Contracts
ci-routing.md
Contract: Proportional CI Routing
Every changed narrow test class has exactly one owner route. Secondary execution in coverage, platform, or hard-gate routes is allowed and recorded by role. Narrow stable classes use an explicit path/manifest; whole-tree marker discovery is prohibited when the owned path set is known. Accepted P0 reproductions remain blocking owner-route reds under the red-main ADR until fixed.
Route changes must preserve a frozen mapping:
| Base route | Base universe | HEAD route | Mapping reason | Required |
|---|
Validation must prove:
1. every expected node has exactly one owner in each changed narrow class, while documented secondary-role overlap remains valid; 2. no retained P0 reproduction self-skips, xfails, quarantines, or retries; 3. an empty route is explicit and green only when its owned manifest is empty; 4. deleted/renamed routes remain in performance denominators through the mapping; 5. base/HEAD commands use identical runner, Python, workers, environment, install, and cache policy; 6. summed compute and critical-path wall-clock are reported separately.
disposition-ledger.md
Contract: Disposition Ledger
The canonical aggregate is generated as docs/reports/test-sanitation/assertive-test-suite-sanitation-01KZME3P/dispositions.yaml from the global machine census plus non-overlapping WP-owned shards under docs/reports/test-sanitation/assertive-test-suite-sanitation-01KZME3P/dispositions/WP##.yaml. Adjudication WPs never edit the aggregate or another WP's shard.
Required invariants
1. schema_version is test-sanitation/v1. 2. Every source-discovered test-like unit and collected node reconciles in the lightweight machine census. 3. Every deletion, consolidation, temporary exception, fix, materially changed survivor, and deletion-justifying survivor has exactly one deep candidate row in one WP shard. 4. Families share production path, oracle, outcome, marker/route class, cost class, platform scope, and verdict; any divergence expands to nodes. 5. Every ledgered KEEP references causal proof that reaches Act and fails the intended oracle and has non-null production path, oracle, contract, and authority. 6. Every DELETE identifies non-causality/obsolete authority or a survivor with equivalent causal ownership. 7. FIX_TEST and FIX_PRODUCT cannot be terminal. 8. CONSOLIDATE is terminal only after a survivor and deleted members exist. 9. TEMPORARY requires one-time HiC approval, issue, owner, expiry within 30 days, and an irreplaceable environmental/platform profile; it cannot renew or cover inert/correctness/timing candidates. 10. Paths and nodeids are repository-relative and deterministic.
The validator fails closed on unknown verdicts, stale members, invalid grouping fields, expired/renewed/forbidden temporary states, missing class-profile proof, duplicate membership, or incomplete discovery reconciliation.
evidence-gates.md
Contract: Evidence and Closure Gates
Candidate gate
A deletion may merge only when its class profile is complete: inert state (source/collection/route + skip/issue/authority); duplicate (equivalence + survivor + unique-boundary comparison); structural/contract (current authority/consumer + causal probe); slow (phase timing + causal/survivor); flake (fixed repetition matrix); dead symbol (caller/authority); route (selector/ownership/timing). Irrelevant evidence fields are not required. Runtime alone never authorizes deletion.
A retained structural guard must:
- name a current authority and observable invariant;
- scan a nonzero live corpus;
- fail under a plausible prohibited production change;
- reach its assertion rather than fail during collection/import/setup.
A retained contract guard must identify a live consumer and fail under an incompatible consumed shape or behavior.
Red and flake gate
- Base-green/HEAD-red: mission regression; block/fix.
- Base-red/HEAD-red deterministic: adjudicate authority; keep exactly one blocking reproduction for an accepted P0 under the red-main ADR, or delete a ledger-proven stale/obsolete/non-causal red as an explicit known-red delta.
- Mixed repetition outcomes: confirmed flake; root-cause or delete if no unique contract.
- Infrastructure before Act: repair harness, then rerun; no product verdict.
- All-green repetition:
NOT_REPRODUCED, not “proved stable.”
Mission closure gate
The census/ledger validates; every WP is independently approved; live known-red deltas are explicit; frozen workloads have three equivalent cold measurements at repaired base, scanner-optimized base, integrated pre-routing HEAD, and routed HEAD (raw pre-fix bootstrap separate); focused fault/mutation evidence preserves unique kills; changed route manifests select their owners; actual applicable platform outcomes are evidenced; contract and architectural suites pass unconditionally; cross-repo E2E passes or has the canonical environmental exception; issue matrix is complete.