AGENTS.md
+44 −21
https://raw.githubusercontent.com/navapbc/rebar/HEAD/AGENTS.md
− `make test` selects exactly what CI's gating `ubuntu-latest, py3.13` cell selects− (`not integration and not external`) — a superset of every other matrix cell — so it is− the locally checkable half of `Verified`, with nothing to enumerate and nothing to drift.− **It costs 20-25 minutes** (measured twice on one six-performance-core host at the default− `PYTEST_WORKERS=4`: 22 min 25 s and 26 min 04 s wall for lint + typecheck + ~19.2k tests --− the spread is host load, so plan for the top of the range; `make test PYTEST_WORKERS=8` on a− bigger box).− **Codex Gerrit workflow rule:** before treating the multi-story feature-branch path as a hard− prerequisite, inspect recent merged Gerrit history and confirm that the configured identity has− `feature-branch-driver` rights. If branch creation is unavailable or rejected, that is not an− implementation blocker: follow the ticket dependency order and send each independently− reviewable change through `git push gerrit HEAD:refs/for/main`, waiting for `LLM-Review +1` and− `Verified +1` before Submit and before advancing to a dependent change. Authorized drivers may− still use the server-side feature-branch flow; see ADR 0025, including its post-ADR-0047 note− that the Rebase-If-Necessary interaction needs human review.− `new>0`**. It exists because 56% of sampled fixes ADD a mechanism against 30% that are pure− logic fixes: each cycle grows the surface that produces the next cycle's defect classes, and− nothing pushed back. The gate does not forbid a new mechanism; it forbids an *unjustified*− one. **Removing** a mechanism always passes (it buckets as `stale`) — that asymmetry is what− makes it a ratchet rather than a freeze. When you genuinely need one, justify it in the tree,− at the definition site:+ `make test` runs exactly the two pytest selections CI's gating `ubuntu-latest, py3.13` cell+ runs, in order — the default tier (`not integration and not external`), then the integration+ tier (`integration and not live`) — a superset of every other matrix cell, so it is the locally+ checkable half of `Verified`. `tests/unit/test_ci_workflow_parity.py` asserts both against+ the workflow, so the two cannot drift silently (bug `a8af-ac33-74aa-4ccd`). `not live` keeps+ tests that reach a real Jira out even when your shell exports Jira credentials; they run only+ on an explicit `pytest -m live` (bug `5f29-9bed-5a47-4a25`, `docs/jira-sync-setup.md`).+ **It costs 25-30 minutes** (measured twice on one six-performance-core host at the default+ `PYTEST_WORKERS=4`: 22 min 25 s and 26 min 04 s wall for lint + typecheck + ~19.2k tests,+ plus ~3 min 40 s for the 200-test integration tier -- the spread is host load, so plan for+ the top of the range; `make test PYTEST_WORKERS=8` on a bigger box).+ **Codex Gerrit workflow rule:** the multi-story feature-branch path is not a prerequisite, and+ this environment is already provisioned for the per-change path — do not spend a step probing+ Gerrit for it. Follow the ticket dependency order and send each independently reviewable change+ through `git push gerrit HEAD:refs/for/main`, waiting for `LLM-Review +1` and `Verified +1`+ before Submit and before advancing to a dependent change. Authorized drivers may still use the+ server-side feature-branch flow; see ADR 0025, including its post-ADR-0047 note that the+ Rebase-If-Necessary interaction needs human review.+ **AWS CLI: pass `--profile frontier` on every `aws` command against this deployment** (account+ `896586841071`, `us-east-1`). The default credential chain has no credentials for that account,+ so a command without the profile fails. The commands in `infra/runbooks/` carry the flag already.+ Terraform under `infra/` pins no provider profile, so `export AWS_PROFILE=frontier` before+ `terraform init`/`plan`/`apply`. Commands that run **on the instance** (inside an+ `aws ssm send-command` payload or an SSM session, and the `infra/**/*.sh` host scripts) use the+ instance role and take no profile; adding one makes them fail.+ new or increased mechanism that LACKS a marker**, reporting that verdict through its **exit+ code** rather than through its counters. It exists because 56% of sampled fixes ADD a mechanism+ against 30% that are pure logic fixes: each cycle grows the surface that produces the next+ cycle's defect classes, and nothing pushed back. The gate does not forbid a new mechanism; it+ forbids an *unjustified* one. **Removing** a mechanism always passes (it buckets as `stale`) —+ that asymmetry is what makes it a ratchet rather than a freeze.+ **Read the exit code, not the `new=` counter.** The counter includes marker-admitted+ mechanisms, so a clean tree reports a nonzero `new`: measured `active=648 new=28 increased=0+ stale=0` with exit 0 at `0886e96f03a`. The baseline has no write path for new keys —+ `drain_stale` (`scripts/_mechanism_delta/compare.py`) keeps only baseline keys still present,+ and there is no `--lock` — so `new=0` is UNREACHABLE here and must never appear in an+ acceptance criterion; assert "exits 0" instead. The complexity ratchet above is the opposite+ case: it admits nothing by marker, so its clean state genuinely is `new=0`.+ When you genuinely need one, justify it in the tree, at the definition site:+ Run `make install` again after any rebase that crosses a version bump: the editable