ci: add strict test evidence gates

.github/pull_request_template.md

@@ -4,7 +4,7 @@
 
 ## Tests
 
-- [ ] `python -m ruff check --select F obliteratus tests scripts/gemma4_12b_recursive_loop.py`
+- [ ] `python -m ruff check --select F obliteratus tests scripts/check_coverage_thresholds.py scripts/gemma4_12b_recursive_loop.py`
 - [ ] `python -m ruff check --select E501 --statistics obliteratus tests scripts/gemma4_12b_recursive_loop.py` reviewed as known non-blocking line-length debt
 - [ ] `python -c 'import obliteratus; print(getattr(obliteratus, "__version__", "import ok"))'`
 - [ ] `python -m obliteratus --help`

.github/workflows/ci.yml

@@ -95,11 +95,17 @@ jobs:
         run: python -m pip install "ruff==0.8.6"
 
       - name: Enforce Ruff F gate
-        run: python -m ruff check --select F obliteratus tests scripts/gemma4_12b_recursive_loop.py
+        run: >-
+          python -m ruff check --select F obliteratus tests
+          scripts/check_coverage_thresholds.py
+          scripts/gemma4_12b_recursive_loop.py
 
       - name: Report E501 legacy baseline
         if: always()
-        run: python -m ruff check --select E501 --statistics obliteratus tests scripts/gemma4_12b_recursive_loop.py || true
+        run: >-
+          python -m ruff check --select E501 --statistics obliteratus tests
+          scripts/check_coverage_thresholds.py
+          scripts/gemma4_12b_recursive_loop.py || true
 
   test:
     name: Tests py${{ matrix.python-version }}
@@ -112,6 +118,13 @@ jobs:
           - "3.10"
           - "3.11"
           - "3.12"
+    env:
+      CUDA_VISIBLE_DEVICES: ""
+      HF_DATASETS_OFFLINE: "1"
+      HF_HUB_DISABLE_TELEMETRY: "1"
+      HF_HUB_OFFLINE: "1"
+      TOKENIZERS_PARALLELISM: "false"
+      TRANSFORMERS_OFFLINE: "1"
 
     steps:
       - name: Check out repository
@@ -151,4 +164,28 @@ jobs:
           python -m obliteratus --help
 
       - name: Run tests with coverage
-        run: python -m pytest
+        run: |
+          mkdir -p test-results
+          python -m pytest \
+            -m "not slow and not gpu and not mps and not mlx and not network and not download and not remote" \
+            --cov-branch \
+            --cov-fail-under=0 \
+            --junitxml="test-results/junit-py${{ matrix.python-version }}.xml" \
+            --cov-report="xml:test-results/coverage-py${{ matrix.python-version }}.xml" \
+            --cov-report="json:test-results/coverage-py${{ matrix.python-version }}.json"
+
+      - name: Enforce line and branch coverage floors
+        run: >-
+          python scripts/check_coverage_thresholds.py
+          "test-results/coverage-py${{ matrix.python-version }}.json"
+          --min-line 49
+          --min-branch 36
+
+      - name: Upload test and coverage evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-evidence-py${{ matrix.python-version }}
+          path: test-results/
+          if-no-files-found: error
+          retention-days: 14