Fix offline test isolation and restore mature CPU coverage

tests/test_conditional_gate_scripts.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import json
-from datetime import date
+from datetime import date, timedelta
 from pathlib import Path
 
 from scripts import check_conditional_policy
@@ -29,14 +29,33 @@ def _waiver(gate: str, **overrides) -> dict:
 
 
 def test_committed_conditional_policy_is_complete():
+    policy = json.loads((ROOT / "ci" / "conditional-test-policy.json").read_text())
+    # Structural tests use the declared review date. The CI policy command
+    # separately enforces expiry against the real clock.
+    reviewed = max(date.fromisoformat(waiver["opened"]) for waiver in policy["environment_waivers"])
     assert check_conditional_policy.validate(
         ROOT / "ci" / "conditional-test-policy.json",
         ROOT / "ci" / "test-quality-policy.json",
         ROOT / ".github" / "workflows" / "conditional-tests.yml",
-        today=TODAY,
+        today=reviewed,
     ) == []
 
 
+def test_committed_waivers_fail_closed_after_expiry():
+    policy = json.loads((ROOT / "ci" / "conditional-test-policy.json").read_text())
+    expired = max(date.fromisoformat(waiver["expires"]) for waiver in policy["environment_waivers"])
+    errors = check_conditional_policy.validate(
+        ROOT / "ci" / "conditional-test-policy.json",
+        ROOT / "ci" / "test-quality-policy.json",
+        ROOT / ".github" / "workflows" / "conditional-tests.yml",
+        today=expired + timedelta(days=1),
+    )
+    assert errors == [
+        f"environment waiver {waiver['gate']} expired on {waiver['expires']}"
+        for waiver in policy["environment_waivers"]
+    ]
+
+
 def test_cuda_job_replaces_locked_cpu_torch_with_same_version_cuda_build():
     workflow = (ROOT / ".github" / "workflows" / "conditional-tests.yml").read_text()
     cuda_job = workflow.split("  cuda:\n", maxsplit=1)[1].split("  mps:\n", maxsplit=1)[0]
@@ -74,6 +93,7 @@ def test_jetson_job_is_manual_physical_trusted_and_retains_sanitized_evidence():
 
 def test_policy_rejects_unknown_cpu_exclusion_gate(tmp_path):
     policy = json.loads((ROOT / "ci" / "conditional-test-policy.json").read_text())
+    policy["environment_waivers"] = []
     quality = {
         "mature_cpu_scope": {
             "exclusions": [{"path": "obliteratus/device.py", "conditional_gate": "missing"}]
@@ -87,6 +107,7 @@ def test_policy_rejects_unknown_cpu_exclusion_gate(tmp_path):
         policy_path,
         quality_path,
         ROOT / ".github" / "workflows" / "conditional-tests.yml",
+        today=TODAY,
     )
     assert errors == ["CPU exclusion obliteratus/device.py references unknown gate missing"]