Serialize the singleton kind fixture across worktrees

docs/spec/testing.md

@@ -6,7 +6,7 @@ Backend integration and fault tests execute as Kubernetes `Job` resources inside
 
 `make check-dependencies` remains the dependency compatibility gate: it creates the full fixture, runs the released-image probes, and tears the fixture down. `make check-kind-sample` builds and loads a Remora-owned cargo-nextest runner, then exercises the full provider matrix around [`fixture-consumer-sample`](../../tests/kind/sample-job.yaml.in). Its init containers access the lane database, coordination namespace, OIDC discovery and signing keys, target bucket, and Vault path before cargo-nextest runs. That Job is the reference structure for a work-package test Job.
 
-For interactive work, `tests/kind/setup.sh` creates a ready fixture and leaves it running. `tests/kind/destroy.sh` removes it. Setup replaces any fixture left by an earlier run, teardown is idempotent, and the harness serializes lifecycle mutations around the single `remora-testbed` cluster. `REMORA_TESTBED_RETAIN=1` retains a failed all-in-one run for inspection.
+For interactive work, `tests/kind/setup.sh` creates a ready fixture and leaves it running. `tests/kind/destroy.sh` removes it. Setup replaces any fixture left by an earlier run, teardown is idempotent, and a host-runtime lock shared across worktrees serializes lifecycle mutations around the single `remora-testbed` cluster and `remora-wp02` containerd namespace. `REMORA_TESTBED_RETAIN=1` retains a failed all-in-one run for inspection.
 
 The fixture owns an isolated kubeconfig at `tests/kind/.runtime/kubeconfig` and the `kind-remora-testbed` context. Every Kubernetes operation uses both explicitly. Package runners use the `kube` helper from `tests/kind/lib.sh`; they do not read or change the user's kubeconfig or current context.
 

tests/kind/lib-test.sh

@@ -94,4 +94,14 @@ if [[ "${cleanup_calls[*]}" != "durable coordination oidc target secret" ]]; the
   exit 1
 fi
 
+FIXTURE_LOCK_DIR="$RUNTIME/lock-test"
+FIXTURE_LOCK_PATH="$FIXTURE_LOCK_DIR/remora-testbed-kind.lock"
+acquire_fixture_lock
+if XDG_RUNTIME_DIR="$FIXTURE_LOCK_DIR" bash -c \
+  'source "$1"; acquire_fixture_lock' _ "$ROOT/tests/kind/lib.sh" 9>&-; then
+  printf 'singleton fixture lock admitted a second worktree process\n' >&2
+  exit 1
+fi
+exec 9>&-
+
 printf 'fixture family matrix tests passed\n'

tests/kind/lib.sh

@@ -6,6 +6,8 @@ TESTBED="$ROOT/tests/kind"
 RUNTIME="$TESTBED/.runtime"
 BIN="$RUNTIME/bin"
 KUBECONFIG_PATH="$RUNTIME/kubeconfig"
+FIXTURE_LOCK_DIR="${XDG_RUNTIME_DIR:-/tmp/remora-$(id -u)}"
+FIXTURE_LOCK_PATH="$FIXTURE_LOCK_DIR/remora-testbed-kind.lock"
 CONTEXT=kind-remora-testbed
 CLUSTER=remora-testbed
 NERDCTL_NAMESPACE=remora-wp02
@@ -69,8 +71,8 @@ prepare_provider() {
 }
 
 acquire_fixture_lock() {
-  mkdir -p "$RUNTIME"
-  exec 9>"$RUNTIME/fixture.lock"
+  mkdir -p "$RUNTIME" "$FIXTURE_LOCK_DIR"
+  exec 9>"$FIXTURE_LOCK_PATH"
   if ! flock --nonblock 9; then
     printf 'kind test fixture is already in use\n' >&2
     return 1

tests/kind/outbound-job.yaml.in

@@ -16,6 +16,9 @@ spec:
         - name: tests
           image: @@TEST_IMAGE@@
           imagePullPolicy: Never
+          env:
+            - name: REMORA_OUTBOUND_REQUIRE_IPV6
+              value: "1"
           resources:
             requests: {cpu: 100m, memory: 128Mi}
             limits: {cpu: "1", memory: 512Mi}