From 84863a3827064ae89cb573848417fe4dc314f0e5 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:49:21 -0600
Subject: [PATCH 01/14] test(cmd): group smd tests by command path

Tests of the smd resource commands were spread across smd_test.go,
smd_errors_test.go, smd_write_test.go, and smd_write_errors_test.go as
well as each resource's own files, so the tests for one command had no
single home.

Move each smd group, group member, iface, rfe, and compep test into its
resource's smd_<resource>_test.go or _errors_test.go file, leaving
smd_test.go and smd_errors_test.go with only the commands directly
under smd and the TestSMDDelete_* tables over every smd resource.
Retire smd_write_test.go and smd_write_errors_test.go. No test logic
changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 cmd/smd_compep_test.go              |  51 +++++
 cmd/smd_errors_test.go              | 182 ++++++++++++---
 cmd/smd_group_errors_test.go        |  27 +++
 cmd/smd_group_member_errors_test.go |  20 ++
 cmd/smd_group_member_test.go        | 105 ++++++++-
 cmd/smd_group_test.go               | 113 ++++++++++
 cmd/smd_iface_test.go               |  73 +++++++
 cmd/smd_rfe_test.go                 |  68 ++++++
 cmd/smd_test.go                     | 328 +---------------------------
 cmd/smd_write_errors_test.go        | 184 ----------------
 cmd/smd_write_test.go               | 114 ----------
 11 files changed, 614 insertions(+), 651 deletions(-)
 delete mode 100644 cmd/smd_write_errors_test.go
 delete mode 100644 cmd/smd_write_test.go

diff --git a/cmd/smd_compep_test.go b/cmd/smd_compep_test.go
index 0d5ce4d8..93c1730d 100644
--- a/cmd/smd_compep_test.go
+++ b/cmd/smd_compep_test.go
@@ -152,3 +152,54 @@ func TestSMDCompepDelete_AllFalse(t *testing.T) {
 		t.Errorf("DELETE paths = %v, want [%s]", gotPaths, want)
 	}
 }
+
+// TestSMDCompepGet_Success verifies "smd compep get" issues GET
+// /Inventory/ComponentEndpoints.
+func TestSMDCompepGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`{}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "compep", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/Inventory/ComponentEndpoints" {
+		t.Errorf("path = %q, want /Inventory/ComponentEndpoints", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+}
+
+// TestSMDCompepDelete_NoConfirm verifies "smd compep delete --no-confirm <xname>"
+// issues DELETE under /Inventory/ComponentEndpoints.
+func TestSMDCompepDelete_NoConfirm(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "compep", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--no-confirm", "x0c0s0b0n0")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+	if gotPath != "/Inventory/ComponentEndpoints/x0c0s0b0n0" {
+		t.Errorf("path = %q, want /Inventory/ComponentEndpoints/x0c0s0b0n0", gotPath)
+	}
+}
diff --git a/cmd/smd_errors_test.go b/cmd/smd_errors_test.go
index c8abbd74..d554c3ea 100644
--- a/cmd/smd_errors_test.go
+++ b/cmd/smd_errors_test.go
@@ -4,8 +4,10 @@
 
 package cmd
 
-// smd_errors_test.go covers HTTP-, transport-, and config-failure paths for
-// the "smd" command group; see smd_test.go for the success paths these mirror.
+// smd_errors_test.go covers HTTP- and config-failure paths for the commands
+// directly under "smd", and the empty or invalid IDs every "smd" delete
+// command rejects before sending a request; see smd_test.go and the
+// smd_<resource>_test.go files for the success paths these mirror.
 
 import (
 	"errors"
@@ -38,32 +40,6 @@ func TestSMDDeprecatedStatus_HTTPError(t *testing.T) {
 	}
 }
 
-// TestSMDGroupGet_TruncatedResponseBody verifies that a truncated HTTP response
-// body (a declared Content-Length the server doesn't deliver) is reported as
-// a network error, not silently swallowed.
-func TestSMDGroupGet_TruncatedResponseBody(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Declare a body longer than what's written, then close the
-		// connection without fulfilling Content-Length.
-		w.Header().Set("Content-Length", "100")
-		w.Write([]byte("partial"))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "smd", "group", "get", "--uri", srv.URL, "--token", "t")
-	if res.err == nil {
-		t.Fatal("expected an error for a truncated response body, got nil")
-	}
-	if res.exitCode != cli.CodeNetwork {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
-	}
-	if !strings.Contains(res.err.Error(), "unexpected EOF") {
-		t.Errorf("error = %q, want it to report the truncated read", res.err.Error())
-	}
-}
-
 // TestSMDServiceStatus_DuplicateCluster verifies that "smd service status"
 // warns about and then fails with a config error, without contacting SMD,
 // when the cluster selected through default-cluster or --cluster is defined
@@ -97,3 +73,153 @@ func TestSMDServiceStatus_DuplicateCluster(t *testing.T) {
 		t.Errorf("SMD received %d requests, want 0", n)
 	}
 }
+
+// TestSMDDelete_RejectsEmptyData verifies an explicit empty payload cannot
+// turn a requested deletion into a silent no-op.
+func TestSMDDelete_RejectsEmptyData(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		command string
+		payload string
+		wantMsg string
+	}{
+		{name: "interface", command: "iface", payload: `[]`, wantMsg: "payload contained no ethernet interfaces to delete"},
+		{name: "group", command: "group", payload: `[]`, wantMsg: "payload contained no groups to delete"},
+		{name: "redfish endpoint", command: "rfe", payload: `{"RedfishEndpoints":[]}`, wantMsg: "payload contained no redfish endpoints to delete"},
+		{name: "component endpoint", command: "compep", payload: `[]`, wantMsg: "payload contained no component endpoints to delete"},
+		{name: "component", command: "component", payload: `{"Components":[]}`, wantMsg: "payload contained no components to delete"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			var deletes int
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method == http.MethodDelete {
+					deletes++
+				}
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithRuntime(t, "smd", "--ignore-config", tc.command, "delete",
+				"--uri", srv.URL, "--token", "t", "--no-confirm", "-d", tc.payload)
+			if res.err == nil {
+				t.Fatal("expected an error, got nil")
+			}
+			if res.exitCode != cli.CodeUsage {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+			}
+			if !strings.Contains(res.err.Error(), tc.wantMsg) {
+				t.Errorf("error = %q, want it to contain %q", res.err.Error(), tc.wantMsg)
+			}
+			if deletes != 0 {
+				t.Errorf("DELETE count = %d, want 0 (no request should be made for an empty payload)", deletes)
+			}
+		})
+	}
+}
+
+// TestSMDDelete_RejectsInvalidPayloadIDs verifies that a payload item whose ID
+// is blank or is not a single path segment, which would otherwise address the
+// whole collection, fails the delete with CodeUsage before any request is
+// made, including for the payload's valid items.
+func TestSMDDelete_RejectsInvalidPayloadIDs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		command string
+		payload string
+		wantMsg string
+	}{
+		{name: "component without ID", command: "component", payload: `{"Components":[{}]}`, wantMsg: "component ID cannot be blank (item 1 of 1)"},
+		{name: "component with dot ID", command: "component", payload: `{"Components":[{"ID":"."}]}`, wantMsg: `component ID "." is not a single path segment`},
+		{name: "component after a valid one", command: "component", payload: `{"Components":[{"ID":"x0c0s0b0n0"},{"ID":"x0/.."}]}`, wantMsg: "(item 2 of 2)"},
+		{name: "interface without ID", command: "iface", payload: `[{}]`, wantMsg: "ethernet interface ID cannot be blank"},
+		{name: "interface with only a MAC address", command: "iface", payload: `[{"MACAddress":"de:ad:be:ef:00:01"}]`, wantMsg: "delete does not derive an ID from MACAddress"},
+		{name: "group without label", command: "group", payload: `[{}]`, wantMsg: "group label cannot be blank"},
+		{name: "redfish endpoint without ID", command: "rfe", payload: `{"RedfishEndpoints":[{}]}`, wantMsg: "redfish endpoint ID cannot be blank"},
+		{name: "component endpoint without ID", command: "compep", payload: `[{}]`, wantMsg: "component endpoint ID cannot be blank"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			var deletes int
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method == http.MethodDelete {
+					deletes++
+				}
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithRuntime(t, "smd", "--ignore-config", tc.command, "delete",
+				"--uri", srv.URL, "--token", "t", "--no-confirm", "-d", tc.payload)
+			if res.err == nil {
+				t.Fatal("expected an error, got nil")
+			}
+			if res.exitCode != cli.CodeUsage {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+			}
+			if !strings.Contains(res.err.Error(), tc.wantMsg) {
+				t.Errorf("error = %q, want it to contain %q", res.err.Error(), tc.wantMsg)
+			}
+			if deletes != 0 {
+				t.Errorf("DELETE count = %d, want 0", deletes)
+			}
+		})
+	}
+}
+
+// TestSMDDelete_RejectsInvalidArgumentIDs verifies that a positional ID that
+// is blank or is not a single path segment fails the delete with CodeUsage
+// before any request is made, including for the valid arguments.
+func TestSMDDelete_RejectsInvalidArgumentIDs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		args    []string
+		wantMsg string
+	}{
+		{name: "blank component", args: []string{"component", "delete", ""}, wantMsg: "component ID cannot be blank"},
+		{name: "component after a valid one", args: []string{"component", "delete", "x0c0s0b0n0", ".."}, wantMsg: `component ID ".." is not a single path segment (item 2 of 2)`},
+		{name: "interface with slash", args: []string{"iface", "delete", "x0/.."}, wantMsg: "ethernet interface ID"},
+		{name: "blank group", args: []string{"group", "delete", ""}, wantMsg: "group label cannot be blank"},
+		{name: "blank redfish endpoint", args: []string{"rfe", "delete", " "}, wantMsg: "redfish endpoint ID cannot be blank"},
+		{name: "dot component endpoint", args: []string{"compep", "delete", "."}, wantMsg: "component endpoint ID"},
+		{name: "blank member group", args: []string{"group", "member", "delete", "", "x0c0s0b0n0"}, wantMsg: "group label cannot be blank"},
+		{name: "blank group member", args: []string{"group", "member", "delete", "compute", ""}, wantMsg: "group member cannot be blank"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			var deletes int
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method == http.MethodDelete {
+					deletes++
+				}
+			}))
+			defer srv.Close()
+
+			args := append([]string{"smd", "--ignore-config"}, tc.args...)
+			args = append(args, "--uri", srv.URL, "--token", "t", "--no-confirm")
+			res := runOchamiWithRuntime(t, args...)
+			if res.err == nil {
+				t.Fatal("expected an error, got nil")
+			}
+			if res.exitCode != cli.CodeUsage {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+			}
+			if !strings.Contains(res.err.Error(), tc.wantMsg) {
+				t.Errorf("error = %q, want it to contain %q", res.err.Error(), tc.wantMsg)
+			}
+			if deletes != 0 {
+				t.Errorf("DELETE count = %d, want 0", deletes)
+			}
+		})
+	}
+}
diff --git a/cmd/smd_group_errors_test.go b/cmd/smd_group_errors_test.go
index b0198d73..7ee3c973 100644
--- a/cmd/smd_group_errors_test.go
+++ b/cmd/smd_group_errors_test.go
@@ -7,6 +7,7 @@ package cmd
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/openchami/ochami/internal/cli"
@@ -172,3 +173,29 @@ func TestSMDGroupAdd_NetworkError(t *testing.T) {
 		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
 	}
 }
+
+// TestSMDGroupGet_TruncatedResponseBody verifies that a truncated HTTP response
+// body (a declared Content-Length the server doesn't deliver) is reported as
+// a network error, not silently swallowed.
+func TestSMDGroupGet_TruncatedResponseBody(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Declare a body longer than what's written, then close the
+		// connection without fulfilling Content-Length.
+		w.Header().Set("Content-Length", "100")
+		w.Write([]byte("partial"))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "smd", "group", "get", "--uri", srv.URL, "--token", "t")
+	if res.err == nil {
+		t.Fatal("expected an error for a truncated response body, got nil")
+	}
+	if res.exitCode != cli.CodeNetwork {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
+	}
+	if !strings.Contains(res.err.Error(), "unexpected EOF") {
+		t.Errorf("error = %q, want it to report the truncated read", res.err.Error())
+	}
+}
diff --git a/cmd/smd_group_member_errors_test.go b/cmd/smd_group_member_errors_test.go
index d3e0d017..04dbf044 100644
--- a/cmd/smd_group_member_errors_test.go
+++ b/cmd/smd_group_member_errors_test.go
@@ -101,3 +101,23 @@ func TestSMDGroupMember_NetworkErrors(t *testing.T) {
 		t.Errorf("member get network: err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
 	}
 }
+
+// TestSMDGroupMemberAdd_HTTPError verifies an unsuccessful HTTP response
+// resolves to CodeHTTP.
+func TestSMDGroupMemberAdd_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "conflict", http.StatusConflict)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "member", "add", "compute", "x0c0s0b0n0",
+		"--uri", srv.URL, "--token", "t")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
diff --git a/cmd/smd_group_member_test.go b/cmd/smd_group_member_test.go
index d42657f4..9d611cb9 100644
--- a/cmd/smd_group_member_test.go
+++ b/cmd/smd_group_member_test.go
@@ -5,9 +5,10 @@
 package cmd
 
 // smd_group_member_test.go exercises the success paths of the "smd group
-// member" add and delete commands end-to-end against an httptest.Server: one
-// request per member, and the delete confirmation prompt. Error arms for every
-// member verb are covered in smd_group_member_errors_test.go.
+// member" commands (get, add, set, delete) end-to-end against an
+// httptest.Server: the request each verb issues, one request per member, and
+// the delete confirmation prompt. Error arms for every member verb are covered
+// in smd_group_member_errors_test.go.
 
 import (
 	"net/http"
@@ -91,3 +92,101 @@ func TestSMDGroupMemberDelete_Multiple(t *testing.T) {
 		t.Errorf("DELETE count = %d, want 2", deletes)
 	}
 }
+
+// TestSMDGroupMemberGet_Success verifies "smd group member get <label>" issues GET
+// /groups/<label>/members.
+func TestSMDGroupMemberGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "group", "member", "get", "--ignore-config", "--uri", srv.URL, "--token", "t", "compute")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/groups/compute/members" {
+		t.Errorf("path = %q, want /groups/compute/members", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+}
+
+// TestSMDGroupMemberSet_Success verifies "smd group member set <label> <comp>..." issues
+// PUT /groups/<label>/members.
+func TestSMDGroupMemberSet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "group", "member", "set", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"compute", "x0c0s0b0n0")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPut || gotPath != "/groups/compute/members" {
+		t.Errorf("request = %s %s, want PUT /groups/compute/members", gotMethod, gotPath)
+	}
+}
+
+// TestSMDGroupMemberAdd_Success verifies "smd group member add" issues POST under
+// /groups/<label>/members.
+func TestSMDGroupMemberAdd_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusCreated)
+		w.Write([]byte(`"x0c0s0b0n0"`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "member", "add", "compute", "x0c0s0b0n0",
+		"--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost {
+		t.Errorf("method = %q, want POST", gotMethod)
+	}
+	if !strings.Contains(gotPath, "/groups/compute/members") {
+		t.Errorf("path = %q, want it under /groups/compute/members", gotPath)
+	}
+}
+
+// TestSMDGroupMemberDelete_Success verifies "smd group member delete" issues DELETE
+// under /groups/<label>/members/<component>.
+func TestSMDGroupMemberDelete_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.Write([]byte(`{"code":0,"message":"ok"}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "member", "delete", "compute", "x0c0s0b0n0",
+		"--uri", srv.URL, "--token", "t", "--no-confirm")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+	if !strings.Contains(gotPath, "/groups/compute/members") {
+		t.Errorf("path = %q, want it under /groups/compute/members", gotPath)
+	}
+}
diff --git a/cmd/smd_group_test.go b/cmd/smd_group_test.go
index bd524611..69e13402 100644
--- a/cmd/smd_group_test.go
+++ b/cmd/smd_group_test.go
@@ -280,3 +280,116 @@ func TestSMDGroupDelete_DataWithExtraArgs(t *testing.T) {
 		t.Errorf("request = %s %s, want DELETE /groups/compute (the payload's group, not the extra argument)", gotMethod, gotPath)
 	}
 }
+
+// TestSMDGroupGet_Success verifies "smd group get" issues GET /groups.
+func TestSMDGroupGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "group", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodGet || gotPath != "/groups" {
+		t.Errorf("request = %s %s, want GET /groups", gotMethod, gotPath)
+	}
+}
+
+// TestSMDGroupAdd_ViaFlags verifies "smd group add <label>" issues POST /groups.
+func TestSMDGroupAdd_ViaFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "group", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--description", "compute nodes", "compute")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost || gotPath != "/groups" {
+		t.Errorf("request = %s %s, want POST /groups", gotMethod, gotPath)
+	}
+}
+
+// TestSMDGroupDelete_NoConfirm verifies "smd group delete --no-confirm <label>"
+// issues DELETE /groups/<label>.
+func TestSMDGroupDelete_NoConfirm(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "group", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--no-confirm", "compute")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete || !strings.HasPrefix(gotPath, "/groups/compute") {
+		t.Errorf("request = %s %s, want DELETE /groups/compute", gotMethod, gotPath)
+	}
+}
+
+// TestSMDGroupMembership_Get verifies "smd group membership" issues GET
+// /memberships.
+func TestSMDGroupMembership_Get(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "group", "membership", "--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/memberships" {
+		t.Errorf("path = %q, want /memberships", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+}
+
+// TestSMDGroupUpdate_Success verifies "smd group update" issues PATCH under /groups.
+func TestSMDGroupUpdate_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.Write([]byte(`{}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "update", "compute",
+		"--description", "compute nodes",
+		"--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPatch {
+		t.Errorf("method = %q, want PATCH", gotMethod)
+	}
+	if !strings.HasPrefix(gotPath, "/hsm/v2/groups") && !strings.Contains(gotPath, "/groups") {
+		t.Errorf("path = %q, want it under /groups", gotPath)
+	}
+}
diff --git a/cmd/smd_iface_test.go b/cmd/smd_iface_test.go
index 04650624..1ec185e4 100644
--- a/cmd/smd_iface_test.go
+++ b/cmd/smd_iface_test.go
@@ -306,3 +306,76 @@ func TestSMDIfaceDelete_AllFalse(t *testing.T) {
 		t.Errorf("DELETE paths = %v, want [%s]", gotPaths, want)
 	}
 }
+
+// TestSMDIfaceGet_Success verifies "smd iface get" issues GET
+// /Inventory/EthernetInterfaces.
+func TestSMDIfaceGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "iface", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/Inventory/EthernetInterfaces" {
+		t.Errorf("path = %q, want /Inventory/EthernetInterfaces", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+}
+
+// TestSMDIfaceAdd_ViaArgs verifies "smd iface add <comp> <mac> <net,ip>" issues
+// POST /Inventory/EthernetInterfaces.
+func TestSMDIfaceAdd_ViaArgs(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "iface", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"x0c0s0b0n0", "de:ad:be:ef:00:00", "internal,172.16.0.1")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost || gotPath != "/Inventory/EthernetInterfaces" {
+		t.Errorf("request = %s %s, want POST /Inventory/EthernetInterfaces", gotMethod, gotPath)
+	}
+}
+
+// TestSMDIfaceDelete_NoConfirm verifies "smd iface delete --no-confirm <id>"
+// issues DELETE under /Inventory/EthernetInterfaces.
+func TestSMDIfaceDelete_NoConfirm(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "iface", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--no-confirm", "deadbeef0000")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+	if gotPath != "/Inventory/EthernetInterfaces/deadbeef0000" {
+		t.Errorf("path = %q, want /Inventory/EthernetInterfaces/deadbeef0000", gotPath)
+	}
+}
diff --git a/cmd/smd_rfe_test.go b/cmd/smd_rfe_test.go
index cd17a14d..f763f0d7 100644
--- a/cmd/smd_rfe_test.go
+++ b/cmd/smd_rfe_test.go
@@ -216,3 +216,71 @@ func TestSMDRFEDelete_AllFalse(t *testing.T) {
 		t.Errorf("DELETE paths = %v, want [%s]", gotPaths, want)
 	}
 }
+
+// TestSMDRFEGet_Success verifies "smd rfe get" issues GET /Inventory/RedfishEndpoints.
+func TestSMDRFEGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`{}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "rfe", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/Inventory/RedfishEndpoints" {
+		t.Errorf("path = %q, want /Inventory/RedfishEndpoints", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+}
+
+// TestSMDRFEAdd_ViaArgs verifies "smd rfe add <xname> <name> <ip> <mac>" issues
+// POST /Inventory/RedfishEndpoints.
+func TestSMDRFEAdd_ViaArgs(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "rfe", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"x0c0s0b0", "bmc0", "172.16.0.100", "de:ad:be:ef:01:02")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost || gotPath != "/Inventory/RedfishEndpoints" {
+		t.Errorf("request = %s %s, want POST /Inventory/RedfishEndpoints", gotMethod, gotPath)
+	}
+}
+
+// TestSMDRFEDelete_NoConfirm verifies "smd rfe delete --no-confirm" issues a
+// DELETE.
+func TestSMDRFEDelete_NoConfirm(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.Write([]byte(`{"code":0,"message":"ok"}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "rfe", "delete", "x0c0s0b0",
+		"--uri", srv.URL, "--token", "t", "--no-confirm")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+}
diff --git a/cmd/smd_test.go b/cmd/smd_test.go
index 5ab0b2c1..4012df37 100644
--- a/cmd/smd_test.go
+++ b/cmd/smd_test.go
@@ -4,11 +4,12 @@
 
 package cmd
 
-// smd_test.go exercises representative "smd" subcommands (group, group member,
-// iface, rfe, compep, service, status) end-to-end against an httptest.Server,
-// asserting outbound request method/path and the resolved exit code. The
-// "smd component" commands are covered separately in smd_component_test.go.
-// HTTP-failure cases are covered in smd_errors_test.go.
+// smd_test.go exercises the commands directly under "smd" (service, status)
+// end-to-end against an httptest.Server, asserting outbound request
+// method/path and the resolved exit code, and the checks that span several SMD
+// resources, such as CA trust for their add commands. Each SMD resource's own
+// commands are covered in its smd_<resource>_test.go file, and HTTP-failure
+// cases in smd_errors_test.go.
 
 import (
 	"encoding/pem"
@@ -20,71 +21,6 @@ import (
 	"testing"
 )
 
-// --- groups ---
-
-// TestSMDGroupGet_Success verifies "smd group get" issues GET /groups.
-func TestSMDGroupGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "group", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodGet || gotPath != "/groups" {
-		t.Errorf("request = %s %s, want GET /groups", gotMethod, gotPath)
-	}
-}
-
-// TestSMDGroupAdd_ViaFlags verifies "smd group add <label>" issues POST /groups.
-func TestSMDGroupAdd_ViaFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "group", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--description", "compute nodes", "compute")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost || gotPath != "/groups" {
-		t.Errorf("request = %s %s, want POST /groups", gotMethod, gotPath)
-	}
-}
-
-// TestSMDGroupDelete_NoConfirm verifies "smd group delete --no-confirm <label>"
-// issues DELETE /groups/<label>.
-func TestSMDGroupDelete_NoConfirm(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "group", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--no-confirm", "compute")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete || !strings.HasPrefix(gotPath, "/groups/compute") {
-		t.Errorf("request = %s %s, want DELETE /groups/compute", gotMethod, gotPath)
-	}
-}
-
 // TestSMDAdd_TrustsCACert verifies that "smd group add" and "smd rfe add"
 // issue their POST to a TLS server whose certificate is trusted only through
 // --cacert.
@@ -127,258 +63,6 @@ func TestSMDAdd_TrustsCACert(t *testing.T) {
 	}
 }
 
-// TestSMDGroupMembership_Get verifies "smd group membership" issues GET
-// /memberships.
-func TestSMDGroupMembership_Get(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "group", "membership", "--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/memberships" {
-		t.Errorf("path = %q, want /memberships", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-}
-
-// --- group members ---
-
-// TestSMDGroupMemberGet_Success verifies "smd group member get <label>" issues GET
-// /groups/<label>/members.
-func TestSMDGroupMemberGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "group", "member", "get", "--ignore-config", "--uri", srv.URL, "--token", "t", "compute")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/groups/compute/members" {
-		t.Errorf("path = %q, want /groups/compute/members", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-}
-
-// TestSMDGroupMemberSet_Success verifies "smd group member set <label> <comp>..." issues
-// PUT /groups/<label>/members.
-func TestSMDGroupMemberSet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "group", "member", "set", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"compute", "x0c0s0b0n0")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPut || gotPath != "/groups/compute/members" {
-		t.Errorf("request = %s %s, want PUT /groups/compute/members", gotMethod, gotPath)
-	}
-}
-
-// --- ethernet interfaces ---
-
-// TestSMDIfaceGet_Success verifies "smd iface get" issues GET
-// /Inventory/EthernetInterfaces.
-func TestSMDIfaceGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "iface", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/Inventory/EthernetInterfaces" {
-		t.Errorf("path = %q, want /Inventory/EthernetInterfaces", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-}
-
-// TestSMDIfaceAdd_ViaArgs verifies "smd iface add <comp> <mac> <net,ip>" issues
-// POST /Inventory/EthernetInterfaces.
-func TestSMDIfaceAdd_ViaArgs(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "iface", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"x0c0s0b0n0", "de:ad:be:ef:00:00", "internal,172.16.0.1")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost || gotPath != "/Inventory/EthernetInterfaces" {
-		t.Errorf("request = %s %s, want POST /Inventory/EthernetInterfaces", gotMethod, gotPath)
-	}
-}
-
-// TestSMDIfaceDelete_NoConfirm verifies "smd iface delete --no-confirm <id>"
-// issues DELETE under /Inventory/EthernetInterfaces.
-func TestSMDIfaceDelete_NoConfirm(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		gotPath = r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "iface", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--no-confirm", "deadbeef0000")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-	if gotPath != "/Inventory/EthernetInterfaces/deadbeef0000" {
-		t.Errorf("path = %q, want /Inventory/EthernetInterfaces/deadbeef0000", gotPath)
-	}
-}
-
-// --- redfish endpoints ---
-
-// TestSMDRFEGet_Success verifies "smd rfe get" issues GET /Inventory/RedfishEndpoints.
-func TestSMDRFEGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`{}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "rfe", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/Inventory/RedfishEndpoints" {
-		t.Errorf("path = %q, want /Inventory/RedfishEndpoints", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-}
-
-// TestSMDRFEAdd_ViaArgs verifies "smd rfe add <xname> <name> <ip> <mac>" issues
-// POST /Inventory/RedfishEndpoints.
-func TestSMDRFEAdd_ViaArgs(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "rfe", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"x0c0s0b0", "bmc0", "172.16.0.100", "de:ad:be:ef:01:02")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost || gotPath != "/Inventory/RedfishEndpoints" {
-		t.Errorf("request = %s %s, want POST /Inventory/RedfishEndpoints", gotMethod, gotPath)
-	}
-}
-
-// --- component endpoints ---
-
-// TestSMDCompepGet_Success verifies "smd compep get" issues GET
-// /Inventory/ComponentEndpoints.
-func TestSMDCompepGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`{}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "compep", "get", "--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/Inventory/ComponentEndpoints" {
-		t.Errorf("path = %q, want /Inventory/ComponentEndpoints", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-}
-
-// TestSMDCompepDelete_NoConfirm verifies "smd compep delete --no-confirm <xname>"
-// issues DELETE under /Inventory/ComponentEndpoints.
-func TestSMDCompepDelete_NoConfirm(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		gotPath = r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "compep", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--no-confirm", "x0c0s0b0n0")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-	if gotPath != "/Inventory/ComponentEndpoints/x0c0s0b0n0" {
-		t.Errorf("path = %q, want /Inventory/ComponentEndpoints/x0c0s0b0n0", gotPath)
-	}
-}
-
-// --- service / status ---
-
 // TestSMDServiceStatus_Success verifies "smd service status" issues a GET under /service.
 func TestSMDServiceStatus_Success(t *testing.T) {
 	t.Parallel()
diff --git a/cmd/smd_write_errors_test.go b/cmd/smd_write_errors_test.go
deleted file mode 100644
index cf1997d1..00000000
--- a/cmd/smd_write_errors_test.go
+++ /dev/null
@@ -1,184 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/openchami/ochami/internal/cli"
-)
-
-// TestSMDGroupMemberAdd_HTTPError verifies an unsuccessful HTTP response
-// resolves to CodeHTTP.
-func TestSMDGroupMemberAdd_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "conflict", http.StatusConflict)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "member", "add", "compute", "x0c0s0b0n0",
-		"--uri", srv.URL, "--token", "t")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
-// TestSMDDelete_RejectsEmptyData verifies an explicit empty payload cannot
-// turn a requested deletion into a silent no-op.
-func TestSMDDelete_RejectsEmptyData(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		command string
-		payload string
-		wantMsg string
-	}{
-		{name: "interface", command: "iface", payload: `[]`, wantMsg: "payload contained no ethernet interfaces to delete"},
-		{name: "group", command: "group", payload: `[]`, wantMsg: "payload contained no groups to delete"},
-		{name: "redfish endpoint", command: "rfe", payload: `{"RedfishEndpoints":[]}`, wantMsg: "payload contained no redfish endpoints to delete"},
-		{name: "component endpoint", command: "compep", payload: `[]`, wantMsg: "payload contained no component endpoints to delete"},
-		{name: "component", command: "component", payload: `{"Components":[]}`, wantMsg: "payload contained no components to delete"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			var deletes int
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Method == http.MethodDelete {
-					deletes++
-				}
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "smd", "--ignore-config", tc.command, "delete",
-				"--uri", srv.URL, "--token", "t", "--no-confirm", "-d", tc.payload)
-			if res.err == nil {
-				t.Fatal("expected an error, got nil")
-			}
-			if res.exitCode != cli.CodeUsage {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-			}
-			if !strings.Contains(res.err.Error(), tc.wantMsg) {
-				t.Errorf("error = %q, want it to contain %q", res.err.Error(), tc.wantMsg)
-			}
-			if deletes != 0 {
-				t.Errorf("DELETE count = %d, want 0 (no request should be made for an empty payload)", deletes)
-			}
-		})
-	}
-}
-
-// TestSMDDelete_RejectsInvalidPayloadIDs verifies that a payload item whose ID
-// is blank or is not a single path segment, which would otherwise address the
-// whole collection, fails the delete with CodeUsage before any request is
-// made, including for the payload's valid items.
-func TestSMDDelete_RejectsInvalidPayloadIDs(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		command string
-		payload string
-		wantMsg string
-	}{
-		{name: "component without ID", command: "component", payload: `{"Components":[{}]}`, wantMsg: "component ID cannot be blank (item 1 of 1)"},
-		{name: "component with dot ID", command: "component", payload: `{"Components":[{"ID":"."}]}`, wantMsg: `component ID "." is not a single path segment`},
-		{name: "component after a valid one", command: "component", payload: `{"Components":[{"ID":"x0c0s0b0n0"},{"ID":"x0/.."}]}`, wantMsg: "(item 2 of 2)"},
-		{name: "interface without ID", command: "iface", payload: `[{}]`, wantMsg: "ethernet interface ID cannot be blank"},
-		{name: "interface with only a MAC address", command: "iface", payload: `[{"MACAddress":"de:ad:be:ef:00:01"}]`, wantMsg: "delete does not derive an ID from MACAddress"},
-		{name: "group without label", command: "group", payload: `[{}]`, wantMsg: "group label cannot be blank"},
-		{name: "redfish endpoint without ID", command: "rfe", payload: `{"RedfishEndpoints":[{}]}`, wantMsg: "redfish endpoint ID cannot be blank"},
-		{name: "component endpoint without ID", command: "compep", payload: `[{}]`, wantMsg: "component endpoint ID cannot be blank"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			var deletes int
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Method == http.MethodDelete {
-					deletes++
-				}
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "smd", "--ignore-config", tc.command, "delete",
-				"--uri", srv.URL, "--token", "t", "--no-confirm", "-d", tc.payload)
-			if res.err == nil {
-				t.Fatal("expected an error, got nil")
-			}
-			if res.exitCode != cli.CodeUsage {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-			}
-			if !strings.Contains(res.err.Error(), tc.wantMsg) {
-				t.Errorf("error = %q, want it to contain %q", res.err.Error(), tc.wantMsg)
-			}
-			if deletes != 0 {
-				t.Errorf("DELETE count = %d, want 0", deletes)
-			}
-		})
-	}
-}
-
-// TestSMDDelete_RejectsInvalidArgumentIDs verifies that a positional ID that
-// is blank or is not a single path segment fails the delete with CodeUsage
-// before any request is made, including for the valid arguments.
-func TestSMDDelete_RejectsInvalidArgumentIDs(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		args    []string
-		wantMsg string
-	}{
-		{name: "blank component", args: []string{"component", "delete", ""}, wantMsg: "component ID cannot be blank"},
-		{name: "component after a valid one", args: []string{"component", "delete", "x0c0s0b0n0", ".."}, wantMsg: `component ID ".." is not a single path segment (item 2 of 2)`},
-		{name: "interface with slash", args: []string{"iface", "delete", "x0/.."}, wantMsg: "ethernet interface ID"},
-		{name: "blank group", args: []string{"group", "delete", ""}, wantMsg: "group label cannot be blank"},
-		{name: "blank redfish endpoint", args: []string{"rfe", "delete", " "}, wantMsg: "redfish endpoint ID cannot be blank"},
-		{name: "dot component endpoint", args: []string{"compep", "delete", "."}, wantMsg: "component endpoint ID"},
-		{name: "blank member group", args: []string{"group", "member", "delete", "", "x0c0s0b0n0"}, wantMsg: "group label cannot be blank"},
-		{name: "blank group member", args: []string{"group", "member", "delete", "compute", ""}, wantMsg: "group member cannot be blank"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			var deletes int
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Method == http.MethodDelete {
-					deletes++
-				}
-			}))
-			defer srv.Close()
-
-			args := append([]string{"smd", "--ignore-config"}, tc.args...)
-			args = append(args, "--uri", srv.URL, "--token", "t", "--no-confirm")
-			res := runOchamiWithRuntime(t, args...)
-			if res.err == nil {
-				t.Fatal("expected an error, got nil")
-			}
-			if res.exitCode != cli.CodeUsage {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-			}
-			if !strings.Contains(res.err.Error(), tc.wantMsg) {
-				t.Errorf("error = %q, want it to contain %q", res.err.Error(), tc.wantMsg)
-			}
-			if deletes != 0 {
-				t.Errorf("DELETE count = %d, want 0", deletes)
-			}
-		})
-	}
-}
diff --git a/cmd/smd_write_test.go b/cmd/smd_write_test.go
deleted file mode 100644
index 68f50993..00000000
--- a/cmd/smd_write_test.go
+++ /dev/null
@@ -1,114 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-// smd_write_test.go covers SMD write commands end-to-end: group member
-// add/delete, group update, and Redfish endpoint delete. Error arms are
-// covered in smd_write_errors_test.go.
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-// TestSMDGroupMemberAdd_Success verifies "smd group member add" issues POST under
-// /groups/<label>/members.
-func TestSMDGroupMemberAdd_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusCreated)
-		w.Write([]byte(`"x0c0s0b0n0"`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "member", "add", "compute", "x0c0s0b0n0",
-		"--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost {
-		t.Errorf("method = %q, want POST", gotMethod)
-	}
-	if !strings.Contains(gotPath, "/groups/compute/members") {
-		t.Errorf("path = %q, want it under /groups/compute/members", gotPath)
-	}
-}
-
-// TestSMDGroupMemberDelete_Success verifies "smd group member delete" issues DELETE
-// under /groups/<label>/members/<component>.
-func TestSMDGroupMemberDelete_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.Write([]byte(`{"code":0,"message":"ok"}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "member", "delete", "compute", "x0c0s0b0n0",
-		"--uri", srv.URL, "--token", "t", "--no-confirm")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-	if !strings.Contains(gotPath, "/groups/compute/members") {
-		t.Errorf("path = %q, want it under /groups/compute/members", gotPath)
-	}
-}
-
-// TestSMDGroupUpdate_Success verifies "smd group update" issues PATCH under /groups.
-func TestSMDGroupUpdate_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.Write([]byte(`{}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "group", "update", "compute",
-		"--description", "compute nodes",
-		"--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPatch {
-		t.Errorf("method = %q, want PATCH", gotMethod)
-	}
-	if !strings.HasPrefix(gotPath, "/hsm/v2/groups") && !strings.Contains(gotPath, "/groups") {
-		t.Errorf("path = %q, want it under /groups", gotPath)
-	}
-}
-
-// TestSMDRFEDelete_NoConfirm verifies "smd rfe delete --no-confirm" issues a
-// DELETE.
-func TestSMDRFEDelete_NoConfirm(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.Write([]byte(`{"code":0,"message":"ok"}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "smd", "--ignore-config", "rfe", "delete", "x0c0s0b0",
-		"--uri", srv.URL, "--token", "t", "--no-confirm")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-}

From 9d27d2fe6bf2879c59f81e2e884dd46bce2b58dd Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:50:11 -0600
Subject: [PATCH 02/14] test(cmd): group bss tests by command path

bss_test.go and bss_errors_test.go held tests for every bss command, and
the boot params set/update tests sat in bss_params_write_test.go and
bss_params_write_errors_test.go, so the tests for one command were split
across files.

Move the boot params, boot script, boot image, and hosts tests into
bss_boot_params_test.go, bss_boot_script_test.go,
bss_boot_image_test.go, and bss_hosts_test.go and their _errors_test.go
companions, leaving bss_test.go and bss_errors_test.go with only the
commands directly under bss. Retire the bss_params_write files. No test
logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 cmd/bss_boot_image_test.go                    |  49 +-
 cmd/bss_boot_params_errors_test.go            | 348 ++++++++++
 cmd/bss_boot_params_test.go                   | 558 +++++++++++++++
 ...test.go => bss_boot_script_errors_test.go} |  13 +-
 cmd/bss_boot_script_test.go                   |  70 ++
 cmd/bss_errors_test.go                        | 356 +---------
 cmd/bss_hosts_errors_test.go                  |  31 +
 cmd/bss_hosts_test.go                         |  66 ++
 cmd/bss_params_write_test.go                  |  65 --
 cmd/bss_test.go                               | 642 +-----------------
 10 files changed, 1131 insertions(+), 1067 deletions(-)
 create mode 100644 cmd/bss_boot_params_errors_test.go
 create mode 100644 cmd/bss_boot_params_test.go
 rename cmd/{bss_params_write_errors_test.go => bss_boot_script_errors_test.go} (57%)
 create mode 100644 cmd/bss_boot_script_test.go
 create mode 100644 cmd/bss_hosts_errors_test.go
 create mode 100644 cmd/bss_hosts_test.go
 delete mode 100644 cmd/bss_params_write_test.go

diff --git a/cmd/bss_boot_image_test.go b/cmd/bss_boot_image_test.go
index 4c05b53f..de39c9fc 100644
--- a/cmd/bss_boot_image_test.go
+++ b/cmd/bss_boot_image_test.go
@@ -4,11 +4,10 @@
 
 package cmd
 
-// bss_boot_image_test.go covers the branch families of "bss boot image set"
-// that the happy path (TestBSSBootImageSet_Success in bss_test.go) does not
-// reach: selector fan-out with per-selector "not found" warnings and selection
-// by --xname/--nid. Malformed or empty GET responses and GET/PUT HTTP error
-// mapping are covered in bss_boot_image_errors_test.go.
+// bss_boot_image_test.go covers "bss boot image set": the GET and PUT it
+// issues, selector fan-out with per-selector "not found" warnings, and
+// selection by --xname/--nid. Malformed or empty GET responses and GET/PUT
+// HTTP error mapping are covered in bss_boot_image_errors_test.go.
 
 import (
 	"io"
@@ -99,3 +98,43 @@ func TestBSSBootImageSet_ByXnameAndNid(t *testing.T) {
 		})
 	}
 }
+
+// TestBSSBootImageSet_Success verifies "bss boot image set" fetches the
+// existing boot parameters with a GET and writes the updated root back with a
+// PUT.
+func TestBSSBootImageSet_Success(t *testing.T) {
+	t.Parallel()
+
+	var methods []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		methods = append(methods, r.Method)
+		if r.Method == http.MethodGet {
+			// Return one boot-params entry matching the requested mac so the
+			// command has something to edit and PUT back.
+			w.Write([]byte(`[{"macs":["de:ad:be:ef:00:00"],"params":"console=tty0"}]`))
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "image", "set",
+		"--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--mac", "de:ad:be:ef:00:00", "/dev/sda1")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	// Expect at least one GET (fetch) followed by a PUT (update).
+	sawGet, sawPut := false, false
+	for _, m := range methods {
+		switch m {
+		case http.MethodGet:
+			sawGet = true
+		case http.MethodPut:
+			sawPut = true
+		}
+	}
+	if !sawGet || !sawPut {
+		t.Errorf("methods = %v, want at least one GET and one PUT", methods)
+	}
+}
diff --git a/cmd/bss_boot_params_errors_test.go b/cmd/bss_boot_params_errors_test.go
new file mode 100644
index 00000000..84e0e90f
--- /dev/null
+++ b/cmd/bss_boot_params_errors_test.go
@@ -0,0 +1,348 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestBSSBootParamsAdd_MissingSelectors verifies that add without -d and without
+// any of --xname/--nid/--mac is a usage error.
+func TestBSSBootParamsAdd_MissingSelectors(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
+		"--ignore-config", "--uri", "http://127.0.0.1:0", "--token", "faketoken",
+		"--kernel", "https://example.com/vmlinuz")
+
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeUsage {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBSSBootParamsGet_AllHTTPError verifies an unsuccessful HTTP response resolves
+// to CodeHTTP.
+func TestBSSBootParamsGet_AllHTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "boom", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
+		"--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
+
+// TestBSSBootParamsGet_AllNetworkError verifies pointing at a closed port resolves
+// to CodeNetwork.
+func TestBSSBootParamsGet_AllNetworkError(t *testing.T) {
+	t.Parallel()
+
+	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
+		"--ignore-config", "--uri", url, "--token", "t")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeNetwork {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
+	}
+}
+
+// TestBSSBootParamsAdd_MalformedPayload verifies malformed inline payload
+// resolves to CodePayload.
+func TestBSSBootParamsAdd_MalformedPayload(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
+		"--ignore-config", "--uri", srv.URL, "--token", "t", "-d", `not json`)
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBSSBootParamsUpdate_HTTPError verifies a failing PATCH resolves to
+// CodeHTTP.
+func TestBSSBootParamsUpdate_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "bad", http.StatusBadRequest)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update",
+		"--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
+
+// TestBSSBootParamsDelete_MissingSelector verifies delete without -d and without
+// a component selector is a usage error.
+func TestBSSBootParamsDelete_MissingSelector(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
+		"--ignore-config", "--uri", "http://127.0.0.1:1", "--token", "t", "--no-confirm")
+	if res.err == nil {
+		t.Fatal("expected a usage error, got nil")
+	}
+	if res.exitCode != cli.CodeUsage {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBSSBootParamsDelete_MissingConfig verifies delete with a component selector
+// but no config selector is a usage error.
+func TestBSSBootParamsDelete_MissingConfig(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
+		"--ignore-config", "--uri", "http://127.0.0.1:1", "--token", "t", "--no-confirm",
+		"--mac", "de:ad:be:ef:00:00")
+	if res.err == nil {
+		t.Fatal("expected a usage error, got nil")
+	}
+	if res.exitCode != cli.CodeUsage {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBSSBootParamsDelete_HTTPError verifies a failing DELETE resolves to
+// CodeHTTP.
+func TestBSSBootParamsDelete_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "bad", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
+		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
+
+// TestBSSBootParamsUpdate_MissingSelector verifies update without -d and without
+// a component selector is a usage error.
+func TestBSSBootParamsUpdate_MissingSelector(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config",
+		"--uri", "http://127.0.0.1:1", "--token", "t")
+	if res.err == nil || res.exitCode != cli.CodeUsage {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBSSBootParamsUpdate_MissingConfig verifies update with a component selector
+// but no config selector is a usage error.
+func TestBSSBootParamsUpdate_MissingConfig(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config",
+		"--uri", "http://127.0.0.1:1", "--token", "t", "--mac", "de:ad:be:ef:00:00")
+	if res.err == nil || res.exitCode != cli.CodeUsage {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBSSBootParamsSet_InvalidMac verifies an invalid MAC address is a usage
+// error for "set".
+func TestBSSBootParamsSet_InvalidMac(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set", "--ignore-config",
+		"--uri", "http://127.0.0.1:1", "--token", "t", "--mac", "not-a-mac", "--kernel", "http://k")
+	if res.err == nil || res.exitCode != cli.CodeUsage {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBSSBootParamsUpdate_NetworkError verifies a closed port surfaces
+// CodeNetwork for update.
+func TestBSSBootParamsUpdate_NetworkError(t *testing.T) {
+	t.Parallel()
+
+	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config", "--uri", url, "--token", "t",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
+	if res.err == nil || res.exitCode != cli.CodeNetwork {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
+	}
+}
+
+// TestBSSBootParamsAdd_InvalidMac verifies an invalid MAC is a usage error for
+// "add".
+func TestBSSBootParamsAdd_InvalidMac(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add", "--ignore-config",
+		"--uri", "http://127.0.0.1:1", "--token", "t", "--mac", "not-a-mac", "--kernel", "http://k")
+	if res.err == nil || res.exitCode != cli.CodeUsage {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBSSBootParamsAdd_NetworkError verifies a closed port surfaces CodeNetwork
+// for "add".
+func TestBSSBootParamsAdd_NetworkError(t *testing.T) {
+	t.Parallel()
+
+	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add", "--ignore-config", "--uri", url, "--token", "t",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
+	if res.err == nil || res.exitCode != cli.CodeNetwork {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
+	}
+}
+
+// TestBSSBootParamsSet_NetworkError verifies a closed port surfaces CodeNetwork
+// for "set".
+func TestBSSBootParamsSet_NetworkError(t *testing.T) {
+	t.Parallel()
+
+	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set", "--ignore-config", "--uri", url, "--token", "t",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
+	if res.err == nil || res.exitCode != cli.CodeNetwork {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
+	}
+}
+
+// TestBSSBootParamsDelete_NetworkError verifies a closed port surfaces
+// CodeNetwork for "delete".
+func TestBSSBootParamsDelete_NetworkError(t *testing.T) {
+	t.Parallel()
+
+	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete", "--ignore-config", "--uri", url, "--token", "t",
+		"--no-confirm", "--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
+	if res.err == nil || res.exitCode != cli.CodeNetwork {
+		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
+	}
+}
+
+// TestBSSBootParamsGet_MalformedResponse verifies that "bss boot params get
+// --xname" fails with CodePayload when the response can't be decoded.
+func TestBSSBootParamsGet_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BootParameters":[{"ID":"`)); err != nil {
+			t.Errorf("writing response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"bss", "boot", "params", "get", "--xname", "x0c0s1b0n0")
+
+	if res.err == nil {
+		t.Fatal("expected error for malformed JSON, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBSSBootParamsGetByXname_HTTPError verifies that "bss boot params get
+// --xname" fails with CodeHTTP for an HTTP 503 response.
+func TestBSSBootParamsGetByXname_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"bss", "boot", "params", "get", "--xname", "x0c0s1b0n0")
+
+	if res.err == nil {
+		t.Fatal("expected error for HTTP 503, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
+
+// TestBSSBootParamsGetByXname_NetworkError verifies that "bss boot params get
+// --xname" fails with CodeNetwork when BSS can't be reached.
+func TestBSSBootParamsGetByXname_NetworkError(t *testing.T) {
+	t.Parallel()
+
+	// Nothing listens on port 1, so the connection is refused.
+	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", "http://127.0.0.1:1", "--token", "t",
+		"bss", "boot", "params", "get", "--xname", "x0c0s1b0n0")
+
+	if res.err == nil {
+		t.Fatal("expected network error, got nil")
+	}
+	if res.exitCode != cli.CodeNetwork {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
+	}
+}
+
+// TestBSSBootParamsSet_HTTPError verifies an unsuccessful HTTP response resolves
+// to CodeHTTP.
+func TestBSSBootParamsSet_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "bad request", http.StatusBadRequest)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
+		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
diff --git a/cmd/bss_boot_params_test.go b/cmd/bss_boot_params_test.go
new file mode 100644
index 00000000..b47a78fa
--- /dev/null
+++ b/cmd/bss_boot_params_test.go
@@ -0,0 +1,558 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+// bss_boot_params_test.go exercises the "bss boot params" verbs (get, add,
+// set, update, delete) end-to-end against an httptest.Server, asserting
+// outbound request method/path/query/body. HTTP-failure and rejection-path
+// cases are covered in bss_boot_params_errors_test.go.
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+// TestBSSBootParamsGet_All verifies "bss boot params get" issues GET
+// /bootparameters and prints the response body.
+func TestBSSBootParamsGet_All(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		w.Write([]byte(`[{"hosts":["x0c0s0b0n0"]}]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
+		"--ignore-config", "--uri", srv.URL, "--token", "faketoken")
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+	if gotPath != "/bootparameters" {
+		t.Errorf("path = %q, want /bootparameters", gotPath)
+	}
+	if !strings.Contains(res.stdout, "x0c0s0b0n0") {
+		t.Errorf("stdout = %q, want it to contain the host", res.stdout)
+	}
+}
+
+// TestBSSBootParamsGet_WithMAC verifies that --mac is encoded into the query
+// string sent to /bootparameters.
+func TestBSSBootParamsGet_WithMAC(t *testing.T) {
+	t.Parallel()
+
+	var gotPath, gotQuery string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotQuery = r.URL.RawQuery
+		gotPath = r.URL.Path
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
+		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+		"--mac", "de:ad:be:ef:00:00")
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if !strings.Contains(gotQuery, "mac=de%3Aad%3Abe%3Aef%3A00%3A00") {
+		t.Errorf("query = %q, want it to contain the URL-encoded mac", gotQuery)
+	}
+	if gotPath != "/bootparameters" {
+		t.Errorf("path = %q, want /bootparameters", gotPath)
+	}
+}
+
+// TestBSSBootParamsAdd_ViaFlags verifies "bss boot params add" issues POST
+// /bootparameters with the kernel and macs encoded in the body.
+func TestBSSBootParamsAdd_ViaFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	var gotBody []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		var err error
+		gotBody, err = io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("read request body: %v", err)
+		}
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
+		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+		"--mac", "de:ad:be:ef:00:00",
+		"--kernel", "https://example.com/vmlinuz")
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost {
+		t.Errorf("method = %q, want POST", gotMethod)
+	}
+	if gotPath != "/bootparameters" {
+		t.Errorf("path = %q, want /bootparameters", gotPath)
+	}
+	var bp map[string]any
+	if err := json.Unmarshal(gotBody, &bp); err != nil {
+		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
+	}
+	if k, _ := bp["kernel"].(string); k != "https://example.com/vmlinuz" {
+		t.Errorf("kernel = %v, want https://example.com/vmlinuz", bp["kernel"])
+	}
+}
+
+// TestBSSBootParamsDelete_NoConfirm verifies "bss boot params delete --no-confirm"
+// issues DELETE /bootparameters.
+func TestBSSBootParamsDelete_NoConfirm(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
+		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+		"--no-confirm", "--mac", "de:ad:be:ef:00:00",
+		"--kernel", "https://example.com/vmlinuz")
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+	if gotPath != "/bootparameters" {
+		t.Errorf("path = %q, want /bootparameters", gotPath)
+	}
+}
+
+// TestBSSBootParamsGet_Query verifies the query builder emits name/mac/nid query
+// parameters for the corresponding flags.
+func TestBSSBootParamsGet_Query(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		args    []string
+		wantKey string
+		wantVal string
+	}{
+		{"xname", []string{"--xname", "x0c0s0b0n0"}, "name", "x0c0s0b0n0"},
+		{"mac", []string{"--mac", "de:ad:be:ef:00:00"}, "mac", "de:ad:be:ef:00:00"},
+		{"nid", []string{"--nid", "42"}, "nid", "42"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var gotQuery url.Values
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				gotQuery = r.URL.Query()
+				w.Write([]byte(`[]`))
+			}))
+			defer srv.Close()
+
+			args := append([]string{"bss", "boot", "params", "get",
+				"--ignore-config", "--uri", srv.URL, "--token", "t"}, tc.args...)
+			res := runOchamiWithRuntime(t, args...)
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+			if got := gotQuery.Get(tc.wantKey); got != tc.wantVal {
+				t.Errorf("query %s = %q, want %q", tc.wantKey, got, tc.wantVal)
+			}
+		})
+	}
+}
+
+// TestBSSBootParamsGet_Formats verifies the output-format variants.
+func TestBSSBootParamsGet_Formats(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`[{"macs":["de:ad:be:ef:00:00"],"params":"console=tty0"}]`))
+	}))
+	defer srv.Close()
+
+	for _, f := range []string{"json", "json-pretty", "yaml"} {
+		res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
+			"--ignore-config", "--uri", srv.URL, "--token", "t", "-F", f)
+		if res.err != nil {
+			t.Fatalf("format %s: unexpected error: %v (exit %d)", f, res.err, res.exitCode)
+		}
+		assertFormattedOutput(t, f, res.stdout, "params", "console=tty0")
+	}
+}
+
+// TestBSSBootParamsAdd_DataAndFlags verifies that "add -d <payload>" with
+// --mac sends a POST whose MACs come from the flag and whose kernel comes
+// from the payload.
+func TestBSSBootParamsAdd_DataAndFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	var gotBody []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		var err error
+		gotBody, err = io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("read request body: %v", err)
+		}
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"-d", `{"macs":["de:ad:be:ef:00:01"],"kernel":"https://example.com/vmlinuz"}`, "--mac", "de:ad:be:ef:00:00")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost {
+		t.Errorf("method = %q, want POST", gotMethod)
+	}
+	var bp struct {
+		Macs   []string `json:"macs"`
+		Kernel string   `json:"kernel"`
+	}
+	if err := json.Unmarshal(gotBody, &bp); err != nil {
+		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
+	}
+	if len(bp.Macs) != 1 || bp.Macs[0] != "de:ad:be:ef:00:00" {
+		t.Errorf("macs = %v, want the --mac value [de:ad:be:ef:00:00]", bp.Macs)
+	}
+	if bp.Kernel != "https://example.com/vmlinuz" {
+		t.Errorf("kernel = %q, want the payload's https://example.com/vmlinuz", bp.Kernel)
+	}
+}
+
+// TestBSSBootParamsAdd_AllFlags verifies that "bss boot params add" accepts
+// every component selector and config-field flag at once and sends a POST.
+func TestBSSBootParamsAdd_AllFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
+		"--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--xname", "x0c0s0b0n0", "--mac", "de:ad:be:ef:00:00", "--nid", "1",
+		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
+		"--params", "console=tty0")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost {
+		t.Errorf("method = %q, want POST", gotMethod)
+	}
+}
+
+// TestBSSBootParamsDelete_AllFlags verifies that "bss boot params delete
+// --no-confirm" accepts every component selector and config-field flag at once
+// and sends a DELETE.
+func TestBSSBootParamsDelete_AllFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
+		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
+		"--xname", "x0c0s0b0n0", "--mac", "de:ad:be:ef:00:00", "--nid", "1",
+		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
+		"--params", "console=tty0")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+}
+
+// TestBSSBootParamsSet_AllSelectorFlags verifies that "bss boot params set"
+// accepts every component selector (--xname, --mac, --nid) and config field
+// (--kernel, --initrd, --params) at once and sends a PUT.
+func TestBSSBootParamsSet_AllSelectorFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
+		"--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--xname", "x0c0s0b0n0", "--mac", "de:ad:be:ef:00:00", "--nid", "1",
+		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
+		"--params", "console=tty0")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPut {
+		t.Errorf("method = %q, want PUT", gotMethod)
+	}
+}
+
+// TestBSSBootParamsUpdate_AllSelectorFlags verifies that "bss boot params
+// update" accepts the --xname and --nid selectors together with every
+// config-field flag and sends a PATCH.
+func TestBSSBootParamsUpdate_AllSelectorFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update",
+		"--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--xname", "x0c0s0b0n0", "--nid", "1",
+		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
+		"--params", "console=tty0")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPatch {
+		t.Errorf("method = %q, want PATCH", gotMethod)
+	}
+}
+
+// TestBSSBootParamsSet_DataWithFlagOverride verifies that "set -d <payload>"
+// with --kernel sends a PUT whose kernel comes from the flag and whose MACs
+// come from the payload.
+func TestBSSBootParamsSet_DataWithFlagOverride(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	var gotBody []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		var err error
+		gotBody, err = io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("read request body: %v", err)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
+		"--ignore-config", "--uri", srv.URL, "--token", "t",
+		"-d", `{"macs":["de:ad:be:ef:00:00"],"kernel":"http://old/vmlinuz"}`,
+		"--kernel", "https://example.com/new-vmlinuz")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPut {
+		t.Errorf("method = %q, want PUT", gotMethod)
+	}
+	var bp struct {
+		Macs   []string `json:"macs"`
+		Kernel string   `json:"kernel"`
+	}
+	if err := json.Unmarshal(gotBody, &bp); err != nil {
+		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
+	}
+	if bp.Kernel != "https://example.com/new-vmlinuz" {
+		t.Errorf("kernel = %q, want the --kernel value https://example.com/new-vmlinuz", bp.Kernel)
+	}
+	if len(bp.Macs) != 1 || bp.Macs[0] != "de:ad:be:ef:00:00" {
+		t.Errorf("macs = %v, want the payload's [de:ad:be:ef:00:00]", bp.Macs)
+	}
+}
+
+// TestBSSBootParamsDelete_ByFlags verifies "delete --no-confirm" with component
+// and config flags issues a DELETE.
+func TestBSSBootParamsDelete_ByFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
+		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
+		"--xname", "x0c0s0b0n0", "--nid", "1", "--kernel", "https://example.com/vmlinuz",
+		"--initrd", "https://example.com/initrd", "--params", "quiet")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+}
+
+// TestBSSBootParamsDelete_ByData verifies "delete -d <payload>" issues a DELETE.
+func TestBSSBootParamsDelete_ByData(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
+		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
+		"-d", `{"macs":["de:ad:be:ef:00:00"]}`)
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+}
+
+// TestBSSBootParamsDelete_Confirm verifies the interactive confirm path issues
+// the DELETE when the user answers "y".
+func TestBSSBootParamsDelete_Confirm(t *testing.T) {
+	t.Parallel()
+
+	var deletes int
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodDelete {
+			deletes++
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithInputAndRuntime(t, "y\n",
+		"bss", "boot", "params", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if deletes != 1 {
+		t.Errorf("DELETE count = %d, want 1", deletes)
+	}
+}
+
+// TestBSSBootParamsUpdate_DataWithFlags verifies that "bss boot params update
+// -d <payload>" combined with --mac sends a PATCH whose MACs come from the
+// flag, and logs the "raw data passed" warning.
+func TestBSSBootParamsUpdate_DataWithFlags(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	var gotBody []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		var err error
+		gotBody, err = io.ReadAll(r.Body)
+		if err != nil {
+			t.Errorf("read request body: %v", err)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"-d", `{"macs":["de:ad:be:ef:00:00"],"kernel":"http://k"}`, "--mac", "de:ad:be:ef:00:01")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if !strings.Contains(res.stdout, "raw data passed, ignoring CLI configuration") {
+		t.Errorf("output = %q, want the raw data warning", res.stdout)
+	}
+	if gotMethod != http.MethodPatch {
+		t.Errorf("method = %q, want PATCH", gotMethod)
+	}
+	var bp struct {
+		Macs   []string `json:"macs"`
+		Kernel string   `json:"kernel"`
+	}
+	if err := json.Unmarshal(gotBody, &bp); err != nil {
+		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
+	}
+	if len(bp.Macs) != 1 || bp.Macs[0] != "de:ad:be:ef:00:01" {
+		t.Errorf("macs = %v, want the --mac value [de:ad:be:ef:00:01]", bp.Macs)
+	}
+}
+
+// TestBSSBootParamsSet_Success verifies "bss boot params set" issues PUT /bootparameters.
+func TestBSSBootParamsSet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
+		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPut {
+		t.Errorf("method = %q, want PUT", gotMethod)
+	}
+	if gotPath != "/bootparameters" {
+		t.Errorf("path = %q, want /bootparameters", gotPath)
+	}
+}
+
+// TestBSSBootParamsUpdate_Success verifies "bss boot params update" issues PATCH
+// /bootparameters.
+func TestBSSBootParamsUpdate_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update",
+		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPatch {
+		t.Errorf("method = %q, want PATCH", gotMethod)
+	}
+	if gotPath != "/bootparameters" {
+		t.Errorf("path = %q, want /bootparameters", gotPath)
+	}
+}
diff --git a/cmd/bss_params_write_errors_test.go b/cmd/bss_boot_script_errors_test.go
similarity index 57%
rename from cmd/bss_params_write_errors_test.go
rename to cmd/bss_boot_script_errors_test.go
index 9c101c79..16b556e2 100644
--- a/cmd/bss_params_write_errors_test.go
+++ b/cmd/bss_boot_script_errors_test.go
@@ -12,19 +12,18 @@ import (
 	"github.com/openchami/ochami/internal/cli"
 )
 
-// TestBSSBootParamsSet_HTTPError verifies an unsuccessful HTTP response resolves
-// to CodeHTTP.
-func TestBSSBootParamsSet_HTTPError(t *testing.T) {
+// TestBSSBootScriptGet_HTTPError verifies a failing boot-script GET resolves to
+// CodeHTTP.
+func TestBSSBootScriptGet_HTTPError(t *testing.T) {
 	t.Parallel()
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "bad request", http.StatusBadRequest)
+		http.Error(w, "boom", http.StatusInternalServerError)
 	}))
 	defer srv.Close()
 
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
-		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
+	res := runOchamiWithRuntime(t, "bss", "boot", "script", "get", "--ignore-config", "--uri", srv.URL,
+		"--mac", "de:ad:be:ef:00:00")
 	if res.err == nil {
 		t.Fatal("expected an error, got nil")
 	}
diff --git a/cmd/bss_boot_script_test.go b/cmd/bss_boot_script_test.go
new file mode 100644
index 00000000..4c3b18e7
--- /dev/null
+++ b/cmd/bss_boot_script_test.go
@@ -0,0 +1,70 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+// bss_boot_script_test.go exercises "bss boot script get" end-to-end against
+// an httptest.Server, asserting the outbound request and its query string.
+// HTTP-failure cases are covered in bss_boot_script_errors_test.go.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+)
+
+// TestBSSBootScriptGet_Success verifies "bss boot script get" issues GET /bootscript
+// with the selector encoded in the query string.
+func TestBSSBootScriptGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath, gotQuery string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath, gotQuery = r.URL.Path, r.URL.RawQuery
+		gotMethod = r.Method
+		w.Write([]byte(`#!ipxe`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "script", "get",
+		"--ignore-config", "--uri", srv.URL, "--mac", "de:ad:be:ef:00:00")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/bootscript" {
+		t.Errorf("path = %q, want /bootscript", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+	if !strings.Contains(gotQuery, "mac=de%3Aad%3Abe%3Aef%3A00%3A00") {
+		t.Errorf("query = %q, want it to contain the URL-encoded mac", gotQuery)
+	}
+}
+
+// TestBSSBootScriptGet_Query verifies the boot-script query builder emits the
+// xname (as name) and the retry, arch, and timestamp parameters.
+func TestBSSBootScriptGet_Query(t *testing.T) {
+	t.Parallel()
+
+	var gotQuery url.Values
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotQuery = r.URL.Query()
+		w.Write([]byte(`#!ipxe`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "boot", "script", "get", "--ignore-config", "--uri", srv.URL,
+		"--xname", "x0c0s0b0n0", "--retry", "3", "--arch", "x86_64", "--timestamp", "12345")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	for key, want := range map[string]string{"name": "x0c0s0b0n0", "retry": "3", "arch": "x86_64", "timestamp": "12345"} {
+		if got := gotQuery.Get(key); got != want {
+			t.Errorf("query %s = %q, want %q", key, got, want)
+		}
+	}
+}
diff --git a/cmd/bss_errors_test.go b/cmd/bss_errors_test.go
index 4da1b6f4..6733f776 100644
--- a/cmd/bss_errors_test.go
+++ b/cmd/bss_errors_test.go
@@ -4,8 +4,8 @@
 
 package cmd
 
-// bss_errors_test.go covers the error arms of the "bss" command group; see
-// bss_test.go for the success paths these mirror.
+// bss_errors_test.go covers the error arms of the commands directly under
+// "bss"; see bss_test.go for the success paths these mirror.
 
 import (
 	"net/http"
@@ -15,23 +15,6 @@ import (
 	"github.com/openchami/ochami/internal/cli"
 )
 
-// TestBSSBootParamsAdd_MissingSelectors verifies that add without -d and without
-// any of --xname/--nid/--mac is a usage error.
-func TestBSSBootParamsAdd_MissingSelectors(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
-		"--ignore-config", "--uri", "http://127.0.0.1:0", "--token", "faketoken",
-		"--kernel", "https://example.com/vmlinuz")
-
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeUsage {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
 // TestBSSServiceStatus_HTTPError verifies an unsuccessful HTTP response from the
 // status endpoint resolves to CodeHTTP.
 func TestBSSServiceStatus_HTTPError(t *testing.T) {
@@ -52,44 +35,6 @@ func TestBSSServiceStatus_HTTPError(t *testing.T) {
 	}
 }
 
-// TestBSSBootScriptGet_HTTPError verifies a failing boot-script GET resolves to
-// CodeHTTP.
-func TestBSSBootScriptGet_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "boom", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "script", "get", "--ignore-config", "--uri", srv.URL,
-		"--mac", "de:ad:be:ef:00:00")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
-// TestBSSHostsGet_HTTPError verifies a failing hosts GET resolves to CodeHTTP.
-func TestBSSHostsGet_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "boom", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "hosts", "get", "--ignore-config", "--uri", srv.URL, "--mac", "de:ad:be:ef:00:00")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
 // TestBSSHistoryGet_HTTPError verifies a failing history GET resolves to
 // CodeHTTP.
 func TestBSSHistoryGet_HTTPError(t *testing.T) {
@@ -108,300 +53,3 @@ func TestBSSHistoryGet_HTTPError(t *testing.T) {
 		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
 	}
 }
-
-// TestBSSBootParamsGet_AllHTTPError verifies an unsuccessful HTTP response resolves
-// to CodeHTTP.
-func TestBSSBootParamsGet_AllHTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "boom", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
-		"--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
-// TestBSSBootParamsGet_AllNetworkError verifies pointing at a closed port resolves
-// to CodeNetwork.
-func TestBSSBootParamsGet_AllNetworkError(t *testing.T) {
-	t.Parallel()
-
-	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
-		"--ignore-config", "--uri", url, "--token", "t")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeNetwork {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
-	}
-}
-
-// TestBSSBootParamsAdd_MalformedPayload verifies malformed inline payload
-// resolves to CodePayload.
-func TestBSSBootParamsAdd_MalformedPayload(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
-		"--ignore-config", "--uri", srv.URL, "--token", "t", "-d", `not json`)
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBSSBootParamsUpdate_HTTPError verifies a failing PATCH resolves to
-// CodeHTTP.
-func TestBSSBootParamsUpdate_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "bad", http.StatusBadRequest)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update",
-		"--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
-// TestBSSBootParamsDelete_MissingSelector verifies delete without -d and without
-// a component selector is a usage error.
-func TestBSSBootParamsDelete_MissingSelector(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
-		"--ignore-config", "--uri", "http://127.0.0.1:1", "--token", "t", "--no-confirm")
-	if res.err == nil {
-		t.Fatal("expected a usage error, got nil")
-	}
-	if res.exitCode != cli.CodeUsage {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
-// TestBSSBootParamsDelete_MissingConfig verifies delete with a component selector
-// but no config selector is a usage error.
-func TestBSSBootParamsDelete_MissingConfig(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
-		"--ignore-config", "--uri", "http://127.0.0.1:1", "--token", "t", "--no-confirm",
-		"--mac", "de:ad:be:ef:00:00")
-	if res.err == nil {
-		t.Fatal("expected a usage error, got nil")
-	}
-	if res.exitCode != cli.CodeUsage {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
-// TestBSSBootParamsDelete_HTTPError verifies a failing DELETE resolves to
-// CodeHTTP.
-func TestBSSBootParamsDelete_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "bad", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
-		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
-// TestBSSBootParamsUpdate_MissingSelector verifies update without -d and without
-// a component selector is a usage error.
-func TestBSSBootParamsUpdate_MissingSelector(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config",
-		"--uri", "http://127.0.0.1:1", "--token", "t")
-	if res.err == nil || res.exitCode != cli.CodeUsage {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
-// TestBSSBootParamsUpdate_MissingConfig verifies update with a component selector
-// but no config selector is a usage error.
-func TestBSSBootParamsUpdate_MissingConfig(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config",
-		"--uri", "http://127.0.0.1:1", "--token", "t", "--mac", "de:ad:be:ef:00:00")
-	if res.err == nil || res.exitCode != cli.CodeUsage {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
-// TestBSSBootParamsSet_InvalidMac verifies an invalid MAC address is a usage
-// error for "set".
-func TestBSSBootParamsSet_InvalidMac(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set", "--ignore-config",
-		"--uri", "http://127.0.0.1:1", "--token", "t", "--mac", "not-a-mac", "--kernel", "http://k")
-	if res.err == nil || res.exitCode != cli.CodeUsage {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
-// TestBSSBootParamsUpdate_NetworkError verifies a closed port surfaces
-// CodeNetwork for update.
-func TestBSSBootParamsUpdate_NetworkError(t *testing.T) {
-	t.Parallel()
-
-	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config", "--uri", url, "--token", "t",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
-	if res.err == nil || res.exitCode != cli.CodeNetwork {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
-	}
-}
-
-// TestBSSBootParamsAdd_InvalidMac verifies an invalid MAC is a usage error for
-// "add".
-func TestBSSBootParamsAdd_InvalidMac(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add", "--ignore-config",
-		"--uri", "http://127.0.0.1:1", "--token", "t", "--mac", "not-a-mac", "--kernel", "http://k")
-	if res.err == nil || res.exitCode != cli.CodeUsage {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
-// TestBSSBootParamsAdd_NetworkError verifies a closed port surfaces CodeNetwork
-// for "add".
-func TestBSSBootParamsAdd_NetworkError(t *testing.T) {
-	t.Parallel()
-
-	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add", "--ignore-config", "--uri", url, "--token", "t",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
-	if res.err == nil || res.exitCode != cli.CodeNetwork {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
-	}
-}
-
-// TestBSSBootParamsSet_NetworkError verifies a closed port surfaces CodeNetwork
-// for "set".
-func TestBSSBootParamsSet_NetworkError(t *testing.T) {
-	t.Parallel()
-
-	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set", "--ignore-config", "--uri", url, "--token", "t",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
-	if res.err == nil || res.exitCode != cli.CodeNetwork {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
-	}
-}
-
-// TestBSSBootParamsDelete_NetworkError verifies a closed port surfaces
-// CodeNetwork for "delete".
-func TestBSSBootParamsDelete_NetworkError(t *testing.T) {
-	t.Parallel()
-
-	url := "http://127.0.0.1:1" // nothing listens on port 1, so connections are refused
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete", "--ignore-config", "--uri", url, "--token", "t",
-		"--no-confirm", "--mac", "de:ad:be:ef:00:00", "--kernel", "http://k")
-	if res.err == nil || res.exitCode != cli.CodeNetwork {
-		t.Errorf("err=%v exit=%d, want %d (%s)", res.err, res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
-	}
-}
-
-// TestBSSBootParamsGet_MalformedResponse verifies that "bss boot params get
-// --xname" fails with CodePayload when the response can't be decoded.
-func TestBSSBootParamsGet_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BootParameters":[{"ID":"`)); err != nil {
-			t.Errorf("writing response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"bss", "boot", "params", "get", "--xname", "x0c0s1b0n0")
-
-	if res.err == nil {
-		t.Fatal("expected error for malformed JSON, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBSSBootParamsGetByXname_HTTPError verifies that "bss boot params get
-// --xname" fails with CodeHTTP for an HTTP 503 response.
-func TestBSSBootParamsGetByXname_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"bss", "boot", "params", "get", "--xname", "x0c0s1b0n0")
-
-	if res.err == nil {
-		t.Fatal("expected error for HTTP 503, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
-// TestBSSBootParamsGetByXname_NetworkError verifies that "bss boot params get
-// --xname" fails with CodeNetwork when BSS can't be reached.
-func TestBSSBootParamsGetByXname_NetworkError(t *testing.T) {
-	t.Parallel()
-
-	// Nothing listens on port 1, so the connection is refused.
-	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", "http://127.0.0.1:1", "--token", "t",
-		"bss", "boot", "params", "get", "--xname", "x0c0s1b0n0")
-
-	if res.err == nil {
-		t.Fatal("expected network error, got nil")
-	}
-	if res.exitCode != cli.CodeNetwork {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeNetwork, cli.CodeName(cli.CodeNetwork))
-	}
-}
diff --git a/cmd/bss_hosts_errors_test.go b/cmd/bss_hosts_errors_test.go
new file mode 100644
index 00000000..9760fdbf
--- /dev/null
+++ b/cmd/bss_hosts_errors_test.go
@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestBSSHostsGet_HTTPError verifies a failing hosts GET resolves to CodeHTTP.
+func TestBSSHostsGet_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "boom", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "hosts", "get", "--ignore-config", "--uri", srv.URL, "--mac", "de:ad:be:ef:00:00")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
diff --git a/cmd/bss_hosts_test.go b/cmd/bss_hosts_test.go
new file mode 100644
index 00000000..d60f6acd
--- /dev/null
+++ b/cmd/bss_hosts_test.go
@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+// bss_hosts_test.go exercises "bss hosts get" end-to-end against an
+// httptest.Server, asserting the outbound request, its query string, and the
+// output formats. HTTP-failure cases are covered in bss_hosts_errors_test.go.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+// TestBSSHostsGet_Success verifies "bss hosts get" issues GET /hosts.
+func TestBSSHostsGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "bss", "hosts", "get", "--ignore-config", "--uri", srv.URL)
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/hosts" {
+		t.Errorf("path = %q, want /hosts", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+}
+
+// TestBSSHostsGet_QueryAndFormats verifies the hosts query builder and
+// output-format variants.
+func TestBSSHostsGet_QueryAndFormats(t *testing.T) {
+	t.Parallel()
+
+	var gotQuery url.Values
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotQuery = r.URL.Query()
+		w.Write([]byte(`[{"ID":"x0c0s0b0n0"}]`))
+	}))
+	defer srv.Close()
+
+	for _, f := range []string{"json", "yaml"} {
+		res := runOchamiWithRuntime(t, "bss", "hosts", "get", "--ignore-config", "--uri", srv.URL,
+			"--xname", "x0c0s0b0n0", "-F", f)
+		if res.err != nil {
+			t.Fatalf("format %s: unexpected error: %v (exit %d)", f, res.err, res.exitCode)
+		}
+		assertFormattedOutput(t, f, res.stdout, "ID", "x0c0s0b0n0")
+	}
+	if len(gotQuery) == 0 {
+		t.Error("expected a non-empty query for --xname")
+	}
+}
diff --git a/cmd/bss_params_write_test.go b/cmd/bss_params_write_test.go
deleted file mode 100644
index 3f1bc16d..00000000
--- a/cmd/bss_params_write_test.go
+++ /dev/null
@@ -1,65 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-// bss_params_write_test.go covers the "bss boot params set" (PUT) and
-// "bss boot params update" (PATCH) verbs end-to-end against an httptest.Server.
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// TestBSSBootParamsSet_Success verifies "bss boot params set" issues PUT /bootparameters.
-func TestBSSBootParamsSet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
-		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPut {
-		t.Errorf("method = %q, want PUT", gotMethod)
-	}
-	if gotPath != "/bootparameters" {
-		t.Errorf("path = %q, want /bootparameters", gotPath)
-	}
-}
-
-// TestBSSBootParamsUpdate_Success verifies "bss boot params update" issues PATCH
-// /bootparameters.
-func TestBSSBootParamsUpdate_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update",
-		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPatch {
-		t.Errorf("method = %q, want PATCH", gotMethod)
-	}
-	if gotPath != "/bootparameters" {
-		t.Errorf("path = %q, want /bootparameters", gotPath)
-	}
-}
diff --git a/cmd/bss_test.go b/cmd/bss_test.go
index e0014bf6..d0a0f054 100644
--- a/cmd/bss_test.go
+++ b/cmd/bss_test.go
@@ -4,14 +4,14 @@
 
 package cmd
 
-// bss_test.go exercises representative "bss" commands end-to-end against an
-// httptest.Server, asserting outbound request method/path/query/body and the
-// exit codes that command errors resolve to. HTTP-failure and rejection-path
-// cases are covered in bss_errors_test.go.
+// bss_test.go exercises the commands directly under "bss" (dumpstate,
+// history, service status, and the deprecated status) end-to-end against an
+// httptest.Server, asserting outbound request method/path/query and the exit
+// codes that command errors resolve to. The "bss boot" and "bss hosts"
+// commands are covered in their own bss_<command>_test.go files, and
+// HTTP-failure cases in bss_errors_test.go.
 
 import (
-	"encoding/json"
-	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -19,135 +19,6 @@ import (
 	"testing"
 )
 
-// TestBSSBootParamsGet_All verifies "bss boot params get" issues GET
-// /bootparameters and prints the response body.
-func TestBSSBootParamsGet_All(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		gotPath = r.URL.Path
-		w.Write([]byte(`[{"hosts":["x0c0s0b0n0"]}]`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
-		"--ignore-config", "--uri", srv.URL, "--token", "faketoken")
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-	if gotPath != "/bootparameters" {
-		t.Errorf("path = %q, want /bootparameters", gotPath)
-	}
-	if !strings.Contains(res.stdout, "x0c0s0b0n0") {
-		t.Errorf("stdout = %q, want it to contain the host", res.stdout)
-	}
-}
-
-// TestBSSBootParamsGet_WithMAC verifies that --mac is encoded into the query
-// string sent to /bootparameters.
-func TestBSSBootParamsGet_WithMAC(t *testing.T) {
-	t.Parallel()
-
-	var gotPath, gotQuery string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotQuery = r.URL.RawQuery
-		gotPath = r.URL.Path
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
-		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-		"--mac", "de:ad:be:ef:00:00")
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if !strings.Contains(gotQuery, "mac=de%3Aad%3Abe%3Aef%3A00%3A00") {
-		t.Errorf("query = %q, want it to contain the URL-encoded mac", gotQuery)
-	}
-	if gotPath != "/bootparameters" {
-		t.Errorf("path = %q, want /bootparameters", gotPath)
-	}
-}
-
-// TestBSSBootParamsAdd_ViaFlags verifies "bss boot params add" issues POST
-// /bootparameters with the kernel and macs encoded in the body.
-func TestBSSBootParamsAdd_ViaFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	var gotBody []byte
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		gotPath = r.URL.Path
-		var err error
-		gotBody, err = io.ReadAll(r.Body)
-		if err != nil {
-			t.Errorf("read request body: %v", err)
-		}
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
-		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-		"--mac", "de:ad:be:ef:00:00",
-		"--kernel", "https://example.com/vmlinuz")
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost {
-		t.Errorf("method = %q, want POST", gotMethod)
-	}
-	if gotPath != "/bootparameters" {
-		t.Errorf("path = %q, want /bootparameters", gotPath)
-	}
-	var bp map[string]any
-	if err := json.Unmarshal(gotBody, &bp); err != nil {
-		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
-	}
-	if k, _ := bp["kernel"].(string); k != "https://example.com/vmlinuz" {
-		t.Errorf("kernel = %v, want https://example.com/vmlinuz", bp["kernel"])
-	}
-}
-
-// TestBSSBootParamsDelete_NoConfirm verifies "bss boot params delete --no-confirm"
-// issues DELETE /bootparameters.
-func TestBSSBootParamsDelete_NoConfirm(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		gotPath = r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
-		"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-		"--no-confirm", "--mac", "de:ad:be:ef:00:00",
-		"--kernel", "https://example.com/vmlinuz")
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-	if gotPath != "/bootparameters" {
-		t.Errorf("path = %q, want /bootparameters", gotPath)
-	}
-}
-
 // TestBSSDumpstate verifies "bss dumpstate" issues GET /dumpstate.
 func TestBSSDumpstate(t *testing.T) {
 	t.Parallel()
@@ -173,31 +44,6 @@ func TestBSSDumpstate(t *testing.T) {
 	}
 }
 
-// TestBSSHostsGet_Success verifies "bss hosts get" issues GET /hosts.
-func TestBSSHostsGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "hosts", "get", "--ignore-config", "--uri", srv.URL)
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/hosts" {
-		t.Errorf("path = %q, want /hosts", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-}
-
 // TestBSSServiceStatus_Success verifies "bss service status" issues GET /service/status.
 func TestBSSServiceStatus_Success(t *testing.T) {
 	t.Parallel()
@@ -223,35 +69,6 @@ func TestBSSServiceStatus_Success(t *testing.T) {
 	}
 }
 
-// TestBSSBootScriptGet_Success verifies "bss boot script get" issues GET /bootscript
-// with the selector encoded in the query string.
-func TestBSSBootScriptGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath, gotQuery string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath, gotQuery = r.URL.Path, r.URL.RawQuery
-		gotMethod = r.Method
-		w.Write([]byte(`#!ipxe`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "script", "get",
-		"--ignore-config", "--uri", srv.URL, "--mac", "de:ad:be:ef:00:00")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/bootscript" {
-		t.Errorf("path = %q, want /bootscript", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-	if !strings.Contains(gotQuery, "mac=de%3Aad%3Abe%3Aef%3A00%3A00") {
-		t.Errorf("query = %q, want it to contain the URL-encoded mac", gotQuery)
-	}
-}
-
 // TestBSSHistoryGet_Success verifies "bss history" issues GET /endpoint-history.
 func TestBSSHistoryGet_Success(t *testing.T) {
 	t.Parallel()
@@ -301,453 +118,6 @@ func TestBSSStatus_Deprecated(t *testing.T) {
 	}
 }
 
-// TestBSSBootImageSet_Success verifies "bss boot image set" fetches the
-// existing boot parameters with a GET and writes the updated root back with a
-// PUT.
-func TestBSSBootImageSet_Success(t *testing.T) {
-	t.Parallel()
-
-	var methods []string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		methods = append(methods, r.Method)
-		if r.Method == http.MethodGet {
-			// Return one boot-params entry matching the requested mac so the
-			// command has something to edit and PUT back.
-			w.Write([]byte(`[{"macs":["de:ad:be:ef:00:00"],"params":"console=tty0"}]`))
-			return
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "image", "set",
-		"--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--mac", "de:ad:be:ef:00:00", "/dev/sda1")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	// Expect at least one GET (fetch) followed by a PUT (update).
-	sawGet, sawPut := false, false
-	for _, m := range methods {
-		switch m {
-		case http.MethodGet:
-			sawGet = true
-		case http.MethodPut:
-			sawPut = true
-		}
-	}
-	if !sawGet || !sawPut {
-		t.Errorf("methods = %v, want at least one GET and one PUT", methods)
-	}
-}
-
-// TestBSSBootParamsGet_Query verifies the query builder emits name/mac/nid query
-// parameters for the corresponding flags.
-func TestBSSBootParamsGet_Query(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		args    []string
-		wantKey string
-		wantVal string
-	}{
-		{"xname", []string{"--xname", "x0c0s0b0n0"}, "name", "x0c0s0b0n0"},
-		{"mac", []string{"--mac", "de:ad:be:ef:00:00"}, "mac", "de:ad:be:ef:00:00"},
-		{"nid", []string{"--nid", "42"}, "nid", "42"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			var gotQuery url.Values
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				gotQuery = r.URL.Query()
-				w.Write([]byte(`[]`))
-			}))
-			defer srv.Close()
-
-			args := append([]string{"bss", "boot", "params", "get",
-				"--ignore-config", "--uri", srv.URL, "--token", "t"}, tc.args...)
-			res := runOchamiWithRuntime(t, args...)
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-			if got := gotQuery.Get(tc.wantKey); got != tc.wantVal {
-				t.Errorf("query %s = %q, want %q", tc.wantKey, got, tc.wantVal)
-			}
-		})
-	}
-}
-
-// TestBSSBootParamsGet_Formats verifies the output-format variants.
-func TestBSSBootParamsGet_Formats(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(`[{"macs":["de:ad:be:ef:00:00"],"params":"console=tty0"}]`))
-	}))
-	defer srv.Close()
-
-	for _, f := range []string{"json", "json-pretty", "yaml"} {
-		res := runOchamiWithRuntime(t, "bss", "boot", "params", "get",
-			"--ignore-config", "--uri", srv.URL, "--token", "t", "-F", f)
-		if res.err != nil {
-			t.Fatalf("format %s: unexpected error: %v (exit %d)", f, res.err, res.exitCode)
-		}
-		assertFormattedOutput(t, f, res.stdout, "params", "console=tty0")
-	}
-}
-
-// TestBSSBootParamsAdd_DataAndFlags verifies that "add -d <payload>" with
-// --mac sends a POST whose MACs come from the flag and whose kernel comes
-// from the payload.
-func TestBSSBootParamsAdd_DataAndFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	var gotBody []byte
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		var err error
-		gotBody, err = io.ReadAll(r.Body)
-		if err != nil {
-			t.Errorf("read request body: %v", err)
-		}
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"-d", `{"macs":["de:ad:be:ef:00:01"],"kernel":"https://example.com/vmlinuz"}`, "--mac", "de:ad:be:ef:00:00")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost {
-		t.Errorf("method = %q, want POST", gotMethod)
-	}
-	var bp struct {
-		Macs   []string `json:"macs"`
-		Kernel string   `json:"kernel"`
-	}
-	if err := json.Unmarshal(gotBody, &bp); err != nil {
-		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
-	}
-	if len(bp.Macs) != 1 || bp.Macs[0] != "de:ad:be:ef:00:00" {
-		t.Errorf("macs = %v, want the --mac value [de:ad:be:ef:00:00]", bp.Macs)
-	}
-	if bp.Kernel != "https://example.com/vmlinuz" {
-		t.Errorf("kernel = %q, want the payload's https://example.com/vmlinuz", bp.Kernel)
-	}
-}
-
-// TestBSSBootParamsAdd_AllFlags verifies that "bss boot params add" accepts
-// every component selector and config-field flag at once and sends a POST.
-func TestBSSBootParamsAdd_AllFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "add",
-		"--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--xname", "x0c0s0b0n0", "--mac", "de:ad:be:ef:00:00", "--nid", "1",
-		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
-		"--params", "console=tty0")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost {
-		t.Errorf("method = %q, want POST", gotMethod)
-	}
-}
-
-// TestBSSBootParamsDelete_AllFlags verifies that "bss boot params delete
-// --no-confirm" accepts every component selector and config-field flag at once
-// and sends a DELETE.
-func TestBSSBootParamsDelete_AllFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
-		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
-		"--xname", "x0c0s0b0n0", "--mac", "de:ad:be:ef:00:00", "--nid", "1",
-		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
-		"--params", "console=tty0")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-}
-
-// TestBSSBootParamsSet_AllSelectorFlags verifies that "bss boot params set"
-// accepts every component selector (--xname, --mac, --nid) and config field
-// (--kernel, --initrd, --params) at once and sends a PUT.
-func TestBSSBootParamsSet_AllSelectorFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
-		"--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--xname", "x0c0s0b0n0", "--mac", "de:ad:be:ef:00:00", "--nid", "1",
-		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
-		"--params", "console=tty0")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPut {
-		t.Errorf("method = %q, want PUT", gotMethod)
-	}
-}
-
-// TestBSSBootParamsUpdate_AllSelectorFlags verifies that "bss boot params
-// update" accepts the --xname and --nid selectors together with every
-// config-field flag and sends a PATCH.
-func TestBSSBootParamsUpdate_AllSelectorFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update",
-		"--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--xname", "x0c0s0b0n0", "--nid", "1",
-		"--kernel", "https://example.com/vmlinuz", "--initrd", "https://example.com/initrd",
-		"--params", "console=tty0")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPatch {
-		t.Errorf("method = %q, want PATCH", gotMethod)
-	}
-}
-
-// TestBSSBootParamsSet_DataWithFlagOverride verifies that "set -d <payload>"
-// with --kernel sends a PUT whose kernel comes from the flag and whose MACs
-// come from the payload.
-func TestBSSBootParamsSet_DataWithFlagOverride(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	var gotBody []byte
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		var err error
-		gotBody, err = io.ReadAll(r.Body)
-		if err != nil {
-			t.Errorf("read request body: %v", err)
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "set",
-		"--ignore-config", "--uri", srv.URL, "--token", "t",
-		"-d", `{"macs":["de:ad:be:ef:00:00"],"kernel":"http://old/vmlinuz"}`,
-		"--kernel", "https://example.com/new-vmlinuz")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPut {
-		t.Errorf("method = %q, want PUT", gotMethod)
-	}
-	var bp struct {
-		Macs   []string `json:"macs"`
-		Kernel string   `json:"kernel"`
-	}
-	if err := json.Unmarshal(gotBody, &bp); err != nil {
-		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
-	}
-	if bp.Kernel != "https://example.com/new-vmlinuz" {
-		t.Errorf("kernel = %q, want the --kernel value https://example.com/new-vmlinuz", bp.Kernel)
-	}
-	if len(bp.Macs) != 1 || bp.Macs[0] != "de:ad:be:ef:00:00" {
-		t.Errorf("macs = %v, want the payload's [de:ad:be:ef:00:00]", bp.Macs)
-	}
-}
-
-// TestBSSBootParamsDelete_ByFlags verifies "delete --no-confirm" with component
-// and config flags issues a DELETE.
-func TestBSSBootParamsDelete_ByFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
-		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
-		"--xname", "x0c0s0b0n0", "--nid", "1", "--kernel", "https://example.com/vmlinuz",
-		"--initrd", "https://example.com/initrd", "--params", "quiet")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-}
-
-// TestBSSBootParamsDelete_ByData verifies "delete -d <payload>" issues a DELETE.
-func TestBSSBootParamsDelete_ByData(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "delete",
-		"--ignore-config", "--uri", srv.URL, "--token", "t", "--no-confirm",
-		"-d", `{"macs":["de:ad:be:ef:00:00"]}`)
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-}
-
-// TestBSSBootParamsDelete_Confirm verifies the interactive confirm path issues
-// the DELETE when the user answers "y".
-func TestBSSBootParamsDelete_Confirm(t *testing.T) {
-	t.Parallel()
-
-	var deletes int
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodDelete {
-			deletes++
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithInputAndRuntime(t, "y\n",
-		"bss", "boot", "params", "delete", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--mac", "de:ad:be:ef:00:00", "--kernel", "https://example.com/vmlinuz")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if deletes != 1 {
-		t.Errorf("DELETE count = %d, want 1", deletes)
-	}
-}
-
-// TestBSSBootParamsUpdate_DataWithFlags verifies that "bss boot params update
-// -d <payload>" combined with --mac sends a PATCH whose MACs come from the
-// flag, and logs the "raw data passed" warning.
-func TestBSSBootParamsUpdate_DataWithFlags(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	var gotBody []byte
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		var err error
-		gotBody, err = io.ReadAll(r.Body)
-		if err != nil {
-			t.Errorf("read request body: %v", err)
-		}
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "params", "update", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"-d", `{"macs":["de:ad:be:ef:00:00"],"kernel":"http://k"}`, "--mac", "de:ad:be:ef:00:01")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if !strings.Contains(res.stdout, "raw data passed, ignoring CLI configuration") {
-		t.Errorf("output = %q, want the raw data warning", res.stdout)
-	}
-	if gotMethod != http.MethodPatch {
-		t.Errorf("method = %q, want PATCH", gotMethod)
-	}
-	var bp struct {
-		Macs   []string `json:"macs"`
-		Kernel string   `json:"kernel"`
-	}
-	if err := json.Unmarshal(gotBody, &bp); err != nil {
-		t.Fatalf("failed to unmarshal body %q: %v", string(gotBody), err)
-	}
-	if len(bp.Macs) != 1 || bp.Macs[0] != "de:ad:be:ef:00:01" {
-		t.Errorf("macs = %v, want the --mac value [de:ad:be:ef:00:01]", bp.Macs)
-	}
-}
-
-// TestBSSBootScriptGet_Query verifies the boot-script query builder emits the
-// xname (as name) and the retry, arch, and timestamp parameters.
-func TestBSSBootScriptGet_Query(t *testing.T) {
-	t.Parallel()
-
-	var gotQuery url.Values
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotQuery = r.URL.Query()
-		w.Write([]byte(`#!ipxe`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "bss", "boot", "script", "get", "--ignore-config", "--uri", srv.URL,
-		"--xname", "x0c0s0b0n0", "--retry", "3", "--arch", "x86_64", "--timestamp", "12345")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	for key, want := range map[string]string{"name": "x0c0s0b0n0", "retry": "3", "arch": "x86_64", "timestamp": "12345"} {
-		if got := gotQuery.Get(key); got != want {
-			t.Errorf("query %s = %q, want %q", key, got, want)
-		}
-	}
-}
-
-// TestBSSHostsGet_QueryAndFormats verifies the hosts query builder and
-// output-format variants.
-func TestBSSHostsGet_QueryAndFormats(t *testing.T) {
-	t.Parallel()
-
-	var gotQuery url.Values
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotQuery = r.URL.Query()
-		w.Write([]byte(`[{"ID":"x0c0s0b0n0"}]`))
-	}))
-	defer srv.Close()
-
-	for _, f := range []string{"json", "yaml"} {
-		res := runOchamiWithRuntime(t, "bss", "hosts", "get", "--ignore-config", "--uri", srv.URL,
-			"--xname", "x0c0s0b0n0", "-F", f)
-		if res.err != nil {
-			t.Fatalf("format %s: unexpected error: %v (exit %d)", f, res.err, res.exitCode)
-		}
-		assertFormattedOutput(t, f, res.stdout, "ID", "x0c0s0b0n0")
-	}
-	if len(gotQuery) == 0 {
-		t.Error("expected a non-empty query for --xname")
-	}
-}
-
 // TestBSSHistoryGet_QueryAndFormats verifies the history query builder and
 // output-format variants.
 func TestBSSHistoryGet_QueryAndFormats(t *testing.T) {

From 0fa671dbf183fa67f4adce9486f56cb390a78ef8 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:50:43 -0600
Subject: [PATCH 03/14] test(cmd): group boot and metadata tests by command
 path

The add, set, patch, and delete tests of the boot and metadata commands
sat in boot_write_test.go and metadata_write_test.go (and their
_errors_test.go companions), apart from the other tests of the same
subjects in boot_test.go and metadata_test.go.

Fold the write files into the family files, which hold the tables over
every resource type, and move the tests of a single resource type's
commands into boot_<type>_errors_test.go and metadata_group_test.go. No
test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 cmd/boot_bmc_errors_test.go       | 115 ++++++++++++
 cmd/boot_config_errors_test.go    | 105 +++++++++++
 cmd/boot_errors_test.go           | 290 +++---------------------------
 cmd/boot_node_errors_test.go      |  91 ++++++++++
 cmd/boot_test.go                  | 103 ++++++++++-
 cmd/boot_write_errors_test.go     |  38 ----
 cmd/boot_write_test.go            | 111 ------------
 cmd/metadata_errors_test.go       |  85 +++++++++
 cmd/metadata_group_test.go        |  37 ++++
 cmd/metadata_test.go              | 105 +++++++++--
 cmd/metadata_write_errors_test.go |  98 ----------
 cmd/metadata_write_test.go        | 116 ------------
 12 files changed, 644 insertions(+), 650 deletions(-)
 create mode 100644 cmd/boot_bmc_errors_test.go
 create mode 100644 cmd/boot_config_errors_test.go
 create mode 100644 cmd/boot_node_errors_test.go
 delete mode 100644 cmd/boot_write_errors_test.go
 delete mode 100644 cmd/boot_write_test.go
 create mode 100644 cmd/metadata_group_test.go
 delete mode 100644 cmd/metadata_write_errors_test.go
 delete mode 100644 cmd/metadata_write_test.go

diff --git a/cmd/boot_bmc_errors_test.go b/cmd/boot_bmc_errors_test.go
new file mode 100644
index 00000000..21e4d947
--- /dev/null
+++ b/cmd/boot_bmc_errors_test.go
@@ -0,0 +1,115 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestBootBmcAdd_MalformedResponse verifies that "boot bmc add" fails with
+// CodePayload when the service's success response can't be decoded.
+func TestBootBmcAdd_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BMCs":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "bmc", "add", "-d", `{}`)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBootBmcSet_MalformedResponse verifies that "boot bmc set" fails with
+// CodePayload when the service's success response can't be decoded.
+func TestBootBmcSet_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BMCs":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "bmc", "set", "x0c0s1b0n0", "-d", `{"xname":"test"}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBootBmcSet_EnvelopeMalformedResponse verifies that "boot bmc set -e"
+// fails with CodePayload when the service's success response can't be decoded.
+func TestBootBmcSet_EnvelopeMalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BMCs":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "bmc", "set", "-e", "x0c0s1b0n0", "-d", `{"spec":{"xname":"test"}}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBootBmcPatch_MalformedResponse verifies that "boot bmc patch" fails with
+// CodePayload when the service's success response can't be decoded.
+func TestBootBmcPatch_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BMCs":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "bmc", "patch", "x0c0s1b0n0", "-d", `{}`)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
diff --git a/cmd/boot_config_errors_test.go b/cmd/boot_config_errors_test.go
new file mode 100644
index 00000000..0fc4e5f4
--- /dev/null
+++ b/cmd/boot_config_errors_test.go
@@ -0,0 +1,105 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestBootConfigDelete_NoArgs verifies that "boot config delete" with no UID
+// arguments is a usage error (MinimumNArgs(1)).
+func TestBootConfigDelete_NoArgs(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "boot", "config", "delete", "--uri", "http://127.0.0.1:0", "--no-confirm")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeUsage {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestBootConfigAdd_MalformedResponse verifies that "boot config add" fails
+// with CodePayload when the service's success response can't be decoded.
+func TestBootConfigAdd_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BootConfigParams":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "config", "add", "-d", `{}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBootConfigPatch_MalformedResponse verifies that "boot config patch" fails
+// with CodePayload when the service's success response can't be decoded.
+func TestBootConfigPatch_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BootConfigParams":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "config", "patch", "x0c0s1b0n0", "-d", `{}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBootConfigSet_MalformedResponse verifies that "boot config set" fails
+// with CodePayload when the service's success response can't be decoded.
+func TestBootConfigSet_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"BootConfigParams":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "config", "set", "x0c0s1b0n0", "-d", `{}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
diff --git a/cmd/boot_errors_test.go b/cmd/boot_errors_test.go
index 996ce775..7cb24bf6 100644
--- a/cmd/boot_errors_test.go
+++ b/cmd/boot_errors_test.go
@@ -4,8 +4,9 @@
 
 package cmd
 
-// boot_errors_test.go covers the error arms of the "boot" command group; see
-// boot_test.go for the success paths these mirror.
+// boot_errors_test.go covers the error arms of the "boot" command group that
+// apply to every resource type; see boot_test.go for the success paths these
+// mirror, and boot_<type>_errors_test.go for the error arms of one type.
 
 import (
 	"net/http"
@@ -62,20 +63,6 @@ func TestBootGet_HTTPError(t *testing.T) {
 	}
 }
 
-// TestBootConfigDelete_NoArgs verifies that "boot config delete" with no UID
-// arguments is a usage error (MinimumNArgs(1)).
-func TestBootConfigDelete_NoArgs(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "boot", "config", "delete", "--uri", "http://127.0.0.1:0", "--no-confirm")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeUsage {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
 // TestBootList_NetworkError verifies a closed port resolves to CodeNetwork for
 // each boot type's list.
 func TestBootList_NetworkError(t *testing.T) {
@@ -245,260 +232,27 @@ func TestBootDelete_HTTPError(t *testing.T) {
 	}
 }
 
-// TestBootBmcAdd_MalformedResponse verifies that "boot bmc add" fails with
-// CodePayload when the service's success response can't be decoded.
-func TestBootBmcAdd_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BMCs":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "bmc", "add", "-d", `{}`)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootBmcSet_MalformedResponse verifies that "boot bmc set" fails with
-// CodePayload when the service's success response can't be decoded.
-func TestBootBmcSet_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BMCs":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "bmc", "set", "x0c0s1b0n0", "-d", `{"xname":"test"}`}
-	res := runOchamiWithRuntime(t, args...)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootBmcSet_EnvelopeMalformedResponse verifies that "boot bmc set -e"
-// fails with CodePayload when the service's success response can't be decoded.
-func TestBootBmcSet_EnvelopeMalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BMCs":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "bmc", "set", "-e", "x0c0s1b0n0", "-d", `{"spec":{"xname":"test"}}`}
-	res := runOchamiWithRuntime(t, args...)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootBmcPatch_MalformedResponse verifies that "boot bmc patch" fails with
-// CodePayload when the service's success response can't be decoded.
-func TestBootBmcPatch_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BMCs":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "bmc", "patch", "x0c0s1b0n0", "-d", `{}`)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootNodeAdd_MalformedResponse verifies that "boot node add" fails with
-// CodePayload when the service's success response can't be decoded.
-func TestBootNodeAdd_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"Nodes":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "node", "add", "-d", `{}`}
-	res := runOchamiWithRuntime(t, args...)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootNodePatch_MalformedResponse verifies that "boot node patch" fails
-// with CodePayload when the service's success response can't be decoded.
-func TestBootNodePatch_MalformedResponse(t *testing.T) {
+// TestBootAdd_HTTPError verifies that "boot <type> add" fails with CodeHTTP for
+// an unsuccessful HTTP response, for every boot resource type.
+func TestBootAdd_HTTPError(t *testing.T) {
 	t.Parallel()
 
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"Nodes":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "node", "patch", "x0c0s1b0n0", "-d", `{}`}
-	res := runOchamiWithRuntime(t, args...)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootNodeSet_MalformedResponse verifies that "boot node set" fails with
-// CodePayload when the service's success response can't be decoded.
-func TestBootNodeSet_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"Nodes":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "node", "set", "x0c0s1b0n0", "-d", `{}`}
-	res := runOchamiWithRuntime(t, args...)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootConfigAdd_MalformedResponse verifies that "boot config add" fails
-// with CodePayload when the service's success response can't be decoded.
-func TestBootConfigAdd_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BootConfigParams":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "config", "add", "-d", `{}`}
-	res := runOchamiWithRuntime(t, args...)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootConfigPatch_MalformedResponse verifies that "boot config patch" fails
-// with CodePayload when the service's success response can't be decoded.
-func TestBootConfigPatch_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BootConfigParams":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "config", "patch", "x0c0s1b0n0", "-d", `{}`}
-	res := runOchamiWithRuntime(t, args...)
-
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
-// TestBootConfigSet_MalformedResponse verifies that "boot config set" fails
-// with CodePayload when the service's success response can't be decoded.
-func TestBootConfigSet_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		if _, err := w.Write([]byte(`{"BootConfigParams":[{"ID":`)); err != nil {
-			t.Errorf("write response: %v", err)
-		}
-	}))
-	defer srv.Close()
-
-	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
-		"boot", "config", "set", "x0c0s1b0n0", "-d", `{}`}
-	res := runOchamiWithRuntime(t, args...)
+	for _, typ := range []string{"config", "node", "bmc"} {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Error(w, "bad request", http.StatusBadRequest)
+			}))
+			defer srv.Close()
 
-	if res.err == nil {
-		t.Fatal("expected malformed response error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+			res := runOchamiWithRuntime(t, "boot", typ, "add",
+				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+				"-d", bootAddPayload(typ))
+			if res.err == nil {
+				t.Fatal("expected an error, got nil")
+			}
+			if res.exitCode != cli.CodeHTTP {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+			}
+		})
 	}
 }
diff --git a/cmd/boot_node_errors_test.go b/cmd/boot_node_errors_test.go
new file mode 100644
index 00000000..708f388d
--- /dev/null
+++ b/cmd/boot_node_errors_test.go
@@ -0,0 +1,91 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestBootNodeAdd_MalformedResponse verifies that "boot node add" fails with
+// CodePayload when the service's success response can't be decoded.
+func TestBootNodeAdd_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"Nodes":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "node", "add", "-d", `{}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBootNodePatch_MalformedResponse verifies that "boot node patch" fails
+// with CodePayload when the service's success response can't be decoded.
+func TestBootNodePatch_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"Nodes":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "node", "patch", "x0c0s1b0n0", "-d", `{}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestBootNodeSet_MalformedResponse verifies that "boot node set" fails with
+// CodePayload when the service's success response can't be decoded.
+func TestBootNodeSet_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		if _, err := w.Write([]byte(`{"Nodes":[{"ID":`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer srv.Close()
+
+	args := []string{"--ignore-config", "--cluster-uri", srv.URL, "--token", "t",
+		"boot", "node", "set", "x0c0s1b0n0", "-d", `{}`}
+	res := runOchamiWithRuntime(t, args...)
+
+	if res.err == nil {
+		t.Fatal("expected malformed response error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
diff --git a/cmd/boot_test.go b/cmd/boot_test.go
index 5231f62e..d2b1626c 100644
--- a/cmd/boot_test.go
+++ b/cmd/boot_test.go
@@ -5,10 +5,12 @@
 package cmd
 
 // boot_test.go provides end-to-end tests for the "boot" command group, whose
-// client wraps the upstream boot-service library. Because the library controls
-// the exact request paths, these tests assert exit-code behavior rather than
-// exact request routing. HTTP-failure and rejection-path cases are covered in
-// boot_errors_test.go.
+// client wraps the upstream boot-service library: tables over the resource
+// types (config, node, bmc) that share each verb, and "boot service status".
+// Because the library controls the exact request paths, these tests assert
+// exit-code behavior rather than exact request routing. HTTP-failure and
+// rejection-path cases are covered in boot_errors_test.go, and those specific
+// to one resource type in boot_<type>_errors_test.go.
 
 import (
 	"net/http"
@@ -447,3 +449,96 @@ func TestBootPatch_StdinData(t *testing.T) {
 		})
 	}
 }
+
+// bootAddPayload returns a minimal add payload for each boot resource type.
+func bootAddPayload(typ string) string {
+	switch typ {
+	case "config":
+		return `{"name":"compute-boot","hosts":["x0c0s0b0n0"],"kernel":"http://s3/vmlinuz"}`
+	case "node":
+		return `{"name":"node-1","xname":"x0c0s0b0n0"}`
+	case "bmc":
+		return `{"name":"bmc-1","xname":"x0c0s0b0"}`
+	default:
+		return `{"name":"thing-1"}`
+	}
+}
+
+// TestBootAdd_Success verifies that "boot <type> add" succeeds for every boot
+// resource type.
+func TestBootAdd_Success(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range []string{"config", "node", "bmc"} {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusCreated)
+				w.Write([]byte(`{}`))
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithRuntime(t, "boot", typ, "add",
+				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+				"-d", bootAddPayload(typ))
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+			if res.exitCode != cli.CodeSuccess {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+			}
+		})
+	}
+}
+
+// TestBootSet_Success verifies that "boot <type> set" succeeds for every boot
+// resource type.
+func TestBootSet_Success(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range []string{"config", "node", "bmc"} {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.Write([]byte(`{}`))
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithRuntime(t, "boot", typ, "set", "some-uid",
+				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+				"-d", bootAddPayload(typ))
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+			if res.exitCode != cli.CodeSuccess {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+			}
+		})
+	}
+}
+
+// TestBootPatch_Success verifies that "boot <type> patch" with a payload
+// succeeds for every boot resource type.
+func TestBootPatch_Success(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range []string{"config", "node", "bmc"} {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.Write([]byte(`{}`))
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithRuntime(t, "boot", typ, "patch", "some-uid",
+				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
+				"-d", bootAddPayload(typ))
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+			if res.exitCode != cli.CodeSuccess {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+			}
+		})
+	}
+}
diff --git a/cmd/boot_write_errors_test.go b/cmd/boot_write_errors_test.go
deleted file mode 100644
index c9e02cde..00000000
--- a/cmd/boot_write_errors_test.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/openchami/ochami/internal/cli"
-)
-
-// TestBootAdd_HTTPError verifies that "boot <type> add" fails with CodeHTTP for
-// an unsuccessful HTTP response, for every boot resource type.
-func TestBootAdd_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range []string{"config", "node", "bmc"} {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				http.Error(w, "bad request", http.StatusBadRequest)
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "boot", typ, "add",
-				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-				"-d", bootAddPayload(typ))
-			if res.err == nil {
-				t.Fatal("expected an error, got nil")
-			}
-			if res.exitCode != cli.CodeHTTP {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-			}
-		})
-	}
-}
diff --git a/cmd/boot_write_test.go b/cmd/boot_write_test.go
deleted file mode 100644
index 4bd6cab8..00000000
--- a/cmd/boot_write_test.go
+++ /dev/null
@@ -1,111 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-// boot_write_test.go covers the "boot" command group's write verbs (add, set,
-// patch). As with boot_test.go, the boot-service client wraps an upstream
-// library that controls exact routing, so these tests assert exit-code behavior
-// for success rather than exact paths.
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/openchami/ochami/internal/cli"
-)
-
-// bootAddPayload returns a minimal add payload for each boot resource type.
-func bootAddPayload(typ string) string {
-	switch typ {
-	case "config":
-		return `{"name":"compute-boot","hosts":["x0c0s0b0n0"],"kernel":"http://s3/vmlinuz"}`
-	case "node":
-		return `{"name":"node-1","xname":"x0c0s0b0n0"}`
-	case "bmc":
-		return `{"name":"bmc-1","xname":"x0c0s0b0"}`
-	default:
-		return `{"name":"thing-1"}`
-	}
-}
-
-// TestBootAdd_Success verifies that "boot <type> add" succeeds for every boot
-// resource type.
-func TestBootAdd_Success(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range []string{"config", "node", "bmc"} {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "application/json")
-				w.WriteHeader(http.StatusCreated)
-				w.Write([]byte(`{}`))
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "boot", typ, "add",
-				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-				"-d", bootAddPayload(typ))
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-			if res.exitCode != cli.CodeSuccess {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
-			}
-		})
-	}
-}
-
-// TestBootSet_Success verifies that "boot <type> set" succeeds for every boot
-// resource type.
-func TestBootSet_Success(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range []string{"config", "node", "bmc"} {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "application/json")
-				w.Write([]byte(`{}`))
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "boot", typ, "set", "some-uid",
-				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-				"-d", bootAddPayload(typ))
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-			if res.exitCode != cli.CodeSuccess {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
-			}
-		})
-	}
-}
-
-// TestBootPatch_Success verifies that "boot <type> patch" with a payload
-// succeeds for every boot resource type.
-func TestBootPatch_Success(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range []string{"config", "node", "bmc"} {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "application/json")
-				w.Write([]byte(`{}`))
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "boot", typ, "patch", "some-uid",
-				"--ignore-config", "--uri", srv.URL, "--token", "faketoken",
-				"-d", bootAddPayload(typ))
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-			if res.exitCode != cli.CodeSuccess {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
-			}
-		})
-	}
-}
diff --git a/cmd/metadata_errors_test.go b/cmd/metadata_errors_test.go
index 20ac3ca5..a69a1bc6 100644
--- a/cmd/metadata_errors_test.go
+++ b/cmd/metadata_errors_test.go
@@ -11,6 +11,7 @@ package cmd
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/openchami/ochami/internal/cli"
@@ -197,3 +198,87 @@ func TestMetadataServiceStatus_HTTPError(t *testing.T) {
 		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
 	}
 }
+
+// TestMetadataAdd_HTTPError verifies that "metadata <type> add" fails with
+// CodeHTTP for an unsuccessful HTTP response, for every metadata resource type.
+func TestMetadataAdd_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range metadataTypes {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Error(w, "bad request", http.StatusBadRequest)
+			}))
+			defer srv.Close()
+
+			t.Parallel()
+			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "add",
+				"--uri", srv.URL, "--token", "t",
+				"-d", addPayloadFor(typ))
+			if res.err == nil {
+				t.Fatal("expected an error, got nil")
+			}
+			if res.exitCode != cli.CodeHTTP {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+			}
+		})
+	}
+}
+
+// TestMetadataDelete_AbortsOnNo verifies that answering "n" at the confirmation
+// prompt aborts deletion without contacting the server, for every metadata
+// resource type.
+func TestMetadataDelete_AbortsOnNo(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range metadataTypes {
+		t.Run(typ, func(t *testing.T) {
+			var contacted bool
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				// Only record calls to the delete verb (the client may issue a
+				// preliminary request); any DELETE means confirmation failed to abort.
+				if r.Method == http.MethodDelete {
+					contacted = true
+				}
+				w.WriteHeader(http.StatusOK)
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithInputAndRuntime(t, "n\n", "--ignore-config", "metadata", typ, "delete", "some-uid",
+				"--uri", srv.URL, "--token", "t")
+			if res.exitCode != cli.CodeDeclined {
+				t.Fatalf("result = (err %v, exit %d), want %d (%s)", res.err, res.exitCode, cli.CodeDeclined, cli.CodeName(cli.CodeDeclined))
+			}
+			if !strings.Contains(res.stdout, "Really delete?") {
+				t.Errorf("output = %q, want the confirmation prompt", res.stdout)
+			}
+			if contacted {
+				t.Error("server received a DELETE despite user declining confirmation")
+			}
+		})
+	}
+}
+
+// TestMetadataDelete_HTTPError verifies that an unsuccessful HTTP response to
+// a delete fails the command for every metadata resource type.
+func TestMetadataDelete_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range metadataTypes {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				http.Error(w, "not found", http.StatusNotFound)
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "delete", "some-uid",
+				"--uri", srv.URL, "--token", "t", "--no-confirm")
+			if res.err == nil {
+				t.Fatal("expected an error, got nil")
+			}
+			if res.exitCode != cli.CodeHTTP {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+			}
+		})
+	}
+}
diff --git a/cmd/metadata_group_test.go b/cmd/metadata_group_test.go
new file mode 100644
index 00000000..8cbebecf
--- /dev/null
+++ b/cmd/metadata_group_test.go
@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+// metadata_group_test.go exercises the "metadata group" commands that the
+// cross-type tables in metadata_test.go don't cover.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestMetadataGroupList_Success verifies that "metadata group list" exits
+// successfully when the service returns a valid list response.
+func TestMetadataGroupList_Success(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "metadata", "group", "list", "--uri", srv.URL, "--token", "faketoken")
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if res.exitCode != cli.CodeSuccess {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+	}
+}
diff --git a/cmd/metadata_test.go b/cmd/metadata_test.go
index 33b8b2af..82ac266e 100644
--- a/cmd/metadata_test.go
+++ b/cmd/metadata_test.go
@@ -8,8 +8,8 @@ package cmd
 // four resource types (defaults, group, instance, peer). The metadata client
 // wraps an upstream library, so these tests assert exit-code behavior rather
 // than exact request routing (routing for the metadata client is covered by its
-// own package tests). HTTP-failure cases are covered in
-// metadata_errors_test.go.
+// own package tests). Tests of one resource type's commands live in
+// metadata_<type>_test.go, and HTTP-failure cases in metadata_errors_test.go.
 
 import (
 	"io"
@@ -477,23 +477,98 @@ func TestMetadataSet_NilResource(t *testing.T) {
 	}
 }
 
-// TestMetadataGroupList_Success verifies that "metadata group list" exits
-// successfully when the service returns a valid list response.
-func TestMetadataGroupList_Success(t *testing.T) {
+// metadataTypes are the four metadata resource types that share a common verb
+// surface.
+var metadataTypes = []string{"defaults", "group", "instance", "peer"}
+
+// addPayloadFor returns a minimal JSON payload accepted by "<type> add" for the
+// given resource type. All four accept a name plus type-appropriate fields.
+func addPayloadFor(typ string) string {
+	switch typ {
+	case "peer":
+		return `{"name":"peer-1","publicKey":"abc","allowedIP":"10.0.0.1/32"}`
+	default:
+		return `{"name":"thing-1"}`
+	}
+}
+
+// TestMetadataAdd_Success verifies that "metadata <type> add" succeeds for
+// every metadata resource type.
+func TestMetadataAdd_Success(t *testing.T) {
 	t.Parallel()
 
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
+	for _, typ := range metadataTypes {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusCreated)
+				w.Write([]byte(`{"metadata":{"name":"thing-1"}}`))
+			}))
+			defer srv.Close()
 
-	res := runOchamiWithRuntime(t, "--ignore-config", "metadata", "group", "list", "--uri", srv.URL, "--token", "faketoken")
+			t.Parallel()
+			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "add",
+				"--uri", srv.URL, "--token", "t",
+				"-d", addPayloadFor(typ))
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+			if res.exitCode != cli.CodeSuccess {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+			}
+		})
+	}
+}
 
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+// TestMetadataSet_Success verifies that "metadata <type> set" succeeds for
+// every metadata resource type.
+func TestMetadataSet_Success(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range metadataTypes {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.Write([]byte(`{"metadata":{"name":"thing-1"}}`))
+			}))
+			defer srv.Close()
+
+			t.Parallel()
+			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "set", "some-uid",
+				"--uri", srv.URL, "--token", "t",
+				"-d", addPayloadFor(typ))
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+			if res.exitCode != cli.CodeSuccess {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+			}
+		})
 	}
-	if res.exitCode != cli.CodeSuccess {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+}
+
+// TestMetadataDelete_NoConfirm verifies that "metadata <type> delete
+// --no-confirm" deletes without prompting, for every metadata resource type.
+func TestMetadataDelete_NoConfirm(t *testing.T) {
+	t.Parallel()
+
+	for _, typ := range metadataTypes {
+		t.Run(typ, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				w.Write([]byte(`{}`))
+			}))
+			defer srv.Close()
+
+			t.Parallel()
+			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "delete", "some-uid",
+				"--uri", srv.URL, "--token", "t", "--no-confirm")
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+			if res.exitCode != cli.CodeSuccess {
+				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+			}
+		})
 	}
 }
diff --git a/cmd/metadata_write_errors_test.go b/cmd/metadata_write_errors_test.go
deleted file mode 100644
index 9a9fe8a4..00000000
--- a/cmd/metadata_write_errors_test.go
+++ /dev/null
@@ -1,98 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/openchami/ochami/internal/cli"
-)
-
-// TestMetadataAdd_HTTPError verifies that "metadata <type> add" fails with
-// CodeHTTP for an unsuccessful HTTP response, for every metadata resource type.
-func TestMetadataAdd_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range metadataTypes {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				http.Error(w, "bad request", http.StatusBadRequest)
-			}))
-			defer srv.Close()
-
-			t.Parallel()
-			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "add",
-				"--uri", srv.URL, "--token", "t",
-				"-d", addPayloadFor(typ))
-			if res.err == nil {
-				t.Fatal("expected an error, got nil")
-			}
-			if res.exitCode != cli.CodeHTTP {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-			}
-		})
-	}
-}
-
-// TestMetadataDelete_AbortsOnNo verifies that answering "n" at the confirmation
-// prompt aborts deletion without contacting the server, for every metadata
-// resource type.
-func TestMetadataDelete_AbortsOnNo(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range metadataTypes {
-		t.Run(typ, func(t *testing.T) {
-			var contacted bool
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				// Only record calls to the delete verb (the client may issue a
-				// preliminary request); any DELETE means confirmation failed to abort.
-				if r.Method == http.MethodDelete {
-					contacted = true
-				}
-				w.WriteHeader(http.StatusOK)
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithInputAndRuntime(t, "n\n", "--ignore-config", "metadata", typ, "delete", "some-uid",
-				"--uri", srv.URL, "--token", "t")
-			if res.exitCode != cli.CodeDeclined {
-				t.Fatalf("result = (err %v, exit %d), want %d (%s)", res.err, res.exitCode, cli.CodeDeclined, cli.CodeName(cli.CodeDeclined))
-			}
-			if !strings.Contains(res.stdout, "Really delete?") {
-				t.Errorf("output = %q, want the confirmation prompt", res.stdout)
-			}
-			if contacted {
-				t.Error("server received a DELETE despite user declining confirmation")
-			}
-		})
-	}
-}
-
-// TestMetadataDelete_HTTPError verifies that an unsuccessful HTTP response to
-// a delete fails the command for every metadata resource type.
-func TestMetadataDelete_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range metadataTypes {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				http.Error(w, "not found", http.StatusNotFound)
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "delete", "some-uid",
-				"--uri", srv.URL, "--token", "t", "--no-confirm")
-			if res.err == nil {
-				t.Fatal("expected an error, got nil")
-			}
-			if res.exitCode != cli.CodeHTTP {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-			}
-		})
-	}
-}
diff --git a/cmd/metadata_write_test.go b/cmd/metadata_write_test.go
deleted file mode 100644
index 8f8b4b13..00000000
--- a/cmd/metadata_write_test.go
+++ /dev/null
@@ -1,116 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-// metadata_write_test.go exercises the add, set, and delete verbs of the
-// "metadata" subcommands across the four resource types. The metadata client
-// wraps an upstream library, so these tests assert exit-code behavior rather
-// than exact request routing (routing is covered by the client package's own
-// tests). HTTP failures and the declined delete confirmation are covered in
-// metadata_write_errors_test.go.
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/openchami/ochami/internal/cli"
-)
-
-// metadataTypes are the four metadata resource types that share a common verb
-// surface.
-var metadataTypes = []string{"defaults", "group", "instance", "peer"}
-
-// addPayloadFor returns a minimal JSON payload accepted by "<type> add" for the
-// given resource type. All four accept a name plus type-appropriate fields.
-func addPayloadFor(typ string) string {
-	switch typ {
-	case "peer":
-		return `{"name":"peer-1","publicKey":"abc","allowedIP":"10.0.0.1/32"}`
-	default:
-		return `{"name":"thing-1"}`
-	}
-}
-
-// TestMetadataAdd_Success verifies that "metadata <type> add" succeeds for
-// every metadata resource type.
-func TestMetadataAdd_Success(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range metadataTypes {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "application/json")
-				w.WriteHeader(http.StatusCreated)
-				w.Write([]byte(`{"metadata":{"name":"thing-1"}}`))
-			}))
-			defer srv.Close()
-
-			t.Parallel()
-			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "add",
-				"--uri", srv.URL, "--token", "t",
-				"-d", addPayloadFor(typ))
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-			if res.exitCode != cli.CodeSuccess {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
-			}
-		})
-	}
-}
-
-// TestMetadataSet_Success verifies that "metadata <type> set" succeeds for
-// every metadata resource type.
-func TestMetadataSet_Success(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range metadataTypes {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "application/json")
-				w.Write([]byte(`{"metadata":{"name":"thing-1"}}`))
-			}))
-			defer srv.Close()
-
-			t.Parallel()
-			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "set", "some-uid",
-				"--uri", srv.URL, "--token", "t",
-				"-d", addPayloadFor(typ))
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-			if res.exitCode != cli.CodeSuccess {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
-			}
-		})
-	}
-}
-
-// TestMetadataDelete_NoConfirm verifies that "metadata <type> delete
-// --no-confirm" deletes without prompting, for every metadata resource type.
-func TestMetadataDelete_NoConfirm(t *testing.T) {
-	t.Parallel()
-
-	for _, typ := range metadataTypes {
-		t.Run(typ, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "application/json")
-				w.Write([]byte(`{}`))
-			}))
-			defer srv.Close()
-
-			t.Parallel()
-			res := runOchamiWithRuntime(t, "metadata", "--ignore-config", typ, "delete", "some-uid",
-				"--uri", srv.URL, "--token", "t", "--no-confirm")
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-			if res.exitCode != cli.CodeSuccess {
-				t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
-			}
-		})
-	}
-}

From 3e1f89e339bd421a4bb6d34306470ed64601479d Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:51:17 -0600
Subject: [PATCH 04/14] test(cmd): group cloud-init tests by command path

cloud_init_test.go held happy-path tests for the group, node, and
defaults commands, whose other tests live in cloud_init_group_test.go
and cloud_init_node_test.go.

Move them into the matching cloud_init_<command>_test.go files, and the
defaults tests into new cloud_init_defaults_test.go and
cloud_init_defaults_errors_test.go files, leaving cloud_init_test.go
with only the service commands. No test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 cmd/cloud_init_defaults_errors_test.go |  36 +++++
 cmd/cloud_init_defaults_test.go        |  63 ++++++++
 cmd/cloud_init_errors_test.go          |  23 ---
 cmd/cloud_init_group_test.go           | 145 ++++++++++++++++-
 cmd/cloud_init_node_test.go            |  27 +++-
 cmd/cloud_init_test.go                 | 214 +------------------------
 6 files changed, 268 insertions(+), 240 deletions(-)
 create mode 100644 cmd/cloud_init_defaults_errors_test.go
 create mode 100644 cmd/cloud_init_defaults_test.go

diff --git a/cmd/cloud_init_defaults_errors_test.go b/cmd/cloud_init_defaults_errors_test.go
new file mode 100644
index 00000000..020285c7
--- /dev/null
+++ b/cmd/cloud_init_defaults_errors_test.go
@@ -0,0 +1,36 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestCloudInitDefaults_GetMalformedResponse verifies that "cloud-init defaults
+// get" fails with CodePayload when the response can't be decoded.
+func TestCloudInitDefaults_GetMalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"defaults":`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"cloud-init", "defaults", "get")
+
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
diff --git a/cmd/cloud_init_defaults_test.go b/cmd/cloud_init_defaults_test.go
new file mode 100644
index 00000000..88747062
--- /dev/null
+++ b/cmd/cloud_init_defaults_test.go
@@ -0,0 +1,63 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+// cloud_init_defaults_test.go exercises the "cloud-init defaults" get and set
+// commands end-to-end against an httptest.Server, asserting outbound request
+// method/path. Error arms are covered in cloud_init_defaults_errors_test.go.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// TestCloudInitDefaults_Set verifies "cloud-init defaults set -d <payload>"
+// issues POST /admin/cluster-defaults.
+func TestCloudInitDefaults_Set(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "defaults", "set", "--uri", srv.URL, "--token", "t",
+		"-d", `{"cluster-name":"demo"}`)
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost || gotPath != "/admin/cluster-defaults" {
+		t.Errorf("request = %s %s, want POST /admin/cluster-defaults", gotMethod, gotPath)
+	}
+}
+
+// TestCloudInitDefaults_Get verifies "cloud-init defaults get" issues GET
+// /admin/cluster-defaults.
+func TestCloudInitDefaults_Get(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`{"cluster-name":"demo"}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "defaults", "get", "--uri", srv.URL)
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/admin/cluster-defaults" {
+		t.Errorf("path = %q, want /admin/cluster-defaults", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+}
diff --git a/cmd/cloud_init_errors_test.go b/cmd/cloud_init_errors_test.go
index 87b992ea..0fa7b98b 100644
--- a/cmd/cloud_init_errors_test.go
+++ b/cmd/cloud_init_errors_test.go
@@ -146,26 +146,3 @@ func TestCloudInit_MalformedSuccessResponses(t *testing.T) {
 		})
 	}
 }
-
-// TestCloudInitDefaults_GetMalformedResponse verifies that "cloud-init defaults
-// get" fails with CodePayload when the response can't be decoded.
-func TestCloudInitDefaults_GetMalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"defaults":`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"cloud-init", "defaults", "get")
-
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
diff --git a/cmd/cloud_init_group_test.go b/cmd/cloud_init_group_test.go
index 4b396d76..31db1080 100644
--- a/cmd/cloud_init_group_test.go
+++ b/cmd/cloud_init_group_test.go
@@ -5,11 +5,10 @@
 package cmd
 
 // cloud_init_group_test.go exercises the "cloud-init group" verbs (get
-// config/meta-data/raw, add, delete, render) end-to-end against an
-// httptest.Server, covering the success-path branches that the happy paths in
-// cloud_init_test.go do not reach: output format variants, payload input
-// variants, decode/render logic, and the delete confirmation prompt. Error arms
-// are covered in cloud_init_group_errors_test.go.
+// config/meta-data/raw, add, set, delete, render) end-to-end against an
+// httptest.Server: the request each verb issues, output format variants,
+// payload input variants, decode/render logic, and the delete confirmation
+// prompt. Error arms are covered in cloud_init_group_errors_test.go.
 
 import (
 	"encoding/base64"
@@ -321,3 +320,139 @@ func TestCloudInitGroupGet_ConfigEdgeCases(t *testing.T) {
 		})
 	}
 }
+
+// TestCloudInitGroupGet_Success verifies "cloud-init group get raw" issues GET
+// /admin/groups.
+func TestCloudInitGroupGet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.Write([]byte(`{}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "get", "raw", "--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodGet || gotPath != "/admin/groups" {
+		t.Errorf("request = %s %s, want GET /admin/groups", gotMethod, gotPath)
+	}
+}
+
+// TestCloudInitGroupAdd_Success verifies "cloud-init group add -d <payload>" issues
+// POST /admin/groups.
+func TestCloudInitGroupAdd_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "add", "--uri", srv.URL, "--token", "t",
+		"-d", `[{"name":"compute"}]`)
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPost || gotPath != "/admin/groups" {
+		t.Errorf("request = %s %s, want POST /admin/groups", gotMethod, gotPath)
+	}
+}
+
+// TestCloudInitGroupSet_Success verifies "cloud-init group set -d <payload>"
+// issues a PUT.
+func TestCloudInitGroupSet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "set", "--uri", srv.URL, "--token", "t",
+		"-d", `[{"name":"compute"}]`)
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPut {
+		t.Errorf("method = %q, want PUT", gotMethod)
+	}
+}
+
+// TestCloudInitGroupDelete_NoConfirm verifies "cloud-init group delete
+// --no-confirm <name>" issues DELETE under /admin/groups.
+func TestCloudInitGroupDelete_NoConfirm(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod = r.Method
+		gotPath = r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "delete", "--uri", srv.URL, "--token", "t",
+		"--no-confirm", "compute")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodDelete {
+		t.Errorf("method = %q, want DELETE", gotMethod)
+	}
+	if gotPath != "/admin/groups/compute" {
+		t.Errorf("path = %q, want /admin/groups/compute", gotPath)
+	}
+}
+
+// TestCloudInitGroupRender_EmptyConfig verifies that "cloud-init group render"
+// succeeds without rendering anything, and logs a warning, when the group's
+// cloud-config is empty.
+func TestCloudInitGroupRender_EmptyConfig(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Empty body for the group-config fetch => nothing to render.
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "render", "--uri", srv.URL, "--token", "t",
+		"compute", "x0c0s0b0n0")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if !strings.Contains(res.stdout, "cloud-config for group compute was empty") {
+		t.Errorf("output = %q, want a warning about the empty cloud-config", res.stdout)
+	}
+}
+
+// TestCloudInitGroupGet_ConfigAndMetaData verifies that "cloud-init group get
+// config" and "cloud-init group get meta-data" succeed against a service that
+// returns no groups.
+func TestCloudInitGroupGet_ConfigAndMetaData(t *testing.T) {
+	t.Parallel()
+
+	for _, subcommand := range []string{"config", "meta-data"} {
+		t.Run(subcommand, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				io.WriteString(w, `{}`)
+			}))
+			defer srv.Close()
+
+			res := runOchamiWithRuntime(t, "cloud-init", "group", "get", subcommand,
+				"--ignore-config", "--uri", srv.URL, "--token", "t")
+			if res.err != nil {
+				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+			}
+		})
+	}
+}
diff --git a/cmd/cloud_init_node_test.go b/cmd/cloud_init_node_test.go
index 1701aa2c..09bc1f9c 100644
--- a/cmd/cloud_init_node_test.go
+++ b/cmd/cloud_init_node_test.go
@@ -5,8 +5,9 @@
 package cmd
 
 // cloud_init_node_test.go exercises the "cloud-init node get" subcommands
-// (meta-data, user-data, vendor-data, group) end-to-end against an
-// httptest.Server, asserting the impersonation path and exit codes.
+// (meta-data, user-data, vendor-data, group) and "cloud-init node set"
+// end-to-end against an httptest.Server, asserting the request paths and exit
+// codes. Error arms are covered in cloud_init_node_errors_test.go.
 
 import (
 	"net/http"
@@ -250,3 +251,25 @@ func TestCloudInitNodeGet_GroupSkipsEmptyGroup(t *testing.T) {
 		t.Errorf("output = %q, want a warning about the empty group", res.stdout)
 	}
 }
+
+// TestCloudInitNodeSet_Success verifies "cloud-init node set -d <payload>" issues a PUT
+// under /admin/instance-info.
+func TestCloudInitNodeSet_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "node", "set", "--uri", srv.URL, "--token", "t",
+		"-d", `[{"id":"x0c0s0b0n0"}]`)
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodPut || !strings.HasPrefix(gotPath, "/admin/instance-info") {
+		t.Errorf("request = %s %s, want PUT under /admin/instance-info", gotMethod, gotPath)
+	}
+}
diff --git a/cmd/cloud_init_test.go b/cmd/cloud_init_test.go
index b523af9c..d439fead 100644
--- a/cmd/cloud_init_test.go
+++ b/cmd/cloud_init_test.go
@@ -4,198 +4,18 @@
 
 package cmd
 
-// cloud_init_test.go exercises representative "cloud-init" subcommands (group,
-// node, defaults, service) end-to-end against an httptest.Server, asserting
-// outbound request method/path and the resolved exit code.
+// cloud_init_test.go exercises the "cloud-init service" commands end-to-end
+// against an httptest.Server, asserting outbound request method/path and the
+// resolved exit code. The group, node, and defaults commands are covered in
+// their own cloud_init_<command>_test.go files.
 
 import (
-	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 )
 
-// TestCloudInitGroupGet_Success verifies "cloud-init group get raw" issues GET
-// /admin/groups.
-func TestCloudInitGroupGet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.Write([]byte(`{}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "get", "raw", "--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodGet || gotPath != "/admin/groups" {
-		t.Errorf("request = %s %s, want GET /admin/groups", gotMethod, gotPath)
-	}
-}
-
-// TestCloudInitGroupAdd_Success verifies "cloud-init group add -d <payload>" issues
-// POST /admin/groups.
-func TestCloudInitGroupAdd_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusCreated)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "add", "--uri", srv.URL, "--token", "t",
-		"-d", `[{"name":"compute"}]`)
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost || gotPath != "/admin/groups" {
-		t.Errorf("request = %s %s, want POST /admin/groups", gotMethod, gotPath)
-	}
-}
-
-// TestCloudInitGroupSet_Success verifies "cloud-init group set -d <payload>"
-// issues a PUT.
-func TestCloudInitGroupSet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "set", "--uri", srv.URL, "--token", "t",
-		"-d", `[{"name":"compute"}]`)
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPut {
-		t.Errorf("method = %q, want PUT", gotMethod)
-	}
-}
-
-// TestCloudInitGroupDelete_NoConfirm verifies "cloud-init group delete
-// --no-confirm <name>" issues DELETE under /admin/groups.
-func TestCloudInitGroupDelete_NoConfirm(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod = r.Method
-		gotPath = r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "delete", "--uri", srv.URL, "--token", "t",
-		"--no-confirm", "compute")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodDelete {
-		t.Errorf("method = %q, want DELETE", gotMethod)
-	}
-	if gotPath != "/admin/groups/compute" {
-		t.Errorf("path = %q, want /admin/groups/compute", gotPath)
-	}
-}
-
-// TestCloudInitNodeSet_Success verifies "cloud-init node set -d <payload>" issues a PUT
-// under /admin/instance-info.
-func TestCloudInitNodeSet_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "node", "set", "--uri", srv.URL, "--token", "t",
-		"-d", `[{"id":"x0c0s0b0n0"}]`)
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPut || !strings.HasPrefix(gotPath, "/admin/instance-info") {
-		t.Errorf("request = %s %s, want PUT under /admin/instance-info", gotMethod, gotPath)
-	}
-}
-
-// TestCloudInitDefaults_Set verifies "cloud-init defaults set -d <payload>"
-// issues POST /admin/cluster-defaults.
-func TestCloudInitDefaults_Set(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "defaults", "set", "--uri", srv.URL, "--token", "t",
-		"-d", `{"cluster-name":"demo"}`)
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodPost || gotPath != "/admin/cluster-defaults" {
-		t.Errorf("request = %s %s, want POST /admin/cluster-defaults", gotMethod, gotPath)
-	}
-}
-
-// TestCloudInitGroupRender_EmptyConfig verifies that "cloud-init group render"
-// succeeds without rendering anything, and logs a warning, when the group's
-// cloud-config is empty.
-func TestCloudInitGroupRender_EmptyConfig(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Empty body for the group-config fetch => nothing to render.
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "group", "render", "--uri", srv.URL, "--token", "t",
-		"compute", "x0c0s0b0n0")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if !strings.Contains(res.stdout, "cloud-config for group compute was empty") {
-		t.Errorf("output = %q, want a warning about the empty cloud-config", res.stdout)
-	}
-}
-
-// TestCloudInitGroupGet_ConfigAndMetaData verifies that "cloud-init group get
-// config" and "cloud-init group get meta-data" succeed against a service that
-// returns no groups.
-func TestCloudInitGroupGet_ConfigAndMetaData(t *testing.T) {
-	t.Parallel()
-
-	for _, subcommand := range []string{"config", "meta-data"} {
-		t.Run(subcommand, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Header().Set("Content-Type", "application/json")
-				io.WriteString(w, `{}`)
-			}))
-			defer srv.Close()
-
-			res := runOchamiWithRuntime(t, "cloud-init", "group", "get", subcommand,
-				"--ignore-config", "--uri", srv.URL, "--token", "t")
-			if res.err != nil {
-				t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-			}
-		})
-	}
-}
-
 // TestCloudInitServiceStatus_API verifies --api prints the returned OpenAPI
 // document through the command's injected output stream.
 func TestCloudInitServiceStatus_API(t *testing.T) {
@@ -215,32 +35,6 @@ func TestCloudInitServiceStatus_API(t *testing.T) {
 	}
 }
 
-// TestCloudInitDefaults_Get verifies "cloud-init defaults get" issues GET
-// /admin/cluster-defaults.
-func TestCloudInitDefaults_Get(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`{"cluster-name":"demo"}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "cloud-init", "defaults", "get", "--uri", srv.URL)
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/admin/cluster-defaults" {
-		t.Errorf("path = %q, want /admin/cluster-defaults", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-}
-
 // TestCloudInitServiceStatus_Running verifies that "cloud-init service status"
 // exits successfully when the /version endpoint responds OK.
 func TestCloudInitServiceStatus_Running(t *testing.T) {

From 1996b7bbb2d6c68c89eaae743e4827ec3afafea8 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:51:41 -0600
Subject: [PATCH 05/14] test(cmd): group pcs tests by command path

pcs_test.go and pcs_errors_test.go held the pcs status tests next to
the service ones, and pcs_flags_test.go and pcs_flags_errors_test.go
held one flag test each for subjects whose other tests live elsewhere.

Move the status tests into new pcs_status_test.go and
pcs_status_errors_test.go files, and the flag tests into the files of
the commands they cover, retiring the pcs_flags files. No test logic
changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 cmd/pcs_errors_test.go            |  78 -------------------
 cmd/pcs_flags_errors_test.go      |  31 --------
 cmd/pcs_flags_test.go             |  42 -----------
 cmd/pcs_status_errors_test.go     |  91 ++++++++++++++++++++++
 cmd/pcs_status_test.go            | 120 ++++++++++++++++++++++++++++++
 cmd/pcs_test.go                   |  82 +-------------------
 cmd/pcs_transition_errors_test.go |  20 +++++
 7 files changed, 234 insertions(+), 230 deletions(-)
 delete mode 100644 cmd/pcs_flags_errors_test.go
 delete mode 100644 cmd/pcs_flags_test.go
 create mode 100644 cmd/pcs_status_errors_test.go
 create mode 100644 cmd/pcs_status_test.go

diff --git a/cmd/pcs_errors_test.go b/cmd/pcs_errors_test.go
index 204a131d..b8491cc1 100644
--- a/cmd/pcs_errors_test.go
+++ b/cmd/pcs_errors_test.go
@@ -12,40 +12,6 @@ import (
 	"github.com/openchami/ochami/internal/cli"
 )
 
-// TestPCSStatusList_InvalidPowerFilter verifies that an invalid --power-filter
-// value is a usage error, reported before any request is sent.
-func TestPCSStatusList_InvalidPowerFilter(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", "http://127.0.0.1:0",
-		"--token", "t", "--power-filter", "bogus")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeUsage {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
-
-// TestPCSStatusList_HTTPError verifies an unsuccessful HTTP response resolves to
-// CodeHTTP.
-func TestPCSStatusList_HTTPError(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "down", http.StatusServiceUnavailable)
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeHTTP {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
-	}
-}
-
 // TestPCSServiceStatus_UnknownState verifies the "unable to get state" path when
 // neither readiness nor liveness reports ready.
 func TestPCSServiceStatus_UnknownState(t *testing.T) {
@@ -108,30 +74,6 @@ func TestPCSServiceStatus_HealthHTTPError(t *testing.T) {
 	}
 }
 
-// TestPCSStatusList_MalformedResponse verifies a malformed status-list
-// response resolves to CodePayload (a decode failure, not an HTTP failure:
-// the server responds 200 OK with an undecodable body).
-func TestPCSStatusList_MalformedResponse(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"State":`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"pcs", "status", "list")
-
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodePayload {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
-	}
-}
-
 // TestPCSServiceStatus_MalformedResponse verifies a malformed readiness/liveness
 // response resolves to CodeGeneric: the command can't classify the failure as
 // a specific HTTP status once neither probe successfully reports a state.
@@ -155,23 +97,3 @@ func TestPCSServiceStatus_MalformedResponse(t *testing.T) {
 		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeGeneric, cli.CodeName(cli.CodeGeneric))
 	}
 }
-
-// TestPCSStatusShow_Empty verifies that an empty status array resolves to
-// CodeGeneric (the "no status found" case).
-func TestPCSStatusShow_Empty(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(`{"status":[]}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "pcs", "status", "show", "--uri", srv.URL, "x3000c0s15b0")
-
-	if res.err == nil {
-		t.Fatal("expected an error, got nil")
-	}
-	if res.exitCode != cli.CodeGeneric {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeGeneric, cli.CodeName(cli.CodeGeneric))
-	}
-}
diff --git a/cmd/pcs_flags_errors_test.go b/cmd/pcs_flags_errors_test.go
deleted file mode 100644
index 640f7238..00000000
--- a/cmd/pcs_flags_errors_test.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"testing"
-
-	"github.com/openchami/ochami/internal/cli"
-)
-
-// TestPCSTransitionStart_RequiresXname verifies --xname is enforced as a
-// required flag (proving the MarkFlagRequired registration in start.go takes
-// effect; the registration's own error return is unreachable in practice
-// since "xname" is always registered immediately beforehand), and that
-// Cobra's required-flag validation error resolves to CodeUsage via
-// cli.WrapUsageErrors, which composes each command's PreRunE/PreRun to
-// re-run and wrap Cobra's ValidateRequiredFlags/ValidateFlagGroups checks.
-func TestPCSTransitionStart_RequiresXname(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "pcs", "transition", "start", "--ignore-config",
-		"--uri", "http://127.0.0.1:1", "--token", "t", "on")
-	if res.err == nil {
-		t.Fatal("expected an error for missing required --xname, got nil")
-	}
-	if res.exitCode != cli.CodeUsage {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
-	}
-}
diff --git a/cmd/pcs_flags_test.go b/cmd/pcs_flags_test.go
deleted file mode 100644
index dcd6bba6..00000000
--- a/cmd/pcs_flags_test.go
+++ /dev/null
@@ -1,42 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-// pcs_flags_test.go verifies that pcs status list's flag-backed variables are
-// local to each command instance, mirroring the discover static flag-isolation
-// test. The required --xname check for "pcs transition start" is in
-// pcs_flags_errors_test.go.
-
-import (
-	"testing"
-
-	pcs_status "github.com/openchami/ochami/cmd/pcs/status"
-)
-
-// TestPCSStatusList_FlagStateIsLocal verifies one "pcs status list" invocation
-// cannot change the default --power-filter of a subsequently constructed
-// command (xnames, powerFilter, and mgmtFilter are command-local variables,
-// not package-level ones, for this reason).
-func TestPCSStatusList_FlagStateIsLocal(t *testing.T) {
-	t.Parallel()
-
-	first := pcs_status.NewCmd()
-	firstList, _, err := first.Find([]string{"list"})
-	if err != nil {
-		t.Fatalf("find first list command: %v", err)
-	}
-	if err := firstList.Flags().Set("power-filter", "on"); err != nil {
-		t.Fatalf("set first power-filter: %v", err)
-	}
-
-	second := pcs_status.NewCmd()
-	secondList, _, err := second.Find([]string{"list"})
-	if err != nil {
-		t.Fatalf("find second list command: %v", err)
-	}
-	if got := secondList.Flags().Lookup("power-filter").Value.String(); got != "" {
-		t.Errorf("second command power-filter = %q, want default empty", got)
-	}
-}
diff --git a/cmd/pcs_status_errors_test.go b/cmd/pcs_status_errors_test.go
new file mode 100644
index 00000000..b6e8200c
--- /dev/null
+++ b/cmd/pcs_status_errors_test.go
@@ -0,0 +1,91 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestPCSStatusList_InvalidPowerFilter verifies that an invalid --power-filter
+// value is a usage error, reported before any request is sent.
+func TestPCSStatusList_InvalidPowerFilter(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", "http://127.0.0.1:0",
+		"--token", "t", "--power-filter", "bogus")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeUsage {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}
+
+// TestPCSStatusList_HTTPError verifies an unsuccessful HTTP response resolves to
+// CodeHTTP.
+func TestPCSStatusList_HTTPError(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "down", http.StatusServiceUnavailable)
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeHTTP {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeHTTP, cli.CodeName(cli.CodeHTTP))
+	}
+}
+
+// TestPCSStatusList_MalformedResponse verifies a malformed status-list
+// response resolves to CodePayload (a decode failure, not an HTTP failure:
+// the server responds 200 OK with an undecodable body).
+func TestPCSStatusList_MalformedResponse(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{"State":`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"pcs", "status", "list")
+
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodePayload {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
+	}
+}
+
+// TestPCSStatusShow_Empty verifies that an empty status array resolves to
+// CodeGeneric (the "no status found" case).
+func TestPCSStatusShow_Empty(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`{"status":[]}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "pcs", "status", "show", "--uri", srv.URL, "x3000c0s15b0")
+
+	if res.err == nil {
+		t.Fatal("expected an error, got nil")
+	}
+	if res.exitCode != cli.CodeGeneric {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeGeneric, cli.CodeName(cli.CodeGeneric))
+	}
+}
diff --git a/cmd/pcs_status_test.go b/cmd/pcs_status_test.go
new file mode 100644
index 00000000..62d96ff2
--- /dev/null
+++ b/cmd/pcs_status_test.go
@@ -0,0 +1,120 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+// pcs_status_test.go exercises the "pcs status" verbs (list, show) end-to-end
+// against an httptest.Server, including the list filters. Error arms are
+// covered in pcs_status_errors_test.go.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	pcs_status "github.com/openchami/ochami/cmd/pcs/status"
+)
+
+// TestPCSStatusList_Success verifies "pcs status list" issues GET /power-status.
+func TestPCSStatusList_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotMethod, gotPath = r.Method, r.URL.Path
+		w.Write([]byte(`{"status":[]}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", srv.URL, "--token", "t")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+	if gotPath != "/power-status" {
+		t.Errorf("path = %q, want /power-status", gotPath)
+	}
+}
+
+// TestPCSStatusList_WithFilters verifies xname and power/mgmt filters are encoded
+// in the query string.
+func TestPCSStatusList_WithFilters(t *testing.T) {
+	t.Parallel()
+
+	var gotQuery string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotQuery = r.URL.RawQuery
+		w.Write([]byte(`{"status":[]}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", srv.URL, "--token", "t",
+		"--xname", "x0c0s0b0n0", "--power-filter", "on", "--mgmt-filter", "available")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	for _, want := range []string{"xname=x0c0s0b0n0", "powerStateFilter=on", "managementStateFilter=available"} {
+		if !strings.Contains(gotQuery, want) {
+			t.Errorf("query = %q, want it to contain %q", gotQuery, want)
+		}
+	}
+}
+
+// TestPCSStatusShow_Success verifies "pcs status show <xname>" issues GET /power-status
+// and prints the first status entry.
+func TestPCSStatusShow_Success(t *testing.T) {
+	t.Parallel()
+
+	var gotMethod, gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotMethod = r.Method
+		w.Write([]byte(`{"status":[{"xname":"x3000c0s15b0","powerState":"on"}]}`))
+	}))
+	defer srv.Close()
+
+	res := runOchamiWithRuntime(t, "--ignore-config", "pcs", "status", "show", "--uri", srv.URL, "x3000c0s15b0")
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotPath != "/power-status" {
+		t.Errorf("path = %q, want /power-status", gotPath)
+	}
+	if gotMethod != http.MethodGet {
+		t.Errorf("method = %q, want GET", gotMethod)
+	}
+	if !strings.Contains(res.stdout, "x3000c0s15b0") {
+		t.Errorf("stdout = %q, want it to contain the xname", res.stdout)
+	}
+}
+
+// TestPCSStatusList_FlagStateIsLocal verifies one "pcs status list" invocation
+// cannot change the default --power-filter of a subsequently constructed
+// command (xnames, powerFilter, and mgmtFilter are command-local variables,
+// not package-level ones, for this reason).
+func TestPCSStatusList_FlagStateIsLocal(t *testing.T) {
+	t.Parallel()
+
+	first := pcs_status.NewCmd()
+	firstList, _, err := first.Find([]string{"list"})
+	if err != nil {
+		t.Fatalf("find first list command: %v", err)
+	}
+	if err := firstList.Flags().Set("power-filter", "on"); err != nil {
+		t.Fatalf("set first power-filter: %v", err)
+	}
+
+	second := pcs_status.NewCmd()
+	secondList, _, err := second.Find([]string{"list"})
+	if err != nil {
+		t.Fatalf("find second list command: %v", err)
+	}
+	if got := secondList.Flags().Lookup("power-filter").Value.String(); got != "" {
+		t.Errorf("second command power-filter = %q, want default empty", got)
+	}
+}
diff --git a/cmd/pcs_test.go b/cmd/pcs_test.go
index f97a6f57..ec313eb0 100644
--- a/cmd/pcs_test.go
+++ b/cmd/pcs_test.go
@@ -4,9 +4,9 @@
 
 package cmd
 
-// pcs_test.go exercises "pcs status" and "pcs service" commands end-to-end
-// against an httptest.Server. Transition commands are covered in
-// pcs_transition_test.go.
+// pcs_test.go exercises the "pcs service" commands end-to-end against an
+// httptest.Server. The status and transition commands are covered in
+// pcs_status_test.go and pcs_transition_test.go.
 
 import (
 	"net/http"
@@ -17,53 +17,6 @@ import (
 	"github.com/openchami/ochami/internal/cli"
 )
 
-// TestPCSStatusList_Success verifies "pcs status list" issues GET /power-status.
-func TestPCSStatusList_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotMethod, gotPath = r.Method, r.URL.Path
-		w.Write([]byte(`{"status":[]}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", srv.URL, "--token", "t")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-	if gotPath != "/power-status" {
-		t.Errorf("path = %q, want /power-status", gotPath)
-	}
-}
-
-// TestPCSStatusList_WithFilters verifies xname and power/mgmt filters are encoded
-// in the query string.
-func TestPCSStatusList_WithFilters(t *testing.T) {
-	t.Parallel()
-
-	var gotQuery string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotQuery = r.URL.RawQuery
-		w.Write([]byte(`{"status":[]}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "pcs", "status", "list", "--ignore-config", "--uri", srv.URL, "--token", "t",
-		"--xname", "x0c0s0b0n0", "--power-filter", "on", "--mgmt-filter", "available")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	for _, want := range []string{"xname=x0c0s0b0n0", "powerStateFilter=on", "managementStateFilter=available"} {
-		if !strings.Contains(gotQuery, want) {
-			t.Errorf("query = %q, want it to contain %q", gotQuery, want)
-		}
-	}
-}
-
 // TestPCSServiceStatus_Success verifies "pcs service status" contacts PCS readiness and
 // exits successfully when PCS reports ready (HTTP 204 on /readiness).
 func TestPCSServiceStatus_Success(t *testing.T) {
@@ -139,35 +92,6 @@ func TestPCSServiceStatus_LivenessFallback(t *testing.T) {
 	}
 }
 
-// TestPCSStatusShow_Success verifies "pcs status show <xname>" issues GET /power-status
-// and prints the first status entry.
-func TestPCSStatusShow_Success(t *testing.T) {
-	t.Parallel()
-
-	var gotMethod, gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		gotMethod = r.Method
-		w.Write([]byte(`{"status":[{"xname":"x3000c0s15b0","powerState":"on"}]}`))
-	}))
-	defer srv.Close()
-
-	res := runOchamiWithRuntime(t, "--ignore-config", "pcs", "status", "show", "--uri", srv.URL, "x3000c0s15b0")
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotPath != "/power-status" {
-		t.Errorf("path = %q, want /power-status", gotPath)
-	}
-	if gotMethod != http.MethodGet {
-		t.Errorf("method = %q, want GET", gotMethod)
-	}
-	if !strings.Contains(res.stdout, "x3000c0s15b0") {
-		t.Errorf("stdout = %q, want it to contain the xname", res.stdout)
-	}
-}
-
 // TestPCSServiceStatus_HealthFalseFlags verifies that health flags passed as
 // false are left out of the output while the ones passed as true are included.
 func TestPCSServiceStatus_HealthFalseFlags(t *testing.T) {
diff --git a/cmd/pcs_transition_errors_test.go b/cmd/pcs_transition_errors_test.go
index 0459280a..cd5b3fa3 100644
--- a/cmd/pcs_transition_errors_test.go
+++ b/cmd/pcs_transition_errors_test.go
@@ -156,3 +156,23 @@ func TestPCSTransitionShow_MalformedResponse(t *testing.T) {
 		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodePayload, cli.CodeName(cli.CodePayload))
 	}
 }
+
+// TestPCSTransitionStart_RequiresXname verifies --xname is enforced as a
+// required flag (proving the MarkFlagRequired registration in start.go takes
+// effect; the registration's own error return is unreachable in practice
+// since "xname" is always registered immediately beforehand), and that
+// Cobra's required-flag validation error resolves to CodeUsage via
+// cli.WrapUsageErrors, which composes each command's PreRunE/PreRun to
+// re-run and wrap Cobra's ValidateRequiredFlags/ValidateFlagGroups checks.
+func TestPCSTransitionStart_RequiresXname(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "pcs", "transition", "start", "--ignore-config",
+		"--uri", "http://127.0.0.1:1", "--token", "t", "on")
+	if res.err == nil {
+		t.Fatal("expected an error for missing required --xname, got nil")
+	}
+	if res.exitCode != cli.CodeUsage {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
+	}
+}

From 14754563b635b991ab2db659121b9a2514deea2b Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:52:15 -0600
Subject: [PATCH 06/14] test(cmd): rename rcs tests after rcs console

rcs_test.go and rcs_errors_test.go hold only tests of the "rcs console"
commands. Rename them rcs_console_test.go and rcs_console_errors_test.go
so the file names follow the command path, as for the other families.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 cmd/{rcs_errors_test.go => rcs_console_errors_test.go} | 8 ++++----
 cmd/{rcs_test.go => rcs_console_test.go}               | 6 +++---
 2 files changed, 7 insertions(+), 7 deletions(-)
 rename cmd/{rcs_errors_test.go => rcs_console_errors_test.go} (92%)
 rename cmd/{rcs_test.go => rcs_console_test.go} (95%)

diff --git a/cmd/rcs_errors_test.go b/cmd/rcs_console_errors_test.go
similarity index 92%
rename from cmd/rcs_errors_test.go
rename to cmd/rcs_console_errors_test.go
index 4d95d6fe..46b6de92 100644
--- a/cmd/rcs_errors_test.go
+++ b/cmd/rcs_console_errors_test.go
@@ -4,10 +4,10 @@
 
 package cmd
 
-// rcs_errors_test.go covers failure paths for the "rcs" command group:
-// unsuccessful HTTP responses, and a console connection without a node ID, with
-// its websocket upgrade rejected, or without a token; see rcs_test.go for the
-// success paths these mirror.
+// rcs_console_errors_test.go covers failure paths for the "rcs console"
+// commands: unsuccessful HTTP responses, and a console connection without a
+// node ID, with its websocket upgrade rejected, or without a token; see
+// rcs_console_test.go for the success paths these mirror.
 
 import (
 	"net/http"
diff --git a/cmd/rcs_test.go b/cmd/rcs_console_test.go
similarity index 95%
rename from cmd/rcs_test.go
rename to cmd/rcs_console_test.go
index 8f2ff4cc..2be50f54 100644
--- a/cmd/rcs_test.go
+++ b/cmd/rcs_console_test.go
@@ -4,10 +4,10 @@
 
 package cmd
 
-// rcs_test.go exercises the "rcs console" subcommands end-to-end: "list"
-// (plain HTTP), "show" (websocket streamed to captured stdout), and
+// rcs_console_test.go exercises the "rcs console" subcommands end-to-end:
+// "list" (plain HTTP), "show" (websocket streamed to captured stdout), and
 // "connect" (interactive websocket session). HTTP-failure cases are covered
-// in rcs_errors_test.go.
+// in rcs_console_errors_test.go.
 
 import (
 	"net/http"

From 935e8be3f957412e7c100824ed13798f6a7fddc2 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:52:16 -0600
Subject: [PATCH 07/14] test(cmd): group discover tests by command path

"discover static" is the only command under "discover", so its tests
belong in the family files, as the tests of "bss dumpstate" and "bss
history" are in bss_test.go. Rename discover_static_test.go and
discover_static_errors_test.go to discover_test.go and
discover_errors_test.go, and move the one TestDiscoverStatic test in
discover_static_flags_test.go into discover_test.go, retiring the topic
file. No test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 ...errors_test.go => discover_errors_test.go} |  5 ++-
 cmd/discover_static_flags_test.go             | 31 -------------------
 ...scover_static_test.go => discover_test.go} | 23 ++++++++++++--
 3 files changed, 22 insertions(+), 37 deletions(-)
 rename cmd/{discover_static_errors_test.go => discover_errors_test.go} (98%)
 delete mode 100644 cmd/discover_static_flags_test.go
 rename cmd/{discover_static_test.go => discover_test.go} (92%)

diff --git a/cmd/discover_static_errors_test.go b/cmd/discover_errors_test.go
similarity index 98%
rename from cmd/discover_static_errors_test.go
rename to cmd/discover_errors_test.go
index 964d7ced..ade87d54 100644
--- a/cmd/discover_static_errors_test.go
+++ b/cmd/discover_errors_test.go
@@ -4,12 +4,11 @@
 
 package cmd
 
-// discover_static_errors_test.go exercises the error-arm branches of "ochami
+// discover_errors_test.go exercises the error-arm branches of "ochami
 // discover static": HTTP failures (with and without --overwrite),
 // malformed/missing payload and config, 409-then-failing-fallback cases, and
 // transport-level (network) failures across the plain, discovery-version v1,
-// and --overwrite paths. The discoveryPayload fixture is in
-// discover_static_test.go.
+// and --overwrite paths. The discoveryPayload fixture is in discover_test.go.
 
 import (
 	"net/http"
diff --git a/cmd/discover_static_flags_test.go b/cmd/discover_static_flags_test.go
deleted file mode 100644
index 3e46c163..00000000
--- a/cmd/discover_static_flags_test.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-// discover_static_flags_test.go verifies that discover static's flag-backed
-// variables are local to each command instance and do not leak state across
-// repeated NewCmd() construction.
-
-import (
-	"testing"
-
-	discover_static "github.com/openchami/ochami/cmd/discover/static"
-)
-
-// TestDiscoverStatic_FlagStateIsLocal verifies one command invocation cannot
-// change the default discovery version of a subsequently constructed command.
-func TestDiscoverStatic_FlagStateIsLocal(t *testing.T) {
-	t.Parallel()
-
-	first := discover_static.NewCmd()
-	if err := first.Flags().Set("discovery-version", "1"); err != nil {
-		t.Fatalf("set first discovery version: %v", err)
-	}
-
-	second := discover_static.NewCmd()
-	if got := second.Flags().Lookup("discovery-version").Value.String(); got != "2" {
-		t.Errorf("second command discovery version = %q, want default 2", got)
-	}
-}
diff --git a/cmd/discover_static_test.go b/cmd/discover_test.go
similarity index 92%
rename from cmd/discover_static_test.go
rename to cmd/discover_test.go
index a3a1a1ec..b27a9a38 100644
--- a/cmd/discover_static_test.go
+++ b/cmd/discover_test.go
@@ -4,13 +4,13 @@
 
 package cmd
 
-// discover_static_test.go exercises "ochami discover static", which reads a
+// discover_test.go exercises "ochami discover static", which reads a
 // discovery payload and populates SMD by POSTing components, redfish endpoints,
 // and groups, against an httptest.Server standing in for SMD: the default path,
 // the --overwrite 409-then-fallback loops (redfish PUT, ethernet-interface
 // PATCH, group PATCH), the discovery-version v1 ethernet-interface path, stdin
-// input, and the deprecated discovery format. Error-arm cases live in
-// discover_static_errors_test.go.
+// input, the deprecated discovery format, and that flag state stays local to
+// each command instance. Error-arm cases live in discover_errors_test.go.
 
 import (
 	"net/http"
@@ -19,6 +19,7 @@ import (
 	"sync"
 	"testing"
 
+	discover_static "github.com/openchami/ochami/cmd/discover/static"
 	"github.com/openchami/ochami/internal/cli"
 )
 
@@ -363,3 +364,19 @@ func TestDiscoverStatic_Help(t *testing.T) {
 		t.Errorf("expected help to describe the command, got: %s", res.stdout)
 	}
 }
+
+// TestDiscoverStatic_FlagStateIsLocal verifies one command invocation cannot
+// change the default discovery version of a subsequently constructed command.
+func TestDiscoverStatic_FlagStateIsLocal(t *testing.T) {
+	t.Parallel()
+
+	first := discover_static.NewCmd()
+	if err := first.Flags().Set("discovery-version", "1"); err != nil {
+		t.Fatalf("set first discovery version: %v", err)
+	}
+
+	second := discover_static.NewCmd()
+	if got := second.Flags().Lookup("discovery-version").Value.String(); got != "2" {
+		t.Errorf("second command discovery version = %q, want default 2", got)
+	}
+}

From d2c64e6a4e65f3b78c84782893539409da45c448 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Fri, 23 Oct 2026 10:17:01 -0600
Subject: [PATCH 08/14] test(cmd): move config loading tests to the root files

Seven tests in config*_test.go run "version" or "smd group get", not
the "config" commands: they check that the root command loads the
config file and resolves a command's base URI and token from its
cluster. Move them to root_test.go, root_errors_test.go, and a new
root_boundary_test.go, keeping each test's bucket. Rename the two
boundary tests from TestConfig_* to TestRootCommand_* so the TestConfig
boundary tests stay in one file. No test logic changes.

The root tests now share the writeTempConfig helper with the config
tests and several other families, so move it from config_test.go to
testhelpers_test.go.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 cmd/config_boundary_test.go |  48 +------------
 cmd/config_errors_test.go   |  34 +--------
 cmd/config_test.go          | 135 ------------------------------------
 cmd/root_boundary_test.go   |  59 ++++++++++++++++
 cmd/root_errors_test.go     |  31 +++++++++
 cmd/root_test.go            | 126 ++++++++++++++++++++++++++++++++-
 cmd/testhelpers_test.go     |  15 ++++
 7 files changed, 233 insertions(+), 215 deletions(-)
 create mode 100644 cmd/root_boundary_test.go

diff --git a/cmd/config_boundary_test.go b/cmd/config_boundary_test.go
index e7516d20..4df52560 100644
--- a/cmd/config_boundary_test.go
+++ b/cmd/config_boundary_test.go
@@ -4,8 +4,8 @@
 
 package cmd
 
-// config_boundary_test.go exercises configuration edge cases (explicit nulls,
-// unusual file states) and the error handling they reach.
+// config_boundary_test.go exercises edge cases of the "config" commands
+// (unusual file states and environments) and the error handling they reach.
 
 import (
 	"bytes"
@@ -82,34 +82,6 @@ clusters:
 	}
 }
 
-// TestConfig_NullValueHandling verifies that an explicit YAML "null" for a
-// non-nullable key (log.level) is rejected as a config validation error at
-// load time, rather than silently resolving to its default.
-func TestConfig_NullValueHandling(t *testing.T) {
-	t.Parallel()
-
-	cfg := writeTempConfig(t, `log:
-  level: null
-  format: json
-clusters:
-  - name: test
-    cluster:
-      uri: http://localhost:8080
-`)
-
-	// --ignore-config is deliberately omitted: it would skip reading --config
-	// entirely (see InitConfig), which would make this test pass regardless
-	// of what the file contains.
-	res := runOchamiWithRuntime(t, "--config", cfg, "version")
-
-	if res.err == nil {
-		t.Fatal("expected an error for a null log.level, got nil")
-	}
-	if res.exitCode != cli.CodeConfig {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeConfig, cli.CodeName(cli.CodeConfig))
-	}
-}
-
 // TestConfig_PermissionPreservation verifies that "config set" keeps the
 // config file's permissions when it replaces the file.
 func TestConfig_PermissionPreservation(t *testing.T) {
@@ -141,22 +113,6 @@ func TestConfig_PermissionPreservation(t *testing.T) {
 	}
 }
 
-// TestConfig_IgnoreConfigSkipsConfigFile verifies that --ignore-config skips
-// reading the path given to --config entirely (per InitConfig), so a
-// nonexistent path doesn't cause an error.
-func TestConfig_IgnoreConfigSkipsConfigFile(t *testing.T) {
-	t.Parallel()
-
-	res := runOchamiWithRuntime(t, "--config", "/nonexistent/path/to/config.yaml", "--ignore-config", "version")
-
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if res.exitCode != cli.CodeSuccess {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
-	}
-}
-
 // TestConfigAtomicWrite_PreservesOnFailure verifies that a failed config write
 // leaves the old file intact.
 func TestConfigAtomicWrite_PreservesOnFailure(t *testing.T) {
diff --git a/cmd/config_errors_test.go b/cmd/config_errors_test.go
index b7ae5458..9827e08b 100644
--- a/cmd/config_errors_test.go
+++ b/cmd/config_errors_test.go
@@ -5,12 +5,9 @@
 package cmd
 
 // config_errors_test.go covers rejection-path cases for the "config"
-// commands; see config_test.go (including the writeTempConfig helper) for
-// the success paths these mirror.
+// commands; see config_test.go for the success paths these mirror.
 
 import (
-	"net/http"
-	"net/http/httptest"
 	"strings"
 	"testing"
 
@@ -52,35 +49,6 @@ func TestConfigShow_RejectsClusterKey(t *testing.T) {
 	}
 }
 
-// TestEnableAuth_MissingTokenFails verifies that with enable-auth true and no
-// token available, the command fails with CodeAuth.
-func TestEnableAuth_MissingTokenFails(t *testing.T) {
-	t.Parallel()
-
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	cfg := writeTempConfig(t, `default-cluster: demo
-clusters:
-- name: demo
-  cluster:
-    uri: `+srv.URL+`
-    enable-auth: true
-`)
-
-	// runOchamiWithRuntime's environment is empty, so DEMO_ACCESS_TOKEN is
-	// unset regardless of the host's environment.
-	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
-	if res.err == nil {
-		t.Fatal("expected an auth error, got nil")
-	}
-	if res.exitCode != cli.CodeAuth {
-		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeAuth, cli.CodeName(cli.CodeAuth))
-	}
-}
-
 // TestConfigUnset_UnknownKey verifies "config unset" rejects a key that does
 // not exist in the config file.
 func TestConfigUnset_UnknownKey(t *testing.T) {
diff --git a/cmd/config_test.go b/cmd/config_test.go
index a2729ec7..f240de14 100644
--- a/cmd/config_test.go
+++ b/cmd/config_test.go
@@ -10,8 +10,6 @@ package cmd
 // network requests. Rejection-path cases are covered in config_errors_test.go.
 
 import (
-	"net/http"
-	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -21,19 +19,6 @@ import (
 	"github.com/openchami/ochami/pkg/config"
 )
 
-// writeTempConfig creates an (empty) YAML config file in a temp dir and returns
-// its path. Pre-creating the file avoids the interactive "create it?" prompt in
-// commands that write config.
-func writeTempConfig(t *testing.T, contents string) string {
-	t.Helper()
-	dir := t.TempDir()
-	path := filepath.Join(dir, "config.yaml")
-	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
-		t.Fatalf("failed to write temp config: %v", err)
-	}
-	return path
-}
-
 // TestConfigSet_ThenShow verifies that "config set" persists a key to the given
 // config file and "config show" reads it back.
 func TestConfigSet_ThenShow(t *testing.T) {
@@ -192,123 +177,3 @@ func TestConfigUnset_ViaConfigFlag(t *testing.T) {
 		t.Error("log.level still exists after unset")
 	}
 }
-
-// TestDefaultCluster_URIResolution verifies a command resolves its base URI from
-// the default cluster's cluster.uri in a config file (no --uri flag).
-func TestDefaultCluster_URIResolution(t *testing.T) {
-	t.Parallel()
-
-	var hit bool
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		hit = true
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	cfg := writeTempConfig(t, `default-cluster: demo
-clusters:
-- name: demo
-  cluster:
-    uri: `+srv.URL+`
-    enable-auth: false
-`)
-
-	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if !hit {
-		t.Error("expected the server (from default-cluster uri) to be contacted")
-	}
-}
-
-// TestPerServiceURI_Override verifies a per-service URI override in the cluster
-// config is honored.
-func TestPerServiceURI_Override(t *testing.T) {
-	t.Parallel()
-
-	var gotPath string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	cfg := writeTempConfig(t, `default-cluster: demo
-clusters:
-- name: demo
-  cluster:
-    uri: https://unused.example.com
-    smd:
-      uri: `+srv.URL+`/smd
-    enable-auth: false
-`)
-
-	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if !strings.HasPrefix(gotPath, "/smd") {
-		t.Errorf("path = %q, want the /smd override", gotPath)
-	}
-}
-
-// TestEnableAuth_ReadsTokenFromEnv verifies that, for a cluster with
-// enable-auth set, a command reads the token from <CLUSTER>_ACCESS_TOKEN and
-// sends it as a bearer token.
-func TestEnableAuth_ReadsTokenFromEnv(t *testing.T) {
-	var gotAuth string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotAuth = r.Header.Get("Authorization")
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	cfg := writeTempConfig(t, `default-cluster: demo
-clusters:
-- name: demo
-  cluster:
-    uri: `+srv.URL+`
-    enable-auth: true
-`)
-
-	tok := validToken(t)
-	t.Setenv("DEMO_ACCESS_TOKEN", tok)
-
-	res := runOchamiWithRuntimeEnv(t, cli.EnvironmentFunc(os.LookupEnv), "--config", cfg, "smd", "group", "get")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if !strings.Contains(gotAuth, "Bearer") {
-		t.Errorf("Authorization header = %q, want it to carry the bearer token", gotAuth)
-	}
-}
-
-// TestEnableAuth_DisabledSkipsToken verifies that with enable-auth false, no
-// token is required or sent.
-func TestEnableAuth_DisabledSkipsToken(t *testing.T) {
-	t.Parallel()
-
-	var gotAuth string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotAuth = r.Header.Get("Authorization")
-		w.Write([]byte(`[]`))
-	}))
-	defer srv.Close()
-
-	cfg := writeTempConfig(t, `default-cluster: demo
-clusters:
-- name: demo
-  cluster:
-    uri: `+srv.URL+`
-    enable-auth: false
-`)
-
-	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
-	if res.err != nil {
-		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
-	}
-	if gotAuth != "" {
-		t.Errorf("Authorization header = %q, want empty (auth disabled)", gotAuth)
-	}
-}
diff --git a/cmd/root_boundary_test.go b/cmd/root_boundary_test.go
new file mode 100644
index 00000000..ca6b3255
--- /dev/null
+++ b/cmd/root_boundary_test.go
@@ -0,0 +1,59 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+// root_boundary_test.go exercises edge cases of how the root command loads the
+// config file: a --config path skipped by --ignore-config, and an explicit
+// null value.
+
+import (
+	"testing"
+
+	"github.com/openchami/ochami/internal/cli"
+)
+
+// TestRootCommand_NullValueHandling verifies that an explicit YAML "null" for a
+// non-nullable key (log.level) is rejected as a config validation error at
+// load time, rather than silently resolving to its default.
+func TestRootCommand_NullValueHandling(t *testing.T) {
+	t.Parallel()
+
+	cfg := writeTempConfig(t, `log:
+  level: null
+  format: json
+clusters:
+  - name: test
+    cluster:
+      uri: http://localhost:8080
+`)
+
+	// --ignore-config is deliberately omitted: it would skip reading --config
+	// entirely (see InitConfig), which would make this test pass regardless
+	// of what the file contains.
+	res := runOchamiWithRuntime(t, "--config", cfg, "version")
+
+	if res.err == nil {
+		t.Fatal("expected an error for a null log.level, got nil")
+	}
+	if res.exitCode != cli.CodeConfig {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeConfig, cli.CodeName(cli.CodeConfig))
+	}
+}
+
+// TestRootCommand_IgnoreConfigSkipsConfigFile verifies that --ignore-config skips
+// reading the path given to --config entirely (per InitConfig), so a
+// nonexistent path doesn't cause an error.
+func TestRootCommand_IgnoreConfigSkipsConfigFile(t *testing.T) {
+	t.Parallel()
+
+	res := runOchamiWithRuntime(t, "--config", "/nonexistent/path/to/config.yaml", "--ignore-config", "version")
+
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if res.exitCode != cli.CodeSuccess {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeSuccess, cli.CodeName(cli.CodeSuccess))
+	}
+}
diff --git a/cmd/root_errors_test.go b/cmd/root_errors_test.go
index a03d212e..8e3a7551 100644
--- a/cmd/root_errors_test.go
+++ b/cmd/root_errors_test.go
@@ -5,6 +5,8 @@
 package cmd
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/openchami/ochami/internal/cli"
@@ -26,3 +28,32 @@ func TestRootCommand_RejectsCACertWithInsecure(t *testing.T) {
 		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeUsage, cli.CodeName(cli.CodeUsage))
 	}
 }
+
+// TestEnableAuth_MissingTokenFails verifies that with enable-auth true and no
+// token available, the command fails with CodeAuth.
+func TestEnableAuth_MissingTokenFails(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	cfg := writeTempConfig(t, `default-cluster: demo
+clusters:
+- name: demo
+  cluster:
+    uri: `+srv.URL+`
+    enable-auth: true
+`)
+
+	// runOchamiWithRuntime's environment is empty, so DEMO_ACCESS_TOKEN is
+	// unset regardless of the host's environment.
+	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
+	if res.err == nil {
+		t.Fatal("expected an auth error, got nil")
+	}
+	if res.exitCode != cli.CodeAuth {
+		t.Errorf("exit code = %d, want %d (%s)", res.exitCode, cli.CodeAuth, cli.CodeName(cli.CodeAuth))
+	}
+}
diff --git a/cmd/root_test.go b/cmd/root_test.go
index 25e774a7..07e7015c 100644
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -7,12 +7,16 @@ package cmd
 // root_test.go exercises handleExecuteError, the testable core of Execute that
 // resolves an error to a process exit code and emits the help hint, without
 // terminating the test binary via os.Exit, and checks that apply to the root
-// command tree as a whole.
+// command tree as a whole. It also checks that the root command loads the
+// config file and resolves a command's base URI and token from its cluster.
 
 import (
 	"bytes"
 	"context"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
 	"strings"
 	"sync"
 	"testing"
@@ -265,3 +269,123 @@ func TestRootCommand_ConcurrentRuntimesStayIsolated(t *testing.T) {
 		}
 	}
 }
+
+// TestDefaultCluster_URIResolution verifies a command resolves its base URI from
+// the default cluster's cluster.uri in a config file (no --uri flag).
+func TestDefaultCluster_URIResolution(t *testing.T) {
+	t.Parallel()
+
+	var hit bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hit = true
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	cfg := writeTempConfig(t, `default-cluster: demo
+clusters:
+- name: demo
+  cluster:
+    uri: `+srv.URL+`
+    enable-auth: false
+`)
+
+	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if !hit {
+		t.Error("expected the server (from default-cluster uri) to be contacted")
+	}
+}
+
+// TestPerServiceURI_Override verifies a per-service URI override in the cluster
+// config is honored.
+func TestPerServiceURI_Override(t *testing.T) {
+	t.Parallel()
+
+	var gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	cfg := writeTempConfig(t, `default-cluster: demo
+clusters:
+- name: demo
+  cluster:
+    uri: https://unused.example.com
+    smd:
+      uri: `+srv.URL+`/smd
+    enable-auth: false
+`)
+
+	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if !strings.HasPrefix(gotPath, "/smd") {
+		t.Errorf("path = %q, want the /smd override", gotPath)
+	}
+}
+
+// TestEnableAuth_ReadsTokenFromEnv verifies that, for a cluster with
+// enable-auth set, a command reads the token from <CLUSTER>_ACCESS_TOKEN and
+// sends it as a bearer token.
+func TestEnableAuth_ReadsTokenFromEnv(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	cfg := writeTempConfig(t, `default-cluster: demo
+clusters:
+- name: demo
+  cluster:
+    uri: `+srv.URL+`
+    enable-auth: true
+`)
+
+	tok := validToken(t)
+	t.Setenv("DEMO_ACCESS_TOKEN", tok)
+
+	res := runOchamiWithRuntimeEnv(t, cli.EnvironmentFunc(os.LookupEnv), "--config", cfg, "smd", "group", "get")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if !strings.Contains(gotAuth, "Bearer") {
+		t.Errorf("Authorization header = %q, want it to carry the bearer token", gotAuth)
+	}
+}
+
+// TestEnableAuth_DisabledSkipsToken verifies that with enable-auth false, no
+// token is required or sent.
+func TestEnableAuth_DisabledSkipsToken(t *testing.T) {
+	t.Parallel()
+
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		w.Write([]byte(`[]`))
+	}))
+	defer srv.Close()
+
+	cfg := writeTempConfig(t, `default-cluster: demo
+clusters:
+- name: demo
+  cluster:
+    uri: `+srv.URL+`
+    enable-auth: false
+`)
+
+	res := runOchamiWithRuntime(t, "--config", cfg, "smd", "group", "get")
+	if res.err != nil {
+		t.Fatalf("unexpected error: %v (exit %d)", res.err, res.exitCode)
+	}
+	if gotAuth != "" {
+		t.Errorf("Authorization header = %q, want empty (auth disabled)", gotAuth)
+	}
+}
diff --git a/cmd/testhelpers_test.go b/cmd/testhelpers_test.go
index d4c527fe..26a42a30 100644
--- a/cmd/testhelpers_test.go
+++ b/cmd/testhelpers_test.go
@@ -23,6 +23,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -42,6 +44,19 @@ func writeJSONResponse(t *testing.T, w http.ResponseWriter, value any) {
 	}
 }
 
+// writeTempConfig creates an (empty) YAML config file in a temp dir and returns
+// its path. Pre-creating the file avoids the interactive "create it?" prompt in
+// commands that write config.
+func writeTempConfig(t *testing.T, contents string) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
+		t.Fatalf("failed to write temp config: %v", err)
+	}
+	return path
+}
+
 // cmdResult captures everything a command-level test needs to assert on after
 // running the CLI: the error returned from Execute, the exit code that error
 // resolves to, and whatever the command wrote to the combined stdout/stderr buffer.

From 1688bc285ef432831a3bfb06333320ed468dcb1f Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:53:25 -0600
Subject: [PATCH 09/14] test(cli): keep each internal/cli test subject in one
 file

The CheckToken, HandleToken, and IOStreams tests were each spread over
two or three files, with the IOStreams error test apart from the others
in cli_errors_test.go. The InitConfig tests were split between
runtime_test.go, as TestRuntimeInitConfig_*, and
runtime_input_environment_test.go, as TestInitConfig_*. And
TestRuntime_EnvironmentIsolation was named for the whole Runtime though
it tests SetTokenFromEnv.

Move the lone CheckToken and HandleToken tests into cli_test.go with the
others for their method, retiring cli_token_validation_test.go. Move the
IOStreams tests into runtime_test.go beside the IOStreams accessors
test, and the IOStreams error test into runtime_errors_test.go, each
with the reader and writer stubs only they use. Rename
TestRuntimeInitConfig_DeclineCreate to TestInitConfig_DeclineCreate and
move the other InitConfig tests beside it in runtime_test.go, the plain
companion of runtime_errors_test.go, which holds the InitConfig error
test. Rename TestRuntime_EnvironmentIsolation to
TestSetTokenFromEnv_PerRuntimeEnvironment and move it next to the other
SetTokenFromEnv test. No test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 internal/cli/cli_errors_test.go               |  47 -----
 internal/cli/cli_test.go                      | 193 +++++++++++++-----
 internal/cli/cli_token_validation_test.go     |  90 --------
 internal/cli/runtime_errors_test.go           |  49 +++++
 internal/cli/runtime_filesystem_test.go       |  54 -----
 .../cli/runtime_input_environment_test.go     | 117 -----------
 internal/cli/runtime_test.go                  | 166 ++++++++++++++-
 7 files changed, 350 insertions(+), 366 deletions(-)
 delete mode 100644 internal/cli/cli_token_validation_test.go

diff --git a/internal/cli/cli_errors_test.go b/internal/cli/cli_errors_test.go
index 3e1b3991..e936fb20 100644
--- a/internal/cli/cli_errors_test.go
+++ b/internal/cli/cli_errors_test.go
@@ -18,53 +18,6 @@ import (
 	"github.com/openchami/ochami/pkg/config"
 )
 
-type zeroWriter struct{}
-
-func (zeroWriter) Write([]byte) (int, error) { return 0, nil }
-
-type oversizedWriter struct{}
-
-func (oversizedWriter) Write(p []byte) (int, error) { return len(p) + 1, nil }
-
-type errorWriter struct{ err error }
-
-func (w errorWriter) Write([]byte) (int, error) { return 0, w.err }
-
-type errorReader struct{ err error }
-
-func (r errorReader) Read([]byte) (int, error) { return 0, r.err }
-
-// TestIOStreams_Errors verifies that LoopYesNo returns prompt-write and
-// input-read failures, and that WriteOutput reports a writer that writes too
-// few or too many bytes as io.ErrShortWrite.
-func TestIOStreams_Errors(t *testing.T) {
-	t.Parallel()
-
-	sentinel := errors.New("stream failure")
-	t.Run("prompt writer", func(t *testing.T) {
-		ios := NewIOStreams(strings.NewReader("y\n"), io.Discard, errorWriter{sentinel})
-		if _, err := ios.LoopYesNo("Proceed?"); !errors.Is(err, sentinel) {
-			t.Fatalf("LoopYesNo() error = %v, want stream failure", err)
-		}
-	})
-	t.Run("input reader", func(t *testing.T) {
-		ios := NewIOStreams(errorReader{sentinel}, io.Discard, io.Discard)
-		if _, err := ios.LoopYesNo("Proceed?"); !errors.Is(err, sentinel) {
-			t.Fatalf("LoopYesNo() error = %v, want stream failure", err)
-		}
-	})
-	t.Run("zero write", func(t *testing.T) {
-		if err := WriteOutput(zeroWriter{}, []byte("data")); !errors.Is(err, io.ErrShortWrite) {
-			t.Fatalf("WriteOutput() error = %v, want io.ErrShortWrite", err)
-		}
-	})
-	t.Run("oversized write", func(t *testing.T) {
-		if err := WriteOutput(oversizedWriter{}, []byte("data")); !errors.Is(err, io.ErrShortWrite) {
-			t.Fatalf("WriteOutput() error = %v, want io.ErrShortWrite", err)
-		}
-	})
-}
-
 // TestSetTokenFromEnv_NoCluster verifies that SetTokenFromEnv returns a
 // CodeAuth error when neither --token nor --cluster/default-cluster is
 // available to resolve a token from.
diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
index 2663d9ed..649dc6e3 100644
--- a/internal/cli/cli_test.go
+++ b/internal/cli/cli_test.go
@@ -10,7 +10,9 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
+	"encoding/base64"
 	"errors"
+	"fmt"
 	"io"
 	"strings"
 	"testing"
@@ -18,67 +20,12 @@ import (
 
 	"github.com/lestrrat-go/jwx/v4/jwa"
 	"github.com/lestrrat-go/jwx/v4/jwt"
+	"github.com/rs/zerolog"
 	"github.com/spf13/cobra"
 
 	"github.com/openchami/ochami/pkg/config"
 )
 
-// TestIOStreams_LoopYesNo verifies that LoopYesNo returns the user's yes or no
-// answer and prompts again after an invalid one.
-func TestIOStreams_LoopYesNo(t *testing.T) {
-	cases := []struct {
-		name      string
-		input     string
-		want      bool
-		wantCount int
-	}{
-		{
-			name:      "yes first try",
-			input:     "y\n",
-			want:      true,
-			wantCount: 1,
-		},
-		{
-			name:      "no first try",
-			input:     "n\n",
-			want:      false,
-			wantCount: 1,
-		},
-		{
-			name:      "invalid then no",
-			input:     "maybe\nn\n",
-			want:      false,
-			wantCount: 2,
-		},
-	}
-
-	for _, tt := range cases {
-		// Create per-iteration copy of test tt so that running
-		// tests in parallel does not reuse the same test for
-		// each run.
-		tc := tt
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			inBuf := bytes.NewBufferString(tc.input)
-			errBuf := &bytes.Buffer{}
-			ios := NewIOStreams(inBuf, io.Discard, errBuf)
-
-			got, err := ios.LoopYesNo("Proceed?")
-			if err != nil {
-				t.Fatalf("LoopYesNo() error = %v, want nil", err)
-			}
-			if got != tc.want {
-				t.Errorf("LoopYesNo() = %v, want %v", got, tc.want)
-			}
-
-			prompt := "Proceed? [yn]:"
-			if count := strings.Count(errBuf.String(), prompt); count != tc.wantCount {
-				t.Errorf("prompt count = %d, want %d", count, tc.wantCount)
-			}
-		})
-	}
-}
-
 // Helper function to generate a test JWT token.
 func generateTestToken(exp time.Time, nbf time.Time, iat time.Time) (string, error) {
 	// Generate RSA key for signing
@@ -378,3 +325,137 @@ func TestLogHelpHint(t *testing.T) {
 		t.Errorf("stderr = %q, want the help hint for demo", stderr.String())
 	}
 }
+
+// TestCheckToken_ParsingAndTimeClaims verifies that local validation accepts
+// optional time claims and invalid signatures but rejects duplicate claims.
+func TestCheckToken_ParsingAndTimeClaims(t *testing.T) {
+	t.Parallel()
+	now := time.Now().Unix()
+	for _, tc := range []struct {
+		name       string
+		payload    string
+		wantReject bool
+		wantCause  error
+		wantWarn   bool
+	}{
+		{
+			name:    "missing_optional_time_claims",
+			payload: `{"sub":"test-subject"}`,
+		},
+		{
+			name:    "invalid_signature_checked_by_service",
+			payload: fmt.Sprintf(`{"exp":%d,"nbf":%d,"iat":%d}`, now+3600, now-60, now-60),
+		},
+		{
+			name:       "future_issued_at",
+			payload:    fmt.Sprintf(`{"iat":%d}`, now+3600),
+			wantReject: true,
+			wantCause:  jwt.InvalidIssuedAtError{},
+		},
+		{
+			name:       "duplicate_expiration",
+			payload:    fmt.Sprintf(`{"exp":%d,"exp":%d}`, now+7200, now+3600),
+			wantReject: true,
+		},
+		{
+			name:       "duplicate_custom_claim",
+			payload:    `{"scope":"admin","scope":"audit"}`,
+			wantReject: true,
+		},
+		{
+			name:     "expiry_warning",
+			payload:  fmt.Sprintf(`{"exp":%d}`, now+600),
+			wantWarn: true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Construct raw payloads so duplicate names survive serialization.
+			// The signature is deliberately invalid: only services verify it.
+			token := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","typ":"JWT"}`)) + "." +
+				base64.RawURLEncoding.EncodeToString([]byte(tc.payload)) + ".c2lnbmF0dXJl"
+			var logs bytes.Buffer
+			rt := NewTestRuntime(strings.NewReader(""), io.Discard, io.Discard).
+				WithToken(token).WithLogger(zerolog.New(&logs))
+			err := rt.CheckToken()
+			if tc.wantReject {
+				if err == nil || ExitCode(err) != CodeAuth {
+					t.Fatalf("CheckToken() = %v, want authentication error", err)
+				}
+				if tc.wantCause != nil && !errors.Is(err, tc.wantCause) {
+					t.Errorf("CheckToken() = %v, want cause %T", err, tc.wantCause)
+				}
+			} else if err != nil {
+				t.Fatalf("CheckToken() = %v, want success", err)
+			}
+			if rt.Token != token {
+				t.Error("CheckToken modified the bearer token")
+			}
+			if warned := strings.Contains(logs.String(), "until token expires"); warned != tc.wantWarn {
+				t.Errorf("expiry warning = %t, want %t", warned, tc.wantWarn)
+			}
+		})
+	}
+}
+
+// TestSetTokenFromEnv_PerRuntimeEnvironment verifies that each runtime
+// resolves its cluster's token from its own environment.
+func TestSetTokenFromEnv_PerRuntimeEnvironment(t *testing.T) {
+	t.Parallel()
+
+	lookup := func(values map[string]string) EnvironmentFunc {
+		return func(key string) (string, bool) {
+			value, ok := values[key]
+			return value, ok
+		}
+	}
+	rtA := NewTestRuntime(nil, io.Discard, io.Discard).WithEnvironment(lookup(map[string]string{"CLUSTER_A_ACCESS_TOKEN": "token-a"}))
+	rtB := NewTestRuntime(nil, io.Discard, io.Discard).WithEnvironment(lookup(map[string]string{"CLUSTER_B_ACCESS_TOKEN": "token-b"}))
+	rtA.Config.DefaultCluster = "cluster-a"
+	rtB.Config.DefaultCluster = "cluster-b"
+
+	if err := rtA.SetTokenFromEnv(tokenTestCmd()); err != nil {
+		t.Fatalf("runtime A SetTokenFromEnv() error = %v", err)
+	}
+	if err := rtB.SetTokenFromEnv(tokenTestCmd()); err != nil {
+		t.Fatalf("runtime B SetTokenFromEnv() error = %v", err)
+	}
+	if rtA.Token != "token-a" || rtB.Token != "token-b" {
+		t.Fatalf("tokens = %q, %q; want token-a, token-b", rtA.Token, rtB.Token)
+	}
+}
+
+// TestHandleToken_FlagPrecedesRuntimeEnvironment verifies that HandleToken uses
+// --token even when the cluster's token environment variable is also set.
+func TestHandleToken_FlagPrecedesRuntimeEnvironment(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now()
+	flagToken, err := generateTestToken(now.Add(time.Hour), now.Add(-time.Hour), now.Add(-time.Hour))
+	if err != nil {
+		t.Fatalf("generate flag token: %v", err)
+	}
+	envToken, err := generateTestToken(now.Add(2*time.Hour), now.Add(-time.Hour), now.Add(-time.Hour))
+	if err != nil {
+		t.Fatalf("generate environment token: %v", err)
+	}
+	rt := NewTestRuntime(nil, io.Discard, io.Discard).WithEnvironment(EnvironmentFunc(func(key string) (string, bool) {
+		return envToken, key == "MY_CLUSTER_ACCESS_TOKEN"
+	}))
+	rt.Config = config.Config{
+		DefaultCluster: "my-cluster",
+		Clusters: []config.Cluster{{
+			Name:    "my-cluster",
+			Cluster: config.ClusterConfig{EnableAuth: true},
+		}},
+	}
+	cmd := tokenTestCmd()
+	if err := cmd.Flags().Set("token", flagToken); err != nil {
+		t.Fatalf("set token flag: %v", err)
+	}
+	if err := rt.HandleToken(cmd); err != nil {
+		t.Fatalf("HandleToken() error = %v", err)
+	}
+	if rt.Token != flagToken {
+		t.Fatal("HandleToken() did not preserve explicit token precedence")
+	}
+}
diff --git a/internal/cli/cli_token_validation_test.go b/internal/cli/cli_token_validation_test.go
deleted file mode 100644
index 2f59061c..00000000
--- a/internal/cli/cli_token_validation_test.go
+++ /dev/null
@@ -1,90 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package cli
-
-import (
-	"bytes"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"io"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/lestrrat-go/jwx/v4/jwt"
-	"github.com/rs/zerolog"
-)
-
-// TestCheckToken_ParsingAndTimeClaims verifies that local validation accepts
-// optional time claims and invalid signatures but rejects duplicate claims.
-func TestCheckToken_ParsingAndTimeClaims(t *testing.T) {
-	t.Parallel()
-	now := time.Now().Unix()
-	for _, tc := range []struct {
-		name       string
-		payload    string
-		wantReject bool
-		wantCause  error
-		wantWarn   bool
-	}{
-		{
-			name:    "missing_optional_time_claims",
-			payload: `{"sub":"test-subject"}`,
-		},
-		{
-			name:    "invalid_signature_checked_by_service",
-			payload: fmt.Sprintf(`{"exp":%d,"nbf":%d,"iat":%d}`, now+3600, now-60, now-60),
-		},
-		{
-			name:       "future_issued_at",
-			payload:    fmt.Sprintf(`{"iat":%d}`, now+3600),
-			wantReject: true,
-			wantCause:  jwt.InvalidIssuedAtError{},
-		},
-		{
-			name:       "duplicate_expiration",
-			payload:    fmt.Sprintf(`{"exp":%d,"exp":%d}`, now+7200, now+3600),
-			wantReject: true,
-		},
-		{
-			name:       "duplicate_custom_claim",
-			payload:    `{"scope":"admin","scope":"audit"}`,
-			wantReject: true,
-		},
-		{
-			name:     "expiry_warning",
-			payload:  fmt.Sprintf(`{"exp":%d}`, now+600),
-			wantWarn: true,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			// Construct raw payloads so duplicate names survive serialization.
-			// The signature is deliberately invalid: only services verify it.
-			token := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","typ":"JWT"}`)) + "." +
-				base64.RawURLEncoding.EncodeToString([]byte(tc.payload)) + ".c2lnbmF0dXJl"
-			var logs bytes.Buffer
-			rt := NewTestRuntime(strings.NewReader(""), io.Discard, io.Discard).
-				WithToken(token).WithLogger(zerolog.New(&logs))
-			err := rt.CheckToken()
-			if tc.wantReject {
-				if err == nil || ExitCode(err) != CodeAuth {
-					t.Fatalf("CheckToken() = %v, want authentication error", err)
-				}
-				if tc.wantCause != nil && !errors.Is(err, tc.wantCause) {
-					t.Errorf("CheckToken() = %v, want cause %T", err, tc.wantCause)
-				}
-			} else if err != nil {
-				t.Fatalf("CheckToken() = %v, want success", err)
-			}
-			if rt.Token != token {
-				t.Error("CheckToken modified the bearer token")
-			}
-			if warned := strings.Contains(logs.String(), "until token expires"); warned != tc.wantWarn {
-				t.Errorf("expiry warning = %t, want %t", warned, tc.wantWarn)
-			}
-		})
-	}
-}
diff --git a/internal/cli/runtime_errors_test.go b/internal/cli/runtime_errors_test.go
index 16999861..c9892613 100644
--- a/internal/cli/runtime_errors_test.go
+++ b/internal/cli/runtime_errors_test.go
@@ -7,6 +7,8 @@ package cli
 import (
 	"bytes"
 	"context"
+	"errors"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -77,3 +79,50 @@ func TestInitConfig_RejectsMalformedFile(t *testing.T) {
 		t.Fatal("InitConfig() accepted a malformed config file")
 	}
 }
+
+type zeroWriter struct{}
+
+func (zeroWriter) Write([]byte) (int, error) { return 0, nil }
+
+type oversizedWriter struct{}
+
+func (oversizedWriter) Write(p []byte) (int, error) { return len(p) + 1, nil }
+
+type errorWriter struct{ err error }
+
+func (w errorWriter) Write([]byte) (int, error) { return 0, w.err }
+
+type errorReader struct{ err error }
+
+func (r errorReader) Read([]byte) (int, error) { return 0, r.err }
+
+// TestIOStreams_Errors verifies that LoopYesNo returns prompt-write and
+// input-read failures, and that WriteOutput reports a writer that writes too
+// few or too many bytes as io.ErrShortWrite.
+func TestIOStreams_Errors(t *testing.T) {
+	t.Parallel()
+
+	sentinel := errors.New("stream failure")
+	t.Run("prompt writer", func(t *testing.T) {
+		ios := NewIOStreams(strings.NewReader("y\n"), io.Discard, errorWriter{sentinel})
+		if _, err := ios.LoopYesNo("Proceed?"); !errors.Is(err, sentinel) {
+			t.Fatalf("LoopYesNo() error = %v, want stream failure", err)
+		}
+	})
+	t.Run("input reader", func(t *testing.T) {
+		ios := NewIOStreams(errorReader{sentinel}, io.Discard, io.Discard)
+		if _, err := ios.LoopYesNo("Proceed?"); !errors.Is(err, sentinel) {
+			t.Fatalf("LoopYesNo() error = %v, want stream failure", err)
+		}
+	})
+	t.Run("zero write", func(t *testing.T) {
+		if err := WriteOutput(zeroWriter{}, []byte("data")); !errors.Is(err, io.ErrShortWrite) {
+			t.Fatalf("WriteOutput() error = %v, want io.ErrShortWrite", err)
+		}
+	})
+	t.Run("oversized write", func(t *testing.T) {
+		if err := WriteOutput(oversizedWriter{}, []byte("data")); !errors.Is(err, io.ErrShortWrite) {
+			t.Fatalf("WriteOutput() error = %v, want io.ErrShortWrite", err)
+		}
+	})
+}
diff --git a/internal/cli/runtime_filesystem_test.go b/internal/cli/runtime_filesystem_test.go
index dcef6fcd..f45a3d11 100644
--- a/internal/cli/runtime_filesystem_test.go
+++ b/internal/cli/runtime_filesystem_test.go
@@ -5,7 +5,6 @@
 package cli
 
 import (
-	"bytes"
 	"errors"
 	"io"
 	"os"
@@ -36,59 +35,6 @@ type closeFunc func() error
 
 func (f closeFunc) Close() error { return f() }
 
-type readError struct{ err error }
-
-func (r readError) Read([]byte) (int, error) { return 0, r.err }
-
-type writeError struct{ err error }
-
-func (w writeError) Write([]byte) (int, error) { return 0, w.err }
-
-// TestIOStreams_ConfirmCreate verifies that ConfirmCreate returns the user's
-// answer, prompts again after an invalid one, treats end of input as no, and
-// returns a failure to read the answer or write the prompt.
-func TestIOStreams_ConfirmCreate(t *testing.T) {
-	t.Parallel()
-
-	readErr := errors.New("read failed")
-	writeErr := errors.New("write failed")
-	tests := []struct {
-		name        string
-		input       io.Reader
-		stderr      io.Writer
-		want        bool
-		wantErr     error
-		wantPrompts int
-	}{
-		{name: "accepted", input: strings.NewReader("y\n"), stderr: &bytes.Buffer{}, want: true, wantPrompts: 1},
-		{name: "declined", input: strings.NewReader("n\n"), stderr: &bytes.Buffer{}, wantPrompts: 1},
-		{name: "invalid then accepted", input: strings.NewReader("perhaps\ny\n"), stderr: &bytes.Buffer{}, want: true, wantPrompts: 2},
-		{name: "EOF", input: strings.NewReader(""), stderr: &bytes.Buffer{}, wantPrompts: 1},
-		{name: "read failure", input: readError{err: readErr}, stderr: &bytes.Buffer{}, wantErr: readErr, wantPrompts: 1},
-		{name: "write failure", input: strings.NewReader("y\n"), stderr: writeError{err: writeErr}, wantErr: writeErr},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			ios := NewIOStreams(tc.input, io.Discard, tc.stderr)
-			got, err := ios.ConfirmCreate("config.yaml")
-			if got != tc.want {
-				t.Errorf("ConfirmCreate() = %v, want %v", got, tc.want)
-			}
-			if !errors.Is(err, tc.wantErr) {
-				t.Errorf("ConfirmCreate() error = %v, want %v", err, tc.wantErr)
-			}
-			if buf, ok := tc.stderr.(*bytes.Buffer); ok {
-				const prompt = "config.yaml does not exist. Create it? [yn]:"
-				if got := strings.Count(buf.String(), prompt); got != tc.wantPrompts {
-					t.Errorf("prompt count = %d, want %d; output %q", got, tc.wantPrompts, buf.String())
-				}
-			}
-		})
-	}
-}
-
 // TestRuntimeAskToCreate verifies that AskToCreate rejects an empty path
 // without checking the filesystem, reports an existing file with ErrFileExists,
 // returns a failure to check the file, and otherwise returns whether the user
diff --git a/internal/cli/runtime_input_environment_test.go b/internal/cli/runtime_input_environment_test.go
index d87c828f..91e7cc09 100644
--- a/internal/cli/runtime_input_environment_test.go
+++ b/internal/cli/runtime_input_environment_test.go
@@ -12,11 +12,8 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/spf13/cobra"
-
-	"github.com/openchami/ochami/pkg/config"
 )
 
 type runtimePayload struct {
@@ -63,33 +60,6 @@ func TestRuntimeHandlePayload_SliceUsesRuntimeInput(t *testing.T) {
 	}
 }
 
-// TestRuntime_EnvironmentIsolation verifies that each runtime resolves its
-// cluster's token from its own environment.
-func TestRuntime_EnvironmentIsolation(t *testing.T) {
-	t.Parallel()
-
-	lookup := func(values map[string]string) EnvironmentFunc {
-		return func(key string) (string, bool) {
-			value, ok := values[key]
-			return value, ok
-		}
-	}
-	rtA := NewTestRuntime(nil, io.Discard, io.Discard).WithEnvironment(lookup(map[string]string{"CLUSTER_A_ACCESS_TOKEN": "token-a"}))
-	rtB := NewTestRuntime(nil, io.Discard, io.Discard).WithEnvironment(lookup(map[string]string{"CLUSTER_B_ACCESS_TOKEN": "token-b"}))
-	rtA.Config.DefaultCluster = "cluster-a"
-	rtB.Config.DefaultCluster = "cluster-b"
-
-	if err := rtA.SetTokenFromEnv(tokenTestCmd()); err != nil {
-		t.Fatalf("runtime A SetTokenFromEnv() error = %v", err)
-	}
-	if err := rtB.SetTokenFromEnv(tokenTestCmd()); err != nil {
-		t.Fatalf("runtime B SetTokenFromEnv() error = %v", err)
-	}
-	if rtA.Token != "token-a" || rtB.Token != "token-b" {
-		t.Fatalf("tokens = %q, %q; want token-a, token-b", rtA.Token, rtB.Token)
-	}
-}
-
 // TestRuntimeResolveUserConfigFile_UsesRuntimeEnvironment verifies that
 // ResolveUserConfigFile reads XDG_CONFIG_HOME from the runtime's environment
 // rather than the process's.
@@ -140,42 +110,6 @@ func TestRuntimeLoadMergedConfig_UsesRuntimeEnvironment(t *testing.T) {
 	}
 }
 
-// TestHandleToken_FlagPrecedesRuntimeEnvironment verifies that HandleToken uses
-// --token even when the cluster's token environment variable is also set.
-func TestHandleToken_FlagPrecedesRuntimeEnvironment(t *testing.T) {
-	t.Parallel()
-
-	now := time.Now()
-	flagToken, err := generateTestToken(now.Add(time.Hour), now.Add(-time.Hour), now.Add(-time.Hour))
-	if err != nil {
-		t.Fatalf("generate flag token: %v", err)
-	}
-	envToken, err := generateTestToken(now.Add(2*time.Hour), now.Add(-time.Hour), now.Add(-time.Hour))
-	if err != nil {
-		t.Fatalf("generate environment token: %v", err)
-	}
-	rt := NewTestRuntime(nil, io.Discard, io.Discard).WithEnvironment(EnvironmentFunc(func(key string) (string, bool) {
-		return envToken, key == "MY_CLUSTER_ACCESS_TOKEN"
-	}))
-	rt.Config = config.Config{
-		DefaultCluster: "my-cluster",
-		Clusters: []config.Cluster{{
-			Name:    "my-cluster",
-			Cluster: config.ClusterConfig{EnableAuth: true},
-		}},
-	}
-	cmd := tokenTestCmd()
-	if err := cmd.Flags().Set("token", flagToken); err != nil {
-		t.Fatalf("set token flag: %v", err)
-	}
-	if err := rt.HandleToken(cmd); err != nil {
-		t.Fatalf("HandleToken() error = %v", err)
-	}
-	if rt.Token != flagToken {
-		t.Fatal("HandleToken() did not preserve explicit token precedence")
-	}
-}
-
 // TestTokenHelpers_AllowStandaloneCommands verifies that SetTokenFromFlag and
 // HandleToken succeed for a command that has no token or cluster flags.
 func TestTokenHelpers_AllowStandaloneCommands(t *testing.T) {
@@ -191,57 +125,6 @@ func TestTokenHelpers_AllowStandaloneCommands(t *testing.T) {
 	}
 }
 
-// TestInitConfig_LoadsMergedDefaults verifies InitConfig reads real process
-// environment variables (HOME, XDG_CONFIG_HOME) to resolve and load the
-// merged system+user configuration when explicitly opted in via
-// WithEnvironment, since NewTestRuntime is hermetic by default.
-func TestInitConfig_LoadsMergedDefaults(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("HOME", home)
-	t.Setenv("XDG_CONFIG_HOME", filepath.Join(home, ".config"))
-
-	rt := NewTestRuntime(nil, &bytes.Buffer{}, &bytes.Buffer{}).WithEnvironment(EnvironmentFunc(os.LookupEnv))
-	cmd := &cobra.Command{Use: "test"}
-	cmd.Flags().Bool("ignore-config", false, "")
-
-	if err := rt.InitConfig(cmd, false); err != nil {
-		t.Fatalf("InitConfig() error = %v", err)
-	}
-	if rt.Config.Log.Level == "" {
-		t.Error("InitConfig() did not load global defaults")
-	}
-	if rt.Effective == (config.Effective{}) {
-		t.Fatal("InitConfig() did not retain the effective view")
-	}
-	if rt.UserConfigFile == "" {
-		t.Error("InitConfig() did not resolve the user config path")
-	}
-}
-
-// TestInitConfig_IgnoreConfigResolvesUserConfigFile verifies that --ignore-config
-// still resolves rt.UserConfigFile (without reading it), so commands that
-// report or target the user config path (e.g. "config show --user") get a
-// usable path instead of an empty string.
-func TestInitConfig_IgnoreConfigResolvesUserConfigFile(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("HOME", home)
-	t.Setenv("XDG_CONFIG_HOME", filepath.Join(home, ".config"))
-
-	rt := NewTestRuntime(nil, &bytes.Buffer{}, &bytes.Buffer{}).WithEnvironment(EnvironmentFunc(os.LookupEnv))
-	cmd := &cobra.Command{Use: "test"}
-	cmd.Flags().Bool("ignore-config", false, "")
-	if err := cmd.Flags().Set("ignore-config", "true"); err != nil {
-		t.Fatalf("set ignore-config flag: %v", err)
-	}
-
-	if err := rt.InitConfig(cmd, false); err != nil {
-		t.Fatalf("InitConfig() error = %v", err)
-	}
-	if rt.UserConfigFile == "" {
-		t.Error("InitConfig() with --ignore-config did not resolve the user config path")
-	}
-}
-
 // TestConfigLoadOpts_TracesOnlyWhenVerbose verifies that rt.configLoadOpts
 // attaches a working trace logger when --verbose is on (EarlyVerbose), and
 // omits it entirely otherwise, so pkg/config's key-enumeration trace path is
diff --git a/internal/cli/runtime_test.go b/internal/cli/runtime_test.go
index a4eb0d9c..8dd3ed71 100644
--- a/internal/cli/runtime_test.go
+++ b/internal/cli/runtime_test.go
@@ -12,6 +12,8 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
+	"errors"
+	"io"
 	"math/big"
 	"os"
 	"path/filepath"
@@ -204,9 +206,9 @@ func TestUseCACert(t *testing.T) {
 	}
 }
 
-// TestRuntimeInitConfig_DeclineCreate verifies that declining to create a
+// TestInitConfig_DeclineCreate verifies that declining to create a
 // missing config file resolves to CodeDeclined and leaves the file uncreated.
-func TestRuntimeInitConfig_DeclineCreate(t *testing.T) {
+func TestInitConfig_DeclineCreate(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.yaml")
 	rt := NewTestRuntime(strings.NewReader("n\n"), &bytes.Buffer{}, &bytes.Buffer{}).WithConfigFile(path)
 	cmd := &cobra.Command{Use: "test"}
@@ -221,6 +223,57 @@ func TestRuntimeInitConfig_DeclineCreate(t *testing.T) {
 	}
 }
 
+// TestInitConfig_LoadsMergedDefaults verifies InitConfig reads real process
+// environment variables (HOME, XDG_CONFIG_HOME) to resolve and load the
+// merged system+user configuration when explicitly opted in via
+// WithEnvironment, since NewTestRuntime is hermetic by default.
+func TestInitConfig_LoadsMergedDefaults(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("XDG_CONFIG_HOME", filepath.Join(home, ".config"))
+
+	rt := NewTestRuntime(nil, &bytes.Buffer{}, &bytes.Buffer{}).WithEnvironment(EnvironmentFunc(os.LookupEnv))
+	cmd := &cobra.Command{Use: "test"}
+	cmd.Flags().Bool("ignore-config", false, "")
+
+	if err := rt.InitConfig(cmd, false); err != nil {
+		t.Fatalf("InitConfig() error = %v", err)
+	}
+	if rt.Config.Log.Level == "" {
+		t.Error("InitConfig() did not load global defaults")
+	}
+	if rt.Effective == (config.Effective{}) {
+		t.Fatal("InitConfig() did not retain the effective view")
+	}
+	if rt.UserConfigFile == "" {
+		t.Error("InitConfig() did not resolve the user config path")
+	}
+}
+
+// TestInitConfig_IgnoreConfigResolvesUserConfigFile verifies that --ignore-config
+// still resolves rt.UserConfigFile (without reading it), so commands that
+// report or target the user config path (e.g. "config show --user") get a
+// usable path instead of an empty string.
+func TestInitConfig_IgnoreConfigResolvesUserConfigFile(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	t.Setenv("XDG_CONFIG_HOME", filepath.Join(home, ".config"))
+
+	rt := NewTestRuntime(nil, &bytes.Buffer{}, &bytes.Buffer{}).WithEnvironment(EnvironmentFunc(os.LookupEnv))
+	cmd := &cobra.Command{Use: "test"}
+	cmd.Flags().Bool("ignore-config", false, "")
+	if err := cmd.Flags().Set("ignore-config", "true"); err != nil {
+		t.Fatalf("set ignore-config flag: %v", err)
+	}
+
+	if err := rt.InitConfig(cmd, false); err != nil {
+		t.Fatalf("InitConfig() error = %v", err)
+	}
+	if rt.UserConfigFile == "" {
+		t.Error("InitConfig() with --ignore-config did not resolve the user config path")
+	}
+}
+
 // TestBooleanFlags_UseTheirValue verifies InitConfig and HandleToken consult
 // the actual value of --ignore-config/--no-token rather than merely whether
 // the flag was passed at all (a flag passed as --ignore-config=false or
@@ -296,3 +349,112 @@ func TestShellCompletions_ReturnDefaultValues(t *testing.T) {
 		}
 	}
 }
+
+// TestIOStreams_LoopYesNo verifies that LoopYesNo returns the user's yes or no
+// answer and prompts again after an invalid one.
+func TestIOStreams_LoopYesNo(t *testing.T) {
+	cases := []struct {
+		name      string
+		input     string
+		want      bool
+		wantCount int
+	}{
+		{
+			name:      "yes first try",
+			input:     "y\n",
+			want:      true,
+			wantCount: 1,
+		},
+		{
+			name:      "no first try",
+			input:     "n\n",
+			want:      false,
+			wantCount: 1,
+		},
+		{
+			name:      "invalid then no",
+			input:     "maybe\nn\n",
+			want:      false,
+			wantCount: 2,
+		},
+	}
+
+	for _, tt := range cases {
+		// Create per-iteration copy of test tt so that running
+		// tests in parallel does not reuse the same test for
+		// each run.
+		tc := tt
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			inBuf := bytes.NewBufferString(tc.input)
+			errBuf := &bytes.Buffer{}
+			ios := NewIOStreams(inBuf, io.Discard, errBuf)
+
+			got, err := ios.LoopYesNo("Proceed?")
+			if err != nil {
+				t.Fatalf("LoopYesNo() error = %v, want nil", err)
+			}
+			if got != tc.want {
+				t.Errorf("LoopYesNo() = %v, want %v", got, tc.want)
+			}
+
+			prompt := "Proceed? [yn]:"
+			if count := strings.Count(errBuf.String(), prompt); count != tc.wantCount {
+				t.Errorf("prompt count = %d, want %d", count, tc.wantCount)
+			}
+		})
+	}
+}
+
+type readError struct{ err error }
+
+func (r readError) Read([]byte) (int, error) { return 0, r.err }
+
+type writeError struct{ err error }
+
+func (w writeError) Write([]byte) (int, error) { return 0, w.err }
+
+// TestIOStreams_ConfirmCreate verifies that ConfirmCreate returns the user's
+// answer, prompts again after an invalid one, treats end of input as no, and
+// returns a failure to read the answer or write the prompt.
+func TestIOStreams_ConfirmCreate(t *testing.T) {
+	t.Parallel()
+
+	readErr := errors.New("read failed")
+	writeErr := errors.New("write failed")
+	tests := []struct {
+		name        string
+		input       io.Reader
+		stderr      io.Writer
+		want        bool
+		wantErr     error
+		wantPrompts int
+	}{
+		{name: "accepted", input: strings.NewReader("y\n"), stderr: &bytes.Buffer{}, want: true, wantPrompts: 1},
+		{name: "declined", input: strings.NewReader("n\n"), stderr: &bytes.Buffer{}, wantPrompts: 1},
+		{name: "invalid then accepted", input: strings.NewReader("perhaps\ny\n"), stderr: &bytes.Buffer{}, want: true, wantPrompts: 2},
+		{name: "EOF", input: strings.NewReader(""), stderr: &bytes.Buffer{}, wantPrompts: 1},
+		{name: "read failure", input: readError{err: readErr}, stderr: &bytes.Buffer{}, wantErr: readErr, wantPrompts: 1},
+		{name: "write failure", input: strings.NewReader("y\n"), stderr: writeError{err: writeErr}, wantErr: writeErr},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			ios := NewIOStreams(tc.input, io.Discard, tc.stderr)
+			got, err := ios.ConfirmCreate("config.yaml")
+			if got != tc.want {
+				t.Errorf("ConfirmCreate() = %v, want %v", got, tc.want)
+			}
+			if !errors.Is(err, tc.wantErr) {
+				t.Errorf("ConfirmCreate() error = %v, want %v", err, tc.wantErr)
+			}
+			if buf, ok := tc.stderr.(*bytes.Buffer); ok {
+				const prompt = "config.yaml does not exist. Create it? [yn]:"
+				if got := strings.Count(buf.String(), prompt); got != tc.wantPrompts {
+					t.Errorf("prompt count = %d, want %d; output %q", got, tc.wantPrompts, buf.String())
+				}
+			}
+		})
+	}
+}

From d7f518c49f64dcb0ee41b3cca8b50fc8dbefe0ba Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:53:46 -0600
Subject: [PATCH 10/14] test(configfile): keep ReadConfigWithDefaults tests in
 one file

The happy-path ReadConfigWithDefaults tests were split across
clusterdefaults_test.go, configfile_test.go, and validate_test.go.

Move them, with their temp-file helpers, into configfile_test.go next to
the function's other tests, and rename clusterdefaults_errors_test.go
to configfile_errors_test.go to match. No test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 internal/configfile/clusterdefaults_test.go   |  66 ------
 ...rors_test.go => configfile_errors_test.go} |   0
 internal/configfile/configfile_test.go        | 195 ++++++++++++++++++
 internal/configfile/validate_test.go          | 158 --------------
 4 files changed, 195 insertions(+), 224 deletions(-)
 delete mode 100644 internal/configfile/clusterdefaults_test.go
 rename internal/configfile/{clusterdefaults_errors_test.go => configfile_errors_test.go} (100%)
 delete mode 100644 internal/configfile/validate_test.go

diff --git a/internal/configfile/clusterdefaults_test.go b/internal/configfile/clusterdefaults_test.go
deleted file mode 100644
index 73bf17e4..00000000
--- a/internal/configfile/clusterdefaults_test.go
+++ /dev/null
@@ -1,66 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package configfile
-
-// clusterdefaults_test.go covers the per-cluster defaults
-// ReadConfigWithDefaults applies to well-formed cluster entries, including one
-// with no cluster block. Malformed entries are covered in
-// clusterdefaults_errors_test.go.
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func writeTemp(t *testing.T, contents string) string {
-	t.Helper()
-	path := filepath.Join(t.TempDir(), "config.yaml")
-	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
-		t.Fatalf("write temp config: %v", err)
-	}
-	return path
-}
-
-// TestReadConfigWithDefaults_NilClusterBlock verifies a cluster entry whose
-// "cluster" block is nil is accepted.
-func TestReadConfigWithDefaults_NilClusterBlock(t *testing.T) {
-	path := writeTemp(t, `clusters:
-- name: demo
-`)
-	if _, err := ReadConfigWithDefaults(path); err != nil {
-		t.Errorf("ReadConfigWithDefaults with nil cluster block = %v, want nil", err)
-	}
-}
-
-// TestReadConfigWithDefaults_ValidClusters verifies a well-formed multi-cluster
-// config loads and applies defaults.
-func TestReadConfigWithDefaults_ValidClusters(t *testing.T) {
-	path := writeTemp(t, `default-cluster: demo
-clusters:
-- name: demo
-  cluster:
-    uri: https://demo.example.com
-- name: prod
-  cluster:
-    uri: https://prod.example.com
-`)
-	eff, err := ReadConfigWithDefaults(path)
-	if err != nil {
-		t.Fatalf("ReadConfigWithDefaults = %v, want nil", err)
-	}
-	if got := eff.Get("default-cluster"); got != "demo" {
-		t.Errorf("default-cluster = %v, want demo", got)
-	}
-	clusters, ok := eff.Get("clusters").([]map[string]any)
-	if !ok || len(clusters) != 2 {
-		t.Fatalf("clusters = %v, want 2 entries", eff.Get("clusters"))
-	}
-	// Defaults (e.g. enable-auth) should have been applied per-cluster.
-	demo, ok := clusters[0]["cluster"].(map[string]any)
-	if !ok || demo["enable-auth"] != true {
-		t.Errorf("demo cluster enable-auth = %v, want true (default applied)", demo["enable-auth"])
-	}
-}
diff --git a/internal/configfile/clusterdefaults_errors_test.go b/internal/configfile/configfile_errors_test.go
similarity index 100%
rename from internal/configfile/clusterdefaults_errors_test.go
rename to internal/configfile/configfile_errors_test.go
diff --git a/internal/configfile/configfile_test.go b/internal/configfile/configfile_test.go
index 71a64a08..9d94bb4f 100644
--- a/internal/configfile/configfile_test.go
+++ b/internal/configfile/configfile_test.go
@@ -6,6 +6,7 @@
 package configfile
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -508,3 +509,197 @@ func TestReadConfigWithDefaults_AppliesClusterDefaults(t *testing.T) {
 		t.Errorf("clusters not slice: %v", order)
 	}
 }
+
+func writeTemp(t *testing.T, contents string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.yaml")
+	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
+		t.Fatalf("write temp config: %v", err)
+	}
+	return path
+}
+
+// TestReadConfigWithDefaults_NilClusterBlock verifies a cluster entry whose
+// "cluster" block is nil is accepted.
+func TestReadConfigWithDefaults_NilClusterBlock(t *testing.T) {
+	path := writeTemp(t, `clusters:
+- name: demo
+`)
+	if _, err := ReadConfigWithDefaults(path); err != nil {
+		t.Errorf("ReadConfigWithDefaults with nil cluster block = %v, want nil", err)
+	}
+}
+
+// TestReadConfigWithDefaults_ValidClusters verifies a well-formed multi-cluster
+// config loads and applies defaults.
+func TestReadConfigWithDefaults_ValidClusters(t *testing.T) {
+	path := writeTemp(t, `default-cluster: demo
+clusters:
+- name: demo
+  cluster:
+    uri: https://demo.example.com
+- name: prod
+  cluster:
+    uri: https://prod.example.com
+`)
+	eff, err := ReadConfigWithDefaults(path)
+	if err != nil {
+		t.Fatalf("ReadConfigWithDefaults = %v, want nil", err)
+	}
+	if got := eff.Get("default-cluster"); got != "demo" {
+		t.Errorf("default-cluster = %v, want demo", got)
+	}
+	clusters, ok := eff.Get("clusters").([]map[string]any)
+	if !ok || len(clusters) != 2 {
+		t.Fatalf("clusters = %v, want 2 entries", eff.Get("clusters"))
+	}
+	// Defaults (e.g. enable-auth) should have been applied per-cluster.
+	demo, ok := clusters[0]["cluster"].(map[string]any)
+	if !ok || demo["enable-auth"] != true {
+		t.Errorf("demo cluster enable-auth = %v, want true (default applied)", demo["enable-auth"])
+	}
+}
+
+// writeCfg writes content to a temp config file and returns its path.
+func writeCfg(t *testing.T, content string) string {
+	t.Helper()
+	tmp := t.TempDir()
+	path := filepath.Join(tmp, "config.yaml")
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("setup failed: %v", err)
+	}
+	return path
+}
+
+// TestReadConfigWithDefaults_Validation verifies that ReadConfigWithDefaults
+// rejects null, empty, or malformed timeout, enable-auth, and log values with
+// ErrInvalidConfigVal, a cluster without a name, and malformed YAML, coerces a
+// quoted enable-auth, and accepts a valid file.
+func TestReadConfigWithDefaults_Validation(t *testing.T) {
+	t.Run("null timeout rejected", func(t *testing.T) {
+		path := writeCfg(t, "timeout:\n")
+		_, err := ReadConfigWithDefaults(path)
+		if err == nil {
+			t.Fatal("expected error for null timeout, got nil")
+		}
+		var eicv config.ErrInvalidConfigVal
+		if !errors.As(err, &eicv) {
+			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
+		}
+		if eicv.Key != "timeout" {
+			t.Errorf("error key = %q, want timeout", eicv.Key)
+		}
+	})
+
+	t.Run("invalid timeout duration rejected", func(t *testing.T) {
+		path := writeCfg(t, "timeout: notaduration\n")
+		_, err := ReadConfigWithDefaults(path)
+		if err == nil {
+			t.Fatal("expected error for invalid timeout, got nil")
+		}
+		var eicv config.ErrInvalidConfigVal
+		if !errors.As(err, &eicv) {
+			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
+		}
+	})
+
+	t.Run("null enable-auth rejected", func(t *testing.T) {
+		path := writeCfg(t, "clusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth:\n")
+		_, err := ReadConfigWithDefaults(path)
+		if err == nil {
+			t.Fatal("expected error for null enable-auth, got nil")
+		}
+		var eicv config.ErrInvalidConfigVal
+		if !errors.As(err, &eicv) {
+			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
+		}
+	})
+
+	t.Run("string enable-auth coerced", func(t *testing.T) {
+		path := writeCfg(t, "clusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth: \"false\"\n")
+		eff, err := ReadConfigWithDefaults(path)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		var clusters []config.Cluster
+		if err := eff.Unmarshal("clusters", &clusters); err != nil {
+			t.Fatalf("unmarshal: %v", err)
+		}
+		if len(clusters) != 1 {
+			t.Fatalf("got %d clusters, want 1", len(clusters))
+		}
+		if clusters[0].Cluster.EnableAuth {
+			t.Errorf("EnableAuth = true, want false (coerced from string \"false\")")
+		}
+	})
+
+	t.Run("invalid enable-auth string rejected", func(t *testing.T) {
+		path := writeCfg(t, "clusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth: maybe\n")
+		_, err := ReadConfigWithDefaults(path)
+		if err == nil {
+			t.Fatal("expected error for invalid enable-auth string, got nil")
+		}
+		var eicv config.ErrInvalidConfigVal
+		if !errors.As(err, &eicv) {
+			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
+		}
+	})
+
+	t.Run("valid config accepted", func(t *testing.T) {
+		path := writeCfg(t, "timeout: 45s\nclusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth: false\n")
+		eff, err := ReadConfigWithDefaults(path)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if got, _ := eff.Get("timeout").(string); got != "45s" {
+			t.Errorf("timeout = %q, want 45s", got)
+		}
+	})
+
+	t.Run("empty log.level rejected", func(t *testing.T) {
+		path := writeCfg(t, "log:\n  level: \"\"\n")
+		_, err := ReadConfigWithDefaults(path)
+		if err == nil {
+			t.Fatal("expected error for empty log.level, got nil")
+		}
+		var eicv config.ErrInvalidConfigVal
+		if !errors.As(err, &eicv) {
+			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
+		}
+		if eicv.Key != "log.level" {
+			t.Errorf("error key = %q, want log.level", eicv.Key)
+		}
+		if eicv.Value != "empty string" {
+			t.Errorf("error value = %q, want empty string", eicv.Value)
+		}
+	})
+
+	t.Run("empty log.format rejected", func(t *testing.T) {
+		path := writeCfg(t, "log:\n  format: \"\"\n")
+		_, err := ReadConfigWithDefaults(path)
+		if err == nil {
+			t.Fatal("expected error for empty log.format, got nil")
+		}
+		var eicv config.ErrInvalidConfigVal
+		if !errors.As(err, &eicv) {
+			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
+		}
+		if eicv.Key != "log.format" {
+			t.Errorf("error key = %q, want log.format", eicv.Key)
+		}
+	})
+
+	t.Run("cluster missing name rejected", func(t *testing.T) {
+		path := writeCfg(t, "clusters:\n  - cluster:\n      uri: https://foo.example.com\n")
+		if _, err := ReadConfigWithDefaults(path); err == nil {
+			t.Fatal("expected error for cluster missing name, got nil")
+		}
+	})
+
+	t.Run("malformed yaml rejected", func(t *testing.T) {
+		path := writeCfg(t, "clusters: [unterminated\n")
+		if _, err := ReadConfigWithDefaults(path); err == nil {
+			t.Fatal("expected error for malformed YAML, got nil")
+		}
+	})
+}
diff --git a/internal/configfile/validate_test.go b/internal/configfile/validate_test.go
deleted file mode 100644
index 0c3e59c0..00000000
--- a/internal/configfile/validate_test.go
+++ /dev/null
@@ -1,158 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package configfile
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/openchami/ochami/pkg/config"
-)
-
-// writeCfg writes content to a temp config file and returns its path.
-func writeCfg(t *testing.T, content string) string {
-	t.Helper()
-	tmp := t.TempDir()
-	path := filepath.Join(tmp, "config.yaml")
-	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
-		t.Fatalf("setup failed: %v", err)
-	}
-	return path
-}
-
-// TestReadConfigWithDefaults_Validation verifies that ReadConfigWithDefaults
-// rejects null, empty, or malformed timeout, enable-auth, and log values with
-// ErrInvalidConfigVal, a cluster without a name, and malformed YAML, coerces a
-// quoted enable-auth, and accepts a valid file.
-func TestReadConfigWithDefaults_Validation(t *testing.T) {
-	t.Run("null timeout rejected", func(t *testing.T) {
-		path := writeCfg(t, "timeout:\n")
-		_, err := ReadConfigWithDefaults(path)
-		if err == nil {
-			t.Fatal("expected error for null timeout, got nil")
-		}
-		var eicv config.ErrInvalidConfigVal
-		if !errors.As(err, &eicv) {
-			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
-		}
-		if eicv.Key != "timeout" {
-			t.Errorf("error key = %q, want timeout", eicv.Key)
-		}
-	})
-
-	t.Run("invalid timeout duration rejected", func(t *testing.T) {
-		path := writeCfg(t, "timeout: notaduration\n")
-		_, err := ReadConfigWithDefaults(path)
-		if err == nil {
-			t.Fatal("expected error for invalid timeout, got nil")
-		}
-		var eicv config.ErrInvalidConfigVal
-		if !errors.As(err, &eicv) {
-			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
-		}
-	})
-
-	t.Run("null enable-auth rejected", func(t *testing.T) {
-		path := writeCfg(t, "clusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth:\n")
-		_, err := ReadConfigWithDefaults(path)
-		if err == nil {
-			t.Fatal("expected error for null enable-auth, got nil")
-		}
-		var eicv config.ErrInvalidConfigVal
-		if !errors.As(err, &eicv) {
-			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
-		}
-	})
-
-	t.Run("string enable-auth coerced", func(t *testing.T) {
-		path := writeCfg(t, "clusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth: \"false\"\n")
-		eff, err := ReadConfigWithDefaults(path)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		var clusters []config.Cluster
-		if err := eff.Unmarshal("clusters", &clusters); err != nil {
-			t.Fatalf("unmarshal: %v", err)
-		}
-		if len(clusters) != 1 {
-			t.Fatalf("got %d clusters, want 1", len(clusters))
-		}
-		if clusters[0].Cluster.EnableAuth {
-			t.Errorf("EnableAuth = true, want false (coerced from string \"false\")")
-		}
-	})
-
-	t.Run("invalid enable-auth string rejected", func(t *testing.T) {
-		path := writeCfg(t, "clusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth: maybe\n")
-		_, err := ReadConfigWithDefaults(path)
-		if err == nil {
-			t.Fatal("expected error for invalid enable-auth string, got nil")
-		}
-		var eicv config.ErrInvalidConfigVal
-		if !errors.As(err, &eicv) {
-			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
-		}
-	})
-
-	t.Run("valid config accepted", func(t *testing.T) {
-		path := writeCfg(t, "timeout: 45s\nclusters:\n  - name: foo\n    cluster:\n      uri: https://foo\n      enable-auth: false\n")
-		eff, err := ReadConfigWithDefaults(path)
-		if err != nil {
-			t.Fatalf("unexpected error: %v", err)
-		}
-		if got, _ := eff.Get("timeout").(string); got != "45s" {
-			t.Errorf("timeout = %q, want 45s", got)
-		}
-	})
-
-	t.Run("empty log.level rejected", func(t *testing.T) {
-		path := writeCfg(t, "log:\n  level: \"\"\n")
-		_, err := ReadConfigWithDefaults(path)
-		if err == nil {
-			t.Fatal("expected error for empty log.level, got nil")
-		}
-		var eicv config.ErrInvalidConfigVal
-		if !errors.As(err, &eicv) {
-			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
-		}
-		if eicv.Key != "log.level" {
-			t.Errorf("error key = %q, want log.level", eicv.Key)
-		}
-		if eicv.Value != "empty string" {
-			t.Errorf("error value = %q, want empty string", eicv.Value)
-		}
-	})
-
-	t.Run("empty log.format rejected", func(t *testing.T) {
-		path := writeCfg(t, "log:\n  format: \"\"\n")
-		_, err := ReadConfigWithDefaults(path)
-		if err == nil {
-			t.Fatal("expected error for empty log.format, got nil")
-		}
-		var eicv config.ErrInvalidConfigVal
-		if !errors.As(err, &eicv) {
-			t.Fatalf("expected ErrInvalidConfigVal, got %T: %v", err, err)
-		}
-		if eicv.Key != "log.format" {
-			t.Errorf("error key = %q, want log.format", eicv.Key)
-		}
-	})
-
-	t.Run("cluster missing name rejected", func(t *testing.T) {
-		path := writeCfg(t, "clusters:\n  - cluster:\n      uri: https://foo.example.com\n")
-		if _, err := ReadConfigWithDefaults(path); err == nil {
-			t.Fatal("expected error for cluster missing name, got nil")
-		}
-	})
-
-	t.Run("malformed yaml rejected", func(t *testing.T) {
-		path := writeCfg(t, "clusters: [unterminated\n")
-		if _, err := ReadConfigWithDefaults(path); err == nil {
-			t.Fatal("expected error for malformed YAML, got nil")
-		}
-	})
-}

From 9d016ef140ee70c42aa0bf5ceed9bff268d11532 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:54:09 -0600
Subject: [PATCH 11/14] test(client): keep UseCACert and ShowConsole error
 tests together

TestUseCACert_FileFailures sat in request_layer_errors_test.go and
TestShowConsole_ReturnsConnectionCloseError in session_errors_test.go,
apart from the other error tests of the same functions. Move them into
client_errors_test.go and rcs_errors_test.go. No test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 pkg/client/client_errors_test.go        | 20 +++++++++++++++++
 pkg/client/rcs/rcs_errors_test.go       | 29 +++++++++++++++++++++++--
 pkg/client/rcs/session_errors_test.go   | 22 -------------------
 pkg/client/request_layer_errors_test.go | 20 -----------------
 4 files changed, 47 insertions(+), 44 deletions(-)

diff --git a/pkg/client/client_errors_test.go b/pkg/client/client_errors_test.go
index 04be0949..325a9db9 100644
--- a/pkg/client/client_errors_test.go
+++ b/pkg/client/client_errors_test.go
@@ -207,3 +207,23 @@ func TestDataWrappers_RequestErrors(t *testing.T) {
 		t.Error("DeleteData against closed server = nil, want error")
 	}
 }
+
+// TestUseCACert_FileFailures verifies that UseCACert rejects a missing file, a
+// directory, and an empty file.
+func TestUseCACert_FileFailures(t *testing.T) {
+	oc, err := NewOchamiClient("test", "https://example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	empty := filepath.Join(dir, "empty.pem")
+	if err := os.WriteFile(empty, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, path := range []string{filepath.Join(dir, "missing.pem"), dir, empty} {
+		if err := oc.UseCACert(path); err == nil {
+			t.Errorf("UseCACert(%q) error = nil", path)
+		}
+	}
+}
diff --git a/pkg/client/rcs/rcs_errors_test.go b/pkg/client/rcs/rcs_errors_test.go
index 3cb998b1..ffccf3fa 100644
--- a/pkg/client/rcs/rcs_errors_test.go
+++ b/pkg/client/rcs/rcs_errors_test.go
@@ -6,12 +6,14 @@ package rcs
 
 // rcs_errors_test.go unit-tests the RCSClient's error arms: a non-2XX response
 // from the plain HTTP endpoints, a websocket dial failure for the
-// console-streaming endpoints, malformed response bodies, websocketDialError's
-// classification of failed dials, and the rejection of a malformed client URI.
+// console-streaming endpoints, a failure to close the console connection,
+// malformed response bodies, websocketDialError's classification of failed
+// dials, and the rejection of a malformed client URI.
 
 import (
 	"bytes"
 	"context"
+	"errors"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -19,6 +21,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/gorilla/websocket"
+
 	"github.com/openchami/ochami/pkg/client"
 )
 
@@ -164,3 +168,24 @@ func TestRCSNewClientAndDial_RejectMalformedURIs(t *testing.T) {
 		t.Fatal("dialWebSocket() accepted nil base URI")
 	}
 }
+
+// TestShowConsole_ReturnsConnectionCloseError verifies that ShowConsole returns
+// a failure to close the websocket connection after a normal close from the
+// server.
+func TestShowConsole_ReturnsConnectionCloseError(t *testing.T) {
+	want := errors.New("close failed")
+	conn := &fakeMessageConn{
+		readErr:  &websocket.CloseError{Code: websocket.CloseNormalClosure},
+		closeErr: want,
+	}
+	c, err := NewClient("https://example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	c.dial = func(context.Context, string, http.Header) (messageConn, *http.Response, error) {
+		return conn, nil, nil
+	}
+	if err := c.ShowConsole(context.Background(), "x0", false, 1, "", io.Discard); !errors.Is(err, want) {
+		t.Fatalf("ShowConsole() error = %v, want close error", err)
+	}
+}
diff --git a/pkg/client/rcs/session_errors_test.go b/pkg/client/rcs/session_errors_test.go
index 9ae5b846..17c73564 100644
--- a/pkg/client/rcs/session_errors_test.go
+++ b/pkg/client/rcs/session_errors_test.go
@@ -8,7 +8,6 @@ import (
 	"context"
 	"errors"
 	"io"
-	"net/http"
 	"os"
 	"path/filepath"
 	"testing"
@@ -68,24 +67,3 @@ func TestRunConsoleSession_TerminalErrors(t *testing.T) {
 		}
 	})
 }
-
-// TestShowConsole_ReturnsConnectionCloseError verifies that ShowConsole returns
-// a failure to close the websocket connection after a normal close from the
-// server.
-func TestShowConsole_ReturnsConnectionCloseError(t *testing.T) {
-	want := errors.New("close failed")
-	conn := &fakeMessageConn{
-		readErr:  &websocket.CloseError{Code: websocket.CloseNormalClosure},
-		closeErr: want,
-	}
-	c, err := NewClient("https://example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-	c.dial = func(context.Context, string, http.Header) (messageConn, *http.Response, error) {
-		return conn, nil, nil
-	}
-	if err := c.ShowConsole(context.Background(), "x0", false, 1, "", io.Discard); !errors.Is(err, want) {
-		t.Fatalf("ShowConsole() error = %v, want close error", err)
-	}
-}
diff --git a/pkg/client/request_layer_errors_test.go b/pkg/client/request_layer_errors_test.go
index 167cf7a0..8b141496 100644
--- a/pkg/client/request_layer_errors_test.go
+++ b/pkg/client/request_layer_errors_test.go
@@ -259,23 +259,3 @@ func TestPayloadInput_Failures(t *testing.T) {
 		})
 	}
 }
-
-// TestUseCACert_FileFailures verifies that UseCACert rejects a missing file, a
-// directory, and an empty file.
-func TestUseCACert_FileFailures(t *testing.T) {
-	oc, err := NewOchamiClient("test", "https://example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-	dir := t.TempDir()
-	empty := filepath.Join(dir, "empty.pem")
-	if err := os.WriteFile(empty, nil, 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	for _, path := range []string{filepath.Join(dir, "missing.pem"), dir, empty} {
-		if err := oc.UseCACert(path); err == nil {
-			t.Errorf("UseCACert(%q) error = nil", path)
-		}
-	}
-}

From 6ea838b1a93282d96a897f28c5aaac41f63434d5 Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:54:53 -0600
Subject: [PATCH 12/14] test(config): name File transaction tests after
 File.Update

The tests in transaction_test.go and transaction_errors_test.go shared
the TestFile_ subject with the per-method tests in file_test.go and
file_errors_test.go, though they cover the staged write that File.Update
performs for every mutation. Rename them TestFileUpdate_* so each file
holds a distinct subject. No test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 pkg/config/transaction_errors_test.go | 22 +++++++++++-----------
 pkg/config/transaction_test.go        |  8 ++++----
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkg/config/transaction_errors_test.go b/pkg/config/transaction_errors_test.go
index 651e7493..f4554f72 100644
--- a/pkg/config/transaction_errors_test.go
+++ b/pkg/config/transaction_errors_test.go
@@ -10,11 +10,11 @@ import (
 	"testing"
 )
 
-// TestFile_FailedWriteLeavesStateUnchanged verifies that when a mutating
+// TestFileUpdate_FailedWriteLeavesStateUnchanged verifies that when a mutating
 // method's write fails, neither the file on disk nor the File's in-memory
 // state reflects the attempted change: the mutation is staged on a clone that
 // is discarded on failure.
-func TestFile_FailedWriteLeavesStateUnchanged(t *testing.T) {
+func TestFileUpdate_FailedWriteLeavesStateUnchanged(t *testing.T) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "config.yaml")
@@ -57,10 +57,10 @@ func TestFile_FailedWriteLeavesStateUnchanged(t *testing.T) {
 	}
 }
 
-// TestFile_FailedUpdateLeavesStateUnchanged verifies that a batched Update
+// TestFileUpdate_FailedBatchLeavesStateUnchanged verifies that a batched Update
 // whose final write fails leaves the File's in-memory state exactly as it was
 // before Update, so none of the batch's staged mutations survive.
-func TestFile_FailedUpdateLeavesStateUnchanged(t *testing.T) {
+func TestFileUpdate_FailedBatchLeavesStateUnchanged(t *testing.T) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "config.yaml")
@@ -95,10 +95,10 @@ func TestFile_FailedUpdateLeavesStateUnchanged(t *testing.T) {
 	}
 }
 
-// TestFile_RejectedMutationLeavesNoStagedState verifies that a mutation that
-// rejects its input leaves no working copy behind, so a later mutation starts
-// from the committed state.
-func TestFile_RejectedMutationLeavesNoStagedState(t *testing.T) {
+// TestFileUpdate_RejectedMutationLeavesNoStagedState verifies that a mutation
+// that rejects its input leaves no working copy behind, so a later mutation
+// starts from the committed state.
+func TestFileUpdate_RejectedMutationLeavesNoStagedState(t *testing.T) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "config.yaml")
@@ -129,11 +129,11 @@ func TestFile_RejectedMutationLeavesNoStagedState(t *testing.T) {
 	}
 }
 
-// TestFile_DirectorySyncFailureKeepsStateWithFile verifies that when the new
-// contents replace the file but syncing its directory fails, the mutation
+// TestFileUpdate_DirectorySyncFailureKeepsStateWithFile verifies that when the
+// new contents replace the file but syncing its directory fails, the mutation
 // returns the error and f's in-memory state matches the replaced file, so a
 // later write doesn't undo the change.
-func TestFile_DirectorySyncFailureKeepsStateWithFile(t *testing.T) {
+func TestFileUpdate_DirectorySyncFailureKeepsStateWithFile(t *testing.T) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "config.yaml")
diff --git a/pkg/config/transaction_test.go b/pkg/config/transaction_test.go
index fcbbd1b8..0f22532b 100644
--- a/pkg/config/transaction_test.go
+++ b/pkg/config/transaction_test.go
@@ -21,9 +21,9 @@ func unwritablePath(t *testing.T) string {
 	return filepath.Join(notADir, "config.yaml")
 }
 
-// TestFile_UpdatePersistsAllChanges verifies that a successful Update writes
+// TestFileUpdate_PersistsAllChanges verifies that a successful Update writes
 // all of its batched mutations to disk.
-func TestFile_UpdatePersistsAllChanges(t *testing.T) {
+func TestFileUpdate_PersistsAllChanges(t *testing.T) {
 	t.Parallel()
 
 	path := filepath.Join(t.TempDir(), "config.yaml")
@@ -53,10 +53,10 @@ func TestFile_UpdatePersistsAllChanges(t *testing.T) {
 	}
 }
 
-// TestFile_UpdateReadsSeeStagedChanges verifies that Get, Raw, Cluster, and
+// TestFileUpdate_ReadsSeeStagedChanges verifies that Get, Raw, Cluster, and
 // Clusters called inside Update observe the changes fn has made so far, before
 // they are written.
-func TestFile_UpdateReadsSeeStagedChanges(t *testing.T) {
+func TestFileUpdate_ReadsSeeStagedChanges(t *testing.T) {
 	t.Parallel()
 
 	f, err := CreateFile(filepath.Join(t.TempDir(), "config.yaml"))

From 352fe46d93a0efc8d747ff53dbd426eebcb2f4aa Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:58:54 -0600
Subject: [PATCH 13/14] test(config): keep LoadMerged and UserConfigPath tests
 in one file

loadmerged_test.go held one LoadMerged test and one UserConfigPath test
apart from the others for those functions in config_test.go. Move them
there and retire loadmerged_test.go. No test logic changes.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 pkg/config/config_test.go     | 39 ++++++++++++++++++++++++++
 pkg/config/loadmerged_test.go | 53 -----------------------------------
 2 files changed, 39 insertions(+), 53 deletions(-)
 delete mode 100644 pkg/config/loadmerged_test.go

diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index a0d2222d..ff4a9a85 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -8,6 +8,7 @@ package config
 import (
 	"errors"
 	"os"
+	"os/user"
 	"path/filepath"
 	"reflect"
 	"strings"
@@ -899,3 +900,41 @@ func TestLoadMergedEffective_MatchesConfig(t *testing.T) {
 		t.Errorf("Effective timeout = %s, Config.Timeout = %s; must match", gotDuration, cfg.Timeout)
 	}
 }
+
+// TestLoadMerged_NoUserFile verifies LoadMerged succeeds when no user config
+// file exists (the user source is optional).
+func TestLoadMerged_NoUserFile(t *testing.T) {
+	tmpHome := t.TempDir() // empty; no config file present
+	t.Setenv("XDG_CONFIG_HOME", "")
+	t.Setenv("HOME", tmpHome)
+
+	if _, err := LoadMerged(); err != nil {
+		t.Fatalf("LoadMerged with no user file returned error: %v", err)
+	}
+}
+
+// TestUserConfigPath_HomeUnset verifies that, with HOME unset, UserConfigPath
+// falls back to the current user's home directory, or fails if the current user
+// can't be determined.
+func TestUserConfigPath_HomeUnset(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", "")
+	// t.Setenv restores HOME when the test ends; unset it until then.
+	t.Setenv("HOME", "")
+	os.Unsetenv("HOME")
+
+	u, userErr := user.Current()
+	got, err := UserConfigPath()
+	if userErr != nil {
+		// Without a resolvable current user there is nothing to fall back to.
+		if err == nil {
+			t.Fatalf("UserConfigPath() = %q, want an error when user.Current() fails", got)
+		}
+		return
+	}
+	if err != nil {
+		t.Fatalf("UserConfigPath() error = %v", err)
+	}
+	if want := filepath.Join(u.HomeDir, ".config", "ochami", "config.yaml"); got != want {
+		t.Errorf("UserConfigPath() = %q, want %q", got, want)
+	}
+}
diff --git a/pkg/config/loadmerged_test.go b/pkg/config/loadmerged_test.go
deleted file mode 100644
index 77c143e9..00000000
--- a/pkg/config/loadmerged_test.go
+++ /dev/null
@@ -1,53 +0,0 @@
-// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
-//
-// SPDX-License-Identifier: MIT
-
-package config
-
-// loadmerged_test.go covers LoadMerged and UserConfigPath's fallback to the
-// current user's home directory when HOME is unset.
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-	"testing"
-)
-
-// TestLoadMerged_NoUserFile verifies LoadMerged succeeds when no user config
-// file exists (the user source is optional).
-func TestLoadMerged_NoUserFile(t *testing.T) {
-	tmpHome := t.TempDir() // empty; no config file present
-	t.Setenv("XDG_CONFIG_HOME", "")
-	t.Setenv("HOME", tmpHome)
-
-	if _, err := LoadMerged(); err != nil {
-		t.Fatalf("LoadMerged with no user file returned error: %v", err)
-	}
-}
-
-// TestUserConfigPath_HomeUnset verifies that, with HOME unset, UserConfigPath
-// falls back to the current user's home directory, or fails if the current user
-// can't be determined.
-func TestUserConfigPath_HomeUnset(t *testing.T) {
-	t.Setenv("XDG_CONFIG_HOME", "")
-	// t.Setenv restores HOME when the test ends; unset it until then.
-	t.Setenv("HOME", "")
-	os.Unsetenv("HOME")
-
-	u, userErr := user.Current()
-	got, err := UserConfigPath()
-	if userErr != nil {
-		// Without a resolvable current user there is nothing to fall back to.
-		if err == nil {
-			t.Fatalf("UserConfigPath() = %q, want an error when user.Current() fails", got)
-		}
-		return
-	}
-	if err != nil {
-		t.Fatalf("UserConfigPath() error = %v", err)
-	}
-	if want := filepath.Join(u.HomeDir, ".config", "ochami", "config.yaml"); got != want {
-		t.Errorf("UserConfigPath() = %q, want %q", got, want)
-	}
-}

From 3c18c31dd6c0c2634eee742385e0e4de53fbfa6a Mon Sep 17 00:00:00 2001
From: Devon Bautista <17506592+synackd@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:58:54 -0600
Subject: [PATCH 14/14] test(conventions): require one file per test subject
 and bucket

CONTRIBUTING.md's suffix taxonomy implies one file per subject and
bucket, but nothing enforced it, so tests of one subject spread across
several files as new batches added new files.

Add a source check that flags a subject (the part of a test's name
before its first underscore) whose tests in one bucket (plain, _errors,
or _boundary) are in more than one file of a package. A file that builds
only on some platforms, by a GOOS/GOARCH file name suffix or a
//go:build constraint with a platform tag, is compared only with files
for the same platforms, so it can hold a subject's tests for those
platforms. Other build tags don't exempt a file. Add fixtures for a
split subject, a file with a non-platform build tag, two files for one
platform, and files for other platforms.

Document the rule in CONTRIBUTING.md, along with naming command tests
after the command path they cover.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
---
 CONTRIBUTING.md                               |  28 ++++-
 internal/conventions/conventions_test.go      | 106 ++++++++++++++++++
 .../testdata/violations/widget_linux_test.go  |  11 ++
 .../violations/widget_set_windows_test.go     |  11 ++
 .../testdata/violations/widget_tagged_test.go |  14 +++
 .../testdata/violations/widget_test.go        |  11 ++
 .../violations/widget_windows_test.go         |  11 ++
 7 files changed, 190 insertions(+), 2 deletions(-)
 create mode 100644 internal/conventions/testdata/violations/widget_linux_test.go
 create mode 100644 internal/conventions/testdata/violations/widget_set_windows_test.go
 create mode 100644 internal/conventions/testdata/violations/widget_tagged_test.go
 create mode 100644 internal/conventions/testdata/violations/widget_test.go
 create mode 100644 internal/conventions/testdata/violations/widget_windows_test.go

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0ba29a5d..6123fa81 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -206,6 +206,30 @@ Avoid generic, non-descriptive suffixes (`_more`, `_edge`, `_extra`,
 matches what the test actually asserts, or extend the subject's plain test
 file if it's more happy-path coverage of the same subject.
 
+Keep each subject's tests for a bucket in one file of its package, so the
+file name tells a reader where they are. The subject here is the part of the
+name before the first underscore (`TestFile` in `TestFile_SetKey`); if that
+is too broad to group by, name the tests after the specific function or
+method (`TestFileUpdate_PersistsAllChanges`). The exception is a file
+restricted to some platforms by a GOOS/GOARCH file name suffix or build
+constraint (e.g. `pkg/config/sync_windows_test.go`), which holds a subject's
+tests for those platforms; keep those in one file per set of platforms. Other
+build tags don't make an exception.
+
+Name command tests in `cmd` after the command path they cover, joined with
+underscores: `smd_group_test.go` holds every happy-path test of the `smd
+group` subcommands, whatever the verb, and `smd_group_errors_test.go` their
+error paths. Use a deeper path only for a resource with its own subcommand
+group (`smd_group_member_test.go`, `bss_boot_params_test.go`). The family
+file (`smd_test.go`) holds only the commands directly under the family, such
+as `smd service status` or `discover static`, and tests that span several of
+the family's resources (`TestBootAdd_Success`, `TestSMDAdd_TrustsCACert`). The
+root files (`root_test.go`) hold tests of the global flags and of how the root
+command loads config. Tests of one behavior across families go in a file named
+after that behavior (`prompts_test.go`, `tokenless_test.go`,
+`service_status_test.go`), and error tables across families in
+`commands_errors_test.go`.
+
 The suffix taxonomy groups separate top-level `Test` functions, not the
 `t.Run` subtests within one. A single `TestSubject` that uses subtests to
 check several facets of one cohesive contract (e.g. an executor's
@@ -250,8 +274,8 @@ isolated `cli.NewTestRuntime` through the helpers in `cmd/testhelpers_test.go`
 `make test` runs the tests in `internal/conventions`, which parse the
 module's sources and fail on:
 
-- test names that don't follow `TestSubject_Case`, and test files with a
-  generic suffix;
+- test names that don't follow `TestSubject_Case`, test files with a
+  generic suffix, and a subject's tests for one bucket split across files;
 - test doc comments that don't start with the test's name, use coverage
   jargon, or refer to other tests;
 - test doc comments that say the test issues, sends, or requests an HTTP
diff --git a/internal/conventions/conventions_test.go b/internal/conventions/conventions_test.go
index 21ef1cd8..e3e3a352 100644
--- a/internal/conventions/conventions_test.go
+++ b/internal/conventions/conventions_test.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"go/ast"
+	"go/build/constraint"
 	"go/parser"
 	"go/token"
 	"io/fs"
@@ -15,6 +16,7 @@ import (
 	"path"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -251,6 +253,98 @@ func checkTestFileSuffixes(tr *tree) []violation {
 	return vs
 }
 
+const (
+	knownOS   = `aix|android|darwin|dragonfly|freebsd|hurd|illumos|ios|js|linux|nacl|netbsd|openbsd|plan9|solaris|wasip1|windows|zos`
+	knownArch = `386|amd64|amd64p32|arm|armbe|arm64|arm64be|loong64|mips|mipsle|mips64|mips64le|mips64p32|mips64p32le|ppc|ppc64|ppc64le|riscv|riscv64|s390|s390x|sparc|sparc64|wasm`
+)
+
+var (
+	platformSuffix = regexp.MustCompile(`_((?:` + knownOS + `)(?:_(?:` + knownArch + `))?|` + knownArch + `)_test\.go$`)
+	platformTag    = regexp.MustCompile(`^(?:unix|` + knownOS + `|` + knownArch + `)$`)
+)
+
+// namesPlatform reports whether a build constraint expression uses a GOOS or
+// GOARCH tag (or "unix").
+func namesPlatform(x constraint.Expr) bool {
+	switch x := x.(type) {
+	case *constraint.TagExpr:
+		return platformTag.MatchString(x.Tag)
+	case *constraint.NotExpr:
+		return namesPlatform(x.X)
+	case *constraint.AndExpr:
+		return namesPlatform(x.X) || namesPlatform(x.Y)
+	case *constraint.OrExpr:
+		return namesPlatform(x.X) || namesPlatform(x.Y)
+	}
+	return false
+}
+
+// platform describes the platforms sf builds for, from its GOOS or GOARCH
+// file name suffix and a //go:build constraint that uses a platform tag, or
+// returns "" if sf builds on every platform. Other build tags, such as
+// "integration", don't make a file platform-specific.
+func platform(sf *sourceFile) string {
+	var parts []string
+	if m := platformSuffix.FindStringSubmatch(sf.path); m != nil {
+		parts = append(parts, m[1])
+	}
+	for _, cg := range sf.file.Comments {
+		if cg.Pos() >= sf.file.Package {
+			break
+		}
+		for _, c := range cg.List {
+			if !constraint.IsGoBuild(c.Text) {
+				continue
+			}
+			x, err := constraint.Parse(c.Text)
+			if err != nil || !namesPlatform(x) || slices.Contains(parts, x.String()) {
+				continue
+			}
+			parts = append(parts, x.String())
+		}
+	}
+	return strings.Join(parts, " && ")
+}
+
+// testBucket returns the suffix bucket of a test file: "errors", "boundary",
+// or "plain".
+func testBucket(file string) string {
+	switch {
+	case strings.HasSuffix(file, "_errors_test.go"):
+		return "errors"
+	case strings.HasSuffix(file, "_boundary_test.go"):
+		return "boundary"
+	}
+	return "plain"
+}
+
+// checkSplitSubjects flags a subject (the part of a test's name before its
+// first underscore) whose tests in one suffix bucket are in more than one file
+// of a package. Files that build only on some platforms are compared only with
+// files for the same platforms, since a file for every platform can't hold
+// their tests.
+func checkSplitSubjects(tr *tree) []violation {
+	type group struct{ dir, subject, bucket, platform string }
+	first := map[group]string{}
+	reported := map[string]bool{}
+	var vs []violation
+	for _, tf := range tr.tests {
+		subject, _, _ := strings.Cut(tf.name, "_")
+		g := group{path.Dir(tf.sf.path), subject, testBucket(tf.sf.path), platform(tf.sf)}
+		file, ok := first[g]
+		if !ok {
+			first[g] = tf.sf.path
+			continue
+		}
+		if file == tf.sf.path || reported[subject+":"+tf.sf.path] {
+			continue
+		}
+		reported[subject+":"+tf.sf.path] = true
+		vs = append(vs, tf.at("%s tests (%s) are split between %s and %s", subject, g.bucket, path.Base(file), path.Base(tf.sf.path)))
+	}
+	return vs
+}
+
 // checkDocsStartWithName flags Test functions whose doc comment is missing
 // or doesn't start with the function's name.
 func checkDocsStartWithName(tr *tree) []violation {
@@ -690,6 +784,7 @@ var sourceChecks = map[string]func(*tree) []violation{
 	"names":          checkTestNames,
 	"bare subjects":  checkBareSubjects,
 	"file suffixes":  checkTestFileSuffixes,
+	"split subjects": checkSplitSubjects,
 	"doc names":      checkDocsStartWithName,
 	"doc wording":    checkDocWording,
 	"claimed method": checkClaimedMethods,
@@ -722,6 +817,14 @@ func TestTestFiles_NoGenericSuffix(t *testing.T) {
 	report(t, checkTestFileSuffixes(tr), "Use <subject>_test.go, _errors_test.go, or _boundary_test.go.")
 }
 
+// TestTestFiles_SubjectInOneFile verifies the tests of each subject in each
+// suffix bucket are in one file of their package, or in one file per set of
+// platforms for files that build only on some platforms.
+func TestTestFiles_SubjectInOneFile(t *testing.T) {
+	tr, _ := loadModule(t)
+	report(t, checkSplitSubjects(tr), "Move the test into its subject's file for that bucket, or give a too-broad subject a more specific name; see CONTRIBUTING.md.")
+}
+
 // TestTestDocs_StartWithName verifies every Test function has a doc comment
 // that starts with its name.
 func TestTestDocs_StartWithName(t *testing.T) {
@@ -835,6 +938,9 @@ func TestChecks_FlagFixtures(t *testing.T) {
 			t.Errorf("%s check reported nothing for testdata/violations", name)
 		}
 	}
+	if got := len(checkSplitSubjects(tr)); got != 3 {
+		t.Errorf("split subject check reported %d violations for a subject split across two files, a third with a non-platform build tag, two for one platform, and one for another; want 3", got)
+	}
 	man := "# EXIT STATUS\n\n|  *0*\n:  _CodeSuccess_\n|  *1*\n:  _CodeWrong_\n"
 	if len(checkExitStatusTable("fixture", man)) == 0 {
 		t.Error("EXIT STATUS check reported nothing for a table with a misnamed and missing codes")
diff --git a/internal/conventions/testdata/violations/widget_linux_test.go b/internal/conventions/testdata/violations/widget_linux_test.go
new file mode 100644
index 00000000..64060b2b
--- /dev/null
+++ b/internal/conventions/testdata/violations/widget_linux_test.go
@@ -0,0 +1,11 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package widget
+
+import "testing"
+
+// TestWidget_Linux verifies widgets on Linux. Files for different platforms
+// may each hold a subject's tests for their platform.
+func TestWidget_Linux(t *testing.T) { t.Error("allowed to be split") }
diff --git a/internal/conventions/testdata/violations/widget_set_windows_test.go b/internal/conventions/testdata/violations/widget_set_windows_test.go
new file mode 100644
index 00000000..54ed34bd
--- /dev/null
+++ b/internal/conventions/testdata/violations/widget_set_windows_test.go
@@ -0,0 +1,11 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package widget
+
+import "testing"
+
+// TestWidget_SetPlatform verifies Set on Windows, apart from the other
+// Windows tests in widget_windows_test.go.
+func TestWidget_SetPlatform(t *testing.T) { t.Error("split from its platform's file") }
diff --git a/internal/conventions/testdata/violations/widget_tagged_test.go b/internal/conventions/testdata/violations/widget_tagged_test.go
new file mode 100644
index 00000000..5c0d3e74
--- /dev/null
+++ b/internal/conventions/testdata/violations/widget_tagged_test.go
@@ -0,0 +1,14 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+//go:build integration
+
+package widget
+
+import "testing"
+
+// TestWidget_Integration verifies widgets against a live service. A build tag
+// that doesn't name a platform doesn't let a file hold a subject's tests apart
+// from its other files.
+func TestWidget_Integration(t *testing.T) { t.Error("split from its subject's file") }
diff --git a/internal/conventions/testdata/violations/widget_test.go b/internal/conventions/testdata/violations/widget_test.go
new file mode 100644
index 00000000..43f4d47f
--- /dev/null
+++ b/internal/conventions/testdata/violations/widget_test.go
@@ -0,0 +1,11 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package widget
+
+import "testing"
+
+// TestWidget_Set verifies Set stores a widget, apart from the other TestWidget
+// happy-path tests in widget_more_test.go.
+func TestWidget_Set(t *testing.T) { t.Error("split from its subject's file") }
diff --git a/internal/conventions/testdata/violations/widget_windows_test.go b/internal/conventions/testdata/violations/widget_windows_test.go
new file mode 100644
index 00000000..f15e762b
--- /dev/null
+++ b/internal/conventions/testdata/violations/widget_windows_test.go
@@ -0,0 +1,11 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+package widget
+
+import "testing"
+
+// TestWidget_Platform verifies widgets on Windows. A platform-specific file
+// may hold a subject's tests apart from its other files.
+func TestWidget_Platform(t *testing.T) { t.Error("allowed to be split") }