# Architecture sketch: layered verification

The verification system has four explicit layers:

1. **Mandatory PR gate** — CPU-only, offline unit and boundary-contract tests,
   package build, lint, branch/line coverage, warnings, JUnit, and artifacts.
2. **Offline integration gate** — tiny local model/config fixtures exercise
   pipeline composition, checkpoint/save/reload, evaluation, and reporting.
3. **Quality-depth gate** — property tests, repeat tests, and selective mutation
   testing for high-consequence pure modules.
4. **Conditional environment gates** — accelerator, optional backend, download,
   network, and remote-service jobs with explicit prerequisites.

pytest markers form the selection contract between layers. GitHub Actions jobs
produce retained evidence and never silently convert a required failure into a
success. Tool versions remain project-controlled. The default gate must not
access external services, inherit user model caches, or require credentials.

Coverage policy evolves by wave:

- measurement wave: preserve the 49% line floor and establish branch baseline;
- boundary wave: repository line coverage at least 55%, changed lines at least
  90%, and touched critical modules at least 70%;
- integration wave: repository line coverage at least 60%;
- mature CPU-testable target: at least 80% line and 75% branch coverage, with
  exclusions limited to documented conditional environment code.
