fix(ci): publish quant engine lite verification (#1)

tests/governance/test_ci_contract.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class CiContractTests(unittest.TestCase):
+    def test_ci_is_one_dependency_free_lite_gate(self) -> None:
+        workflow = (ROOT / ".gitea/workflows/ci.yml").read_text(encoding="utf-8")
+        jobs = workflow.split("jobs:", 1)[1]
+        self.assertEqual(re.findall(r"(?m)^  ([a-z][a-z0-9_-]*):\s*$", jobs), ["lite"])
+        self.assertIn("actions/checkout@524e936cd9e579adf00e308bfdf971aebc7de09e", workflow)
+        self.assertIn("persist-credentials: false", workflow)
+        self.assertIn("python3 tests/governance/test_module_spec.py", workflow)
+        for forbidden in ("setup-python", "pip ", "curl ", "wget ", "docker pull"):
+            self.assertNotIn(forbidden, workflow)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/governance/test_module_spec.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import json
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class ModuleSpecTests(unittest.TestCase):
+    def test_module_spec_declares_pure_research_engine_boundary(self) -> None:
+        spec = json.loads((ROOT / "MODULE_SPEC.yaml").read_text(encoding="utf-8"))
+        self.assertEqual(spec["module_id"], "quant_engine")
+        self.assertEqual(spec["authority"]["subject"], spec["module_id"])
+        self.assertEqual(spec["repository"]["type"], "research_engine")
+        self.assertEqual(spec["bounded_context"]["domain"], "quantitative-research-engine")
+        prohibited = " ".join(spec["bounded_context"]["prohibited_responsibilities"]).lower()
+        for term in ("investment advice", "live order", "credentials", "source facts"):
+            self.assertIn(term, prohibited)
+        self.assertEqual(spec["contracts"], {"provides": [], "consumes": []})
+        self.assertEqual(spec["dependencies"], [])
+        self.assertTrue(
+            all(
+                command["required"] and not command["network"]
+                for command in spec["verification"]["commands"]
+            )
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()