test(purchase): regression guard for parallel multi-account execution isolation (closes #210)

[cristim]

Summary

• Gap closed: spec E-2 (specs/multi-account-execution/acceptance.md) required that one account's failure not fail others during parallel multi-account fan-out, but no automated test guarded this invariant — an inadvertent refactor (e.g., swapping the errgroup for a serial loop, or propagating a per-account error up the group) would silently regress the fault-tolerance promise.
• New test added: TestExecuteMultiAccount_PartialFailure_IsolatesAccounts in internal/purchase/execution_test.go seeds two accounts (V=valid credentials, I=invalid credentials), calls executePurchase, and asserts account-V completes while account-I is recorded as failed, with full result-data isolation between the two.
• Test-only PR: zero production code changes.

What the test pins

Assertion	Guards against
Two SavePurchaseExecution calls fire	Silent skip of a failed account's record
account-V: status=completed, PurchaseID set	Failure of I poisoning V's success path
account-I: status=failed, error non-empty	Silent swallowing of credential failures
account-I error does NOT contain account-V's access key	Cross-account credential data leak (log sanitisation)
account-I error does NOT contain account-V's CommitmentID	Result-data cross-contamination
executePurchase returns an error (I's failure is aggregated)	errgroup silently discarding per-account errors
Base exec.CloudAccountID remains nil	Fan-out accidentally mutating the shared base record

Spec coverage

Satisfies specs/multi-account-execution/acceptance.md scenario E-2.

Test plan

• go test ./internal/purchase/... -v -count=1 -run TestExecuteMultiAccount_PartialFailure_IsolatesAccounts — 1/1 pass
• go test ./internal/purchase/... -count=1 — 100/100 pass
• go vet ./... — clean
• gofmt -l . — empty output
• Three consecutive clean verification passes

Summary by CodeRabbit

• Tests
  • Added regression test for multi-account purchase execution scenarios, validating proper error handling and data isolation when credential resolution fails in some accounts while succeeding in others.

[cristim]

@coderabbitai review

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f3b6a807-e383-4792-bd45-6f6bf5aedcb3

📥 Commits

Reviewing files that changed from the base of the PR and between c84fd02 and 3491157.

📒 Files selected for processing (1)

• internal/purchase/execution_test.go

---

📝 Walkthrough

Walkthrough

A regression test is added that validates multi-account purchase execution with proper isolation when one account fails credential resolution while another succeeds. The test verifies per-account error handling, cross-account data sanitization, and persistence of execution records.

Changes

Multi-Account Execution Isolation Test

Layer / File(s)

Summary

Regression Test internal/purchase/execution_test.go

New test TestExecuteMultiAccount_PartialFailure_IsolatesAccounts validates that credential resolution failure in one AWS account results in a failed execution record for that account, while the valid account's record is marked completed; confirms cross-account data isolation by asserting that error and recommendation messages do not leak the valid account's access key or commitment ID; requires two SavePurchaseExecution calls; and ensures the base execution record remains untagged with CloudAccountID == nil.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• test(purchase): regression guard for parallel multi-account execution isolation #210: Adds identical regression test coverage for multi-account execution isolation and per-account failure handling with output sanitization validation.

Poem

🐰 Two accounts hop through, one stumbles and falls,
Yet data stays safe within separate walls,
The test hops along to ensure they're kept clean,
No secrets escape to be wrongly seen.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: a regression test for multi-account execution isolation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/issue-210-multi-account-isolation

---

_{Review rate limit: 0/5 reviews remaining, refill in 50 minutes and 49 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.