = datetime(2026, 7, 24, tzinfo=UTC)
p = PROGRAMS["roadmap"]
recent = now - timedelta(seconds=100)
# Default interval (a week) would still block; a short override fires.
assert program_due(p, now=now, last_opened_at=recent, interval_override=50)
assert not program_due(p, now=now, last_opened_at=recent, interval_override=200)
# ---------------------------------------------------------------------------
# Task 6b: per-project program scoping
# ---------------------------------------------------------------------------
def test_registry_entries_default_to_org_scope() -> None:
assert PROGRAMS["roadmap"].scope == "org"
assert PROGRAMS["x_feature"].scope == "org"
_PROJECT_PROGRAM = BoardProgram(
key="pest_control",
role="product_owner",
trigger=TriggerKind.CRON,
source="board_pest_control",
default_interval_seconds=7 * 24 * 3600,
scope="project",
)
_ORG_PROGRAM = PROGRAMS["roadmap"] # scope="org"
def test_project_scoped_program_is_affirmative_opt_in() -> None:
assert not project_participates(_PROJECT_PROGRAM, None)
assert not project_participates(_PROJECT_PROGRAM, [])
assert not project_participates(_PROJECT_PROGRAM, ["some_other_key"])
assert project_participates(_PROJECT_PROGRAM, ["pest_control"])
def test_org_scoped_program_is_default_eligible_opt_out() -> None:
assert project_participates(_ORG_PROGRAM, None)
assert project_participates(_ORG_PROGRAM, [])
assert project_participates(_ORG_PROGRAM, ["some_other_key"])
assert not project_participates(_ORG_PROGRAM, ["!roadmap"])
def test_validate_board_programs_field_accepts_none() -> None:
assert validate_board_programs_field(None) is None
def test_validate_board_programs_field_accepts_known_org_exclusion() -> None:
assert validate_board_programs_field(["!roadmap"]) == ["!roadmap"]
def test_validate_board_programs_field_rejects_plain_key_on_org_scoped_program() -> (
None
):
"""Both registered programs are org-scoped today, so a plain "roadmap"
entry (the project-scoped opt-in form) is meaningless — org-scoped
programs run against every project by default and are only ever
excluded via '!key'. See test_validate_board_programs_field_allows_
plain_project_scoped_key below for the positive case on a synthetic
project-scoped program."""
with pytest.raises(ValueError, match="meaningless"):
validate_board_programs_field(["roadmap"])
def test_validate_board_programs_field_rejects_unknown_key() -> None:
with pytest.raises(ValueError, match="unknown board program key"):
validate_board_programs_field(["not_a_real_program"])
def test_validate_board_programs_field_rejects_unknown_excluded_key() -> None:
with pytest.raises(ValueError, match="unknown board program key"):
validate_board_programs_field(["!not_a_real_program"])
def test_validate_board_programs_field_rejects_bang_on_project_scoped_key() -> None:
registry = {"pest_control": _PROJECT_PROGRAM}
with pytest.raises(ValueError, match="meaningless"):
validate_board_programs_field(["!pest_control"], programs=registry)
def test_validate_board_programs_field_allows_plain_project_scoped_key() -> None:
registry = {"pest_control": _PROJECT_PROGRAM}
assert validate_board_programs_field(["pest_control"], programs=registry) == [
"pest_control"
]