## Sprint 16.2 gate inventory

**Snapshot:** `9786857c814a29015987681e2416acb23275f9e5` on `sprint16.2/first-import-calibration-portal-flow`; tracked tree clean, no untracked files, and `git diff --check` passed.

### Test baselines

- **Backend:** **796 tests collected** across 113 Python test/support files.
  - Verified with:
    ```bash
    python3 -m pytest --collect-only -q tests
    ```
  - Result: `796 tests collected in 2.66s`
- **Frontend:** **179 Vitest cases** across 49 test files.
  - Static tracked-source count: 165 ordinary cases plus 14 parameterized cases.
  - Not executed: `frontend/node_modules` is absent, so `npm test -- --list` failed with `vitest: not found`.
  - Install gate:
    ```bash
    cd frontend
    npm ci
    ```

### Canonical local gates

From the Makefile/package scripts:

```bash
pytest tests -q
npm --prefix frontend test
npm --prefix frontend run typecheck
npm --prefix frontend run build
python -m compileall src tests
python -m jarvis_finance.cli.main git-safety-scan .
make PYTHON=.venv/bin/python verify
git diff --check
```

`make verify` runs, in order:

1. compileall
2. full backend suite
3. full frontend suite
4. frontend typecheck
5. frontend production build
6. repository safety scan

### CI inventory

Only workflow: `.github/workflows/portfolio-phase3-integration.yml`

Triggers:

- Pull requests targeting `main`
- Manual `workflow_dispatch`
- **No push trigger**

Three CI jobs:

1. **`backend-full`**
   ```bash
   python -m pip install -e . -r requirements-ci.txt
   mkdir -p /tmp/financemanager-phase3-backend/runtime
   python -m pytest tests -q | tee /tmp/financemanager-phase3-backend/pytest.log
   ```
   Parses the pytest summary and currently enforces only:
   ```bash
   test "${passed_count}" -ge 667
   ```

2. **`frontend`**
   ```bash
   cd frontend
   npm ci
   npm test
   npm run typecheck
   npm run build
   ```
   There is **no numeric frontend floor**.

3. **`controls`**
   ```bash
   git diff --check "origin/${GITHUB_BASE_REF:-main}...HEAD"
   python -m jarvis_finance.cli.main git-safety-scan .
   python -m compileall -q src tests scripts/ci_portfolio_phase3_gate.py
   python scripts/ci_portfolio_phase3_gate.py
   ```
   Plus a focused Ruff check over the Phase-3 integration files and focused pytest:
   ```bash
   python -m pytest -q \
     tests/unit/test_api_write_security.py \
     tests/unit/test_settings.py \
     tests/unit/test_portfolio_data_ingestion_reconciliation.py \
     tests/unit/test_portfolio_performance_foundation.py \
     tests/unit/test_portfolio_policy_foundation.py \
     tests/unit/test_reconciliation_snapshot_foundation.py \
     tests/unit/test_transfer_pairing_v2.py
   ```

The migration script validates:

- Empty database migration to schema 47
- Sprint-5 schema 40 → 47 migration
- SQLite integrity
- Seed/business-data preservation
- Performance-scope normalization and audit linkage
- Second-run migration no-op/idempotency
- Rejection of productive paths in test mode

### Safety gates

Tracked safety coverage blocks:

- SQLite/database and backup files
- `.env` and secret-like filenames
- GitHub PAT, `ghp_`, bearer, OpenAI, Slack, and private-key patterns
- Top-level runtime/data/export/report directories
- CSV/JSON outside synthetic fixtures or configuration examples
- Symlinks
- PDFs
- Frontend `dist`, `node_modules`, and frontend environment files

Commands:

```bash
python -m jarvis_finance.cli.main git-safety-scan .
git diff --check
git ls-files --others --exclude-standard
git status --short
```

### Baseline release risks

1. **Backend CI floor is stale:** workflow advertises and enforces **667**, while Sprint 16.2 requires **≥796**.
2. **Frontend count is unguarded:** tracked suite is 179 cases, but CI only checks Vitest exit status; deletion could remain green.
3. **Job display is stale:** `Backend – 667 tests (single run)`.
4. **Makefile is not hermetic:** `PYTHON=.venv/bin/python` affects compile/safety, but `test` hardcodes bare `pytest`. The current shell resolves Python tooling from a sibling Sprint 16.1 worktree, so local results could be contaminated.
5. **No local `.venv` or frontend dependencies:** the documented aggregate gate cannot currently run without environment setup.
6. **Ruff is not in `make verify`** and CI Ruff covers only a selected file list, not the full repository.
7. **Compileall differs:** Makefile checks only `src tests`; CI additionally compiles `scripts/ci_portfolio_phase3_gate.py`.
8. **Possible aggregate ordering conflict:** `frontend-build` precedes `git-safety`; safety tests explicitly reject `frontend/dist`. Confirm whether the scanner ignores Git-ignored build output before trusting `make verify`.
9. **Diff gate misses untracked files:** `git diff --check` does not inspect them. The current tree has none, but candidate completeness needs a separate untracked-file check.
10. **No tracked PR/merge/deploy automation:** CI stops at validation. Restart scripts are operational/dev restarts, not a release deployment pipeline.
11. **Restart scripts are unsafe as deployment gates:** they target a hardcoded canonical checkout, use external runtime defaults, bind services broadly, can kill existing listeners, and provide no exact-SHA, backup, migration, rollback, or post-deploy business smoke.
12. **No semantic privacy gate beyond repository scanning:** secret/file-pattern checks are strong, but there is no tracked dedicated privacy/PHI/financial-record semantic scan.

### Required publication sequence

No exact publication commands are tracked. The minimum safe sequence is:

1. Update CI floors to backend `>=796` and frontend `>=179`.
2. Run full backend and frontend suites.
3. Run typecheck, build, Ruff, compileall, migration controls, safety scan, `make verify`, and candidate/untracked diff checks.
4. Open PR to `main`; require all three CI jobs green.
5. Review the complete PR diff and CI SHA.
6. Merge only with explicit authorization.
7. Deploy the exact merged remote-main SHA only after separate explicit authorization, backup/migration preparation, and rollback readiness.
8. Perform health and read-only functional smokes; verify deployed SHA.

**Files modified/created:** none.  
**Issues encountered:** frontend dependencies were absent; backend collection required the available Python environment, which is currently sourced from a sibling worktree and should not be treated as hermetic full-suite evidence.