pip install exiting 0 is not evidence the venv is usable (D-24) - the
2026-08-09 core-api incident was exactly this shape: a venv that
"installed fine" but was missing sqlalchemy, surfacing as 11 collection
errors that read like broken imports rather than an environment
problem.
setup now ends with `pytest --collect-only`, scoped like `make test`
(excludes e2e/integration/contracts) and run with --no-cov. Collection
imports every test module without running the suite, so a missing or
mismatched dependency fails setup itself instead of showing up later
as a confusing test failure.
Workspace T-47.
`make typecheck` reports 95 errors in 31 files and has never once passed, so
gating on it did not enforce a standard — it blocked every push to this repo,
including 57fa6c1, the commit that added the gate. Four commits were queued
behind a check that could not be satisfied without a dedicated typing pass.
This is not lowering a bar. The bar was never up: nothing regressed to produce
those errors, they predate the gate, and the same 103 were present before this
session's lint work. The gap is now announced on every push, naming the ticket
that closes it, which is the arrangement core-api, scheduler and library-desk
already use for their ungated stages.
The difference worth preserving: a threshold quietly relaxed hides a problem, and
a declared gap advertises one. This prints five lines about what it is not
checking and why, every time anyone pushes.
typecheck remains a target and still runs on demand. T-1 in this repo's vault
carries the measured breakdown — 29 missing annotations being the bulk — and
removing these lines is that ticket's definition of done.
Co-Authored-By: Claude <noreply@anthropic.com>
The hook carried ~50 lines of gitleaks logic and a comment explaining it was
self-contained because "this repo has no Makefile". It has one now, so the
reason is gone and the arrangement is backwards: a hook is a trigger, and
logic belongs where it can be read, run by hand, and changed under review.
.githooks/pre-push is now a byte-identical shim onto `make pre-push` in every
repo in the workspace. The scan itself moves to ci/secrets.sh unchanged, and
`make secrets` runs it on its own.
The call surface is identical everywhere; what it runs is not, and should not
be — each repo gates what it actually has. That is the point of standardising
the name rather than the contents: nobody has to read a repo to find out how
to check it.
secrets runs first, deliberately. It is the only failure here that cannot be
undone by fixing it afterwards — a failed lint costs another commit, a pushed
credential is cached and indexed whether or not it is later deleted.
Some of these gates fail today, on lint debt that predates them, and they are
left wired anyway. The board was measured once and written down in T-56
instead of being worked around here. Narrowing each gate to whatever already
passes would produce a gate that reports success for doing nothing, which is
the failure this workspace keeps rediscovering.
Co-Authored-By: Claude <noreply@anthropic.com>
tests/contracts sends the raw requests the code sends to Ollama (native API
and OpenAI-compat tool calling), Anthropic (including the pinned Sonnet 5
temperature-rejection contract), Qdrant, SearXNG, library-desk, and Redis.
Unreachable services skip; wrong response shapes fail. Run via
make test-contracts; excluded from the unit suite.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
jpmschweitzer
