Cold review (Opus, isolated worktree) cleared the mechanical reformat: 25 of 33
files AST-identical, the suite's collected node IDs identical to main, and the
three percent-format -> f-string conversions byte-equivalent at both call sites.
Everything below is config/CI/doc layer.
M4: `S105` is no longer exempted directory-wide. A blanket over `scripts/tests/**`
gives up hardcoded-credential coverage over the largest Python surface in the repo
— permanently, and this is the only Python lint we run — to suppress 8 known
lines. Those 8 now carry a per-site `# noqa: S105`; removing one is red
(witnessed). Only `S101` stays directory-wide.
M1: `ruff check .` on an empty population prints a stderr warning and exits 0, so
a stray `exclude` would switch the gate off silently — the vacuity failure
`testing.guard-derives-population-from-source` is about. The step now compares
`--show-files` against `git ls-files '*.py'` and fails on drift. Mutation proof:
a top-level `exclude = ["scripts"]` takes `ruff check` to green and the step to
`::error::… 0 Python files but git tracks 33`. Note the same exclude under
`[format]` does NOT reproduce it — it scopes to the formatter, and a mutation
written that way passes while proving nothing.
M3: lint moved ahead of the preflights. Behind `Preflight jq version` (a hard
`--expect` tripwire) the lint would go dark for as long as the jq contract is
broken, under a red that names jq.
H3: ruff.toml named a `Script lint (ruff)` job that does not exist — wrong on the
day it shipped.
H1: the "72 errors" claim is now reproducible against the committed config (it was
only true of the pre-M4 config), carries its reproduction command and base sha, and
splits honestly: 54 fixed in code, 18 per-site `# noqa`s.
H2: `docs/ci-cd.md` still said the suite is ~190 tests / ~10s next to a new
"four-minute" figure. Measured: 773 tests, ~4.5 min. The no-path-filter rationale
rested on the dead number; it now rests on the input set, which is the real reason.
M2: the nine E501 `# noqa`s claimed splitting "would change the payload". Implicit
string concatenation preserves the bytes exactly, so the stated reason was false
nine times. They say what is actually true: kept one-line for greppability.
Nits: the record no longer claims the config is identical to the operator's global
one (per-file-ignores differ), and the unpinned pytest/pyyaml asymmetry is stated
rather than left looking like an oversight.
Refs: #780
Decisions-Edit: yes
timothy
85ecd352f4