Bundle Q (Coverage Audit Closure): property-based pilot + hygiene — L-001/L-002/L-003/L-004/I-001 closed

Five small closures wrapping the Low-tier and Info-tier audit findings.

Q.1 — cmd/cli round-out (L-001 closed)
======================================
cmd/cli/dispatch_test.go: ~30 dispatch tests across handleCerts /
handleAgents / handleJobs / handleImport / handleStatus. httptest.NewTLSServer
mocks the API; cli.NewClient(_, _, _, _, true) constructs an
insecure-skip-verify client. Each test pins the missing-args usage-print
path AND the happy-path delegation. Result: 7.1% -> 63.5% coverage
(gate: >=30%).

Q.2 — awssm round-out (L-002 closed)
======================================
internal/connector/discovery/awssm/awssm_edge_test.go: New() default
constructor, extractKeyInfo (ECDSA/Ed25519/unknown — was RSA-only),
processSecret filter arms (NamePrefix mismatch / TagFilter mismatch /
empty-value / GetSecretValue error), realSMClient stub-contract pin
(ListSecrets / GetSecretValue / NewRealSMClient), and EmailAddresses
SAN extraction. Result: 78.2% -> 96.0% coverage (gate: >=85%).

Q.3 — Property-based testing pilot (L-003 closed)
======================================
gopter@v0.2.11 added to go.mod (test-only).

internal/crypto/encryption_property_test.go:
- TestProperty_EncryptDecryptRoundTrip — 50 successful tests,
  DecryptIfKeySet(EncryptIfKeySet(x, k), k) == x
- TestProperty_WrongPassphraseRejected — 30 successful tests,
  AEAD never returns nil-error AND bytes-equal plaintext under
  wrong passphrase
Both skipped under -short to keep developer loop fast (PBKDF2 600k
rounds × 50 iters ≈ 15s on -race CI).

internal/pkcs7/length_property_test.go:
- TestProperty_ASN1LengthRoundTrip — three sub-properties:
  decodeLength(encode(x)) == x for x ∈ [0, 2³¹−1]; short-form
  invariant (length<128 → 1 byte == length); long-form invariant
  (length>=128 → high bit set + N bytes follow). 500 successful
  tests in <10ms.

Q.4 — Architecture diagram multi-agent update (L-004 closed)
======================================
docs/qa-test-guide.md::Architecture: ASCII diagram updated to show
'certctl-agent (×N)' + callout explaining seed_demo.sql provisions
12 agent rows (1 active, 2 retired, 9 reserved/sentinel) for Parts
04, 05, 55 + FSM coverage. Operators running parallel-agent topologies
guided to AGENT_COUNT=N + 'make qa-stats'.

Q.5 — Test-naming CI guard (I-001 closed)
======================================
.github/workflows/ci.yml: Test-naming convention guard added after
the QA-doc seed-count drift guard. Greps for func Test<X>( missing
the <X>_<Scenario> suffix. Prints first 20 non-conformant as
::warning:: annotations. continue-on-error: true (informational).
Excludes TestMain + TestProperty_*. Promotion to hard-fail tracked
as I-001-extended.

Verification
======================================
- python3 yaml.safe_load on ci.yml: OK
- go vet ./cmd/cli/... ./internal/connector/discovery/awssm/...
  ./internal/crypto/... ./internal/pkcs7/...: clean
- go test -short -count=1 across all four packages: PASS
- go test -count=1 (full property tests): PASS
  - crypto 15.4s (50 + 30 × 600k PBKDF2)
  - pkcs7 5ms

Audit deliverables
======================================
- gap-backlog.md: strikethroughs on L-001/L-002/L-003/L-004/I-001
  with per-finding closure note
- closure-plan.md: ticks Bundle Q [x] with per-item breakdown

Closes: L-001, L-002, L-003, L-004, I-001
Bundle: Q (Property-Based + Hygiene)

docs/qa-test-guide.md

@@ -39,19 +39,35 @@ either manual-only by design or pending QA-suite coverage:
 ## Architecture
 
 ```
-┌────────────────────────┐     ┌──────────────────────────┐
-│  qa_test.go            │────▶│  certctl demo stack      │
-│  (//go:build qa)       │     │  docker-compose.yml +    │
-│                        │     │  docker-compose.demo.yml │
-│  TestQA(t *testing.T)  │     │                          │
-│   ├─ Part01_Infra      │     │  ┌─ certctl-server :8443 │
-│   ├─ Part02_Auth       │     │  ├─ postgres :5432       │
-│   ├─ Part03_CertCRUD   │     │  └─ certctl-agent        │
-│   ├─ ...               │     └──────────────────────────┘
-│   └─ Part52_HelmChart  │
-└────────────────────────┘
+┌────────────────────────┐     ┌─────────────────────────────────┐
+│  qa_test.go            │────▶│  certctl demo stack             │
+│  (//go:build qa)       │     │  docker-compose.yml +           │
+│                        │     │  docker-compose.demo.yml        │
+│  TestQA(t *testing.T)  │     │                                 │
+│   ├─ Part01_Infra      │     │  ┌─ certctl-server :8443        │
+│   ├─ Part02_Auth       │     │  ├─ postgres :5432              │
+│   ├─ Part03_CertCRUD   │     │  └─ certctl-agent (×N)          │
+│   ├─ ...               │     │      ↑ seed_demo.sql provisions │
+│   └─ Part52_HelmChart  │     │        12 agent rows (1 active, │
+└────────────────────────┘     │        2 retired, 9 reserved /  │
+                               │        sentinel) for the soft-  │
+                               │        retire / FSM coverage    │
+                               │        Parts 55–56 exercise.    │
+                               └─────────────────────────────────┘
 ```
 
+> **Multi-agent demo stack (Bundle Q / L-004 closure).** The demo
+> stack runs a single live `certctl-agent` container by default but
+> the database is seeded with 12 agent rows (`migrations/seed_demo.sql`,
+> grep `mc-* | ag-*` IDs). The "(×N)" notation reflects the seed-data
+> reality: Parts 04 (Agents Listing), 05 (Agent Heartbeats), 55
+> (Agent Soft-Retirement), and FSM coverage tables in
+> `coverage-audit-2026-04-27/tables/fsm-coverage.md` exercise the full
+> multi-agent population, not the one live container. Operators
+> running the QA suite in a parallel-agent topology should set
+> `AGENT_COUNT=N` in compose-override and re-derive the seed counts
+> via `make qa-stats`.
+
 Key design choices:
 
 - **Build tag:** `//go:build qa` — never runs during `go test ./...` or CI. Only runs when explicitly requested.