fix(ci): a cited path has to name a file that is there

[stranske]

Two follow-ups to #60, found while independently verifying that PR from a separate session. A third was dropped as redundant — see below.

1. The pin file's pointer to the baseline led nowhere

.github/workflows/autofix-versions.env:24 cited docs/ci/LINT_BASELINE.md. The file #60 added is docs/CI_LINT_BASELINE.md — this repo's docs/ is flat; docs/ci/ is the Workflows repo's layout and does not exist here. ruff.toml and pr-00-gate.yml both cite the correct path, so this was the one outlier of three.

It matters more than a typo because of what that paragraph is for: it is the sole instruction telling the next person to re-measure the baseline before bumping a pin, which is the coupling that stops a silent tool upgrade from widening the rule set behind the recorded counts. A pointer to a file that is not there reads as verified.

2. A citation now has to name a file that is there

test_ci_gate_config.py defends the pin file's contents thoroughly — that it exists, pins exactly, and that its versions match the recorded baseline. Nothing read its prose, which is where the defect in (1) lived. test_every_cited_repo_path_resolves closes that: every repo-relative docs/, scripts/ or tools/ path cited in the two config files this repo owns must resolve.

Scoped deliberately to autofix-versions.env and ruff.toml. I measured the alternative: scanning pr-00-gate.yml too adds six findings, and all six are correct as written — scripts/check_issue_consistency.py sits behind hashFiles(...) != '' with an explicit named-skip branch, scripts/ledger_validate.py behind a .agents existence check, and docs/ci/WORKFLOWS.md is an upstream path. That file is synced from upstream anyway. A test that cries wolf six times gets waived, so it is not scanned, and the docstring says why.

The upstream marker is scoped per paragraph, not per line, because the prose wraps: docs/ci/WORKFLOWS.md is quoted three lines below the sentence that says whose doc it is. Per-line matching false-positived there.

Deliberate break -> revert (performed, not asserted)

Restoring the original citation:

E   autofix-versions.env paragraph at line 23 cites docs/ci/LINT_BASELINE.md
E   assert not ['autofix-versions.env paragraph at line 23 cites docs/ci/LINT_BASELINE.md']
1 failed, 11 deselected

Reverting restored a byte-identical file (cmp-clean) and all 12 passed. The assertion discriminates on the real defect, not on a rephrasing of it.

Dropped: the backplane guard, because #73 landed it first

This branch also carried a fix for backplane-conformance.yml, whose emit-reference-run job had failed on all 9 of its runs across four unrelated branches, dying on pip install -e . with no pyproject.toml. #73 merged byte-identical text from the same upstream template while this was open, so that hunk is gone from this diff rather than re-asserted. Recording it because the finding is still worth having on the record:

• No upstream issue was ever warranted — stranske/Workflows main already guarded that install, with a comment naming this exact failure mode. Filing it would have filed an already-fixed bug.
• Sync PR chore: sync workflow templates #54 would have delivered it but is CONFLICTING and stale.

Verification

pytest:     408 passed, 0 failed, 0/26 max skipped (408 collected; floor 408)
selftests:  84 of 84 modules ran, 0/7 max skipped
5 of 5 gates green

That full run is from the 0d661e3 rebase. The branch was then re-based onto 0593eeb (#62), which touches neither of these two files, and the fast checks were re-run there: test_ci_gate_config.py 12 passed, 412 collected, ruff check . clean, black --line-length 100 --check . 196 files unchanged, at the exact pinned ruff 0.16.4 / black 26.5.1. The full suite on that last base is left to CI, which is the authoritative environment.

.verify-floor.json: 411 -> 412, exactly the one new test, rationale appended by hand. No ceiling moved — the test reads committed files only, so it runs on a bare runner and in CI, and in the exec-mirror layout it skips through the same require_checkout() gate as its siblings.

The floor was re-measured five times, never carried forward

bd6da2e 402 → ddb0928 402 → fc1fd42 407 → 0d661e3 407 → 0593eeb 411, each +1 with this test. Main moved six times in the ~2 hours this one-line change was open, and two of those overlapped it directly: #73 duplicated the backplane hunk, and #69 edited this very test file in a different region. Each rebase re-applied onto the new base's version rather than overwriting it — #69 had rewritten a neighbouring test's message, and appending to my stale copy would have silently reverted that.

Worth naming for whoever hits it next: now that collected is an EQUALITY (#56, and correctly so — a floor let silently-uncollected tests through, and every entry above it in that note records the floor being found below reality), those two lines are a serialization point that care alone does not win. The number is only knowable on the merge result. If it starts costing real time, the durable fix is to have CI run verify.py --update-floor on the merge commit: that keeps the equality and removes the race, instead of asking each author to hand-record a number a concurrent merge invalidates.

[coderabbitai]

Warning

Review limit reached

Next included review available in 39 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 74 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 51657709-5277-422f-8503-8b62e06eb6d6

📥 Commits

Reviewing files that changed from the base of the PR and between 6fed4ad and 9bb2213.

📒 Files selected for processing (3)

• .github/workflows/autofix-versions.env
• .verify-floor.json
• test_ci_gate_config.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[stranske-keepalive]

Workflow source detected

PR #74 now has valid workflow source context (origin=review_followup).

No linked GitHub issue is required for this PR.

[stranske-keepalive]

Automated Status Summary

Head SHA: 03eaed2
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	48.40%
Baseline	0.00%
Delta	+48.40%
Minimum	70.00%
Status	❌ Below minimum

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
outcomes.py	9.0%	243
watch.py	9.6%	431
capability_recurrence_check.py	10.4%	421
durability_sweep.py	12.2%	339
keepalive_shadow.py	13.0%	282
capability_outcome_bridge.py	13.5%	295
keepalive_outcomes.py	14.0%	339
adversarial.py	14.1%	164
langsmith_fetch.py	14.3%	409
gh_capacity.py	14.6%	228
runtime_ac_panel.py	14.7%	290
capability_advisor.py	14.8%	807
redirect_shadow.py	16.9%	476
cross_repo_lane.py	17.3%	268
experiment_recovery.py	18.4%	164

Low Coverage Files (<50.0%)

File	Coverage	Missing
outcomes.py	9.0%	243
watch.py	9.6%	431
capability_recurrence_check.py	10.4%	421
durability_sweep.py	12.2%	339
keepalive_shadow.py	13.0%	282
capability_outcome_bridge.py	13.5%	295
keepalive_outcomes.py	14.0%	339
adversarial.py	14.1%	164
langsmith_fetch.py	14.3%	409
gh_capacity.py	14.6%	228
runtime_ac_panel.py	14.7%	290
capability_advisor.py	14.8%	807
redirect_shadow.py	16.9%	476
cross_repo_lane.py	17.3%	268
experiment_recovery.py	18.4%	164

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[stranske]

Scope note on what this PR's own CI does and does not prove.

Green, and the four checks that matter ran rather than skipped: lint-format 32s, lint-ruff 13s, python 3.12 32s, python 3.13 28s, summary 34s, Gate / gate — All Gate checks succeeded. typecheck-mypy skips, as #60 set it.

But emit-reference-run did not trigger here, so fix (2) is unexercised by this run. That job filters on src/**, artifacts/**, scripts/**, docs/contracts/** and config/backplane_participants.json; this PR touches none of them. #60 only tripped it by adding scripts/ci_lint_baseline.py. So the check is absent from the list above rather than passing, and I would rather say that than let a green wall imply otherwise.

Basis for confidence in the meantime, absent a live run:

• The replacement is byte-identical to the upstream template on stranske/Workflows main, not a local reimplementation — the PR diff is one hunk.
• The guard is a file-existence test, and I ran both branches of it directly. In this repo: No packaging metadata; skipping editable install (opt-in stub not yet tuned). In a directory with a pyproject.toml: it still takes the install path, so the guard suppresses nothing real. That second case matters — a guard that skipped unconditionally would silently disable the job for the repos it is meant to serve, including this one the day it gets a pyproject.toml.

It will be exercised for real by the next PR that touches scripts/**.