test: constrain risk overlays to measured coverage

scripts/check_test_risk_map.py

@@ -117,6 +117,37 @@ def _inventory_sources(
     return sources
 
 
+def _coverage_roots(
+    inventory: object,
+    *,
+    project_root: Path,
+    errors: list[str],
+) -> tuple[str, ...]:
+    if not isinstance(inventory, dict):
+        return ()
+    values = inventory.get("coverage_roots")
+    if not isinstance(values, list) or not values:
+        errors.append("test risk map source_inventory requires non-empty coverage_roots")
+        return ()
+    if len(values) != len(set(map(str, values))):
+        errors.append("test risk map source_inventory has duplicate coverage_roots")
+
+    roots: list[str] = []
+    for value in values:
+        if not isinstance(value, str) or not value or Path(value).is_absolute():
+            errors.append(f"source_inventory has invalid coverage root: {value!r}")
+            continue
+        if not (project_root / value).exists():
+            errors.append(f"source_inventory coverage root does not exist: {value}")
+            continue
+        roots.append(value.rstrip("/"))
+    return tuple(roots)
+
+
+def _is_in_coverage_scope(path: str, roots: tuple[str, ...]) -> bool:
+    return any(path == root or path.startswith(f"{root}/") for root in roots)
+
+
 def _validate_contract_surfaces(
     surfaces: object,
     *,
@@ -208,8 +239,14 @@ def validate(risk_path: Path, quality_path: Path, conditional_path: Path) -> lis
     if not isinstance(risk.get("owner"), str) or not risk["owner"].strip():
         errors.append("test risk map requires a non-empty owner")
 
+    source_inventory = risk.get("source_inventory")
     inventory_sources = _inventory_sources(
-        risk.get("source_inventory"),
+        source_inventory,
+        project_root=project_root,
+        errors=errors,
+    )
+    coverage_roots = _coverage_roots(
+        source_inventory,
         project_root=project_root,
         errors=errors,
     )
@@ -247,6 +284,8 @@ def validate(risk_path: Path, quality_path: Path, conditional_path: Path) -> lis
             errors.append(f"risk module maps missing source path: {path}")
         if path not in source_contracts:
             errors.append(f"risk module is missing a contract owner: {path}")
+        if not _is_in_coverage_scope(path, coverage_roots):
+            errors.append(f"risk module is outside measured coverage roots: {path}")
         risk_class = module.get("risk_class")
         if not isinstance(risk_class, str) or risk_class not in RISK_CLASSES:
             errors.append(f"risk module {path} has invalid risk_class")