Fix two checks that appeared to run and didn't: inert complexity budget, CI-skipped real-SDK tracing test

[mrojas54]

Fixes the two High findings from the 20260811 tech-debt assessment. Both are the same shape: a check that appeared to run and didn't. Neither changes runtime behaviour.

1 — The complexity budget had two declarations, and the authoritative-looking one was inert

pyproject.toml declared [tool.ruff.lint.mccabe] max-complexity = 10. Ruff only evaluates C901 when the rule is selected, and this project keeps Ruff's default rule set (E4, E7, E9, F), which excludes it — so ruff check . never read the value.

Verified by control: re-running against report.py, which contains a complexity-20 function, with --config "lint.mccabe.max-complexity = 1" still reports clean.

The budget that actually governs is complexity_gate.DEFAULT_THRESHOLD. The gate cannot read pyproject.toml by design — collect_complexities() invokes Ruff with --isolated precisely so the base snapshot, written to a temp dir with no pyproject.toml, is measured under the same config as the working tree. Two declarations of "10", one decorative; tightening the obvious one would have been a silent no-op.

A test was pinning the decoration. test_project_config_and_ci_enforce_the_regression_gate asserted the inert key — under that name. Deleting the dead config turned the suite red and told you to put it back, which is how it survived in a repo this disciplined.

The test now asserts the invariant instead: a mccabe budget may be declared only when C901 is actually selected. That permits either design — enforce through Ruff, or leave the gate as sole owner — and forbids only the misleading middle state. Confirmed non-vacuous by evaluating the new assertion against the old config state (it fails, as it should).

Why not just enable the rule?

extend-select = ["C90"] was the alternative. It fails CI immediately on 8 pre-existing functions in src/toolbench — topped by report.py:623 _render_summary (20) and complex_runner.py:209 _assert_deps_base_safe (17), and including shell_safety.py:154 read_escapes (14), the safety-critical bash tokenizer. That is a refactor decision, not a side effect of a config cleanup, so this PR leaves it open. The gate's threshold is unmoved at 10.

The assessment filed those 8 separately as a Medium finding, with a suggestion to record them as a dated baseline so the ratchet has a visible starting line.

2 — The only real-SDK tracing test never ran in CI

tests/test_observability.py::test_real_sdk_export_is_sanitized is guarded on lmnr being importable. The gate job installs no optional extras, so it skipped on every push and pull request while CI reported green. It is the only test exercising the real Laminar SDK's export sanitization rather than a fake.

The code it guards took 35 of the last 46 commits, many corrective — sanitizing SDK-derived context, isolating SDK system exits, preserving interrupts, disabling inherited debugger context. The most-churned and most security-relevant path had its only real-SDK check dark.

Why nobody noticed: a working .venv generally has the extra installed, so the test runs on a developer machine and skips only in CI — the one arrangement where the skip is invisible. Confirmed during review: after a plain uv sync pruned the local venv to CI's 13 packages, the skip appeared locally for the first time.

Adds a second tracing job rather than adding the extra to gate. The default install is 13 packages with zero required runtime dependencies — the repo's strongest supply-chain property, worth keeping intact. The new lane is the single place the opt-in is actually taken.

The lane asserts lmnr is importable before running pytest, so a rename or lock change fails loudly instead of quietly restoring the same green skips. A new test also asserts the lane exists in ci.yml, matching the repo's existing convention of testing its own CI config.

Verification

Check	Result
gate default install (no extra, lmnr absent)	748 passed / 3 skipped, exit 0
tracing lane (extra installed)	748 passed / 3 skipped, exit 0 — test_observability.py:99 absent from the skip list, i.e. it ran
ruff check .	clean, exit 0
mypy --strict src/toolbench tests	clean, exit 0 — also clean with the extra installed
complexity_gate --base main	0 errors, 0 warnings
ci.yml	parses; both jobs present; the folded python -c joins to one valid line

Both lanes were run against real synced environments, not the developer venv.

Reviewer notes

• No behaviour change. Removing the inert config cannot alter linting, because the setting was never evaluated.
• The tracing job uses a shallow checkout deliberately — unlike gate, it runs no Git-base comparison, so fetch-depth: 0 is unnecessary.
• CI cost: one extra job installing 49 packages instead of 13, running a ~21s suite.
• No ${{ }} interpolation is introduced into any run: command; the new job's commands are entirely static.

🤖 Generated with Claude Code