swarmctl setup status shows where the setup ceremony stands

nix/vm-tests/full-setup.nix

@@ -15,6 +15,7 @@
 #   9 first agent   The same endpoint, for `iris`: `swarmctl agent create` has no
 #                   archetype flag, and a custom agent's config repo would need
 #                   inputs the VM cannot resolve offline.
+# `swarmctl setup status` is read last: steps 1-6 done, ruth not yet up.
 # Not scripted yet; a later slice adds them: step 3, the first SSO login to the
 # forge (an OIDC code flow against authelia), `swarmctl forge make-admin`, and
 # the agents' deploy up to the point where each says it needs a login. Green
@@ -379,6 +380,28 @@ pkgs.testers.runNixOSTest (
           committed = machine.succeed("cat /root/meta-flake.nix")
           assert committed == expected, "the controller's flake differs from the one the toplevels came from:\n" + committed
 
+      with subtest("swarmctl setup status reports the steps done so far"):
+          # Ruth is declared paused and her `up` is a later step, so the report
+          # ends on step 9 not done and the exit status is 1.
+          reported = [
+              " 1  secret store initialised: done",
+              " 2  secret store unsealed: done",
+              " 3  granter bootstrapped: done",
+              " 4  granting units active: done",
+              " 5  store unsealed after the granting units: done",
+              " 6  SSO account in the admins group: done",
+              " 9  ruth created and up: not done",
+              "10  another agent [optional]: done",
+          ]
+          for _ in range(60):
+              lines = machine.execute("swarmctl setup status")[1].splitlines()
+              if all(any(line.startswith(prefix) for line in lines) for prefix in reported):
+                  break
+              machine.sleep(10)
+          else:
+              raise Exception("swarmctl setup status did not report the steps done so far:\n" + "\n".join(lines))
+          assert machine.execute("swarmctl setup status >/dev/null")[0] == 1
+
       # The agents' deploy and the check that they need a login are not scripted yet.
     '';
   }