ci: shard validate with native unittest coverage and a strict final check - #838

Scope

The required Linux test job runs serially and blocks each landing for roughly half an hour. This change runs native unittest discovery as eight module shards and keeps one final required check named validate, which fails on any unsuccessful dependency or incomplete module coverage.

• Base commit: b16cb8cf7cb8e37bf0d0edb9924502beb3e6a276.
• Lane: lane:shared; the command center requests trading acknowledgement for the one promotion workflow-contract method.
• Owned paths: validate workflow, shard helper/weights, its fixtures, declared workflow-contract tests, the decision/receipt and the final registry commit.
• Landing path: exact-head co-op cross-family read after the draft's hosted timing run; command-center ACK; 5f lands after Rules: a landscape candidate is finalized by its vendor's clean install and the vendor's own check #833/Instruction core: trim the always-loaded text of both clients; trading rules load only where they apply #836 and before Consolidate catalog evidence, organic controls and foundation records #820/Make standing Ultracode opt-in and record task dispatch scope #829/Qualify CLI transfers and retain applied client-tools evidence #776, per GO-RELAUNCH230713Z and RULING203309Z. The draft stays draft until that read. Critical-path cap allowance confirmed by item191739Z; all25kind3rows accepted by name in203309Z subject to their stronger-assertion condition.
• PR-metadata gates in their own workflow, reading the current PR; suite counts in the validate summary (G-1, G-6) #706 relation: this final summary supersedes G-6 (serial suite counts); G-1 (PR-metadata workflow work) stays in PR-metadata gates in their own workflow, reading the current PR; suite counts in the validate summary (G-1, G-6) #706 for its rank38 turn.

SOTA sources

• GitHub matrix strategies and failure handling, read 2026-10-07.
• GitHub needs result and always, read 2026-10-07.
• Skipped jobs report success even when required; required status checks accept skipped statuses. This final job always runs and explicitly rejects skipped/cancelled/failed dependencies.
• CPython v3.12.3 native discovery, load_tests protocol and TextTestRunner. The helper supplies assignment and receipt glue; unittest runs the tests.
• native-agent-stack@b16cb8cf7cb8e37bf0d0edb9924502beb3e6a276:.github/workflows/validate.yml:147-250: the unchanged provisioners and diagnostics.
• Same pin, docs/decisions/2026-10-03-suite-parallelism-trial-outcome.md:24-27: the superseded Linux serial instruction; failed pool-trial evidence and macOS instruction preserved.
• Existing pinned download/upload artifact actions are reused; no requirement file or other workflow job changes.

Evidence-class table

Expected first-run limitation: this branch is still based on b16cb8c, while main28327acc carries #837's new frozen-lock exceptions. The first osv-scanner check is expected red for that base; it is refreshed only at the command-center landing cue's single rebase. No exception or requirement change is added here, and a local check never substitutes for the landing head's hosted result.

Local commands run

nice -n 19 ionice -c3 actionlint -color .github/workflows/validate.yml
exit0

nice -n 19 ionice -c3 zizmor --offline --no-config --no-ignores --format json .github/workflows/validate.yml
exit0, []

python3 -I -B -X pycache_prefix=<ignored-owned-path> -m py_compile <helper and five touched test modules>
exit0

nice -n 19 ionice -c3 <activated Python3.12.3> -I -B -X faulthandler <stdlib unittest bootstrap> -q --durations 50
selected: test_validate_shards, test_workflow_hardening, test_shell_parser_ci,
test_landscape_sweep_skills, test_workflow_security_coverage, test_promotion_gate,
test_adoption_docs_consistency
exit1, 368ran/95.067s/onefailure/fiveskips (retained)
Only failure: the promotion class's serial-command binding.
Authorized delta: that class exit0, 3ran/0.874s; other36method ASTs and surrounding bytes preserved.
New fixture deltas:12ran/3.407s and13ran/3.383s, both exit0.
No full-suite phase or hidden baseline waiver.

nice -n 19 ionice -c3 <activated Python3.12.3> -I -B scripts/validate.py
exit0, components69/hashed_files10559/profiles4/receipts226.
git diff --check
exit0

The local environment has Python3.12.3/PyYAML6.0.3 and real Node24.21.0/npm11.19.0 bins before generic PATH. It is a focused environment, not full hosted-image parity. Every hosted cell keeps the current installer and promotion/parser/NodeYAML provisioners; non-test checks execute once in cell zero.

Contract changes

Each listed existing test deliberately replaces the serial whole-suite binding with complete module-shard coverage under docs/decisions/2026-10-07-validate-module-shards.md (kind3). Provisioning, history, timeout/faulthandler and native failure controls remain. The one promotion method additionally runs the tiny native aggregate fixture; neighboring and numeric assertions remain byte-identical.

The trading lane's conditional acknowledgement, ledger row report-native-agent-stack-5f-20261007T200005-shardack, binds that promotion method to three conditions:

1. Every shard runs the promotion provisioner with --require-hashes on blueprints/us-equities/data/requirements.lock and exports REQUIRE_PROMOTION_GATE_VENV=1 before testing, including the shard assigned this module.
2. Module coverage comes from live native discovery, with each module's executed suite exactly once. Weights are scheduling estimates, not a separate test inventory.
3. Final validate runs under if: always() and passes only on successful shards; cancellation, skipping and timeout fail the gate. The trading lane checks these again on this PR before merge.

Failed attempts and limits

The failed unittest-parallel trial remains unchanged. The historical weighting run failed17 tests. Worker fixture-authoring attempts (one missing-helper error; then one failure/one error among12cases) remain disclosed separately; later root runs do not replace them. An early validate returned1 for pending registry hashes, and an incorrect register_file CLI probe returned2 before the documented Python API was used.

The source critic's two fixture gaps (global zero discovery and a package hook invoking nested discovery) are covered by the passing native delta fixtures. Shared fixture origins trigger an explicit serial fallback; that preserves native semantics and must be reported as a performance constraint. Actual hosted latency, skips and complete module coverage remain pending.

Decision record

docs/decisions/2026-10-07-validate-module-shards.md; scoped observations in evidence/artifacts/validate-module-shards-20261007/preparation.json. The final commit changes only manifests/evidence.json.

Host evidence

No host receipt, platform-status change, install or setting change.

Checklist

• Changed actions pinned to full SHAs with version comments.
• Top-level permissions empty; each job grants contents:read only.
• No credential value or new secret.
• No new billing surface.
• Peer worktrees preserved.
• Trading acknowledgement before merge (command center requests it).
• Hosted timing/coverage receipt and exact-head cross-family read.