harness

const (
	CapDocker      Capability = "docker"      // docker runtime available
	CapFirecracker Capability = "firecracker" // a firecracker-capable worker
	CapGvisor      Capability = "gvisor"      // a gvisor-capable worker
	CapWasm        Capability = "wasm"        // wasm runtime + staged module
	// CapIsolate gates the V8-isolate (workerd) use cases (UC-103..105). Like
	// CapGvisor it is advertisement-only: the runtime is enabled purely by
	// provisioning (default_with_isolate=true → install.sh --with-isolate writes
	// SB_ENABLE_ISOLATE=true + installs workerd), not by any run.sh config-overlay
	// flip. A scenario advertises it when its node was provisioned --with-isolate;
	// where the runtime is off, the isolate UCs skip (not-applicable) rather than
	// hard-fail. Unlike CapWasm it needs no node-side module staging — the UCs
	// upload JS bundles over POST /v1/js-bundles at runtime.
	CapIsolate Capability = "isolate" // V8-isolate (workerd) runtime available
	CapGPU     Capability = "gpu"     // a GPU worker
	CapDomain  Capability = "domain"  // public domain + TLS (not local-mode)
	CapCluster Capability = "cluster" // multi-node cluster (raft/forwarding)
	// CapMixedArchNegative gates UC-79: inject a foreign-arch snapshot ref and
	// assert the arm64 cluster refuses to resume it.
	CapMixedArchNegative Capability = "mixed-arch-negative"
	// CapCustomDomains gates the custom-domain attach path (UC-35/36). It's
	// distinct from CapDomain: a deployment can have a public domain + TLS yet
	// run with SB_ENABLE_CUSTOM_DOMAINS=false, in which case the API rejects
	// AddCustomDomain. Only scenarios that opt the feature on (and provision the
	// env) advertise this, so the custom-domain UCs skip instead of hard-failing
	// where the feature is off.
	CapCustomDomains Capability = "custom-domains"
	// CapExternalDNSZone gates the custom-domain verification path (UC-35/36).
	// A real custom domain must, by design, live OUTSIDE the deployment base
	// domain (the API rejects hosts under the wildcard zone) AND prove ownership
	// via a `_aerol-verify.<host>` TXT record before attach succeeds. Satisfying
	// that requires the harness to control a second DNS zone it can provision
	// verification (and CNAME) records in — the leased base zone is not enough.
	// Scenarios advertise this only when they wire up such a zone; otherwise the
	// custom-domain reachability UCs skip instead of failing against a gate they
	// structurally cannot pass.
	CapExternalDNSZone Capability = "external-dns-zone"
	// CapPlatformVolumes gates the platform-volume UCs (UC-81..UC-84). A
	// deployment advertises it only when the operator has enabled platform
	// volumes AND configured a shared backend (SB_PLATFORM_VOLUMES_ENABLED=true
	// + an S3 bucket or NFS export). The tests are backend-agnostic — they
	// attach by name, write, and read back — so the same UCs run whether the
	// scenario configured S3 or NFS. Where the feature is off, the UCs skip
	// (not-applicable) rather than fail against a 412.
	CapPlatformVolumes Capability = "platform-volumes"
	// CapBenchmark gates the create-benchmark UCs (UC-94/UC-95). It is
	// deliberately separate from the runtime capabilities: the benchmark is
	// slow and provisions many sandboxes (the density probe runs until the
	// fleet rejects on capacity), so it must be opt-in even on a scenario that
	// otherwise has every runtime. Only scenarios that explicitly advertise it
	// — currently cluster-hetero — run the benchmark; everywhere else the UCs
	// skip (not-applicable) instead of inflating cost on a normal pass.
	CapBenchmark Capability = "benchmark"
	// CapDockerPool is consumed by run.sh's config overlay, not by any UC's
	// Requires: it flips docker.pool.enabled in the scenario's cluster.yml so
	// UC-94 measures the warm-hit create path. It is deliberately separate
	// from CapDocker because each parked slot holds a default-shaped capacity
	// reservation, lowering the UC-95 density ceiling — scenarios opt in
	// (plans/docker-warm-pool.md §9 documents the adjusted gates).
	CapDockerPool Capability = "docker-pool"
	// CapDockerNetnsPool is likewise consumed by run.sh's config overlay: it
	// flips docker.netns_pool.enabled so cold docker creates adopt prepaid
	// pause-container network namespaces. Separate from CapDockerPool because
	// the two pools are independent (netns slots hold no capacity
	// reservations, so this one leaves the UC-95 density gate untouched).
	CapDockerNetnsPool Capability = "docker-netns-pool"
	// CapDockerEngine is consumed by run.sh's engine selection, not by any UC's
	// Requires. It is an OPT-OUT: containerd is the DEFAULT engine for every
	// scenario (run.sh writes SB_CONTAINER_ENGINE=containerd), and only a
	// scenario advertising this cap runs dockerd instead. Exactly two do — the
	// local dev install (local-mode) and the docker A/B benchmark baseline
	// (cluster-3-mixed-docker, kept on docker so it stays a valid comparison
	// against cluster-3-mixed-containerd). This encodes the target end-state of
	// the docker->containerd migration: "local install uses docker, every real
	// deployment uses containerd."
	CapDockerEngine Capability = "docker-engine"
	// CapContainerdEngine does NOT select the engine — that is now the default
	// (see CapDockerEngine). It gates the containerd-SPECIFIC coverage: the
	// Phase 5 soak/coexistence UCs (UC-99..102, plans/containerd-engine.md
	// §6/§8) and the distinctly-labeled `containerd` benchmark row + density.
	// Advertised only on the dedicated containerd validation scenarios
	// (single-node-containerd, cluster-3-mixed-containerd) so UC-102's
	// dockerd-coexistence restart stays off the runtime/metal scenarios where a
	// pure-containerd host makes it not-applicable.
	CapContainerdEngine Capability = "containerd-engine"
	// CapObservability gates UC-106/107 ("Grafana up", "Prometheus sees all
	// sandboxd nodes") and tells run.sh to pass -var deploy_obs=true so
	// Terraform/obs.tf provisions the dedicated obs EC2. Advertisement +
	// provisioning only — same shape as CapGvisor/CapIsolate.
	CapObservability Capability = "observability"
	// CapSimulations gates the suite/sims workload catalogue and UC-108
	// (per-sim pass/fail). Opt-in like CapBenchmark: slow, provisions long-
	// lived services, and needs AEROL_SIMS=1. UC-108 must never roll up to a
	// single "all green" — each sim records independently.
	CapSimulations Capability = "simulations"
)

const (
	RTContainerd  Runtime = "containerd"
	RTGvisor      Runtime = "gvisor"
	RTWasm        Runtime = "wasm"
	RTIsolate     Runtime = "isolate"
	RTFirecracker Runtime = "firecracker"
	RTAll         Runtime = "all"
)

const (
	ScnMixed  ScenarioTag = "M"
	ScnHetero ScenarioTag = "H"
	ScnBoth   ScenarioTag = "M+H"
)