From 637ef173cb6e2437165ee1b11718702ee2d00857 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 27 Sep 2026 01:33:52 +0000
Subject: [PATCH] Fail supervised scans on incomplete coverage

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
 fleet-coordinator.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/fleet-coordinator.sh b/fleet-coordinator.sh
index cbf4c51c..fbe2fd4a 100755
--- a/fleet-coordinator.sh
+++ b/fleet-coordinator.sh
@@ -155,11 +155,18 @@ scan_supervised_repos() {
     fi
 
     local -a repo_paths
-    mapfile -t repo_paths < <("$list_script" "${args[@]}")
+    local resolved_repos
+    if ! resolved_repos=$("$list_script" "${args[@]}"); then
+        log_error "Failed to resolve supervised repository inventory"
+        return 1
+    fi
+    if [[ -n "$resolved_repos" ]]; then
+        mapfile -t repo_paths <<< "$resolved_repos"
+    fi
 
     if [[ "${#repo_paths[@]}" -eq 0 ]]; then
-        log_warn "No supervised repositories resolved"
-        return 0
+        log_error "No supervised repositories resolved; refusing a false-green scan"
+        return 1
     fi
 
     log_info "Scanning ${#repo_paths[@]} supervised repos"
@@ -176,6 +183,11 @@ scan_supervised_repos() {
 
     log_info "Supervised scan complete: scanned=$scanned failed=$failed"
 
+    if [[ "$failed" -gt 0 ]]; then
+        log_error "Supervised scan incomplete: $failed of ${#repo_paths[@]} repositories failed"
+        return 1
+    fi
+
     if [[ "$process_after" == true ]]; then
         process_findings
     fi