test: enforce Wave A quality lock

WORKSPACE.md

@@ -42,10 +42,14 @@ accelerator, or remote-execution credentials.
 
 Canonical required checks:
 
-- `python -m ruff check --select F app.py obliteratus tests scripts/check_coverage_thresholds.py scripts/check_supply_chain_policy.py scripts/gemma4_12b_recursive_loop.py`
-- `python -m pytest` (includes the measured 49% coverage floor)
-- CI additionally enforces the measured 36% branch-coverage floor from its
-  retained coverage JSON report.
+- the exact Ruff F and actionlint command set in [.github/workflows/ci.yml](.github/workflows/ci.yml);
+- `python -m pytest` with at least 60% repository line coverage and 42% branch
+  coverage;
+- at least 90% changed-line coverage plus no line or branch regression in any
+  touched production module, compared with coverage from the exact base commit;
+- at least 80% line and 75% branch coverage for the documented mature
+  CPU-testable scope, plus a 70% selective mutation score and zero unexpected
+  warnings;
 - `python -m build --sdist --wheel`
 - `python -c 'import obliteratus; print(obliteratus.__version__)'`
 - `python -m obliteratus --help`
@@ -55,6 +59,13 @@ in an independent environment outside the checkout, exercises both CLI entry
 paths, and retains the distributions plus evidence. Immutable CI action/tool
 pins are recorded in [ci/digests.txt](ci/digests.txt).
 
+The source-to-test ownership graph is versioned in
+[ci/test-risk-map.json](ci/test-risk-map.json). Coverage, JUnit, repeat, and
+mutation trends are normalized into project-owned JSON and retained for 90
+days. Flake history and time-bounded quarantines are governed by
+[ci/test-quality-policy.json](ci/test-quality-policy.json); a test observed
+flaking twice in 30 days requires an active owner/issue-linked quarantine.
+
 Python CI resolution is locked by `uv.lock`, including the official CPU-only
 PyTorch source for Linux and Windows. The required Supply chain job scans all
 supported Python versions for known vulnerabilities, scans the checkout for
@@ -62,8 +73,9 @@ secrets with fully redacted evidence, enforces the packaged-dependency license
 allow list, and binds a CycloneDX SBOM to the built wheel. Exception and update
 rules are documented in [docs/SUPPLY_CHAIN_POLICY.md](docs/SUPPLY_CHAIN_POLICY.md).
 
-GPU, MPS, model-download, network, and remote-execution checks are conditional
-release or risk-surface gates, not part of the default CPU job.
+GPU, MPS, MLX, model-download, external-evaluation, network, operator-UI, and
+remote-execution checks are conditional release or risk-surface gates, not part
+of the default CPU job.
 
 Use [.aiwg/bt6-maintainer.yaml](.aiwg/bt6-maintainer.yaml) and the project-local
 `bt6-maintainer` bundle for issue, pull-request, provider, and merge-train work.