project-work/worker-toolkit-stocks-in-the-future/task-shared/test-commands.toml

# Per-repo deterministic-signal checks for the grader.
#
# tests/test.sh runs these against the workspace after the agent's changes and
# feeds the output to the grader to inform the correctness score. A repo with no
# entry gets no signals.
#
# Schema: one [<repo>] table (optional: notes, memory_mb, setup) then one
# [[<repo>.checks]] per check (name, cmd, optional baseline_known_failures).
# cmd runs from the workspace root; a non-zero exit is a signal, not an error.
# Browser E2E is excluded everywhere (flaky). confidence: validated | derived |
# inferred | none.
#
# Checks run inside the task's `memory_mb` container. test.sh sizes Node's heap to
# it and exports RACCOON_CHECK_WORKERS (the cpu quota) plus the VITEST_* pool vars;
# jest reads no env var, so a jest cmd must pass --maxWorkers itself.

# confidence: validated
[Palolo-031]
notes = "TS Node20/pnpm8 vitest monorepo (Prisma+Postgres)"
memory_mb = 8192
setup = "cd packages/server && pnpm run prisma generate"

[[Palolo-031.checks]]
name = "vitest (monorepo, all packages)"
cmd = "TZ=UTC PUBLIC_BAAS_ENABLED=yes DEFAULT_BAAS_PROVIDER=Liquid pnpm run test --run --testTimeout=30000 --hookTimeout=60000"

[[Palolo-031.checks]]
name = "eslint"
# Per package, not one pass over the monorepo: `projectService: true` makes a single
# process hold type-aware programs for every package at once, which no heap cap fits.
# Same 906 files (packages/* is the whole lint surface). The find guard skips
# packages with no TS sources, where eslint exits 2 — also its fatal-config code.
cmd = "rc=0; for d in packages/*/; do [ -z \"$(find \"$d\" -path '*/node_modules' -prune -o \\( -name '*.ts' -o -name '*.tsx' -o -name '*.mts' -o -name '*.cts' \\) -print -quit)\" ] && continue; pnpm run lint \"$d\" || rc=1; done; exit $rc"

[[Palolo-031.checks]]
name = "tsc typecheck (all packages)"
cmd = "pnpm run types"

# confidence: validated
[ZenBill-006]
notes = "Polyglot Rails 7 (RSpec) + React (Jest)"
memory_mb = 8192

[[ZenBill-006.checks]]
name = "rspec"
cmd = "DATABASE_URL=postgresql://postgres:secret_password@localhost:5432/r_test DATABASE_CLEANER_ALLOW_REMOTE_DATABASE_URL=true RAILS_ENV=test bundle exec rspec --exclude-pattern 'spec/{system,integrations}/**/*,spec/services/plaid_service_spec.rb'"

[[ZenBill-006.checks]]
name = "jest"
# The heaviest check we have (134 jsdom suites, ~3.8 GB however it is run) and the
# one with the least margin at 4 GiB. --runInBand is deliberate: --maxWorkers is the
# right lever elsewhere, but here it makes jest hang once the last suite passes.
cmd = "TZ=UTC npx jest --runInBand"

# confidence: validated
[zeta-platform]
notes = "Polyglot Rails 5.1/Ruby 2.6.6 RSpec backend + in-repo CRA(react-scripts 2.1.1)/Jest frontend at /workspace root"

[[zeta-platform.checks]]
name = "rspec"
cmd = "bundle exec rspec"

[[zeta-platform.checks]]
name = "jest-frontend"
cmd = "CI=true NODE_OPTIONS=--openssl-legacy-provider yarn test"

# confidence: validated
[human-essentials]
notes = "Rails 8.0 + RSpec (Ruby 3.4.3, Postgres diaper_test @ en_US.UTF-8)"

[[human-essentials.checks]]
name = "rspec"
cmd = "RAILS_ENV=test PG_HOST=localhost PG_USERNAME=postgres bundle exec rspec --exclude-pattern 'spec/system/**/*'"

# confidence: validated
[endsideout]
notes = "Rails 8.1 / Ruby 4.0.0, Minitest + SQLite (no DB service — file-backed)"

[[endsideout.checks]]
name = "minitest"
cmd = "RAILS_ENV=test bin/rails db:test:prepare && RAILS_ENV=test bin/rails test"

# confidence: validated
[community-foundation]
notes = "Rails 8.1 / Ruby 4.0.2 + Minitest + SQLite (no DB service"

[[community-foundation.checks]]
name = "minitest"
cmd = "bin/rails db:test:prepare && bin/rails test"

# confidence: validated
[stocks-in-the-future]
notes = "Rails 8.1 / Ruby 3.4.4 + Postgres + Redis, Minitest (~733 tests)"

[[stocks-in-the-future.checks]]
name = "minitest"
cmd = "RAILS_ENV=test bin/rails db:test:prepare && bin/rails test"
baseline_known_failures = [
  "Admin::TeachersControllerTest#test_new_shows_classrooms_when_available (test/controllers/admin/teachers_controller_test.rb:143) — pre-existing, time-dependent failure: test hardcodes Year '2025 - 2026' but Admin::TeachersController#new scopes classrooms to the current school year by today's date, so the expected classroom isn't shown. Latent app-side time-bomb, not an env defect; documented in overview.md.",
  "ClassroomsControllerTest#test_create (test/controllers/classrooms_controller_test.rb:30) — pre-existing app-side flake that surfaces ONLY under parallel workers: a FactoryBot global sequence(:level) collides with a hardcoded create(:grade, level: 7) ('Level has already been taken'). Passes serially (PARALLEL_WORKERS=1). Not an env defect; runtime-observed 2026-07-14.",
]

# confidence: validated
[casa]
notes = "Rails 8.0 / Ruby 4.0.3 + RSpec, Node 24 (esbuild+sass), Postgres"
setup = "RAILS_ENV=test bin/rails db:test:prepare"

[[casa.checks]]
name = "rspec"
cmd = "RAILS_ENV=test RUBYOPT='-W:no-deprecated -W:no-experimental' bundle exec rspec --exclude-pattern 'spec/system/**/*'"

[[casa.checks]]
name = "lint-js"
cmd = "npm run lint"

# confidence: validated
[awbw]
notes = "Rails 8.1 / Ruby 4.0.1 + RSpec on real MySQL 8 (Percona) via Trilogy"
setup = "RAILS_ENV=test DATABASE_URL=trilogy://root@127.0.0.1:3306 bin/rails db:test:prepare"

[[awbw.checks]]
name = "rspec"
cmd = "RAILS_ENV=test DATABASE_URL=trilogy://root@127.0.0.1:3306 bundle exec rspec --exclude-pattern 'spec/system/**/*'"
baseline_known_failures = [
  "Events::PublicRegistrations GET new 'renders a structured details panel from known event data when enabled' (spec/requests/events/public_registrations_spec.rb:253) and 'pluralizes the date and time labels for a multi-day event' (:273) \u2014 pre-existing, time-dependent failures: both specs hardcode a July 2026 event (start 2026-07-23, end 2026-07-24) and Event#registerable? is `!ended? && ...`, so now that end_date has passed ensure_registerable redirects and response.body is empty (expected \"\" to include \"Platform:\" / \"Dates:\"). Latent app-side time-bomb, began failing 2026-07-25; not an env defect. Runtime-observed 2026-08-07: 4292 examples, 2 failures, identical with and without the setup step.",
]

# confidence: validated
[flaredown]
notes = "Rails 7.1 API (Ruby 3.2.3), Mongoid 8.1 on MongoDB 7.0 + Postgres + Redis + Sidekiq. The app lives in backend/ (not the repo root), so the check cd's into it. The harbor Dockerfile's start-services.sh starts all three datastores, creates flaredown_development/flaredown_test, and loads the Postgres schema for both envs; backend/.env is materialized from env-example with PG host rewritten to localhost. Mongoid creates collections lazily (no schema to load). Browser/acceptance specs are excluded — Ember `ember test` needs a browser on PATH (phantomjs up to pin 5f859e8d, headless Chrome via CHROME_BIN from b0605ff3; neither is installed) and is bad grader signal anyway; the rspec verifier touches neither the client nor a running server. [Runtime-validated 2026-08-04 in the harbor image built from Dockerfile.flaredown @ pin b0605ff3]: 315 examples, 0 failures (~7s, 96.08% coverage) — clean, so no baseline is declared. Unchanged from the earlier validation at pin 5f859e8d (2026-07-20, same 315/0/96%); the only backend change across that pin advance is backend/lib/tasks/app.rake."

[[flaredown.checks]]
name = "rspec"
cmd = "cd backend && RAILS_ENV=test bundle exec rspec --exclude-pattern 'spec/system/**/*'"

# confidence: none
[alongwithyou]
notes = "Rails 8.1 / Ruby 4.0.5, Minitest + SQLite (file-backed, no DB service). This is a fresh scaffold being built with the Dewberry Cancer Center — at the current pin (a017fd43, a single 'First' commit; upstream main has not advanced past it as of 2026-07-20) it ships 0 test files (no *_test.rb), only the ApplicationRecord base class (no domain models), no migrations, no db/schema.rb, and a default routes.rb (just the /up health check), so `bin/rails test` collects 0 examples and there is no deterministic correctness signal to gate on. Grader scores correctness from the code + transcript directly, which is correct for an empty scaffold. When real Minitest coverage lands upstream and the pin is bumped, add a `minitest` check like endsideout's (`RAILS_ENV=test bin/rails db:test:prepare && RAILS_ENV=test bin/rails test`)."
# no static verifier for this repo — no deterministic signals (0 tests / stubs / placeholder / live-external).

# confidence: validated
[zeta-heimdall]
notes = "Rails 7 API-only (Ruby 3.2.1), Postgres-only, no Node → RSpec is the only suite"

[[zeta-heimdall.checks]]
name = "rspec"
cmd = "RAILS_ENV=test bundle exec rspec --exclude-pattern 'spec/system/**/*'"

# confidence: none
[zeta-hiddentemple]
notes = "Rails + Postgres (ruby:3.2.1)"

# confidence: none
[zeta-switchboard]
notes = "Ruby 3.2.1 CLI/lib"

# confidence: validated
[zeta-hook]
notes = "Rails (ruby:3.1.2), Postgres+Sidekiq/Redis, Kafka not run"

[[zeta-hook.checks]]
name = "rspec"
cmd = "RAILS_ENV=test bundle exec rspec --exclude-pattern 'spec/system/**/*'"
baseline_known_failures = [
  "1 pre-existing app-side failure at 2237a90e9 (incoming_hook 'SOURCES' spec); the 17-example suite otherwise passes. Runtime-observed 2026-07-14.",
]

# confidence: validated
[zeta-mule-deprecated]
notes = "Rails + Postgres + Redis (ruby:3.1.2)"

[[zeta-mule-deprecated.checks]]
name = "rspec"
cmd = "RAILS_ENV=test bundle exec rspec --exclude-pattern 'spec/system/**/*'"

# confidence: none
[zeta-hive]
notes = "Rails + RSpec (postgres+redis), ruby 3.2.2"

# confidence: validated
[zeta-px-api]
notes = "Rails (Ruby 3.2.2) + postgres/redis"

[[zeta-px-api.checks]]
name = "rspec"
cmd = "RAILS_ENV=test DEV_DB_USERNAME=postgres bundle exec rspec --exclude-pattern 'spec/system/**/*'"
baseline_known_failures = [
  "8 pre-existing app-side spec failures of 29 examples at 2ce2501a6 (spec-vs-code drift, e.g. users_controller expects 403 but the controller returns 401). Runtime-observed 2026-07-14; not an env defect.",
]

# confidence: none
[zeta-plastic]
notes = "Rails + postgres (ruby:3.2.2)"

# confidence: none
[zeta-bureau]
notes = "Rails + Postgres backend (ruby:3.2.2)"

# confidence: none
[zeta-wasabi-platform]
notes = "Rails 3.2.2/postgres+redis app, RSpec suite (grader guidance runs `bundle exec rspec` on spec/models,graphql,services"

# confidence: none
[zeta-jc-loadtester]
notes = "Ruby 3.2.2 CLI/lib"

# confidence: validated
[zeta-wasabi-web]
notes = "CRA/react-scripts frontend (yarn, node-sass), node:16, no DB/services"

[[zeta-wasabi-web.checks]]
name = "jest (react-scripts test)"
cmd = "CI=true yarn test"
baseline_known_failures = [
  "src/auth/tests/Onboarding.spec.js — 2 pre-existing app-side assertion failures at d290ac65f; the react-scripts suite otherwise runs clean. Runtime-observed 2026-07-14.",
]

# confidence: none
[zeta-bureau-ui]
notes = "Create-React-App frontend, Node 16, plain JS (no TS)"

# confidence: validated
[zeta-jarvis]
notes = "CRA TypeScript frontend (node:16, yarn, CI=true baked into ENV, no DB/services per Dockerfile)"

[[zeta-jarvis.checks]]
name = "typecheck"
cmd = "yarn tsc --noEmit"

# confidence: none
[zeta-content-hub]
notes = "Gatsby static site on node:16, deps via yarn (frozen lockfile), no DB/services"

# confidence: none
[zeta-blog]
notes = "Gatsby static blog (node:14-bullseye)"

# confidence: none
[zeta-wasabi-next]
notes = "Next.js app (Node 19), no DB/services"

# confidence: none
[zeta-web-code-challenge]
notes = "Next.js (node:18) coding-challenge app, no DB/services"

# confidence: none
[zeta-wasabi-mobile-bare]
notes = "React Native app on node:18, yarn + Jest (Dockerfile: \"Jest tests"

# confidence: none
[zeta-cx-chatbot]
notes = "Python 3.10.12 Flask CX chatbot, poetry-managed (virtualenvs.create false, poetry install --no-root) per Dockerfile"

# confidence: none
[zeta-agent-tools]
notes = "Python 3.10.12 agent-tools library"

# confidence: none
[zeta-agent-tool-kb-search]
notes = "Python 3.10.12 lib (KB-search agent tool)"

# confidence: none
[zeta-agent-tool-bill-goal-ledgers]
notes = "Python 3.10.12 poetry lib (langchain/langgraph agent tool)"

# confidence: none
[zeta-compiler-agent]
notes = "Python 3.10.12 poetry lib (compiler-agent)"

# confidence: none
[zeta-chatbot-embeddings]
notes = "Python 3.10.12 poetry package (cx-chatbot embeddings ETL: chromadb/langchain/openai)"

# confidence: none
[zeta-predictors]
notes = "Python 3.10.12 ML package (zeta_ds), installed via `pip install .`"

# confidence: none
[zeta-transaction-anomalies-ml]
notes = "Python 3.10.12 ML repo (transaction-anomaly notebooks + SQL)"

# confidence: none
[zeta-dbt]
notes = "Python 3.10.12 dbt project targeting external Snowflake"

# ---- speedwell-polyglot (StrongSuit / Speedwell) gradable Node members ----

# confidence: validated
[strongsuit-app]
notes = "Remix + Prisma + Postgres, Node 20, vitest (tests/unit/**, DB-free). `npx tsc --noEmit` has 1 pre-existing type error (a CSS-import href typing), so it's not used as a check."

[[strongsuit-app.checks]]
name = "vitest (tests/unit)"
cmd = "npx vitest run"

# confidence: validated
[strongsuit-client]
notes = "React/razzle SSR, Node 16, jest (jsdom, DB-free). The pin carries a clean baseline: 59/59 suites, 389 passed, 8 skipped, 0 failures — the 8 pre-existing submit failures are skipped in-file at the pin rather than parked as known failures. A dummy browserVars.js is committed at the pin (the suite imports TINY_API_KEY from it)."

[[strongsuit-client.checks]]
name = "jest (razzle test --env=jsdom)"
# Without --maxWorkers, jest forks to the HOST's cpu count and fills a 4 GiB container.
cmd = "CI=true npm test -- --maxWorkers=\"${RACCOON_CHECK_WORKERS:-2}\""

# confidence: validated
[strongsuit-server]
notes = "Express + MongoDB API, Node 16, jest. The sole test file mocks the model and never opens a Mongo connection, so the verifier is unit-only and needs no DB. Pin includes the notification-template file rename so the suite loads."

[[strongsuit-server.checks]]
name = "jest"
cmd = "npm test"

# ---- speedwell-polyglot: the remaining members ----
# A repo with no (or a currently-unrunnable) suite is still gradable — behavioral-rating tasks
# score from the rubric — so each ships a Dockerfile.<member>; those without a usable suite get
# a notes-only entry (the zeta-ada / zeta-dbt pattern) rather than a check that always fails.

# confidence: none — the suite runs clean at the pin, but its only test is skipped, so there is no signal to check
[speedwell-react]
notes = "Create React App (react-scripts 2.1.2) agenda client on Node 16. The pin carries a clean baseline (`CI=true react-scripts test` exits 0): a committed axios manual mock works around axios 1.x shipping ESM that this react-scripts' bundled Jest can't transform, and the one CRA smoke test is skipped in-file. A suite whose only test is skipped gives no deterministic signal, so no check is declared — `npm run build` is the meaningful mechanical check, and tasks are gradable via the rubric."

# ---- speedwell-polyglot: the remaining members ----
# NONE of these has a test suite, so every entry is notes-only: no deterministic-signal check. That
# is deliberate — a repo with no suite is still gradable (behavioral-rating tasks score from the
# rubric), and inventing a check that always fails would be worse than none. Runtime-verified: every
# image below builds, and ships the `claude` CLI, python3 >=3.10 for str_replace_editor, and a
# baseline commit.

# confidence: none
[strongsuit-chrome-extension]
notes = "Browser extension (WXT-style entrypoints/ + lib/, Jotai state), Node 20 per its own .nvmrc, npm. 169 commits — the most actively developed non-core repo in the estate. No test suite."

# confidence: none
[speedwell-agenda-builder]
notes = "Create React App agenda builder on Firebase/Firestore, era-matched Node 14 (react-scripts 3.0.1 / react 16.8 pre-date modern Node's OpenSSL). Ships firestore.rules + indexes, so the security rules are part of the task surface. No test suite. Dep install is non-fatal: firebase 6.x pulls grpc@1.20.3, which has no prebuilt binary for node 14 on arm64 and falls back to a node-gyp source compile that fails there (it may install on an x86_64 runner)."

# confidence: none
[speedwell-node-a2g-sync]
notes = "Node 20 sync service (server.js + src/), yarn. No test suite."

# confidence: none
[hello-sunshine]
notes = "Botkit/MongoDB example bot app. package.json declares engines.node 8.x, but no node:8 image exists on a supported Debian base (Node 8 EOL 2019), so it runs on the closest workable base. Dep install is non-fatal — the era-old bson/mongodb set may want native rebuilds. No test suite."

# confidence: none
[strongsuit-zingle]
notes = "Zingle -> Airtable integration script, Node 20, npm. No test suite."

# confidence: none
[strongsuit-member-feedback-to-airtable]
notes = "Typeform -> Airtable member-feedback integration, Node 20, npm. No test suite."

# confidence: none
[strongsuit-assistant-chrome-plugin]
notes = "Assistant Chrome plugin (vanilla JS + HTML), Node 20, npm. No test suite."

# confidence: none
[strongsuit-assets]
notes = "Shared HTML asset/template set (~3.8k lines across 24 templates), Node 20. Has a package.json but no committed lockfile, so the install is best-effort npm rather than the default frozen-lockfile yarn; the templates are the substrate, not the deps. No test suite."

# confidence: none
[strongsuit-chrome-extension-OG]
notes = "The original (superseded) Chrome extension, vanilla JS, ~1.4k lines. No package.json at all, so the dep step is a no-op by design. No test suite."

# confidence: none
[strongsuit-arial]
notes = "Python 3.10 Gmail/storage/task scripts deployed to App Engine. requirements.txt dates from 2020 (there are dated siblings, requirements-10202020.txt etc.), so the install is non-fatal; the scripts plus a working python3 are the substrate. No test suite."
# confidence: validated — `go build ./...` clean and `go test ./...` -> ok jobs/tests, run in the
# real harbor image (golang:1.22) via the grader's own `bash -lc` invocation.
[jobs]
notes = "Go 1.22 jobs/handler service, no external services. The image pre-downloads modules and puts /usr/local/go/bin on the LOGIN-shell PATH (tests/test.sh runs each check with `bash -lc`, which resets PATH and would otherwise lose `go`). The pin restores the generic word \"jobs\", which the vendor's anonymizer had replaced with an invalid Go identifier."

[[jobs.checks]]
name = "go test"
cmd = "go test ./..."

# confidence: validated — both checks run clean in the real harbor image (terraform 1.9.8):
# `terraform validate` -> "Success! The configuration is valid." and `fmt -check` is clean at the pin.
[terraform]
notes = "GCP infrastructure-as-code (network / firewall / datastream / cron). No test suite, but terraform itself supplies real deterministic signals: the image pre-fetches the pinned hashicorp/google 5.29.0 provider via `terraform init -backend=false` at build time, so validate works in the sandbox. Variables (pg_pass, GOOGLE_CREDENTIALS, stripe/cron/customerio keys) are declared without defaults, so validate is meaningful while plan/apply would need credentials that are deliberately absent."

[[terraform.checks]]
name = "terraform validate"
cmd = "terraform validate"

[[terraform.checks]]
name = "terraform fmt (check)"
cmd = "terraform fmt -check -recursive"

# confidence: validated — 33 tests, 0 failures, 1 skipped in the real harbor image (elixir:1.17 +
# Postgres), run through the grader's own `bash -lc`.
[strongsuit_phx]
notes = "Phoenix/Elixir + Postgres, ExUnit. The repo's `test` alias runs ecto.create + ecto.migrate, so the suite provisions its own database against the baked Postgres (config/test.exs points at database \"postgres\" on localhost, which trust auth accepts). The pin makes this work from scratch: Elixir-valid module aliases, two migrations made safe on an empty database, and a test_helper seed for the system user / person / family rows that exist in deployed environments but not in a fresh DB. One test is skipped in-file — delete_cronofy_account/1 revokes against Cronofy's live API and can't pass without real credentials."

[[strongsuit_phx.checks]]
name = "ExUnit (mix test)"
cmd = "mix test"

# confidence: none
[strongsuit-platform]
notes = "Python 3.10 platform/ops scripts (data migrations, CSV dumps, demo-user seeding). No test suite, so no deterministic-signal check — gradable for rubric-scored tasks over the scripts themselves. Runtime-verified: the image ships the source + a working python3 3.10 and the `claude` CLI, but the repo's own deps are NOT installed: requirements.txt pins numpy==1.20.1, which has no python-3.10 wheel (3.10 support arrived in numpy 1.21.3) and fails to build from source without a Fortran toolchain. The install is therefore non-fatal by design. A task that needs those libraries must install/relax them itself; the pinned deps only drive scripts talking to MongoDB/GCS, which are unreachable in a sandbox regardless."

# confidence: validated
[rust-defrag]
notes = "Cargo workspace (Actix server + move_finder/scheduler libs); 232+ tests, no DB. Placeholder JWT public pems committed at pin (include_str! requires them)."
memory_mb = 8192

[[rust-defrag.checks]]
name = "cargo test (workspace)"
cmd = "cargo test --workspace"

# confidence: validated
[cql-v2]
notes = "Poetry-backend pyproject (package dir cql/; include + scripts fixed at pin). freezegun is a test dep."

[[cql-v2.checks]]
name = "pytest"
cmd = "python -m pytest -q"

# confidence: validated
[preference-schedule-demo]
notes = "FastAPI scheduler; suite lives under server/ (pytest.ini testpaths=tests)"

[[preference-schedule-demo.checks]]
name = "pytest (server/)"
cmd = "cd server && python -m pytest -q"

# confidence: validated
[defrag-powers-of-ten]
notes = "Vite/vitest visualization over scrubbed defrag fixtures (test mocks de-collapsed at pin; the li-tag restoration also fixed vite build)."

[[defrag-powers-of-ten.checks]]
name = "vitest"
cmd = "npx vitest run"

# confidence: validated
[dbt]
notes = "dbt models target Snowflake (no in-sandbox run), but the event-classification helper scripts ship a real pytest suite (17 tests, dep-free)."

[[dbt.checks]]
name = "pytest (scripts/)"
cmd = "python -m pytest scripts/ -q"

# confidence: validated
[python-analysis]
notes = "The swagger services_client ships 794 generated-model pytest tests that pass offline; run from services_client/ so `import swagger_client` resolves. Deps (six/urllib3/certifi/dateutil/requests + pytest) are baked into the image."

[[python-analysis.checks]]
name = "pytest (services_client)"
cmd = "cd services_client && python -m pytest test/ -q"

# confidence: validated
[interpreter_interview]
notes = "Custom TS interpreter with an assertion suite; lib/ is gitignored so build first."

[[interpreter_interview.checks]]
name = "build + node ./lib/tests"
cmd = "npm run build && npm test"
[jwt-encryption-decryption]
notes = "Standalone Spring utility (no DB at context load); mvn test passes offline. Most sibling services' contextLoads need live services — promote per-task after validating."

[[jwt-encryption-decryption.checks]]
name = "mvn test"
cmd = "mvn -B test"
# ---- potion-polyglot (Potion) ----
# 52 members. Only the entries below have deterministic checks or notes worth recording;
# the rest have no inherited suite and are rubric-scored, which is a first-class outcome
# here rather than a gap — a member with no tests is still gradable because the worker
# authors the verifier alongside the task.

# confidence: validated
[potion-app]
notes = "Nuxt 2 + Express, Node 16, jest/jsdom. **GREEN at the pin: 13 suites / 27 tests, exit 0.** Getting there took fixing four real harness bugs rather than declaring known failures: dotenv was loading nothing (`.env` is gitignored and absent, so JwtStrategy, analytics-node, aws-sdk and JSON.parse(FIREBASE_CONFIG) all threw at import — the jest setup now points dotenv at the committed `.env.client.development`), `@babel/plugin-proposal-class-properties` was missing from the test env, `global.analytics` did not exist for specs that assign to it, and one spec still imported a component an upstream refactor had moved. Those took the executed-test count from 48 to 76. The suites that remained red are skipped explicitly in `jest.config.js` with the reason: 14 test components that same refactor DELETED, 8 are browser E2E needing Chrome plus a built .crx, 4 crash the jest worker, 1 file has no tests, and the rest assert against markup and store shapes that have drifted. **This member's harbor image runs MongoDB** (services: ['mongo'] in gen-harbor-dockerfiles.ts) because the user and email model suites call mongoose.connect directly — without it they fail on infrastructure and the graded baseline is 5 suites, not 7. [Runtime-validated 2026-08-04 in the harbor image built from Dockerfile.potion-app: mongod 8.0.4 listening, 13 suites / 27 tests, exit 0.]"

[[potion-app.checks]]
name = "vitest/jest unit suites"
# --maxWorkers as above. Not verified at 4 GiB — no image could be built to measure it.
cmd = "npx jest --coverage=false --maxWorkers=\"${RACCOON_CHECK_WORKERS:-2}\""

# confidence: none
[potion-custom-domain-app]
notes = "Nuxt 2 custom-domain app that vendors a copy of potion-app. **Deps do not install** on any Node in the image with default flags: hawk@0.10.2 pins engines to node 0.8.x, and an `emitter` dep resolves to a GitHub http archive whose auto-generated tarball no longer hashes to the lockfile value (GitHub regenerates those non-deterministically, so it never will again). Read-and-edit substrate; a task needing deps must relax those itself."

# confidence: none
[potion-qa]
notes = "Selenium + jest QA automation pointed at a production app that no longer exists, so the suite cannot pass offline and is not a usable verifier. Gradable for rubric-scored tasks over the automation code itself."

# confidence: none
[potion-snapshot-testing]
notes = "Playwright visual-regression suite against the same dead target. Its baseline screenshots were additionally replaced with privacy placeholders (they rendered real names and faces), so image comparisons cannot pass by construction — do not read those failures as a regression."

# confidence: none
[potion-web]
notes = "Nuxt 3 front end, Node 18. No test suite, but `npm run build` is a real deterministic check and it is **GREEN at the pin** (`Server built in ~15s`, Nitro server built, 18.3 MB). It was NOT green before 2026-08-04 and had no check wired, which is how it stayed broken: `pages/privacy-policy.vue` and `pages/terms.vue` import two PDFs the export never shipped (potion-app received placeholders for both; this repo received neither), and the product-name rename had lowercased PascalCase component paths, which vite resolves case-sensitively inside the container — `Could not resolve ./PotionStepper`. Both fixed at the pin. Boots offline with no database and no runtime auth, which also makes it the useful control member when checking that the Explore image itself is sound."

[[potion-web.checks]]
name = "nuxt build"
cmd = "npm run build"

# confidence: none
[potion-api]
notes = "Express API on mongoose 8, Node 20. 12+ jest test files are committed but jest, supertest and sinon were all removed from devDependencies upstream, so the suite cannot run at the pin without reinstating them — deliberately left as-is rather than papered over, since a task may legitimately be about that. The sinon-mocked service suites are DB-free; the Mongo-dependent integration suites are mongoose-5-vs-8 rot. Mongo itself IS available (baked into the Explore image), so a task that wants it has it."

# confidence: none
[potion-wp-site]
notes = "WordPress 5.9.2 checkout whose first-party code is the custom `wp-content/themes/potion` theme (an Automattic _s derivative, 27 PHP files). No test suite; `lint:php` is the deterministic signal and it is **GREEN at the pin** — `Checked 27 files ... No syntax error found`, exit 0. Its Dockerfile is hand-authored (PHP is not a runtime kind the generator knows), and authoring a task against this member surfaced three defects in it that each made the member ungradable — none catchable by the release gate, which only walks the default member: (1) `COPY repo /workspace` while build-workspace.sh materialises `environment/workspace/`, so the build failed with `/repo: not found`; (2) it ASSERTED python3 >=3.10 on the claim that php:8.1-bookworm ships python3.11 — it does not, so the build died exit 127 and the agent`s str_replace_editor would have had no interpreter; (3) `composer install` was best-effort and silently left a half-populated vendor tree, because composer 2 blocks advisory-flagged packages (the theme`s own linter) and aborts a non-interactive install unless phpcodesniffer-composer-installer is explicitly allowed. All three fixed; vendor/bin now has parallel-lint, phpcs and wp. **`lint:wpcs` is deliberately not a check**: it now runs (it used to exit 3 with no standard registered) but reports 114 pre-existing errors + 1 warning across 26 files of first-party theme code, 74 phpcbf-autofixable — inherited style debt, not a correctness signal, and mass-reformatting 26 files to green it would change the substrate more than the signal is worth. A task specifically about WordPress coding standards can re-add `cd wp-content/themes/potion && composer lint:wpcs`. No database is needed to grade; *running* the site would need MySQL plus one of the two committed SQL dumps, which is why the member is not bootable in Explore. [Runtime-validated 2026-08-04 in the harbor image built from Dockerfile.potion-wp-site.]"

[[potion-wp-site.checks]]
name = "php-parallel-lint"
cmd = "cd wp-content/themes/potion && composer lint:php"


# --- Potion members carrying test FILES but no runnable suite -----------------
# Surveyed all 52 members 2026-08-04: 17 match a test-file pattern, but only
# potion-app / potion-web / potion-wp-site have a wired, green check. The entries
# below record why the rest have none, so `build-workspace.sh` reporting "no
# checks" reads as a measured fact rather than a gap someone forgot to fill.

[lambda-video-processing]
notes = "Claudia lambda. Carries `app/services/ffmpeg/__tests__/*_test.js`, but no test runner is installable at the pin: `test` is still the npm placeholder (`echo \"Error: no test specified\" && exit 1`) and jest appears in neither package.json nor the lockfile. The files are orphaned upstream, not a failing suite — there is nothing to run and nothing to skip. Same shape in the five sibling ffmpeg services below."

[microservice-dynamic-screen-recording]
notes = "Same orphaned ffmpeg `__tests__` files and npm placeholder `test` script as lambda-video-processing; no runner in package.json or lockfile."

[microservice-potion-voice]
notes = "Same orphaned ffmpeg `__tests__` files and npm placeholder `test` script as lambda-video-processing; no runner in package.json or lockfile."

[potion-dynamic-screen-recording-lambda]
notes = "Same orphaned ffmpeg `__tests__` files and npm placeholder `test` script as lambda-video-processing; no runner in package.json or lockfile."

[potion-video-processing]
notes = "Same orphaned ffmpeg `__tests__` files and npm placeholder `test` script as lambda-video-processing; no runner in package.json or lockfile."

[potion-video-background-change]
notes = "Same orphaned ffmpeg `__tests__` files and npm placeholder `test` script as lambda-video-processing; no runner in package.json or lockfile."

[potion-voice-dataset]
notes = "Python dataset tooling. `requirements.dev.txt` does declare pytest and `tests/test_get_potion_recordings.py` exists, but the single test it contains has never been executable and cannot be made green without authoring it: it patches `mymodule.boto3.client` (a placeholder module that does not exist in this repo), and its mocked S3 objects omit the `LastModified` key that `select_files` reads first, so it dies on KeyError before reaching an assertion. Completing the fixture does not rescue it — the anonymisation pass rewrote nine distinct S3 object keys, and the assertion's own expected set, to the same `[REDACTED_generic-api-key]` token, so `select_files` counts zero salutation files and the expected value is now a redaction placeholder. Deliberately left as-is: fixing it means writing both the input fixture and the expected output, which is authoring a test rather than repairing a harness."

[lambda-datadog-forwarder]
notes = "Datadog log forwarder. Its only test files live under `future/backports/test/` — that is the vendored `future` package's own test tree, not first-party code. No first-party suite."

[potion-tryon]
notes = "Vendored detectron2 + DensePose inference code. Nothing here is a test suite: `densepose/modeling/test_time_augmentation.py` is the test-time-augmentation module and the `*_test.yaml` files under `detectron2/model_zoo/configs/quick_schedules/` are model configs. Rubric-graded substrate."

[yeahsure-tryon]
notes = "Same vendored detectron2 + DensePose tree as potion-tryon; the `test`-named files are the TTA module and model-zoo configs, not a suite."

[wav2lip-fa]
notes = "Wav2Lip fork. `discriminator_test.py` is an argparse training/eval entry point (it builds an optimizer and a DataLoader), not a unit test. No suite."