@@ -24,7 +24,7 @@
 # --validate: check the whole graph AND the suite mapping — every dependsOn
 #   target resolves to a real PackageSource, there are no dependency cycles, and
 #   every Chainsaw suite under <suites-dir> resolves via suite_to_source() to a
-#   real PackageSource or to "-". Exit non-zero on any failure. The graph lives
+#   real PackageSource. Exit non-zero on any failure. The graph lives
 #   next to the packages and cannot drift from the suite directories; the
 #   hand-maintained suite mapping is the only part that can, so it is guarded here.
 #
 
@@ -172,6 +172,31 @@ YAML
     fi
 }
 
+@test "validate detects a suite mapped to a source absent from the graph" {
+    # suite_to_source() hardcodes securitygroup -> cozystack.securitygroup-controller;
+    # a sources dir without that PackageSource must fail validation (fail closed),
+    # pinning the contract that EVERY mapping resolves to a real source — there is
+    # no bypass value (the old "-" escape is gone).
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' EXIT
+    mkdir -p "$tmp/sources" "$tmp/suites/securitygroup"
+    : > "$tmp/suites/securitygroup/chainsaw-test.yaml"
+    cat > "$tmp/sources/standalone.yaml" <<'YAML'
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.standalone
+spec:
+  variants:
+    - name: default
+YAML
+    err=$(hack/select-install.sh --validate "$tmp/sources" "$tmp/suites" 2>&1 1>/dev/null) && {
+        echo "expected validation to fail on a mapping to a missing source" >&2
+        exit 1
+    }
+    echo "$err" | grep -q "maps to 'cozystack.securitygroup-controller', not a PackageSource"
+}
+
 @test "validate fails when the suites dir does not exist" {
     tmp=$(mktemp -d)
     trap 'rm -rf "$tmp"' EXIT
Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@`
`24`	`24`	`# --validate: check the whole graph AND the suite mapping — every dependsOn`
`25`	`25`	`# target resolves to a real PackageSource, there are no dependency cycles, and`
`26`	`26`	`# every Chainsaw suite under <suites-dir> resolves via suite_to_source() to a`
`27`		`-# real PackageSource or to "-". Exit non-zero on any failure. The graph lives`
	`27`	`+# real PackageSource. Exit non-zero on any failure. The graph lives`
`28`	`28`	`# next to the packages and cannot drift from the suite directories; the`
`29`	`29`	`# hand-maintained suite mapping is the only part that can, so it is guarded here.`
`30`	`30`	`#`