From c682b75f340d40b41b68136bf749dda8350612c5 Mon Sep 17 00:00:00 2001
From: David Zhang <david@scalingforever.com>
Date: Wed, 22 Jul 2026 01:38:46 -0400
Subject: [PATCH] fix(release): align trusted qualification CLI contract

Remove the stale unsupported --no-promote workflow argument and add a
release-flow contract that checks the exact invocation against the qualifier's
accepted options.

Failure-Class: FC-workflow-script-input-contract

Test: python3 .github/scripts/test_desktop_release_flow_contract.py -v
Test: actionlint -shellcheck '' .github/workflows/desktop_qualify_beta.yml
---
 .../test_desktop_release_flow_contract.py     | 26 +++++++++++++++++++
 .github/workflows/desktop_qualify_beta.yml    |  1 -
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/scripts/test_desktop_release_flow_contract.py b/.github/scripts/test_desktop_release_flow_contract.py
index 3c9b9266752..247aa2cbe22 100644
--- a/.github/scripts/test_desktop_release_flow_contract.py
+++ b/.github/scripts/test_desktop_release_flow_contract.py
@@ -4,6 +4,7 @@
 # omi-test-quality: source-inspection -- static contract: GitHub workflow authority is YAML-only.
 from __future__ import annotations
 
+import re
 import unittest
 from pathlib import Path
 
@@ -44,6 +45,31 @@ def test_has_one_automatic_candidate_to_beta_authority(self) -> None:
         self.assertNotIn("workflow_dispatch:", beta)
         self.assertEqual(beta.count("/v2/desktop/beta/promote-qualified"), 1)
 
+    def test_beta_qualification_workflow_uses_supported_exact_cli(self) -> None:
+        qualification = workflow("desktop_qualify_beta.yml")
+        qualification_script = (ROOT / "desktop/macos/scripts/qualify-desktop-beta.sh").read_text(
+            encoding="utf-8"
+        )
+        qualify_step_name = "      - name: Qualify exact candidate on hermetic stack"
+        qualify_step = qualification.split(qualify_step_name, 1)[1]
+        qualify_step = qualify_step.split("\n      - name:", 1)[0]
+        invoked_options = tuple(
+            re.findall(r"^\s+(--[a-z0-9-]+)(?:\s+[^\\]+)? \\$", qualify_step, re.MULTILINE)
+        )
+        supported_options = set(re.findall(r"^    (--[a-z0-9-]+)\)$", qualification_script, re.MULTILINE))
+
+        self.assertEqual(
+            invoked_options,
+            (
+                "--automatic",
+                "--github-actions-artifact",
+                "--signed-smoke-result",
+                "--candidate-gate-result",
+            ),
+        )
+        self.assertTrue(set(invoked_options).issubset(supported_options))
+        self.assertNotIn("--no-promote", qualify_step)
+
     def test_stable_is_manual_and_uses_one_explicit_confirmation(self) -> None:
         stable = workflow("desktop_promote_prod.yml")
         self.assertIn("workflow_dispatch:", stable)
diff --git a/.github/workflows/desktop_qualify_beta.yml b/.github/workflows/desktop_qualify_beta.yml
index 89b1a9b5d12..08c59b57453 100644
--- a/.github/workflows/desktop_qualify_beta.yml
+++ b/.github/workflows/desktop_qualify_beta.yml
@@ -101,7 +101,6 @@ jobs:
           set -euo pipefail
           desktop/macos/scripts/qualify-desktop-beta.sh \
             --automatic \
-            --no-promote \
             --github-actions-artifact \
             --signed-smoke-result /tmp/desktop-beta-qualification/desktop-smoke-result.json \
             --candidate-gate-result /tmp/desktop-beta-qualification/candidate-gate.json \