dirac.yml

name: Dirac gates

# Triggers on EVERY branch, deliberately. The two pre-existing workflows
# (node.yml, docs.yml) are pinned to `branches: master`, but this repo's branch
# is `main` — so neither has ever run a single time. Unqualified `push` cannot
# repeat that mistake.
on:
  push:
  pull_request:

# A second push to the same branch cancels the first: these gates are cheap, but
# not free, and only the tip matters.
concurrency:
  group: dirac-gates-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gates:
    name: S1 gates
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          # gate 9 audits the FULL history; the default depth-1 clone would let it
          # scan one commit and report clean.
          fetch-depth: 0

      # package.json engines says node >=22.0.0. Pinned to the major rather than
      # resolved from the range: a range silently follows the newest release, so
      # a green CI could turn red without a single commit.
      - name: Node 22
        uses: actions/setup-node@v5
        with:
          node-version: '22'
          cache: npm

      # design/check_palette.py imports only math, re, sys and pathlib — all
      # stdlib. There is deliberately no pip install step; adding one would be a
      # dependency this suite does not have.
      - name: Python 3.12
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: npm ci
        id: npm_ci
        run: npm ci

      # ---- the four gates, one step each, so a failure names itself ----------

      - name: 'Gate 1 — typecheck (tsc --noEmit)'
        if: ${{ !cancelled() && steps.npm_ci.outcome == 'success' }}
        run: node_modules/.bin/tsc --noEmit -p tsconfig.json

      - name: 'Gate 2 — build dirac (production)'
        if: ${{ !cancelled() && steps.npm_ci.outcome == 'success' }}
        run: node ./scripts/build.mjs -a dirac --prd

      # Gates 3 and 4 touch neither node_modules nor the build output, so they
      # run even when the install or an earlier gate failed. One red gate must
      # not hide the other three.
      - name: 'Gate 3 — palette chroma / contrast / ΔE'
        if: ${{ !cancelled() }}
        run: python3 design/check_palette.py

      - name: 'Gate 4 — CSS brace balance (regression: a93c175)'
        if: ${{ !cancelled() }}
        run: node scripts/check_css_braces.mjs src/app.frontend.facets.molstar-rdkit.editable/index.html

      # Gates 6-8 were running locally and NOWHERE ELSE, which makes them
      # advice rather than gates. All three are pure node, need no database and
      # no build output, so they run unconditionally like 3 and 4. Gate 5
      # (migration hashes) still cannot run here: it needs the applied ledger,
      # and a version that passes without a database would be a check that
      # cannot fail.
      - name: 'Gate 6 — doc facts re-derived from source'
        if: ${{ !cancelled() }}
        run: node scripts/check_docs_facts.mjs

      # Exit 2 = contracts clean, src/ behind. Reported, not fatal: the frontend
      # interface is owned elsewhere and legitimately trails. Exit 1 (contracts
      # disagree with the code) fails the build.
      - name: 'Gate 7a — canonical contracts validate and generated code is current'
        if: ${{ !cancelled() }}
        run: |
          pip install --quiet jsonschema
          python3 scripts/gen_contracts.py --check
          python3 scripts/check_public_registry.py
          PYTHONPATH=backend python3 -m unittest \
            backend.tests.test_motif_contracts \
            backend.tests.test_execution_identity \
            backend.tests.test_local_cas \
            backend.tests.test_execution_control \
            backend.tests.test_motif_core

      - name: 'Gate 7 — contract drift (errors.json / iface.* / FIELD_META_SCHEMA)'
        if: ${{ !cancelled() }}
        run: |
          node scripts/check_contract_drift.mjs --redproof
          node scripts/check_contract_drift.mjs; code=$?
          # Both 1 and 2 fail now. The frontend gap reached zero on 2026-08-11,
          # and the point of zero is that the next divergence is one key instead
          # of twenty-five. Declaring a key is a two-minute fix; finding out from
          # a chemist that a caveat never rendered is not.
          exit "$code"

      # The selftest runs FIRST and its failure is the gate's failure: this one
      # is green against the real files, so a crafted broken source is the only
      # evidence it has resolution at all.
      # Full history is needed for the hygiene ratchet, and actions/checkout
      # defaults to a shallow clone of depth 1 — on which the audit would scan ONE
      # commit and pass. That is the vacuous-gate shape twice over, so the depth is
      # set explicitly at the checkout step above; if this gate ever reports a
      # suspiciously small commit count, that is the reason.
      # The Python suites that do not need the science stack. Only THREE of ten do
      # today, and that ratio is the point: a suite testing SQL text or a state
      # machine has no business needing a chemistry toolkit, and gate 10 is the
      # ratchet that makes the kernel extraction's progress a number.
      - name: 'Python suites that run without the science stack'
        if: ${{ !cancelled() }}
        run: |
          python3 backend/tests/test_envelope.py
          python3 backend/tests/test_admin_queries.py || echo "::warning::admin_queries needs a database; skipped on this runner"

      - name: 'Gate 10 — test portability ratchet'
        if: ${{ !cancelled() }}
        run: python3 scripts/test_portability.py

      - name: 'Gate 11 — dependency laws (4 enforced, 2 ratchets, 3 N/A)'
        if: ${{ !cancelled() }}
        run: python3 scripts/check_layering.py

      - name: 'Gate 9 — no tooling names in public commit history (ratchet)'
        if: ${{ !cancelled() }}
        run: |
          bash scripts/check_commit_hygiene.sh --selftest
          bash scripts/check_commit_hygiene.sh

      - name: 'Gate 8 — every physics SCF route carries all four protections'
        if: ${{ !cancelled() }}
        run: |
          node scripts/check_physics_contract.mjs --selftest
          node scripts/check_physics_contract.mjs

      - name: 'Gate 14 — architecture twin source discovery and freshness'
        if: ${{ !cancelled() && steps.npm_ci.outcome == 'success' }}
        run: |
          node scripts/watch_digital_twin.mjs --selftest
          python3 scripts/check_digital_twin.py --selftest
          python3 scripts/check_digital_twin.py

  contract-database:
    name: Motif contract and clean-database alignment
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg18
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: dirac
          POSTGRES_DB: dirac
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d dirac"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    env:
      DIRAC_DSN: postgresql://postgres:dirac@localhost:5432/dirac
      PGPASSWORD: dirac
    steps:
      - name: Checkout
        uses: actions/checkout@v5
      - name: PostgreSQL client positive control
        run: |
          command -v psql
          psql --version
          psql "$DIRAC_DSN" -X -v ON_ERROR_STOP=1 -Atc \
            "SELECT current_database(), current_setting('server_version_num')::int >= 180000"
      - name: Clean migration 000 through current
        run: |
          for file in backend/db/migrations/*.sql; do
            psql "$DIRAC_DSN" -X -v ON_ERROR_STOP=1 -f "$file"
          done
      - name: Canonical vocabulary matches the live schema
        run: |
          python3 scripts/verify_contract_db_alignment.py
          bash backend/db/check_migration_hashes.sh