fix(quality): the coverage flag went ON at @main and reached OLD pinned runners — decidesk and doriath went red on gates 4, 24 and 33

[rubenvdlinde]

fix(quality): the coverage flag went ON at @main and reached OLD pinned runners — decidesk and doriath went red on gates 4, 24 and 33

hydra-gates-require-full-coverage was flipped to default TRUE (#164) once the
runner could tell a not-applicable gate from a real gap. But this workflow is
consumed at @main while the gate package is consumed at the caller's own
hydra-gates-ref, so the new default was handed to runners that predate the
accounting entirely — and those count EVERY gate they did not run as a gap.

Measured, not inferred, both after the flip and both failing on nothing else:

decidesk job 92432089644 ref v1.0.1 ALL 61 GATES GREEN
COVERAGE: 58 of 61 / DID NOT RUN: 4 24 33 -> exit 98
doriath job 92363547732 ref v1.0.1 same three gates, same verdict

Gates 4, 24 and 33 are the exact trio the product owner named as legitimately
not applicable. So the flip was producing the outcome it was made to prevent,
in every repo whose pin had not moved — and pins do not move on in-flight
branches.

The flag is now handed only to a package that can honour it. The probe reads the
package's own accounting (_NA_GATES in the runner, the NOT APPLICABLE
verdict in the wrapper) rather than comparing versions, because a pin may be a
tag, a branch, a SHA or a fork. Verified against every published tag:
v1.0.0/v1.0.1/v1.1.0/v1.2.0 -> withheld, v1.3.0/v1.4.0 -> applied. A checkout
missing either file is a broken checkout, not an old one, and fails.

Withholding is stated as a ::warning:: naming the pin and the fix. A control
that switches itself off quietly is a control that has stopped existing.

--axe-enabled is gated on the same probe. The old wrapper's parser ends in
*) APP_DIR="$1", so an unrecognised flag is swallowed as a POSITIONAL and
clobbers the app dir set moments earlier: a v1.0.1 pin handed it aborts with
FATAL: --app-dir '--axe-enabled' is not a directory. No gate ran. — exit 99,
every gate lost, for a flag the caller never typed.

Same ref skew, second instance: axe-run.cjs landed in v1.4.0 and every caller is
pinned v1.3.0, so enable-axe: true would die on Cannot find module and then
present as "the axe report never arrived" — pointing at Playwright, the one
place the fault is not. Asserted at the checkout with a named error instead.

The two probe literals are a CONTRACT: renaming either would silently disable
coverage enforcement fleet-wide, with a warning blaming the caller's pin. The
package's own suite now asserts both, plus a reverse control proving the probe
does not match the pre-v1.3.0 shape of either file. Positive-controlled: with
both literals renamed in a copy, those assertions go red.

Four-way measurement on one fixture, one variable at a time:

v1.0.1 + --require-full-coverage exit 98 <- the observed failure
v1.0.1, flag withheld (this change) exit 0
v1.4.0 + flag, only (a) gaps exit 0 33 of 33 applicable gates ran
v1.4.0 + flag + a structural gap exit 98 [gate-24] SKIPPED (structural)

Also removes a stale comment left by the #161/#166/#168 cycle that instructed
future readers to embed the axe runner inline — the thing that made the whole
workflow unresolvable fleet-wide.

Suite 31 -> 34 tests, 0 failing. actionlint clean (positive-controlled: a
typo'd step id is reported). Largest run: step 8,533 B, far below the ~19 KB
that makes a workflow unresolvable.

---

Gates 4, 24 and 33 — classified, with the evidence

gate	verdict	evidence
gate-4 composer-audit	(a) in both of its common shapes — no composer.json at all, and composer.json/.lock not in a diff-scoped run (ADR-020). (c) in a third: composer.json present but composer not on PATH — a dependency tree that exists and was never audited.	run-hydra-gates.sh:661,663,671 — three _skip 4 call sites, categorised na, wiring, na. Live: doriath job 92411975098 [gate-4] composer-audit: NOT APPLICABLE — neither composer.json nor composer.lock is in this diff.
gate-24 integration-parity	(a) when the repo registers no integration leaves at all; (b) when it registers them and ships no parity check. Split on the gate's OWN subject matter, not on the presence of its checker.	run-hydra-gates.sh:1964 (na) / :1966 (structural). Both measured on one fixture: with no leaves, NOT APPLICABLE, exit 0; after adding one new LeafDescriptor(, [gate-24] integration-parity: SKIPPED (structural) and exit 98.
gate-33 axe-core	(a) with no src/; (a) with src/ but the caller never set enable-axe (that choice is a visible line in the caller's own workflow, not a gap hidden in the runner); (b) when enable-axe IS set and no report arrives.	run-hydra-gates.sh:2494,2496,2498. Live: doriath job 92411975098 [gate-33] axe-core: NOT APPLICABLE — … the caller did not set enable-axe.

Note gate-33's (b) case was, until this PR, unreachable at every pin in the fleet: --axe-enabled cannot be passed to a v1.3.0 package without the axe runner (v1.4.0), and cannot be passed to anything older without destroying the run.

Both directions, on real runs

Either direction alone is satisfiable by a broken flag — one that never fails passes the first, one that always fails passes the second.

(1) only category-(a) non-reporters → PASSES with the flag on — live GitHub Actions, flag on, no local anything:

run	ref	verdict
doriath job 92411975098	v1.3.0	hydra-gates-require-full-coverage: true · NOT APPLICABLE: 4 6 7 24 33 · 58 of 58 applicable gates ran · job success
decidesk job 92441077855	v1.3.0	58 of 63 … (5 not applicable; 58 of 58 applicable gates ran) · job success

(2) a category-(b) non-reporter → FAILS with the flag on — one fixture, one variable at a time:

package	flag	injected	exit	line
v1.4.0	on	—	0	33 of 33 applicable gates ran
v1.4.0	on	one new LeafDescriptor(, no parity script	98	[gate-24] integration-parity: SKIPPED (structural)
v1.4.0	on	check_no_admin_idor.py removed	counted against coverage	[gate-7] no-admin-idor: SKIPPED (wiring) · 51 of 53 applicable gates ran
v1.0.1	on	—	98	the fleet failure this PR fixes
v1.0.1	withheld	—	0	what this PR does at an old pin

That the workflow turns exit 98 into a red job is proven by a real run too — decidesk job 92432089644 exited 98 and the job is failure. Its cause was the misclassification; its plumbing is the same path a genuine structural gap takes.

Verification

• The probe was extracted out of the parsed YAML (983 B, asserted free of ${{ }}) and run against real checkouts of every published tag: v1.0.0 v1.0.1 v1.1.0 v1.2.0 -> categories=0, v1.3.0 v1.4.0 -> categories=1. Broken checkout (either file missing) -> exit 1 with a named error, no output variable written.
• The ARGS assembly was extracted from the parsed YAML the same way and exercised as a matrix: flag on + new pin -> --require-full-coverage; flag on + old pin -> no flag, warning; axe on + old pin -> no flag, both warnings.
• actionlint clean. Positive-controlled on this same file: a typo'd steps.gatecapp is reported at the exact line.
• shellcheck clean on the modified suite. Positive-controlled.
• Suite 31 -> 34 tests, 0 failing. Helper suites 18 passed / 2 quarantined — both quarantines pre-existing and documented (test_gate_glob_recursion_fixtures.sh, test_gate_orphaned_capability_fixtures.sh), neither touched here.
• Largest run: step in the file: 8,533 B. The unresolvable-workflow threshold sits between ~19 KB and ~21 KB.

Not fixed here

Every caller pins hydra-gates-ref: v1.3.0 on its default branch, so nobody gets #168's axe DOM scoping or gate-46 anchor fix until those pins move to v1.4.0. That is a consumer-ref sweep, deliberately not folded into a workflow fix.

🤖 Generated with Claude Code