feat: state harness-agnostic degradation rule #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Run the gate test-system on every push and pull request, so a regression in | |
| # any enforcement gate fails CI — the machine check that the tests actually run. | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| gates: | |
| name: gate suites + doc audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # `nickel` is the only non-standard dependency. It is installed onto PATH | |
| # via Nix; the gate machinery calls `nickel` directly (no nix-run fallback | |
| # — shell.nix provides nickel 1.14.0 for local dev; CI installs it via nix | |
| # profile). python3, bash, and git are preinstalled on ubuntu-latest. | |
| - uses: DeterminateSystems/nix-installer-action@main | |
| - name: install nickel | |
| run: nix profile install nixpkgs#nickel | |
| - name: gate test suites | |
| run: | | |
| set -euo pipefail | |
| bash ledger/gate/test_reconcile.sh | |
| bash ledger/gate/test_surface_protocol.sh | |
| bash ledger/gate/test_gates.sh | |
| bash ledger/gate/test_adherence.sh | |
| bash ledger/gate/test_project_gates.sh | |
| bash ledger/gate/test_colocation_gate.sh | |
| - name: contract typecheck (all ledger/contracts/*.ncl) | |
| run: bash ledger/gate/test_contract_typecheck.sh | |
| - name: fixture polarity sweep (all ledger/fixtures/*.ncl + *.yaml) | |
| run: bash ledger/gate/test_fixture_sweep.sh | |
| - name: conditioning sweep (compose.ncl, core.ncl, probe_no_core.ncl) | |
| run: bash ledger/gate/test_conditioning_sweep.sh | |
| - name: gate-scope completeness (fails on undeclared gate) | |
| run: bash ledger/gate/check_scopes.sh | |
| - name: gate demonstrations (smoke) | |
| run: | | |
| set -euo pipefail | |
| bash ledger/gate/demo_scale_invariant.sh | |
| bash ledger/gate/demo_unauthorized.sh | |
| - name: orchestration demo typecheck (skills/orchestration/demo/*.ncl) | |
| run: | | |
| set -euo pipefail | |
| for f in skills/orchestration/demo/*.ncl; do | |
| [ -f "$f" ] || continue | |
| echo "checking $f" | |
| nickel export -I ledger/contracts "$f" >/dev/null | |
| done | |
| - name: doc audit (links + anchors) | |
| run: python3 skills/doc-audit/scripts/check_docs.py . | |
| - name: conditioning delivery e2e + bootstrap uninstall (hermetic) | |
| run: | | |
| set -euo pipefail | |
| bash conditioning/test_conditioning.sh | |
| bash bootstrap/test_uninstall.sh | |
| # NOTE: bootstrap/test_bootstrap.sh is intentionally NOT run here. It | |
| # performs a real `claude plugin install` (Claude CLI + network + auth), | |
| # which is not CI-appropriate; run it manually when changing bootstrap. | |
| # The two tests above ARE CI-safe: test_conditioning.sh installs into a | |
| # throwaway HOME (PREDICATE_CLAUDE_DIR/PREDICATE_GEMINI_DIR), and | |
| # test_uninstall.sh seeds surfaces directly and uses a mock `claude` — no | |
| # network, no auth, no real ~ touched. |