test: add quality-depth gates and mature CPU coverage

.github/workflows/ci.yml

@@ -200,6 +200,9 @@ jobs:
         run: >-
           python -m ruff check --select F app.py obliteratus tests
           scripts/check_coverage_thresholds.py
+          scripts/check_mutation_score.py
+          scripts/check_quality_policy.py
+          scripts/run_repeat_gate.py
           scripts/check_supply_chain_policy.py
           scripts/gemma4_12b_recursive_loop.py
 
@@ -208,6 +211,9 @@ jobs:
         run: >-
           python -m ruff check --select E501 --statistics app.py obliteratus tests
           scripts/check_coverage_thresholds.py
+          scripts/check_mutation_score.py
+          scripts/check_quality_policy.py
+          scripts/run_repeat_gate.py
           scripts/check_supply_chain_policy.py
           scripts/gemma4_12b_recursive_loop.py || true
 
@@ -297,6 +303,12 @@ jobs:
           --min-changed 90
           --base-ref "$COVERAGE_BASE"
 
+      - name: Enforce mature CPU-scope coverage and immutable quality policy
+        run: >-
+          "$TEST_ENV/bin/python" scripts/check_quality_policy.py
+          --policy ci/test-quality-policy.json
+          --coverage "test-results/coverage-py${{ matrix.python-version }}.json"
+
       - name: Upload test and coverage evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -306,6 +318,65 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
+  quality-depth:
+    name: Quality depth
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      CUDA_VISIBLE_DEVICES: ""
+      HF_DATASETS_OFFLINE: "1"
+      HF_HUB_DISABLE_TELEMETRY: "1"
+      HF_HUB_OFFLINE: "1"
+      TOKENIZERS_PARALLELISM: "false"
+      TRANSFORMERS_OFFLINE: "1"
+      QUALITY_ENV: /tmp/obliteratus-quality-env
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            uv.lock
+
+      - name: Install locked quality tooling
+        run: |
+          python -m pip install "uv==${UV_VERSION}"
+          UV_PROJECT_ENVIRONMENT="$QUALITY_ENV" \
+            uv sync --locked --extra dev --group quality --no-editable
+          mkdir -p quality-evidence
+
+      - name: Run deterministic order and hash-seed repeats
+        run: >-
+          "$QUALITY_ENV/bin/python" scripts/run_repeat_gate.py
+          --output quality-evidence/repeat-gate.json
+
+      - name: Run bounded selective mutation gate
+        run: |
+          /usr/bin/time -f 'elapsed_seconds=%e\nmax_rss_kb=%M' \
+            -o quality-evidence/mutation-time.txt \
+            "$QUALITY_ENV/bin/mutmut" run --max-children 4
+          "$QUALITY_ENV/bin/mutmut" results > quality-evidence/mutation-survivors.txt
+          "$QUALITY_ENV/bin/mutmut" export-cicd-stats
+          cp mutants/mutmut-cicd-stats.json quality-evidence/mutation-stats.json
+          cp mutants/mutmut-stats.json quality-evidence/mutation-test-selection.json
+          "$QUALITY_ENV/bin/python" scripts/check_mutation_score.py \
+            quality-evidence/mutation-stats.json --minimum 70
+
+      - name: Upload quality-depth evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: quality-depth-py3.12
+          path: quality-evidence/
+          if-no-files-found: error
+          retention-days: 14
+
   supply-chain:
     name: Supply chain
     runs-on: ubuntu-latest