test(rqts): Cover remaining RQTS error paths

Bring the rqts package to full statement and branch coverage by
exercising the paths the existing tests bypassed:

- _run_docker reaching subprocess.run with a fixed, non-shell argv
- image_present_locally when docker inspect cannot run at all
- the Docker daemon ping exiting non-zero, raising, or timing out
- RqtsRunner.run aggregating unmet preconditions into one error
- build_docker_argv with explicit workdir, artifact and output overrides

Author: ruslan-aws

tests/rqts/test_argv.py

@@ -371,3 +371,33 @@ def test_defaults_use_project_root_and_hyphenated_name():
     # No scenario selection: the argv ends at the output directory.
     assert "-s" not in argv
     assert argv[-2:] == ["-o", CONTAINER_OUTPUT_DIR]
+
+
+# ===========================================================================
+# Explicit overrides of the project-derived defaults
+# ===========================================================================
+def test_explicit_workdir_artifact_and_output_dir_override_defaults():
+    """Supplied workdir/artifact_name/output_dir replace the project defaults.
+
+    The defaults are derived from the project (``root`` and
+    ``hypenated_name``); when a caller passes them explicitly, none of the
+    project-derived values appear in the argv.
+    """
+    project = _make_project("aws-foo-bar", root="/project/root")
+
+    argv = build_docker_argv(
+        "img:ref",
+        project,
+        "us-west-2",
+        workdir="/elsewhere",
+        artifact_name="custom-artifact.zip",
+        output_dir="/work/custom-output",
+    )
+
+    assert f"/elsewhere:{CONTAINER_WORKDIR}" in argv
+    assert f"{CONTAINER_WORKDIR}/custom-artifact.zip" in argv
+    assert argv[-2:] == ["-o", "/work/custom-output"]
+    # None of the project-derived defaults leak in.
+    assert f"/project/root:{CONTAINER_WORKDIR}" not in argv
+    assert f"{CONTAINER_WORKDIR}/aws-foo-bar.zip" not in argv
+    assert CONTAINER_OUTPUT_DIR not in argv

tests/rqts/test_image.py

@@ -286,3 +286,48 @@ def test_image_present_locally_uses_docker_image_inspect(monkeypatch):
     absent = _RecordingDocker([1])
     monkeypatch.setattr(image_module, "_run_docker", absent)
     assert image_module.image_present_locally("ref:tag") is False
+
+
+# ===========================================================================
+# Internal docker seam and inspect failure handling
+# ===========================================================================
+def test_run_docker_invokes_docker_cli_with_fixed_argv():
+    """_run_docker drives the docker CLI with a fixed, non-shell argv.
+
+    This is the one place that actually reaches ``subprocess.run``; it is
+    patched here so no docker process is spawned. A fixed argv list (never a
+    shell string) is what makes the image reference safe to pass through.
+    """
+    completed = subprocess.CompletedProcess(args=["docker", "info"], returncode=0)
+
+    with mock.patch.object(
+        image_module.subprocess, "run", return_value=completed
+    ) as run:
+        result = image_module._run_docker(  # pylint: disable=protected-access
+            ["image", "inspect", "ref:tag"], timeout=7
+        )
+
+    assert result is completed
+    run.assert_called_once()
+    assert run.call_args[0][0] == ["docker", "image", "inspect", "ref:tag"]
+    assert run.call_args[1]["check"] is False
+    assert run.call_args[1]["capture_output"] is True
+    assert run.call_args[1]["timeout"] == 7
+
+
+@pytest.mark.parametrize(
+    "docker_error", [OSError("docker not found"), subprocess.SubprocessError("boom")]
+)
+def test_image_present_locally_false_when_inspect_cannot_run(monkeypatch, docker_error):
+    """An inspect that cannot even run is treated as 'not present locally'.
+
+    Keeps ``ensure_image``'s fallback decision safe when the docker CLI is
+    missing or unusable: absent, rather than assumed cached.
+    """
+
+    def raise_error(_docker_args, timeout=None):  # pylint: disable=unused-argument
+        raise docker_error
+
+    monkeypatch.setattr(image_module, "_run_docker", raise_error)
+
+    assert image_module.image_present_locally("ref:tag") is False

tests/rqts/test_preconditions.py

@@ -16,8 +16,10 @@
 """
 
 import contextlib
+import subprocess
 from unittest import mock
 
+import pytest
 from hypothesis import HealthCheck, given, settings, strategies as st
 
 from rpdk.core.exceptions import CLIMisconfiguredError
@@ -187,3 +189,74 @@ def test_credentials_unavailable_in_isolation(tmp_path):
     assert len(failures) == 1
     assert MESSAGE_SUBSTRINGS["credentials"] in failures[0]
     assert failures
+
+
+# ---------------------------------------------------------------------------
+# Docker daemon ping failure modes (docker CLI present, daemon unreachable).
+# ---------------------------------------------------------------------------
+
+
+@contextlib.contextmanager
+def docker_ping_env(work_dir, **run_kwargs):
+    """Yield ``(args, project)`` with docker on PATH and ``docker info`` stubbed.
+
+    The artifact and credential checks are forced to pass, so any failure the
+    caller observes comes from the Docker daemon ping alone. ``run_kwargs`` is
+    forwarded to ``mock.patch`` for ``subprocess.run`` (``return_value`` for an
+    exit status, ``side_effect`` to raise).
+    """
+    project = FakeProject(work_dir)
+    (work_dir / f"{project.hypenated_name}.zip").write_bytes(b"zip")
+
+    with contextlib.ExitStack() as stack:
+        stack.enter_context(
+            mock.patch(
+                f"{PRECONDITIONS_MODULE}.shutil.which", return_value="/usr/bin/docker"
+            )
+        )
+        stack.enter_context(
+            mock.patch(f"{PRECONDITIONS_MODULE}.subprocess.run", **run_kwargs)
+        )
+        stack.enter_context(
+            mock.patch(
+                f"{PRECONDITIONS_MODULE}.create_sdk_session", return_value=mock.Mock()
+            )
+        )
+        yield _make_args(), project
+
+
+def test_docker_daemon_ping_nonzero_exit_reports_unreachable(tmp_path):
+    """docker CLI present but ``docker info`` exits non-zero -> unreachable daemon.
+
+    Distinct from the missing-CLI case: the binary exists, so the ping itself is
+    what fails.
+
+    Validates: Requirements 3.2
+    """
+    with docker_ping_env(tmp_path, return_value=mock.Mock(returncode=1)) as (
+        args,
+        project,
+    ):
+        failures = check_preconditions(args, project)
+
+    assert len(failures) == 1
+    assert MESSAGE_SUBSTRINGS["docker"] in failures[0]
+
+
+@pytest.mark.parametrize(
+    "ping_error",
+    [OSError("cannot exec"), subprocess.TimeoutExpired(cmd="docker info", timeout=10)],
+)
+def test_docker_daemon_ping_error_reports_unreachable(tmp_path, ping_error):
+    """A ping that raises (spawn failure or timeout) -> unreachable daemon.
+
+    The check converts the exception into a message rather than propagating it,
+    so a hung or broken daemon still aggregates with other failures.
+
+    Validates: Requirements 3.2
+    """
+    with docker_ping_env(tmp_path, side_effect=ping_error) as (args, project):
+        failures = check_preconditions(args, project)
+
+    assert len(failures) == 1
+    assert MESSAGE_SUBSTRINGS["docker"] in failures[0]

tests/rqts/test_runner.py

@@ -369,3 +369,39 @@ def test_run_logs_full_docker_command_at_debug_on_happy_path(tmp_path, caplog):
     assert any(joined_command in message for message in debug_records)
     # The pass summary is surfaced (Req 6.1).
     assert PASS_SUMMARY in caplog.text
+
+
+# ===========================================================================
+# Precondition enforcement inside the pipeline
+# ===========================================================================
+def test_run_unmet_preconditions_aggregated_and_halts(tmp_path):
+    """Unmet preconditions -> a single error naming every failure; nothing runs.
+
+    The runner turns the aggregated list from ``check_preconditions`` into one
+    ``SysExitRecommendedError`` instead of failing on the first problem, and
+    halts before the image is ensured or any container is started.
+
+    Validates: Requirements 3.1, 3.5
+    """
+    project = _make_resource_project(str(tmp_path))
+    rqts_runner = RqtsRunner(_make_args(), project)
+    failures = [
+        "Docker is required and must be running: the Docker daemon could not "
+        "be reached.",
+        "artifact package 'aws-foo-bar.zip' not found; build the project first.",
+    ]
+
+    with mock.patch(
+        f"{RUNNER_MODULE}.check_preconditions", return_value=failures
+    ), mock.patch(f"{RUNNER_MODULE}.ensure_image") as ensure, mock.patch(
+        f"{RUNNER_MODULE}.run_container"
+    ) as run:
+        with pytest.raises(SysExitRecommendedError) as excinfo:
+            rqts_runner.run()
+
+    message = str(excinfo.value)
+    assert "preconditions were not met" in message
+    for failure in failures:
+        assert failure in message
+    ensure.assert_not_called()
+    run.assert_not_called()