[quantamixsol]

Bring public CI to parity with private — ceiling 37 → 5

Ports CR-CI-001 Phases 2, 3 and 4 plus CR-B in one step. Public had never received any of them: 37 --ignore flags and no ceiling guard, against private's 5 flags with the guard.

	lands here
Phase 2	14 stale flags removed
Phase 3	11 files converted to named skips (10 patent stubs + 1 Ollama)
Phase 4	7 genuinely-failing files fixed
CR-B	release gate fails closed (fallback WARN → BLOCK)
#360, #361	the two hotfixes that followed CR-B

Net: 37 → 5 flags, and the ceiling guard now exists here at MAX=5. MAX ratchets down — a phase that removes flags drops it in the same commit, so no silent gap opens for regrowth.

The remaining 5 match private exactly: test_phase3, test_manager, test_mcp_server (order-dependent, pass alone), plus test_no_internal_strings (issue #358) and test_chat_02_intent_hint (issue #357).

---

Verified against CI's actual dependency versions

The recent CI red on the private line came from verifying against local deps: click 8.3.1 had CliRunner.isolated_filesystem, CI's click 8.5.0 did not, and the suite passed locally while failing there.

This port was verified in a venv resolving the same versions CI resolves — click 8.5.0, typer 0.27.2, isolated_filesystem absent — rather than whatever happened to be installed.

Two files the commit-derived scope missed, found only by that verification

test_02_g2_release_gate.py — needed the #361 fix, which accepts BLOCK as a fail-closed signal. CR-B's engine now returns exactly that. Porting the engine without it would have shipped a known-failing test.

test_cg_14_config_drift.py — public carried an older copy asserting CG-14_UNKNOWN_FILE where the handler returns CG-14_RUNTIME. It passes on private and was hidden behind an --ignore here, so removing that flag exposed it.

Neither appeared in the diff of the four feature commits. Both were found by running the full suite after the flags came off — which is the argument for doing the reduction and the verification together rather than in separate PRs.

---

Verification

• Ceiling guard, run as CI runs it: count=5 MAX=5 PASS. YAML valid.
• Full suite under CI-matched versions, set-difference of failure lists:

	result
base (origin/master, its own 37-flag list)	22 failed / 8700 passed
branch (new 5-flag list)	21 failed / 8715 passed
regression direction	EMPTY

15 more tests run, one base failure no longer fails, and no new failure introduced.

Gates: ip-content-gate PASS (24 paths) · trade-secret-wheel-gate PASS · lint-imports 1 kept, 0 broken. The two TS-scan hits are CR-B's own prohibition text — "never contains internal threshold values, weights, or compose logic" — the policy being stated, not violated.

---

After this merges

Public reaches parity with private, which is the precondition for tagging 0.85.0 as the CI-and-tooling release Research approved. That release carries no DAG content, so it is unaffected by the open Group S continuation decision.

🤖 Generated with Claude Code

[github-actions]

🛡️ GraQle PR Guardian

💥 Blast Radius: 24 modules affected

Module	Files Changed	Risk Level	Impact Radius
.github	1	🟡 T2	1
graqle	1	🟡 T2	1
tests	22	🟠 T3	22

Total blast radius: 24

---

🏛️ Governance Verdict

🚫 FAIL

• T3: 1 file(s) require explicit approval.

---

🔍 SHACL Violations

No SHACL violations detected. ✅

---

🔐 Approval Requirements

This PR requires approval from: T3

• A registered Tech Lead or Governance Admin must approve.

❌ Approval requirement NOT yet satisfied.

---

Metric	Value
Blast Radius	24
Files Analyzed	24
Blocked	1
SHACL Violations	0
Verdict	FAIL

---

_{🔬 Powered by GraQle PR Guardian v0.1.0 · Scan completed 2026-09-26T19:33:11.785156+00:00}