ci: enforce strict zero-test-skip architecture and environment suite partitioning

.github/workflows/ci.yml

@@ -157,6 +157,12 @@ jobs:
       - name: Load harness contract tests
         run: npm run test:load-harness
 
+      - name: POSIX API tests
+        run: npm run test:posix -w @chess-platform/api
+
+      - name: POSIX load harness tests
+        run: npm run test:load-harness:posix
+
       # The container images build with their own package chain, which CI never exercises — it
       # builds from the root chain instead. That gap let `docker compose up --build` stay broken
       # from M11 inc 5 onwards while every gate here was green. Static, so it costs seconds.
@@ -199,6 +205,10 @@ jobs:
       # stopped looking at anything. These drive it against synthetic sources: a commented-out
       # entry, a forward migration, a constraint replaced rather than edited, a renamed
       # declaration. Pure functions over temp files, no services.
+      # Every test file in the repository must belong to an explicit, appropriately provisioned suite.
+      - name: Test topology check
+        run: npm run check:test-topology
+
       - name: Guard script tests
         run: npm run test:scripts
 
@@ -403,10 +413,13 @@ jobs:
         run: npm run build
 
       - name: Test persistence against Postgres
-        run: npm test --workspace @chess-platform/persistence
+        run: npm run test:integration:postgres --workspace @chess-platform/persistence
 
       - name: Test API concurrency controls against Postgres
-        run: npm test --workspace @chess-platform/api
+        run: npm run test:integration:postgres --workspace @chess-platform/api
+
+      - name: Test scripts integration against Postgres
+        run: npm run test:scripts:integration
 
   # The only job that runs a real engine binary (ADR-0113). Every other analysis test drives a
   # fake transport or a provider double, which keeps the main suite hermetic but leaves the

.github/workflows/live-provider.yml

@@ -0,0 +1,75 @@
+name: Live Provider Contract Tests
+
+# Dedicated, manual-only workflow for live third-party AI provider contract tests.
+# These tests make real network calls to OpenAI / Anthropic APIs and require live API keys.
+# Per repository policy:
+# - They MUST NOT run in automatic PR CI.
+# - They MUST NOT be marked as passed when credentials are unavailable.
+# - They execute strictly on demand when credentials are provided in repository secrets.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  live-provider-contract:
+    name: live provider contract tests (provisioned providers)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node 22.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.x'
+          cache: npm
+
+      - name: Install dependencies (reproducible)
+        run: npm ci
+
+      - name: Build (dependency order)
+        run: npm run build
+
+      - name: Detect provisioned credentials
+        id: credentials
+        run: |
+          has_openai=false
+          has_anthropic=false
+          if [ -n "${OPENAI_API_KEY}" ]; then has_openai=true; fi
+          if [ -n "${ANTHROPIC_API_KEY}" ]; then has_anthropic=true; fi
+          echo "has_openai=${has_openai}" >> "$GITHUB_OUTPUT"
+          echo "has_anthropic=${has_anthropic}" >> "$GITHUB_OUTPUT"
+          if [ "${has_openai}" = false ] && [ "${has_anthropic}" = false ]; then
+            echo "::error::At least one live-provider credential must be configured."
+            exit 1
+          fi
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+
+      - name: Test AI orchestrator OpenAI contract
+        if: steps.credentials.outputs.has_openai == 'true'
+        run: npm run test:live-provider:openai --workspace @chess-platform/ai-orchestrator
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+      - name: Test AI orchestrator Anthropic contract
+        if: steps.credentials.outputs.has_anthropic == 'true'
+        run: npm run test:live-provider:anthropic --workspace @chess-platform/ai-orchestrator
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+
+      - name: Test AI features OpenAI contract
+        if: steps.credentials.outputs.has_openai == 'true'
+        run: npm run test:live-provider:openai --workspace @chess-platform/ai-features
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+      - name: Test AI features Anthropic contract
+        if: steps.credentials.outputs.has_anthropic == 'true'
+        run: npm run test:live-provider:anthropic --workspace @chess-platform/ai-features
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

deploy/load/test/run-evidence.posix.test.mjs

@@ -0,0 +1,46 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { once } from 'node:events';
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+
+const armScript = (dir, body, options = 'undefined') => `
+import { existsSync, writeFileSync } from 'node:fs';
+import { armFailureEvidence, buildEvidence, clearEvidence, writeEvidence } from ${JSON.stringify(
+  pathToFileURL(join(REPO_ROOT, 'scripts/lib/run-evidence.mjs')).href,
+)};
+const DIR = ${JSON.stringify(dir)};
+const FILE = 'evidence.json';
+const build = (exitCode) => buildEvidence({
+  harness: 'test', outcome: 'aborted', exitCode,
+  startedAt: '2026-08-27T10:00:00.000Z', finishedAt: '2026-08-27T10:00:01.000Z',
+});
+clearEvidence(DIR, FILE);
+const fallback = armFailureEvidence(DIR, FILE, build, ${options});
+${body}
+`;
+
+test('a real SIGTERM leaves the artifact and still terminates by the signal', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'gambit-evidence-'));
+  const file = join(dir, 'child.mjs');
+  writeFileSync(file, armScript(dir, "console.log('armed');\nsetTimeout(() => {}, 60_000);"), 'utf8');
+
+  const child = spawn(process.execPath, [file], { cwd: REPO_ROOT, encoding: 'utf8' });
+  await once(child.stdout, 'data');
+  child.kill('SIGTERM');
+  const [code, signal] = await once(child, 'exit');
+
+  assert.equal(
+    signal,
+    'SIGTERM',
+    'the handler re-raises after writing, so the process still dies BY the signal rather than ' +
+      'turning an interrupt into an ordinary exit',
+  );
+  assert.equal(code, null);
+  assert.equal(JSON.parse(readFileSync(join(dir, 'evidence.json'), 'utf8')).exitCode, 143);
+});

deploy/load/test/run-evidence.test.mjs

@@ -413,30 +413,6 @@ test('an interrupt after clearing still leaves a failure artifact', () => {
   assert.notEqual(result.status, 0, 'and an interrupted run must never look like a successful one');
 });
 
-test(
-  'a real SIGTERM leaves the artifact and still terminates by the signal',
-  { skip: process.platform === 'win32' ? 'Windows terminates on kill() without running handlers' : false },
-  async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'gambit-evidence-'));
-    const file = join(dir, 'child.mjs');
-    writeFileSync(file, armScript(dir, "console.log('armed');\nsetTimeout(() => {}, 60_000);"), 'utf8');
-
-    const child = spawn(process.execPath, [file], { cwd: REPO_ROOT, encoding: 'utf8' });
-    await once(child.stdout, 'data');
-    child.kill('SIGTERM');
-    const [code, signal] = await once(child, 'exit');
-
-    assert.equal(
-      signal,
-      'SIGTERM',
-      'the handler re-raises after writing, so the process still dies BY the signal rather than ' +
-        'turning an interrupt into an ordinary exit',
-    );
-    assert.equal(code, null);
-    assert.equal(JSON.parse(readFileSync(join(dir, 'evidence.json'), 'utf8')).exitCode, 143);
-  },
-);
-
 test('a run that wrote its own evidence is not overwritten by the fallback', () => {
   const dir = mkdtempSync(join(tmpdir(), 'gambit-evidence-'));
   const result = runInChild(