ci: make the gate real — the tests never ran, and now they must

[Plantucha]

The finding that changes the framing

The problem was never continue-on-error. The tests have not run since 2026-02-09.

test.yml installed with:

pip install -e .                      # pyproject.toml had NO [project] table
pip install -r requirements-test.txt  # that file was never committed

Both lines fail. The install step had no continue-on-error, so the job died there and every pytest step after it was unreachable — the continue-on-error: true on those steps was irrelevant, because they never executed. Every test.yml run in this repository's history is a failure. The repo has looked maintained for six months while nothing was examined.

⚠️ I could not confirm the mechanism from CI logs — GitHub's retention has expired them (HTTP 410) — so that is inference from the file state, strongly supported by the uniform failure record.

Measured first, before any gate was designed

tests	867: 789 passing, 68 failing, 10 skipped
coverage	27% (floor recorded at 26)
mypy	41 errors in 16 files, 110 files checked
ruff	1316 findings

Test dependencies were derived, not guessed: tqdm, psutil and click were each discovered by a collection failure and declared by nothing; pysam and pyyaml accounted for four more failures that were dependency-driven rather than logic.

Packaging repair — nothing could be gated until this worked

Minimal [project] table plus a setuptools backend so pip install -e . succeeds, and requirements-test.txt committed with its provenance in the header.

The gate is not green-only, because the suite is not green

68 failures are recorded in tests/known-failures.txt under a two-direction ratchet:

• a failure not in the baseline → RED. New breakage cannot enter.
• a baseline entry that starts passing → RED, until it is delisted.

The second direction is the point: without it a baseline rots into a permanent excuse list, and a fixed test silently keeps its licence to fail. Both directions were verified against the real suite, not only against selftest fixtures.

Every check distinguishes examined-and-clean from never-examined

Each returns a distinct exit code (2) for refusal:

gate	refuses when
pytest	collection error, zero tests, or no pass/fail counts
mypy	it prints neither Found N errors nor Success — it was dying: mypy.ini pinned python_version to 3.9, which current mypy rejects, and a syntax error stopped it after one file
ruff	no count line
coverage	no TOTAL line (rather than reading as 0)
syntax	any tracked .py fails to parse
install	fails loudly as INSTALL FAILED, never as a test result

check.sh IS the CI. Run it locally and you have run the job.

Workflows 9 → 3

ci (new), security, release. Removed ci.yml (0 bytes), ci-enhanced.yml, test.yml, badges.yml, cd.yml, dependabot.yml, and dependency-updates.yml — the last had failed weekly for six weeks unattended until GitHub auto-disabled it. Security Scanning was disabled the same way and I have re-enabled it.

One file left broken deliberately

varidex/pipeline/phase1_enhancement.py is not valid Python — the body of add_phase1_codes_to_pipeline was commented out, leaving a def with no block. It is orphaned: orchestrator_v2 defines its own apply_phase1_enhancements and does not import it. The original implementation is gone, and inventing one would be fabrication rather than repair, so it is recorded in scripts/known-broken-syntax.txt where the syntax gate blocks any new unparseable file while it stands.

Open question for you

SPDX headers. Tepna's convention is Apache-2.0 headers on every source file; VariDex is AGPL-3.0, so that convention does not port as-is. I have added no headers. If you want them, they should read AGPL-3.0-or-later — your call, not one to make by analogy.

Review notes

• Two commits: formatting (mechanical, verified behaviour-neutral by measurement — the failing set is an exact match before and after) and the CI work.
• The 1316 ruff findings and 41 mypy errors are ratcheted, not auto-fixed — mass-fixing would bury this change under a whole-repo rewrite. They can only go down.
• No Kodiak on this repo, so this waits for you.

[Plantucha]

Withdrawn at owner's direction.