ci(coverage): stop one red gate from hiding the eight behind it

Two coverage regressions turned up this week, and neither was found by the
gate that exists to find it. The auth-manager module sat at 82% against a
90% gate for two weeks; key rotation sat at 89.6% and passed only because
coverage rounds before it compares. Both were found by running the gate
commands by hand.

The reason they were invisible is structural, not specific to those two
modules. Steps in a job stop at the first failure, and test-unit runs nine
per-module coverage gates in sequence after the full suite. While an
earlier step in that job was failing, every gate after it simply never
ran -- so a module could lose twelve points of coverage and the gate meant
to catch it never executed to notice.

The gates share nothing but the venv. Each runs its own pytest over its
own files and reports on its own module; none consumes anything an earlier
one produces. There was never a reason for one to gate the next.

So each now carries `if: !cancelled() && steps.install.outcome ==
'success'`: run whenever the environment installed, skip only on a
cancelled run or a broken install (where all nine would be noise). Every
gate still fails the job on its own -- nothing is downgraded to a warning.
The difference is that a single run now reports all nine verdicts instead
of stopping at the first, which is what turns "the gate is red" into "the
gate is red *and* these two others slipped".

test_coverage_policy.py::test_every_coverage_gate_runs_even_after_an_earlier_one_fails
holds the shape: a gate added without the condition fails it, and so does
dropping the `id: install` the condition refers to. Proven red against the
pre-change ci.yml (1 failed, 9 passed), green after (10 passed).

Verified: ci.yml parses and all nine gates carry the condition, ruff
lint/format clean, test_coverage_policy.py passes (10 passed), docs and
audit-gate ratchets pass (25 passed).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ybRVCaL1Lyd9d5kFTndh3

Author: JuliaEdom

.github/workflows/ci.yml

@@ -247,6 +247,7 @@ jobs:
         with:
           python-version: "3.11"
       - name: Install dependencies
+        id: install
         run: |
           bash scripts/ci_sync.sh test-integrations
       - name: Verify SDK/integrations joint installability
@@ -264,22 +265,27 @@ jobs:
       - name: Enforce changed-code coverage
         run: diff-cover .artifacts/coverage/coverage.xml --compare-branch=origin/main --fail-under=80
       - name: Run quality validators coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           python -m pytest tests/unit/test_validators.py -v --tb=short --cov=agentflow_runtime.quality.validators --cov-report=term-missing --cov-fail-under=90
       - name: Run freshness monitor coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           python -m pytest tests/unit/test_freshness_monitor.py -v --tb=short --cov=agentflow_runtime.quality.monitors.freshness_monitor --cov-report=term-missing --cov-fail-under=90
       - name: Run event producer coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           python -m pytest tests/unit/test_event_producer.py -v --tb=short --cov=agentflow_runtime.ingestion.producers.event_producer --cov-report=term-missing --cov-fail-under=90
       - name: Run SQL guard coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           # Security-critical NL->SQL guard: validate_nl_sql (SELECT-only, no DML,
           # tenant table allow-list, recursive-CTE shadow reject). test_sql_guard
           # plus test_sql_guard_mutation give full module coverage (100% local);
           # the 90% gate keeps a 10pp regression cushion.
           python -m pytest tests/unit/test_sql_guard.py tests/unit/test_sql_guard_mutation.py -v --tb=short --cov=agentflow_runtime.serving.semantic_layer.sql_guard --cov-report=term-missing --cov-fail-under=90
       - name: Run rate limiter coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           # Security-critical sliding-window rate limiter (Redis + in-memory
           # fail-closed fallback); local module coverage is 98% (only the optional
@@ -297,6 +303,7 @@ jobs:
             -k "not auth_middleware" -v --tb=short -p no:schemathesis -p no:cov
           python -m coverage report --include="*/serving/api/rate_limiter.py" --show-missing --fail-under=90
       - name: Run auth manager coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           # Security-critical auth manager (key match/verify, tenant isolation,
           # rate-limit/failed-auth windows, rotation grace) and a mutmut target;
@@ -331,6 +338,7 @@ jobs:
             -p no:schemathesis
           python -m coverage report --include="*/serving/api/auth/manager.py" --show-missing --fail-under=90
       - name: Run key rotation coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           # Security-critical key-rotation lifecycle (create/rotate/revoke,
           # grace-period scheduling, rotation status) and a mutmut target. Like
@@ -353,6 +361,7 @@ jobs:
             -p no:schemathesis
           python -m coverage report --include="*/serving/api/auth/key_rotation.py" --show-missing --fail-under=90
       - name: Run outbox coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           # Security/reliability-critical at-least-once outbox dispatch loop
           # (delivery, retry/backoff, poison-to-failed, mark-sent transactions)
@@ -362,6 +371,7 @@ jobs:
           python -m coverage run -m pytest tests/unit/test_outbox_processor.py tests/unit/test_outbox_connection_guard.py -p no:schemathesis
           python -m coverage report --include="*/processing/outbox.py" --show-missing --fail-under=90
       - name: Run query package coverage gate
+        if: ${{ !cancelled() && steps.install.outcome == 'success' }}
         run: |
           # The NL->SQL orchestration surface (engine, entity/metric/NL query
           # mixins, SQL builder) and a mutmut target set; the old single-file

CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to AgentFlow are documented in this file.
 
 ## [Unreleased]
 
+### CI — a red coverage gate no longer hides the gates behind it
+
+* **Steps in a job stop at the first failure**, and `test-unit` runs nine
+  per-module coverage gates in a row. While an earlier step was failing, the
+  auth-manager gate never ran at all — which is how that module drifted from
+  94% to 82% for two weeks with a gate supposedly holding it at 90%, and how
+  the key-rotation gate reached 89.6% (passing only because coverage rounds
+  before it compares). Both were found by running the gates by hand.
+* **Each gate now runs whenever the environment installed**
+  (`if: !cancelled() && steps.install.outcome == 'success'`). They measure
+  different modules and share nothing but the venv, so there was never a
+  reason for one to gate the next. Every gate still fails the job on its own;
+  the difference is that one run now reports all nine verdicts instead of
+  stopping at the first.
+* **A ratchet keeps it that way.**
+  `test_coverage_policy.py::test_every_coverage_gate_runs_even_after_an_earlier_one_fails`
+  fails if a gate is added without the condition, or if the install step
+  loses the `id` the condition refers to.
+
 ### Supply chain — releases were being built by a yanked builder
 
 * **`build` 1.5.1 is yanked upstream** ("considers breaking changes, will

tests/unit/test_coverage_policy.py

@@ -177,3 +177,36 @@ def test_ci_has_scoped_query_package_coverage_gate() -> None:
     assert "coverage run" in gate_step["run"]
     assert "*/serving/semantic_layer/query/*" in gate_step["run"]
     assert "--fail-under=90" in gate_step["run"]
+
+
+def test_every_coverage_gate_runs_even_after_an_earlier_one_fails() -> None:
+    """A red gate must not hide the gates behind it.
+
+    Steps in a job stop at the first failure, so for two weeks the
+    auth-manager gate never ran: an earlier step in test-unit was failing, and
+    the module drifted from 94% to 82% with nothing to report it. Each gate
+    measures a different module and depends on nothing the others produce, so
+    each one runs whenever the environment installed -- and still fails the
+    job on its own.
+    """
+    workflow = yaml.safe_load(
+        (PROJECT_ROOT / ".github" / "workflows" / "ci.yml").read_text(encoding="utf-8")
+    )
+    steps = workflow["jobs"]["test-unit"]["steps"]
+
+    install = next(step for step in steps if step.get("name") == "Install dependencies")
+    assert install.get("id") == "install", "the gate condition references steps.install"
+
+    gates = [
+        step
+        for step in steps
+        if str(step.get("name", "")).startswith("Run ")
+        and str(step.get("name", "")).endswith(" coverage gate")
+    ]
+    assert len(gates) >= 9, f"expected the per-module gates, found {len(gates)}"
+
+    for gate in gates:
+        condition = gate.get("if")
+        assert condition is not None, f"{gate['name']} has no if: condition"
+        assert "!cancelled()" in condition, gate["name"]
+        assert "steps.install.outcome == 'success'" in condition, gate["name"]