Compose cold-start resources under Runtime Supervisor ownership

crates/lazaret-host-coordinator/src/network/tests.rs

@@ -155,6 +155,60 @@ fn independently_observed_namespace_refuses_attestation_mutation() {
     ));
 }
 
+#[test]
+fn committed_network_roles_release_together_only_after_absence() {
+    let fixture = Fixture::new();
+    let (policy, runtime) = fixture.prepare_roles();
+    let namespace = namespace_identity(std::path::Path::new("/proc/self/ns/net")).unwrap();
+    let attestation = attestation(&fixture.generation, policy.digest(), namespace, runtime);
+    let probe = NetworkReachabilityProbe {
+        domain_id: fixture.generation.domain_id,
+        generation_id: fixture.generation.generation_id,
+        enforcement_namespace: namespace,
+        denied_destinations: vec![DeniedDestinationObservation {
+            destination: IpAddress::V4([10, 1, 2, 3]),
+            unreachable: true,
+        }],
+        permitted_destinations: vec![PermittedDestinationObservation {
+            destination: IpAddress::V4([1, 1, 1, 1]),
+            reachable: true,
+        }],
+        dns_observations: vec![DnsObservation {
+            resolver: IpAddress::V4([8, 8, 8, 8]),
+            query_name: "example.com".into(),
+            resolved_addresses: vec![IpAddress::V4([93, 184, 216, 34])],
+        }],
+    };
+    let coordinator = NetworkCoordinator::new(&fixture.store);
+    coordinator
+        .commit_readiness(&policy, attestation, probe, &reachability())
+        .unwrap();
+    assert!(
+        coordinator
+            .complete_clean_after_absence(fixture.generation.generation_id)
+            .is_err()
+    );
+    coordinator
+        .begin_release(fixture.generation.generation_id)
+        .unwrap();
+    coordinator
+        .complete_clean_after_absence(fixture.generation.generation_id)
+        .unwrap();
+
+    let participants = fixture.store.snapshot().unwrap().participants;
+    for role in [ParticipantRole::Helper, ParticipantRole::Network] {
+        let participant = participants
+            .iter()
+            .find(|participant| participant.role() == role)
+            .unwrap();
+        assert_eq!(participant.state(), ParticipantState::Clean);
+        assert_eq!(
+            participant.ownership(),
+            Some(&ParticipantOwnership::empty(role))
+        );
+    }
+}
+
 fn policy() -> CanonicalDerivedNetworkPolicy {
     derive_policy(DerivedNetworkPolicyFields {
         address_families: vec![