ci: adopt tiered contributor validation

tests/test_aiwg_workspace_contracts.py

@@ -54,9 +54,14 @@ def test_bt6_maintainer_installation_matches_project_plugin():
     assert installation["deployedTo"]["codex"] == {
         "agents": 5,
         "commands": 0,
-        "skills": 5,
+        "skills": 6,
         "rules": 1,
     }
+    assert "skills/bt6-release-validation/SKILL.md" in installation["artifactHashes"]
+    assert (
+        "skills/bt6-release-validation/SKILL.md"
+        in installation["deployedArtifactHashes"]["codex"]
+    )
     _assert_utc_timestamp(installation["installedAt"])
 
 

tests/test_ci_policy.py

@@ -10,6 +10,7 @@ from pathlib import Path
 ROOT = Path(__file__).parents[1]
 WORKFLOW = ROOT / ".github" / "workflows" / "ci.yml"
 MANIFEST = ROOT / "ci" / "digests.txt"
+PR_POLICY = ROOT / "ci" / "pr-test-policy.json"
 ACTION_REF = re.compile(
     r"^\s*uses:\s*([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)@([0-9a-f]{40})\s+#\s+(\S+)\s*$",
 )
@@ -102,6 +103,53 @@ def test_ci_repository_coverage_floors_match_quality_policy():
     assert f"--min-changed {policy['minimums']['changed_line']:g}" in workflow
 
 
+def test_pull_request_gate_is_fast_risk_mapped_and_uses_shared_floor():
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    policy = json.loads(PR_POLICY.read_text(encoding="utf-8"))
+    quality = json.loads(
+        (ROOT / "ci" / "test-quality-policy.json").read_text(encoding="utf-8"),
+    )
+    pr_core = workflow.split("  pr-core:\n", maxsplit=1)[1].split(
+        "  test:\n", maxsplit=1,
+    )[0]
+
+    assert "name: Pull request core" in pr_core
+    assert "github.event_name == 'pull_request'" in pr_core
+    assert 'python-version: "3.12"' in pr_core
+    assert "scripts/select_pr_tests.py" in pr_core
+    assert '"${selected_tests[@]}"' in pr_core
+    assert "--cov=app" in pr_core
+    assert "--min-line 0" in pr_core
+    assert "--min-branch 0" in pr_core
+    assert f"--min-changed {policy['changed_line_coverage_floor']:g}" in pr_core
+    assert policy["changed_line_coverage_floor"] == 50.0
+    assert quality["minimums"]["changed_line"] == 50.0
+    for test in policy["always_tests"] + policy["infrastructure_tests"]:
+        assert (ROOT / test).is_file(), test
+    assert "tests/conditional/" in policy["excluded_test_prefixes"]
+
+
+def test_release_depth_jobs_only_run_for_tags_or_manual_validation():
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    release_condition = (
+        "if: github.event_name == 'workflow_dispatch' || "
+        "startsWith(github.ref, 'refs/tags/v')"
+    )
+
+    assert '      - "v*"' in workflow
+    assert "  workflow_dispatch:" in workflow
+    for start, end in (
+        ("  package:\n", "  lint:\n"),
+        ("  test:\n", "  checkpoint-windows:\n"),
+        ("  checkpoint-windows:\n", "  quality-depth:\n"),
+        ("  quality-depth:\n", "  supply-chain:\n"),
+    ):
+        job = workflow.split(start, maxsplit=1)[1].split(end, maxsplit=1)[0]
+        assert release_condition in job
+    supply_chain = workflow.split("  supply-chain:\n", maxsplit=1)[1]
+    assert release_condition in supply_chain
+
+
 def test_ci_enforces_owned_duration_budgets_and_ten_minute_test_lane():
     workflow = WORKFLOW.read_text(encoding="utf-8")
     test_job = workflow.split("  test:\n", maxsplit=1)[1].split(

tests/test_pr_test_selection.py

@@ -0,0 +1,99 @@
+"""Contracts for the fast pull-request test selector."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from scripts import select_pr_tests
+
+
+def _touch(root: Path, *paths: str) -> None:
+    for value in paths:
+        path = root / value
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text("# test fixture\n", encoding="utf-8")
+
+
+def _policy() -> dict:
+    return {
+        "always_tests": ["tests/test_smoke.py"],
+        "infrastructure_paths": ["ci/**", ".github/workflows/**"],
+        "infrastructure_tests": ["tests/test_ci_policy.py"],
+        "excluded_test_prefixes": ["tests/conditional/"],
+    }
+
+
+def _risk_map() -> dict:
+    return {
+        "contract_surfaces": [{
+            "paths": ["obliteratus/core.py"],
+            "required_tests": [
+                "tests/test_core.py",
+                "tests/conditional/test_core_gpu.py",
+            ],
+        }],
+    }
+
+
+def test_selects_smoke_risk_mapped_and_changed_tests(tmp_path):
+    _touch(
+        tmp_path,
+        "tests/test_smoke.py",
+        "tests/test_core.py",
+        "tests/conditional/test_core_gpu.py",
+        "tests/test_new_contract.py",
+    )
+
+    assert select_pr_tests.select_tests(
+        ["obliteratus/core.py", "tests/test_new_contract.py"],
+        policy=_policy(),
+        risk_maps=[_risk_map()],
+        project_root=tmp_path,
+    ) == [
+        "tests/test_core.py",
+        "tests/test_new_contract.py",
+        "tests/test_smoke.py",
+    ]
+
+
+def test_selects_policy_contracts_for_infrastructure_changes(tmp_path):
+    _touch(tmp_path, "tests/test_smoke.py", "tests/test_ci_policy.py")
+
+    assert select_pr_tests.select_tests(
+        ["ci/pr-test-policy.json"],
+        policy=_policy(),
+        risk_maps=[_risk_map()],
+        project_root=tmp_path,
+    ) == ["tests/test_ci_policy.py", "tests/test_smoke.py"]
+
+
+def test_removed_source_can_use_the_base_risk_map(tmp_path):
+    _touch(tmp_path, "tests/test_smoke.py", "tests/test_removed.py")
+    head = {"contract_surfaces": []}
+    base = {
+        "contract_surfaces": [{
+            "paths": ["obliteratus/removed.py"],
+            "required_tests": ["tests/test_removed.py"],
+        }],
+    }
+
+    assert select_pr_tests.select_tests(
+        ["obliteratus/removed.py"],
+        policy=_policy(),
+        risk_maps=[head, base],
+        project_root=tmp_path,
+    ) == ["tests/test_removed.py", "tests/test_smoke.py"]
+
+
+def test_unmapped_production_source_fails_closed(tmp_path):
+    _touch(tmp_path, "tests/test_smoke.py")
+
+    with pytest.raises(ValueError, match="unmapped"):
+        select_pr_tests.select_tests(
+            ["obliteratus/unowned.py"],
+            policy=_policy(),
+            risk_maps=[_risk_map()],
+            project_root=tmp_path,
+        )