Add Python Tooling to CI and Move the Script Tests to scripts/tests

[ptr727]

Closes #700.

What

• Every ruff and mypy finding is fixed: 88 ruff findings (PLW1510, SIM117, EXE001, BLE001, ISC004, and others) and 5 mypy errors at the configured contract (latest defaults plus extend-select = ["I"]) are at zero. subprocess.run calls carry an explicit check=False (behavior-preserving), nested with/if blocks are merged, shebang files carry the exec bit, and the deliberate blind catches (hook and sweep isolation boundaries) carry scoped # noqa: BLE001 with their why comments.
• CI carries the Python tooling (validate-task.yml): uvx ruff@latest check ., uvx mypy@latest, and the self-test surface under uvx coverage@latest with --append and a report, informational with no threshold. astral-sh/setup-uv is SHA-pinned per the catalog precedent.
• The unit tests move to scripts/tests/, with imports, repo-root constants, .gitattributes pins, and the .editorconfig LF section (scripts/**.py, since an EditorConfig * stops at /) updated, and every prose reference swept (OPERATIONS.md, scripts/README.md, docs/fleet-map.md, host-setup READMEs, the skill sources plus regenerated plugin).
• Linter versus utility is a documented naming split: a gate checks and exits non-zero and carries a _lint/_gate suffix (prose_lint, repo_gate, host_gate), a utility carries none (build_dist, pr_review, skills_install).
• The law amendments: the python-codestyle skill's Scripts profile now requires Python tooling in CI, coverage included, and states the tests/ layout and naming split fleet-wide. CODESTYLE.md Shell, GOVERNANCE.md Repository Layout, spec/project-types.json (python.coverage.codecov note), and spec/host-tools.json (the python floor's why no longer claims no Python linter runs in CI) follow.

Decisions left open, deliberately

• ruff format is not adopted: a format --check gate would reformat 19 files (~12k diff lines) in the same PR. Measured and left for a separate decision.
• The gates stay at scripts/prose_lint.py / scripts/repo_gate.py rather than moving to a scripts/lint/ directory, because those paths are named in carried text (.github/copilot-instructions.md points every fleet repo at them), so a move stales the whole fleet. The issue's naming-separation floor is met instead.

Verification

All gates run locally the way CI runs them: ruff, mypy, the unittest suite under coverage (all seven files, plus the audit, write-guard, and agent-safety self-tests), build_dist.py --check, repo_gate.py, the nine-rule prose gate, spec/validate.py, actionlint, editorconfig-checker, markdownlint, cspell, shellcheck, and PSScriptAnalyzer. test_install.py passes on a clean tree, and OPERATIONS.md now documents its dirty-checkout STALE verdict as by design.

After merge the machines need python3 scripts/skills_install.py re-run per the documented cadence, since the python-codestyle, shell-codestyle, and skill-lifecycle skills changed.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR brings the repository’s Python “Scripts profile” in line with its stated tooling contract by wiring ruff + mypy + coverage into CI, and by moving the script unit tests into a dedicated scripts/tests/ directory with the accompanying doc/spec updates across the repo.

Changes:

• Add Python linting/type-checking and coverage-driven self-test execution to .github/workflows/validate-task.yml via uvx.
• Relocate script tests to scripts/tests/ and update import paths, .gitattributes/.editorconfig pins, and prose/skill documentation references accordingly.
• Update spec/governance docs and refactor Python utilities (e.g., spec/audit.py) to satisfy lint/type rules; add spec/fidelity_honesty.py for fleet divergence reporting.

Reviewed changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
TODO.md	Updates a prose reference to reflect the new scripts/tests/ layout.
spec/validate.py	Renames loop variable in error printing for lint cleanliness.
spec/project-types.json	Updates coverage/Codecov contract wording for the scripts profile.
spec/host-tools.json	Updates host tooling note and Python floor rationale to reflect CI running Python tooling.
spec/fidelity_honesty.py	Adds a new fleet “fidelity-honesty” analysis/report generator script.
spec/audit.py	Refactors for ruff cleanliness (e.g., check=False, pairwise, tuple startswith).
scripts/tests/test_skills_install.py	Moves/updates tests and adjusts imports for new scripts/tests/ location.
scripts/tests/test_repo_gate.py	Moves/updates tests and adjusts repo-root calculations/imports.
scripts/tests/test_prose_lint.py	Moves/updates tests and adjusts repo-root calculations/imports.
scripts/tests/test_pr_review.py	Moves/updates tests and refactors context manager usage; adjusts imports.
scripts/tests/test_host_gate.py	Moves/updates tests and fixes sys.path injection for new location.
scripts/tests/test_build_dist.py	Moves/updates tests and adjusts imports for new scripts/tests/ location.
scripts/tests/test_bootstrap.py	Moves/updates tests and adds typing annotation to satisfy lint/type rules.
scripts/skills_install.py	Adds check=False to subprocess calls for explicit behavior and lint cleanliness.
scripts/repo_gate.py	Adds check=False to subprocess calls for explicit behavior and lint cleanliness.
scripts/README.md	Documents the new naming/layout split and updates test invocation examples.
scripts/prose_lint.py	Adds check=False and refactors string construction for lint cleanliness.
scripts/pr_review.py	Adds check=False, refactors parsing logic, and tightens boolean checks for lint/type rules.
scripts/host_gate.py	Adds check=False and simplifies conditional structure for lint cleanliness.
OPERATIONS.md	Updates the local verification runbook to match the new CI Python tooling and test layout.
host-setup/windows/README.md	Updates references to the bootstrap self-test path under scripts/tests/.
host-setup/README.md	Updates references to the bootstrap self-test path under scripts/tests/.
host-setup/agent-safety/test_install.py	Removes an import noqa and adds check=False to subprocess calls; updates behavior.
host-setup/agent-safety/install.py	Adds check=False, removes the Python version guard, and updates UTC stamping.
host-setup/agent-safety/gh-write-guard.py	Adds check=False and scopes broad exception handling with rationale comments.
GOVERNANCE.md	Notes scripts/tests/ as the home for unit tests in the repo layout section.
docs/fleet-map.md	Updates closing-test references to point at scripts/tests/....
CODESTYLE.md	Updates shell guidance to reference the scripts tree’s tests/ directory.
.github/workflows/validate-task.yml	Adds uvx-driven ruff/mypy and coverage-based self-test execution in CI.
.gitattributes	Updates LF pin entries to point at moved tests under scripts/tests/.
.editorconfig	Updates Python script LF pin section to include scripts/tests/ via scripts/**.py.
.claude-plugin/fleet-skills/skills/skill-lifecycle/SKILL.md	Updates references to moved tests under scripts/tests/.
.claude-plugin/fleet-skills/skills/shell-codestyle/SKILL.md	Updates guidance to reference tests living under <scripts-dir>/tests/.
.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md	Updates Scripts-profile rules to require CI Python tooling + coverage and new tests layout.
.claude-plugin/fleet-skills/.source-digest	Updates the generated digest after regenerating the plugin tree.
.agents/skills/skill-lifecycle/SKILL.md	Updates references to moved tests under scripts/tests/.
.agents/skills/shell-codestyle/SKILL.md	Updates guidance to reference tests living under <scripts-dir>/tests/.
.agents/skills/python-codestyle/SKILL.md	Updates Scripts-profile rules to require CI Python tooling + coverage and new tests layout.

Suppressed comments (6)

scripts/tests/test_repo_gate.py:24

• The sys.path.insert(...) followed by a module import triggers ruff E402 (module level import not at top of file) with the repo’s default ruff rules. Add # noqa: E402 to the late import (or refactor to avoid it) so ruff check . passes.
  scripts/tests/test_prose_lint.py:25
• The sys.path.insert(...) followed by a module import triggers ruff E402 (module level import not at top of file) with the repo’s default ruff rules. Add # noqa: E402 to the late import (or refactor to avoid it) so ruff check . passes.
  scripts/tests/test_pr_review.py:26
• The sys.path.insert(...) followed by a module import triggers ruff E402 (module level import not at top of file) with the repo’s default ruff rules. Add # noqa: E402 to the late import (or refactor to avoid it) so ruff check . passes.
  scripts/tests/test_host_gate.py:18
• The sys.path.insert(...) followed by a module import triggers ruff E402 (module level import not at top of file) with the repo’s default ruff rules. Add # noqa: E402 to the late import (or refactor to avoid it) so ruff check . passes.
  scripts/tests/test_build_dist.py:14
• The sys.path.insert(...) followed by a module import triggers ruff E402 (module level import not at top of file) with the repo’s default ruff rules. Add # noqa: E402 to the late import (or refactor to avoid it) so ruff check . passes.
  scripts/tests/test_skills_install.py:18
• The sys.path.insert(...) followed by a module import triggers ruff E402 (module level import not at top of file) with the repo’s default ruff rules. Add # noqa: E402 to the late import (or refactor to avoid it) so ruff check . passes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ptr727]

Answering the six suppressed low-confidence findings, which share one claim: that sys.path.insert followed by a module import in the moved scripts/tests/test_*.py files triggers ruff E402 under the repo's default rules, so the imports need # noqa: E402.

Declined as a class: E402 is not enabled at this repo's configured contract (ruff latest defaults plus extend-select = ["I"]). This PR demonstrates that twice. RUF100 removed the one pre-existing # noqa: E402 in host-setup/agent-safety/test_install.py as an unused directive explicitly marked non-enabled: E402, and the new Lint Python step runs uvx ruff@latest check . and passes on both pushed heads with no noqa on any of the six imports.

[Copilot]

Pull request overview

Copilot reviewed 37 out of 38 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/validate-task.yml:108

• This comment is now misleading: the step runs tooling via uvx (coverage, and earlier ruff/mypy), so it’s not accurate to say there’s “no dependency to pin”. If the intent is “repo code is stdlib-only and CI uses uvx so there’s no project install step / manual pins”, clarify that to match the new behavior.

      # Each gate here is proven by a case that reintroduces the fault it catches, wherever it lives.
      # A test sits with the layer that owns it rather than beside the file it names, so a read-only gate over the spec and the host tooling lives in scripts/tests/ even where its subject is shell, and the agent-safety kit carries its own because it ships as a unit.
      # Standard library only, so no install step and no dependency to pin.
      # The audit engine self-test is offline, so it runs here rather than only on an owner sweep.

[ptr727]

Answering the round-2 suppressed finding on .github/workflows/validate-task.yml (the "no install step and no dependency to pin" comment reading as misleading once the step runs uvx coverage): accepted and fixed in b5f1e2b. The comment now narrows the standard-library claim to the tests and names uvx coverage at its unpinned latest as the one tool the step fetches.

[Copilot]

Pull request overview

Copilot reviewed 37 out of 38 changed files in this pull request and generated no new comments.