test(coroot): bind consumer evidence to the verified parser

.github/renovate.json

@@ -308,6 +308,15 @@
       "groupName": "kyverno",
       "automerge": false
     },
+    {
+      "description": "This test-only parser witnesses the verified Coroot node-agent source, not the latest library. Keep proposals visible, but require the consumer regression and a verified deployed-source refresh before adopting a different parser (platform#4934).",
+      "matchManagers": ["gomod"],
+      "matchPackageNames": ["github.com/coroot/logparser"],
+      "automerge": false,
+      "prBodyNotes": [
+        "This is a test-witness update, not a production parser upgrade. Reverify the deployed node-agent source and refresh the consumer binding in the same reviewed change; the CRI severity tests reject an independently updated parser."
+      ]
+    },
     {
       "description": "The feature-flag validator (scripts/validate-feature-flags) stays on the v2 YAML parser: v2 resolves plain on/off/yes/no as booleans exactly as Kubernetes does, while v3 reads them as strings and accepts a definition the cluster would decode differently (platform#4496). v2 and v3 are separately maintained module paths, and sigs.k8s.io/yaml itself depends on v2, so the major proposal is not an upgrade. Patch and minor updates of the v2 line stay enabled.",
       "matchManagers": ["gomod"],

scripts/tests/kyverno-logs/consumer_version_test.go

@@ -0,0 +1,34 @@
+package kyvernologs
+
+import (
+	"context"
+	"encoding/json"
+	"os/exec"
+	"testing"
+	"time"
+)
+
+// requireVerifiedConsumer binds the consumer witness to the node-agent
+// source verified for this profile, not to whatever module Renovate proposes.
+// Source: coroot/coroot-node-agent@ee62018e73b90b1549f5b81ba0d3d6e28851a1df/go.mod.
+// A deliberate refresh must reverify the deployed agent's source before changing
+// this profile. This offline check does not attest the current live deployment.
+func requireVerifiedConsumer(t *testing.T) {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, "go", "list", "-m", "-json", "github.com/coroot/logparser").Output()
+	if err != nil {
+		t.Fatalf("cannot establish selected consumer module: %v", err)
+	}
+	var module struct {
+		Path, Version string
+		Replace       json.RawMessage
+	}
+	if err := json.Unmarshal(out, &module); err != nil {
+		t.Fatalf("cannot decode selected consumer module: %v", err)
+	}
+	if module.Path != "github.com/coroot/logparser" || module.Version != "v1.4.0" || len(module.Replace) != 0 {
+		t.Fatalf("consumer is not the verified node-agent parser: selected=%s@%s; refresh the source binding before claiming deployed-consumer coverage", module.Path, module.Version)
+	}
+}

scripts/tests/kyverno-logs/log_format_test.go

@@ -114,6 +114,7 @@ type consumedLog struct {
 // consume exercises the deployed CRI decoder and parser callback, preserving fields.
 func consume(t *testing.T, body string) consumedLog {
 	t.Helper()
+	requireVerifiedConsumer(t)
 	entries := make(chan logparser.LogEntry, 1)
 	results := make(chan consumedLog, 1)
 	parser := logparser.NewParser(entries, logparser.CriDecoder{}, func(timestamp time.Time, level logparser.Level, _, message string, attributes map[string]string) {