Repair parity governance maintenance flow

[bhelm]

Summary

• narrow Parity Governance CI to genuine parity tests instead of every file under Tools/tests
• keep the legacy R-R preservation contract explicitly covered
• add a guarded stale-base repair mode that cannot accept branch-added debt, disposition changes, or partial metadata
• re-derive the currently stale authority and baseline from main

Verification

• parity governance CI command: 113 tests pass
• full Python tools suite passes
• guarded stale-base repair reproduces the committed snapshots
• independent review findings resolved

This maintenance PR intentionally stays separate from localization PR #2103.

[ryanbr]

Reviewed at 5586f14. This is the repair for #2211, and it is the right shape. Taking it.

I was deliberate about not improvising here, because the guards you are changing exist to stop an authority file being rewritten without review, so the thing worth checking is whether the new door can be walked through with something it should refuse.

The guard holds

--repair-stale-base proceeds only when all six of these are true: semantic authority equal to the exact base, finding identities equal, counters equal, typed dispositions equal, current authority exactly derived, current baseline exactly derived. So it can regenerate metadata for a tree whose governed state has not moved, and it cannot carry anything of the branch's own. That is precisely the migration the error message demanded and could not offer.

Two things I checked specifically because they would have made the guard decorative:

The flag appears nowhere in .github/workflows/. If the routine gate passed it, every PR would get the repair path and the six conditions would never bite. It is maintenance-only, which is the only way it is safe.

The acceptance suite tests the refusals, not just the success. Branch-added debt, disposition changes, a non-exact map, a non-exact baseline, and the flag requiring the guarded refresh. Testing that a guard permits the good case is easy and nearly worthless; testing that it refuses five bad ones is the part that matters.

The CI narrowing loses nothing

Tools/tests/ holds exactly three modules and the workflow names all three, so today it is a no-op in coverage. What it buys is that a future unrelated test file cannot silently join the parity-governance job or move its floor, and tools-python.yml still discovers everything with its own floor of 200. Raising the floor 103 to 113 in the same change is right: a named list that nobody counts is how a list quietly loses an entry.

What the baseline now accepts, and why that is fine

Main was 294 baselined; this is 309. The added entries are #2098's lift-log storage, whose API has tests and no production callers because #2099 is the consumer and has not landed.

I had been reluctant to record that, on the grounds it is about to stop being true. Having looked at how it unwinds, that was the wrong instinct. When #2099 lands those become production callsites, the findings disappear, and the ledger says "debt decreased; baseline cleanup is optional", exactly as it already does for StrandAnalytics today. Recording it is reversible; leaving main red until an unrelated PR merges is not.

One correction to my own testing, worth recording

Running your three modules in my working tree gave 113 tests with 1 failure, test_checked_in_inventory_and_baseline_match_current_sources, complaining about test-only-callsite|Packages/StrandAnalytics. CI says five of five green, so one of us was wrong.

It was me. My tree carries Packages/StrandAnalytics/.build from Swift package builds earlier today, and the scanner walks the filesystem. In a pristine clone of your branch: 113 tests, OK, and the ledger reports OK no NEW parity ledger findings.

Worth saying out loud rather than quietly: I nearly reported a failure against your change that belonged entirely to my own working directory. The same thing caught me once before this week, which is why I checked instead of writing it up.

Also confirmed: main currently fails two acceptance tests and this branch fails one, so test_checked_metadata_is_compact_v3_and_expands_losslessly is fixed here, not merely unaffected.

Merging. Thanks for taking the deadlock rather than working around it.