@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/tests/test_cli/test_workflow_projects_phase131_lifecycle.py

@@ -1,2488 +0,0 @@
-from __future__ import annotations
-
-import json
-import subprocess
-from pathlib import Path
-from types import SimpleNamespace
-
-import pytest
-from typer.testing import CliRunner
-from vds_audit_orchestrator import cli, workflow_cmds
-from vds_audit_orchestrator.config import reset_config
-
-runner = CliRunner()
-
-
-@pytest.fixture(autouse=True)
-def _isolate_cli_runtime(monkeypatch: pytest.MonkeyPatch) -> None:
-    reset_config()
-    cli._cli_state.clear()
-    monkeypatch.setattr(
-        cli,
-        "apply_runtime_profile",
-        lambda *args, **kwargs: SimpleNamespace(
-            profile_name="test",
-            source="test",
-            profile_path=Path("/tmp/test-profile.yaml"),
-            applied_env_keys=[],
-        ),
-    )
-    monkeypatch.setattr(cli, "load_shared_env", lambda *args, **kwargs: {})
-    monkeypatch.setenv("VDS_AUDIT_BOOTSTRAP_HOME", "false")
-    monkeypatch.delenv("VDS_AUDIT_PROFILE", raising=False)
-    monkeypatch.delenv("VDS_AUDIT_ACTIVE_PROFILE", raising=False)
-    monkeypatch.setenv("VDS_AUDIT_LANGGRAPH__POSTGRES_DSN", "postgresql://test:test@localhost:5432/test")
-    yield
-    cli._cli_state.clear()
-    reset_config()
-
-
-def _project_payload(
-    key: str,
-    name: str | None = None,
-    department: str | None = None,
-    department_page_id: str | None = None,
-) -> dict:
-    payload = {
-        "project_storage_key": key,
-        "page_id": key,
-        "project_name": name or key,
-        "project_display_name": name or key,
-    }
-    if department is not None:
-        payload["department"] = department
-    if department_page_id is not None:
-        payload["department_page_id"] = department_page_id
-        payload["confluence_ancestry_path"] = [
-            {"page_id": department_page_id, "title": department or department_page_id},
-            {"page_id": key, "title": name or key},
-        ]
-    return payload
-
-
-def _patch_parent_manifest_updates(monkeypatch: pytest.MonkeyPatch) -> None:
-    def _update(*, dispatch_manifest_path: Path, updates: dict) -> None:
-        payload = json.loads(dispatch_manifest_path.read_text(encoding="utf-8"))
-        payload.update(updates)
-        dispatch_manifest_path.write_text(json.dumps(payload, indent=2, default=str), encoding="utf-8")
-
-    monkeypatch.setattr(workflow_cmds, "_write_dispatch_manifest_update", _update)
-
-
-def test_workflow_projects_writes_parent_manifest_and_progress_state(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    _patch_parent_manifest_updates(monkeypatch)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR", "P.NTTT", "88716694")]},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_prepare_job",
-        lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_workflow_project_job",
-        lambda **kwargs: {
-            "ok": True,
-            "payload": {
-                "workflow": "project_completed",
-                "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-            },
-        },
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "workflow-projects",
-            "--project-storage-keys",
-            "88727304",
-            "--report-dir",
-            str(tmp_path),
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    manifest_path = tmp_path / "dispatch-manifest.json"
-    progress_path = tmp_path / "dispatch-progress.state"
-    summary_path = tmp_path / "cross-project-summary.json"
-    assert manifest_path.exists()
-    assert progress_path.exists()
-    assert summary_path.exists()
-
-    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
-    progress = json.loads(progress_path.read_text(encoding="utf-8"))
-    summary = json.loads(summary_path.read_text(encoding="utf-8"))
-
-    assert manifest["schema"] == "workflow-projects.dispatch-manifest.v1"
-    assert manifest["max_projects_prepare_concurrent"] == 3
-    assert manifest["max_projects_concurrent"] == 3
-    assert manifest["child_max_concurrent"] == 6
-    assert manifest["pressure_diagnostics"]["selected_projects"] == 1
-    assert manifest["pressure_diagnostics"]["effective_prepare_concurrency"] == 1
-    assert manifest["pressure_diagnostics"]["effective_analysis_concurrency"] == 1
-    assert len(manifest["projects"]) == 1
-    assert manifest["projects"][0]["project_title"] == "PAR"
-    assert manifest["projects"][0]["project_page"] == {"page_id": "88727304", "title": "PAR"}
-    assert manifest["projects"][0]["department_page"] == {"page_id": "88716694", "title": "P.NTTT"}
-    assert progress["schema"] == "workflow-projects.dispatch-progress-state.v1"
-    assert progress["status"] == "completed"
-    assert progress["pressure_diagnostics"]["selected_projects"] == 1
-    assert summary["counts"]["completed"] == 1
-    assert summary["pressure_diagnostics"]["selected_projects"] == 1
-    assert summary["pressure_diagnostics"]["max_parallel_repo_slots"] == 6
-
-
-def test_workflow_projects_explicit_keys_fail_when_subset_missing(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88718856", "Participant Management")]},
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "workflow-projects",
-            "--project-storage-keys",
-            "88718856,88718877",
-            "--report-dir",
-            str(tmp_path),
-        ],
-    )
-
-    assert result.exit_code == 2
-    assert "Requested --project-storage-keys missing from current" in result.output
-    assert "88718877" in result.output
-    assert not (tmp_path / "dispatch-manifest.json").exists()
-
-
-def test_workflow_projects_require_all_materials_blocks_run_and_emits_json(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    _patch_parent_manifest_updates(monkeypatch)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR"), _project_payload("88718940", "CEP")]},
-    )
-
-    def _prepare(**kwargs):
-        if kwargs["project_storage_key"] == "88727304":
-            return {"ok": True, "payload": {"ready": True}}
-        return {"ok": False, "payload": {"ready": False, "error": "missing_materials"}, "error": "missing_materials"}
-
-    workflow_calls: list[dict] = []
-    monkeypatch.setattr(workflow_cmds, "_run_parent_prepare_job", _prepare)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_workflow_project_job",
-        lambda **kwargs: workflow_calls.append(kwargs) or {"ok": True, "payload": {"workflow": "project_completed"}},
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "workflow-projects",
-            "--project-storage-keys",
-            "88727304,88718940",
-            "--report-dir",
-            str(tmp_path),
-            "--require-all-materials",
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    payload = json.loads(result.output)
-    assert payload["workflow"] == "workflow_projects_blocked"
-    assert payload["counts"]["failed"] >= 1 or payload["counts"]["skipped"] >= 1
-    assert payload["pressure_diagnostics"]["selected_projects"] == 2
-    assert payload["pressure_diagnostics"]["blocked_projects"] >= 1
-    assert workflow_calls == []
-
-
-def test_enrich_selected_projects_with_department_lineage_reuses_sibling_department_page() -> None:
-    manifest_payload = {
-        "projects": [
-            {"project_name": "invalid-row", "department": "3.2.4 Nền tảng thanh toán"},
-            _project_payload("88718943", "Core Payment", "3.2.4 Nền tảng thanh toán"),
-            _project_payload("88718977", "Auto Payment", "3.2.4 Nền tảng thanh toán", "88716694"),
-        ]
-    }
-
-    enriched = workflow_cmds._enrich_selected_projects_with_department_lineage(
-        selected_projects=[manifest_payload["projects"][0]],
-        manifest_payload=manifest_payload,
-    )
-
-    assert enriched[0]["department_page_id"] == "88716694"
-    assert enriched[0]["department"] == "3.2.4 Nền tảng thanh toán"
-
-
-def test_prepare_target_projects_from_manifest_skips_polluted_root_rows() -> None:
-    manifest_payload = {
-        "projects": [
-            {
-                "project_storage_key": "88716675",
-                "page_id": "88716675",
-                "project_name": "3.2 Các hệ thống, nền tảng sản phẩm",
-                "registry_page_id": "88716675",
-                "root_page_id": "88716675",
-                "department_assignment_reason": "unassigned:lineage_missing_ancestor",
-            },
-            {
-                "project_storage_key": "legacy-pay",
-                "project_name": "legacy-pay",
-                "registry_page_id": "88716675",
-                "department": "3.2.4 Nền tảng thanh toán",
-                "department_page_id": None,
-                "root_page_id": None,
-            },
-            {
-                "project_storage_key": "88718943",
-                "page_id": "88718943",
-                "project_name": "Core Payment",
-                "registry_page_id": "88716675",
-                "department": "3.2.4 Nền tảng thanh toán",
-                "department_page_id": "88716694",
-                "root_page_id": "88716675",
-                "department_assignment_reason": "derived_from_candidate_root_anchor",
-                "confluence_ancestry_path": [
-                    {"page_id": "88716675", "title": "3.2 Các hệ thống, nền tảng sản phẩm"},
-                    {"page_id": "88716694", "title": "3.2.4 Nền tảng thanh toán"},
-                    {"page_id": "88718943", "title": "Core Payment"},
-                ],
-            },
-        ]
-    }
-
-    selected = workflow_cmds._prepare_target_projects_from_manifest(
-        manifest_payload,
-        project_selector=None,
-        registry_page_selector="88716675",
-    )
-
-    assert [project["project_storage_key"] for project in selected] == ["88718943"]
-
-
-def test_workflow_projects_registry_page_refresh_discovers_projects_and_runs_child_workflow(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    _patch_parent_manifest_updates(monkeypatch)
-
-    state_payloads = [
-        {"projects": []},
-        {"projects": [_project_payload("88727304", "PAR")]},
-    ]
-
-    def _load_manifest(_state_dsn: str) -> dict:
-        if len(state_payloads) > 1:
-            return state_payloads.pop(0)
-        return state_payloads[0]
-
-    parse_calls: list[dict] = []
-
-    def _invoke(callback, /, **overrides):
-        parse_calls.append({"callback": getattr(callback, "__name__", str(callback)), **overrides})
-
-    prepare_calls: list[dict] = []
-    workflow_calls: list[dict] = []
-
-    monkeypatch.setattr(workflow_cmds, "_load_manifest_payload_from_state", _load_manifest)
-    monkeypatch.setattr(workflow_cmds, "_invoke_typer_callback", _invoke)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_prepare_job",
-        lambda **kwargs: prepare_calls.append(kwargs) or {"ok": True, "payload": {"ready": True}},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_workflow_project_job",
-        lambda **kwargs: (
-            workflow_calls.append(kwargs)
-            or {
-                "ok": True,
-                "payload": {
-                    "workflow": "project_completed",
-                    "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                    "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                },
-            }
-        ),
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "workflow-projects",
-            "--registry-page",
-            "88700000",
-            "--report-dir",
-            str(tmp_path),
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    assert parse_calls and parse_calls[0]["registry_page"] == "88700000"
-    assert prepare_calls and prepare_calls[0]["project_storage_key"] == "88727304"
-    assert workflow_calls and workflow_calls[0]["project_storage_key"] == "88727304"
-
-
-def test_workflow_projects_upload_enabled_passes_child_upload_flags_and_collects_upload_outputs(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    _patch_parent_manifest_updates(monkeypatch)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR")]},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_prepare_job",
-        lambda **kwargs: {"ok": True, "payload": {"ready": True}},
-    )
-
-    workflow_calls: list[dict] = []
-
-    def _run_child(**kwargs):
-        workflow_calls.append(kwargs)
-        return {
-            "ok": True,
-            "payload": {
-                "workflow": "project_completed",
-                "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                "upload_summary": {
-                    "enabled": True,
-                    "errors": 0,
-                    "repo_pages_uploaded": 2,
-                    "aggregate_page_uploaded": True,
-                },
-                "confluence_repo_page_ids": {"repo-a": "111", "repo-b": "222"},
-                "confluence_aggregate_page_id": "333",
-                "upload_errors": [],
-            },
-        }
-
-    monkeypatch.setattr(workflow_cmds, "_run_parent_workflow_project_job", _run_child)
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "workflow-projects",
-            "--project-storage-keys",
-            "88727304",
-            "--report-dir",
-            str(tmp_path),
-            "--upload-to-confluence",
-            "--upload-attachments",
-            "--incremental-upload",
-            "--force-rerun",
-            "--no-ast-grep",
-            "--no-cross-repo-evidence",
-            "--no-knowledge-agent",
-            "--confluence-parent",
-            "999999",
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    assert workflow_calls, "child workflow-project was not invoked"
-    assert workflow_calls[0]["upload_to_confluence"] is True
-    assert workflow_calls[0]["confluence_parent"] == "999999"
-    assert workflow_calls[0]["upload_attachments"] is True
-    assert workflow_calls[0]["incremental_upload"] is True
-    assert workflow_calls[0]["force_rerun"] is True
-    assert workflow_calls[0]["ast_grep"] is False
-    assert workflow_calls[0]["cross_repo_evidence"] is False
-    assert workflow_calls[0]["knowledge_agent"] is False
-
-    payload = json.loads(result.output)
-    assert payload["workflow"] == "workflow_projects_completed"
-    project_payload = payload["projects"][0]
-    assert project_payload["upload_summary"]["enabled"] is True
-    assert project_payload["confluence_repo_page_ids"] == {"repo-a": "111", "repo-b": "222"}
-    assert project_payload["confluence_aggregate_page_id"] == "333"
-
-
-def test_workflow_projects_surfaces_prepare_readiness_completeness_and_pressure_diagnostics(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    _patch_parent_manifest_updates(monkeypatch)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR")]},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_prepare_job",
-        lambda **kwargs: {
-            "ok": True,
-            "payload": {
-                "ready": True,
-                "readiness_summary": [{"repo": "merchant-report", "ready": True}],
-                "completeness_summary": {"completeness_pct": 95, "readiness_status": "ready"},
-            },
-        },
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_workflow_project_job",
-        lambda **kwargs: {
-            "ok": True,
-            "payload": {
-                "workflow": "project_completed",
-                "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-            },
-        },
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "workflow-projects",
-            "--project-storage-keys",
-            "88727304",
-            "--report-dir",
-            str(tmp_path),
-            "--max-projects-prepare-concurrent",
-            "4",
-            "--max-projects-concurrent",
-            "3",
-            "--max-concurrent",
-            "7",
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    payload = json.loads(result.output)
-    project_payload = payload["projects"][0]
-    assert project_payload["readiness_summary"] == [{"repo": "merchant-report", "ready": True}]
-    assert project_payload["completeness_summary"] == {"completeness_pct": 95, "readiness_status": "ready"}
-    assert payload["pressure_diagnostics"]["selected_projects"] == 1
-    assert payload["pressure_diagnostics"]["effective_prepare_concurrency"] == 1
-    assert payload["pressure_diagnostics"]["effective_analysis_concurrency"] == 1
-    assert payload["pressure_diagnostics"]["child_max_concurrent"] == 7
-    assert payload["pressure_diagnostics"]["max_parallel_repo_slots"] == 7
-
-
-def test_workflow_projects_default_all_parent_preflight_blocks_when_all_profiles_unavailable(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR")]},
-    )
-    monkeypatch.setattr(workflow_cmds, "list_runtime_profile_names", lambda: ["profile-a", "profile-b"])
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_evaluate_profiles_availability",
-        lambda **kwargs: {
-            "mode": str(kwargs["mode"]),
-            "checks": [
-                {"profile": "profile-a", "availability_status": "unavailable"},
-                {"profile": "profile-b", "availability_status": "unavailable"},
-            ],
-            "available_profiles": [],
-            "unavailable_profiles": ["profile-a", "profile-b"],
-        },
-    )
-
-    workflow_calls: list[dict[str, object]] = []
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_workflow_project_job",
-        lambda **kwargs: workflow_calls.append(kwargs) or {"ok": True, "payload": {"workflow": "project_completed"}},
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "workflow-projects",
-            "--project-storage-keys",
-            "88727304",
-            "--report-dir",
-            str(tmp_path),
-        ],
-    )
-
-    assert result.exit_code == 1
-    payload = json.loads(result.output)
-    assert payload["error"] == "profile_availability_preflight_failed"
-    assert payload["scope"] == "workflow-projects"
-    assert payload["requested_profiles"] == ["profile-a", "profile-b"]
-    assert workflow_calls == []
-
-
-def test_workflow_projects_parent_entries_expose_derived_child_status_fields(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    _patch_parent_manifest_updates(monkeypatch)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR")]},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_prepare_job",
-        lambda **kwargs: {"ok": True, "payload": {"ready": True}},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_run_parent_workflow_project_job",
-        lambda **kwargs: {
-            "ok": True,
-            "payload": {
-                "workflow": "project_completed",
-                "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-            },
-        },
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "workflow-projects",
-            "--project-storage-keys",
-            "88727304",
-            "--report-dir",
-            str(tmp_path),
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    payload = json.loads(result.output)
-    project_payload = payload["projects"][0]
-
-    assert project_payload["child_thread_id"].endswith("--project-88727304")
-    assert project_payload["child_report_dir"] == str(tmp_path / "project-88727304")
-    assert project_payload["execution_status"] == "completed"
-    assert project_payload["recovery_status"] == "completed"
-    assert project_payload["execution_status_source"] == "parent_terminal_state_mapping"
-    assert project_payload["recovery_status_source"] == "child_payload_or_artifact_classification"
-    assert project_payload["upload_status_source"] == "child_upload_summary"
-    assert isinstance(project_payload["workflow_result"], dict)
-    assert project_payload["workflow_result"]["workflow"] == "project_completed"
-
-
-def test_workflow_projects_rejects_non_parent_resume_manifest(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    bad_manifest = tmp_path / "dispatch-manifest.json"
-    bad_manifest.write_text(
-        json.dumps({"schema": "workflow-project.dispatch-manifest.v1", "thread_id": "child-thread"}),
-        encoding="utf-8",
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "workflow-projects",
-            "--project-storage-keys",
-            "88727304",
-            "--resume-dispatch-manifest",
-            str(bad_manifest),
-        ],
-    )
-
-    assert result.exit_code != 0
-    assert "resume-dispatch-manifest" in result.output or "workflow-projects" in result.output
-
-
-def test_partition_row_keys_by_profile_round_robins_across_profiles() -> None:
-    shard_map = workflow_cmds._partition_row_keys_by_profile(
-        profiles=["zai-openai", "alibaba-openai", "alibaba-anthropic"],
-        row_keys=["rk-1", "rk-2", "rk-3", "rk-4", "rk-5"],
-    )
-
-    assert shard_map == {
-        "zai-openai": ["rk-1", "rk-4"],
-        "alibaba-openai": ["rk-2", "rk-5"],
-        "alibaba-anthropic": ["rk-3"],
-    }
-
-
-def test_build_row_sharded_jobs_emits_multiple_jobs_for_one_repo() -> None:
-    jobs, assignment, idle_profiles = workflow_cmds._build_row_sharded_jobs(
-        profiles=["zai-openai", "alibaba-openai", "alibaba-anthropic"],
-        repos=[("par-merchant-billing", Path("/tmp/merchant-billing"))],
-        repo_row_keys={
-            "par-merchant-billing": ["rk-1", "rk-2", "rk-3", "rk-4"],
-        },
-    )
-
-    assert assignment == {"par-merchant-billing": "zai-openai"}
-    assert idle_profiles == []
-    assert len(jobs) == 3
-    assert {job["profile"] for job in jobs} == {"zai-openai", "alibaba-openai", "alibaba-anthropic"}
-    assert all(job["repo_key"] == "par-merchant-billing" for job in jobs)
-    assert all(job["stage"] == "row_sharded" for job in jobs)
-    assert all(job["extra_target"] for job in jobs)
-    assert any(job["extra_target"] == "rk-1,rk-4" for job in jobs)
-    assert any(job["extra_target"] == "rk-2" for job in jobs)
-    assert any(job["extra_target"] == "rk-3" for job in jobs)
-
-
-def test_resolve_repo_row_keys_for_sharding_ignores_stale_default_report_artifacts(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    stale_report_dir = Path("/Users/vds-ai/.vds/cache/reports/merchant-billing")
-    stale_report_dir.mkdir(parents=True, exist_ok=True)
-    stale_mapping = stale_report_dir / "audit-checklist.requirement-mapping.preflight.json"
-    stale_mapping.write_text(json.dumps({"rows": [{"row_key": "stale:88722450:wrong"}]}), encoding="utf-8")
-
-    class _FakeRow:
-        def __init__(self, row_key: str) -> None:
-            self.row_key = row_key
-
-        def model_dump(self, mode: str = "json") -> dict[str, str]:
-            return {"row_key": self.row_key}
-
-    async def _fake_load_confluence_checklist_rows(**kwargs):
-        return ([_FakeRow("default:88722450:live-a"), _FakeRow("default:88722450:live-b")], {"version": 1})
-
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.engine.confluence_checklist_contract.load_confluence_checklist_rows",
-        _fake_load_confluence_checklist_rows,
-    )
-
-    try:
-        resolved = workflow_cmds._resolve_repo_row_keys_for_sharding(
-            confluence_server=None,
-            page_id="88722450",
-            profile_id="default",
-            repos=[("par-merchant-billing", tmp_path / "merchant-billing")],
-        )
-    finally:
-        stale_mapping.unlink(missing_ok=True)
-
-    assert resolved == {"par-merchant-billing": ["default:88722450:live-a", "default:88722450:live-b"]}
-
-
-def test_resolve_repo_row_keys_for_sharding_filters_rows_by_explicit_target(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    class _FakeRow:
-        def __init__(self, row_key: str, check_id: str) -> None:
-            self.row_key = row_key
-            self.check_id = check_id
-
-        def model_dump(self, mode: str = "json") -> dict[str, str]:
-            return {"row_key": self.row_key, "check_id": self.check_id}
-
-    async def _fake_load_confluence_checklist_rows(**kwargs):
-        return (
-            [
-                _FakeRow("default:88722450:security/auth", "CL-001"),
-                _FakeRow("default:88722450:security/logging", "CL-003"),
-                _FakeRow("default:88722450:security/rate-limit", "CL-005"),
-            ],
-            {"version": 1},
-        )
-
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.engine.confluence_checklist_contract.load_confluence_checklist_rows",
-        _fake_load_confluence_checklist_rows,
-    )
-
-    resolved = workflow_cmds._resolve_repo_row_keys_for_sharding(
-        confluence_server=None,
-        page_id="88722450",
-        profile_id="default",
-        repos=[("par-merchant-billing", tmp_path / "merchant-billing")],
-        target="CL-003",
-    )
-
-    assert resolved == {"par-merchant-billing": ["default:88722450:security/logging"]}
-
-
-def test_resolve_repo_row_keys_for_sharding_uses_per_repo_topology_page_id(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Row keys must be fetched using the topology page/profile for each repo.
-
-    When repo_checklist_topology maps a repo to a different checklist page (e.g. a
-    frontend repo maps to page 88729031 rather than the project-level page 88722450),
-    the row keys used as --target in the child shard job must come from that topology
-    page.  Without the fix, the parent fetched all rows from the single project-level
-    page, producing keys like "default:88722450:..." while the child built its template
-    from the topology page, producing "default:88729031:...", causing all row-key
-    lookups to fail with "Row key(s) not found in template".
-    """
-
-    class _FakeRow:
-        def __init__(self, row_key: str) -> None:
-            self.row_key = row_key
-
-        def model_dump(self, mode: str = "json") -> dict[str, str]:
-            return {"row_key": self.row_key}
-
-    backend_rows = [_FakeRow("default:88722450:security/auth"), _FakeRow("default:88722450:performance")]
-    frontend_rows = [_FakeRow("default:88729031:ui-accessibility"), _FakeRow("default:88729031:responsive-design")]
-
-    async def _fake_load_confluence_checklist_rows(**kwargs):
-        page_id = kwargs.get("page_id", "")
-        if page_id == "88729031":
-            return (frontend_rows, {"version": 1})
-        return (backend_rows, {"version": 1})
-
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.engine.confluence_checklist_contract.load_confluence_checklist_rows",
-        _fake_load_confluence_checklist_rows,
-    )
-
-    repo_checklist_topology = {
-        "par-merchant-billing": {
-            "repo_type": "backend",
-            "checklist_page_id": "88722450",
-            "checklist_profile_id": "default",
-        },
-        "par-product-catalog-cms-fe": {
-            "repo_type": "frontend",
-            "checklist_page_id": "88729031",
-            "checklist_profile_id": "default",
-        },
-    }
-
-    resolved = workflow_cmds._resolve_repo_row_keys_for_sharding(
-        confluence_server=None,
-        page_id="88722450",
-        profile_id="default",
-        repos=[
-            ("par-merchant-billing", tmp_path / "merchant-billing"),
-            ("par-product-catalog-cms-fe", tmp_path / "product-catalog-cms-fe"),
-        ],
-        repo_checklist_topology=repo_checklist_topology,
-    )
-
-    # Backend repo uses the backend page.
-    assert resolved["par-merchant-billing"] == [
-        "default:88722450:security/auth",
-        "default:88722450:performance",
-    ]
-    # Frontend repo uses the topology-specified frontend page, NOT the global backend page.
-    assert resolved["par-product-catalog-cms-fe"] == [
-        "default:88729031:ui-accessibility",
-        "default:88729031:responsive-design",
-    ]
-
-
-def test_resolve_repo_row_keys_for_sharding_batches_identical_topology_pages(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """Repos that share the same topology page/profile are batched into a single load."""
-
-    call_log: list[dict] = []
-
-    class _FakeRow:
-        def __init__(self, row_key: str) -> None:
-            self.row_key = row_key
-
-        def model_dump(self, mode: str = "json") -> dict[str, str]:
-            return {"row_key": self.row_key}
-
-    async def _fake_load_confluence_checklist_rows(**kwargs):
-        call_log.append({"page_id": kwargs.get("page_id"), "source_profile_id": kwargs.get("source_profile_id")})
-        return ([_FakeRow(f"default:{kwargs.get('page_id', '')}:check-a")], {"version": 1})
-
-    monkeypatch.setattr(
-        "vds_audit_orchestrator.engine.confluence_checklist_contract.load_confluence_checklist_rows",
-        _fake_load_confluence_checklist_rows,
-    )
-
-    # Three repos all sharing the same topology page — should result in ONE Confluence call.
-    repo_checklist_topology = {
-        "repo-a": {"repo_type": "backend", "checklist_page_id": "88722450", "checklist_profile_id": "default"},
-        "repo-b": {"repo_type": "backend", "checklist_page_id": "88722450", "checklist_profile_id": "default"},
-        "repo-c": {"repo_type": "backend", "checklist_page_id": "88722450", "checklist_profile_id": "default"},
-    }
-
-    resolved = workflow_cmds._resolve_repo_row_keys_for_sharding(
-        confluence_server=None,
-        page_id="88722450",
-        profile_id="default",
-        repos=[
-            ("repo-a", tmp_path / "a"),
-            ("repo-b", tmp_path / "b"),
-            ("repo-c", tmp_path / "c"),
-        ],
-        repo_checklist_topology=repo_checklist_topology,
-    )
-
-    # All three repos get the same row keys.
-    for repo_key in ("repo-a", "repo-b", "repo-c"):
-        assert resolved[repo_key] == ["default:88722450:check-a"]
-
-    # Only ONE Confluence fetch was needed (not three).
-    assert len(call_log) == 1
-    assert call_log[0]["page_id"] == "88722450"
-
-
-def test_workflow_project_row_sharded_dispatch_summary_routes_into_row_sharded_aggregate_branch(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    monkeypatch.setattr(
-        workflow_cmds, "_resolve_workflow_thread_id", lambda thread_id: thread_id or "phase131-rowshard"
-    )
-    monkeypatch.setattr(workflow_cmds, "list_runtime_profile_names", lambda: ["zai-openai", "alibaba-openai"])
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_evaluate_profiles_availability",
-        lambda **kwargs: {
-            "mode": "active",
-            "checks": [],
-            "available_profiles": ["zai-openai", "alibaba-openai"],
-            "unavailable_profiles": [],
-        },
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_project_repos_from_manifest",
-        lambda *args, **kwargs: (
-            _project_payload("88727304", "PAR"),
-            [("par-merchant-billing", Path("/tmp/merchant-billing"))],
-        ),
-    )
-    monkeypatch.setattr(workflow_cmds, "_resolve_project_junction_bitbucket_keys", lambda **kwargs: None)
-    monkeypatch.setattr(workflow_cmds, "_classify_repo_checklist_topology", lambda **kwargs: {})
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_check_project_already_completed",
-        lambda **kwargs: (
-            False,
-            {
-                "reason": "not_completed",
-                "completed_repo_keys": [],
-                "pending_repo_keys": ["par-merchant-billing"],
-                "completed_run_ids": [],
-                "artifact_status": {},
-                "require_artifacts": True,
-                "retrieval_snapshot_early_exit": False,
-            },
-        ),
-    )
-    monkeypatch.setattr(workflow_cmds, "_materialize_project_repo_report_dirs", lambda **kwargs: None)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_generate_project_readiness_from_aggregate",
-        lambda **kwargs: {
-            "executive_summary": {"readiness_score_pct": 80.0},
-            "source": kwargs.get("source"),
-        },
-    )
-    monkeypatch.setattr(workflow_cmds, "_build_evidence_snapshot_binding", lambda **kwargs: {})
-    monkeypatch.setattr(workflow_cmds, "_build_retrieval_snapshot_binding", lambda **kwargs: {})
-    monkeypatch.setattr(workflow_cmds, "_persist_typed_run_terminal", lambda **kwargs: None)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR")]},
-    )
-
-    row_shard_merge_calls: list[dict] = []
-
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_dispatch_multi_profile_workflows",
-        lambda **kwargs: {
-            "completed": 2,
-            "errors": 0,
-            "timeouts": 0,
-            "exceptions": 0,
-            "requeued": 0,
-            "skipped": 0,
-            "results": [
-                {
-                    "status": "ok",
-                    "repo_key": "par-merchant-billing",
-                    "thread_id": "child-run-1",
-                    "row_shard_index": 0,
-                    "row_shard_count": 2,
-                },
-                {
-                    "status": "ok",
-                    "repo_key": "par-merchant-billing",
-                    "thread_id": "child-run-2",
-                    "row_shard_index": 1,
-                    "row_shard_count": 2,
-                },
-            ],
-            "lane_thread_ids": ["child-run-1", "child-run-2"],
-            "fallback_lane_thread_ids": [],
-            "jobs": [],
-            "resume_stats": {},
-        },
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_merge_row_sharded_repo_runs",
-        lambda **kwargs: (
-            row_shard_merge_calls.append(kwargs)
-            or (
-                [
-                    {
-                        "repository": "par-merchant-billing",
-                        "overall_score": 80.0,
-                        "maturity_level": 4,
-                        "gaps": [],
-                        "aligned_practices": [],
-                    }
-                ],
-                ["child-run-1", "child-run-2"],
-                [
-                    {
-                        "repo_storage_key": "par-merchant-billing",
-                        "source": "row_sharded_merged",
-                        "source_runs": ["child-run-1", "child-run-2"],
-                        "overall_score": 80.0,
-                        "merge_level": "row",
-                        "critique_summary": {},
-                        "rows": [
-                            {
-                                "check_id": "CL-001",
-                                "row_id": "r1",
-                                "row_index": 0,
-                                "status": "PASS",
-                                "score": 90.0,
-                                "source_run_id": "child-run-1",
-                            },
-                            {
-                                "check_id": "CL-002",
-                                "row_id": "r2",
-                                "row_index": 1,
-                                "status": "PASS",
-                                "score": 70.0,
-                                "source_run_id": "child-run-2",
-                            },
-                        ],
-                    }
-                ],
-            )
-        ),
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "workflow-project",
-            "--checkpointer",
-            "memory",
-            "--project-storage-key",
-            "88727304",
-            "--report-dir",
-            str(tmp_path),
-            "--profiles",
-            "zai-openai,alibaba-openai",
-            "--profile-availability",
-            "active",
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    payload = json.loads(result.output)
-    assert payload["aggregation_summary"]["mode"] == "row_sharded_aggregate"
-    assert row_shard_merge_calls, "row-sharded merge helper was not invoked"
-    assert row_shard_merge_calls[0]["shard_run_ids_by_repo"] == {"par-merchant-billing": ["child-run-1", "child-run-2"]}
-
-
-def test_rewrite_workflow_summary_as_failed_preserves_run_metadata(tmp_path: Path) -> None:
-    summary_path = tmp_path / "workflow-summary.json"
-    summary_path.write_text(
-        json.dumps(
-            {
-                "status": "running",
-                "thread_id": None,
-                "run_parameters": None,
-                "terminal_status_pending_checklist_artifacts": True,
-                "summary_score_source": "synthesis_pending_checklist_artifacts",
-                "synthesis": {
-                    "status": "running",
-                    "summary_score_source": "synthesis_pending_checklist_artifacts",
-                    "terminal_status_pending_checklist_artifacts": True,
-                },
-            },
-            indent=2,
-        ),
-        encoding="utf-8",
-    )
-
-    workflow_cmds._rewrite_workflow_summary_as_failed(
-        report_dir=tmp_path,
-        thread_id="phase131-shard-1",
-        error_message="Canonical checklist failed: boom",
-        target_selector="rk-1,rk-2",
-        target_selector_raw="rk-1,rk-2",
-        prior_run_id="prior-run-1",
-        run_parameters={"dispatch_job_id": "job-1", "row_shard_index": 1, "target": "rk-1,rk-2"},
-        dispatch_context={
-            "dispatch_job_id": "job-1",
-            "origin_profile": "zai-openai",
-            "executed_profile": "alibaba-openai",
-        },
-    )
-
-    payload = json.loads(summary_path.read_text(encoding="utf-8"))
-    assert payload["status"] == "failed"
-    assert payload["thread_id"] == "phase131-shard-1"
-    assert payload["run_parameters"]["dispatch_job_id"] == "job-1"
-    assert payload["dispatch_job_id"] == "job-1"
-    assert payload["origin_profile"] == "zai-openai"
-    assert payload["executed_profile"] == "alibaba-openai"
-    assert payload["target_selector"] == "rk-1,rk-2"
-    assert payload["prior_run_id"] == "prior-run-1"
-    assert payload["terminal_status_pending_checklist_artifacts"] is False
-    assert payload["summary_score_source"] == "canonical_checklist_failure"
-    assert payload["synthesis"]["status"] == "failed"
-    assert payload["synthesis"]["terminal_status_pending_checklist_artifacts"] is False
-
-
-def test_merge_row_sharded_repo_runs_preserves_repo_local_source_runs(monkeypatch: pytest.MonkeyPatch) -> None:
-    class _FakeStore:
-        def __init__(self, dsn: str) -> None:
-            self.dsn = dsn
-
-        def list_checklist_row_results(self, run_id: str) -> list[dict[str, object]]:
-            payloads = {
-                "run-a1": [
-                    {
-                        "row_key": "rk-a1",
-                        "row_index": 0,
-                        "status": "PASS",
-                        "score": 90.0,
-                        "check_id": "CL-001",
-                        "payload": {
-                            "score_percent": 90.0,
-                            "severity": "low",
-                            "requirement_text": "req-a1",
-                            "evidence_refs": [],
-                        },
-                    }
-                ],
-                "run-a2": [
-                    {
-                        "row_key": "rk-a2",
-                        "row_index": 1,
-                        "status": "FAIL",
-                        "score": 40.0,
-                        "check_id": "CL-002",
-                        "payload": {
-                            "score_percent": 40.0,
-                            "severity": "high",
-                            "requirement_text": "req-a2",
-                            "evidence_refs": [],
-                        },
-                    }
-                ],
-                "run-b1": [
-                    {
-                        "row_key": "rk-b1",
-                        "row_index": 0,
-                        "status": "PASS",
-                        "score": 80.0,
-                        "check_id": "CL-003",
-                        "payload": {
-                            "score_percent": 80.0,
-                            "severity": "low",
-                            "requirement_text": "req-b1",
-                            "evidence_refs": [],
-                        },
-                    }
-                ],
-            }
-            return payloads.get(run_id, [])
-
-        def close(self) -> None:
-            return None
-
-    class _Budget:
-        def to_telemetry(self) -> dict[str, object]:
-            return {"mode": "test"}
-
-        @classmethod
-        def from_env(cls) -> _Budget:
-            return cls()
-
-    class _MergeLevel:
-        ROW = "row"
-
-    class _RunInput:
-        def __init__(self, *, run_id: str, repo_key: str, rows: list[dict[str, object]]) -> None:
-            self.run_id = run_id
-            self.repo_key = repo_key
-            self.rows = rows
-
-    class _MergedRow:
-        def __init__(
-            self,
-            *,
-            row_id: str,
-            row_index: int,
-            status: str,
-            score_percent: float,
-            source_run_id: str,
-            row_data: dict[str, object],
-        ) -> None:
-            self.row_id = row_id
-            self.row_index = row_index
-            self.status = status
-            self.score_percent = score_percent
-            self.source_run_id = source_run_id
-            self.row_data = row_data
-
-    class _MergedRepo:
-        def __init__(self, *, overall_score: float, rows: list[_MergedRow]) -> None:
-            self.overall_score = overall_score
-            self.rows = rows
-            self.merge_level = "row"
-
-    class _Merged:
-        def __init__(self) -> None:
-            self.repos = {
-                "repo-a": _MergedRepo(
-                    overall_score=65.0,
-                    rows=[
-                        _MergedRow(
-                            row_id="rk-a1",
-                            row_index=0,
-                            status="PASS",
-                            score_percent=90.0,
-                            source_run_id="run-a1",
-                            row_data={"check_id": "CL-001", "finding": "ok", "severity": "low"},
-                        ),
-                        _MergedRow(
-                            row_id="rk-a2",
-                            row_index=1,
-                            status="FAIL",
-                            score_percent=40.0,
-                            source_run_id="run-a2",
-                            row_data={"check_id": "CL-002", "finding": "gap", "severity": "high"},
-                        ),
-                    ],
-                ),
-                "repo-b": _MergedRepo(
-                    overall_score=80.0,
-                    rows=[
-                        _MergedRow(
-                            row_id="rk-b1",
-                            row_index=0,
-                            status="PASS",
-                            score_percent=80.0,
-                            source_run_id="run-b1",
-                            row_data={"check_id": "CL-003", "finding": "ok", "severity": "low"},
-                        ),
-                    ],
-                ),
-            }
-
-    monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-    monkeypatch.setattr(workflow_cmds, "_active_runtime_profile_name", lambda: "zai-openai")
-
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_score_to_maturity_level",
-        lambda score: 4 if score >= 80 else 3,
-    )
-
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_merge_exploratory_refs_from_trace",
-        lambda retrieval_trace: [],
-    )
-
-    monkeypatch.setitem(
-        workflow_cmds._merge_row_sharded_repo_runs.__globals__,
-        "_extract_row_quality_metrics",
-        lambda row_data: {
-            "citation_retention_rate": 0.0,
-            "final_cited_ref_count": 0,
-            "verified_excerpt_anchors": 0,
-        },
-    )
-
-    monkeypatch.setitem(
-        workflow_cmds._merge_row_sharded_repo_runs.__globals__,
-        "CritiqueBudget",
-        _Budget,
-    )
-    monkeypatch.setitem(
-        workflow_cmds._merge_row_sharded_repo_runs.__globals__,
-        "MergeLevel",
-        _MergeLevel,
-    )
-    monkeypatch.setitem(
-        workflow_cmds._merge_row_sharded_repo_runs.__globals__,
-        "RunInput",
-        _RunInput,
-    )
-    monkeypatch.setitem(
-        workflow_cmds._merge_row_sharded_repo_runs.__globals__,
-        "merge_cross_run_results",
-        lambda *args, **kwargs: _Merged(),
-    )
-
-    _aggregate_inputs, source_run_ids, repo_results_payload = workflow_cmds._merge_row_sharded_repo_runs(
-        state_dsn="postgresql://state",
-        project_key="PAR",
-        shard_run_ids_by_repo={"repo-a": ["run-a1", "run-a2"], "repo-b": ["run-b1"]},
-    )
-
-    assert source_run_ids == ["run-a1", "run-a2", "run-b1"]
-    repo_payloads = {item["repo_storage_key"]: item for item in repo_results_payload}
-    assert repo_payloads["repo-a"]["source_runs"] == ["run-a1", "run-a2"]
-    assert repo_payloads["repo-b"]["source_runs"] == ["run-b1"]
-
-
-def test_merge_row_sharded_repo_runs_ignores_non_targeted_na_placeholders(monkeypatch: pytest.MonkeyPatch) -> None:
-    class _FakeStore:
-        def __init__(self, dsn: str) -> None:
-            self.dsn = dsn
-
-        def list_checklist_row_results(self, run_id: str) -> list[dict[str, object]]:
-            if run_id == "run-na":
-                return [
-                    {
-                        "row_key": "rk-na",
-                        "row_index": 10,
-                        "status": "N/A",
-                        "score": 0.0,
-                        "check_id": "CL-999",
-                        "finding": "Hàng checklist không được đánh giá trong lần chạy targeted.",
-                        "payload": {
-                            "score_percent": 0.0,
-                            "severity": "low",
-                            "requirement_text": "ignored",
-                            "evidence_refs": [],
-                        },
-                    }
-                ]
-            if run_id == "run-real":
-                return [
-                    {
-                        "row_key": "rk-real",
-                        "row_index": 1,
-                        "status": "FAIL",
-                        "score": 40.0,
-                        "check_id": "CL-002",
-                        "finding": "real gap",
-                        "payload": {
-                            "score_percent": 40.0,
-                            "severity": "high",
-                            "requirement_text": "req-real",
-                            "evidence_refs": [],
-                        },
-                    }
-                ]
-            return []
-
-        def close(self) -> None:
-            return None
-
-    class _Budget:
-        def to_telemetry(self) -> dict[str, object]:
-            return {"mode": "test"}
-
-        @classmethod
-        def from_env(cls) -> _Budget:
-            return cls()
-
-    class _MergeLevel:
-        ROW = "row"
-
-    class _RunInput:
-        def __init__(self, *, run_id: str, repo_key: str, rows: list[dict[str, object]]) -> None:
-            self.run_id = run_id
-            self.repo_key = repo_key
-            self.rows = rows
-
-    class _MergedRow:
-        def __init__(
-            self,
-            *,
-            row_id: str,
-            row_index: int,
-            status: str,
-            score_percent: float,
-            source_run_id: str,
-            row_data: dict[str, object],
-        ) -> None:
-            self.row_id = row_id
-            self.row_index = row_index
-            self.status = status
-            self.score_percent = score_percent
-            self.source_run_id = source_run_id
-            self.row_data = row_data
-
-    class _MergedRepo:
-        def __init__(self, *, overall_score: float, rows: list[_MergedRow]) -> None:
-            self.overall_score = overall_score
-            self.rows = rows
-            self.merge_level = "row"
-
-    class _Merged:
-        def __init__(self) -> None:
-            self.repos = {
-                "repo-a": _MergedRepo(
-                    overall_score=40.0,
-                    rows=[
-                        _MergedRow(
-                            row_id="rk-real",
-                            row_index=1,
-                            status="FAIL",
-                            score_percent=40.0,
-                            source_run_id="run-real",
-                            row_data={"check_id": "CL-002", "finding": "real gap", "severity": "high"},
-                        ),
-                    ],
-                )
-            }
-
-    monkeypatch.setattr(workflow_cmds, "PostgresStateStore", _FakeStore)
-    monkeypatch.setattr(workflow_cmds, "_active_runtime_profile_name", lambda: "zai-openai")
-    monkeypatch.setattr(workflow_cmds, "_score_to_maturity_level", lambda score: 2)
-    monkeypatch.setattr(workflow_cmds, "_merge_exploratory_refs_from_trace", lambda retrieval_trace: [])
-    monkeypatch.setitem(
-        workflow_cmds._merge_row_sharded_repo_runs.__globals__,
-        "_extract_row_quality_metrics",
-        lambda row_data: {
-            "citation_retention_rate": 0.0,
-            "final_cited_ref_count": 0,
-            "verified_excerpt_anchors": 0,
-        },
-    )
-    monkeypatch.setitem(workflow_cmds._merge_row_sharded_repo_runs.__globals__, "CritiqueBudget", _Budget)
-    monkeypatch.setitem(workflow_cmds._merge_row_sharded_repo_runs.__globals__, "MergeLevel", _MergeLevel)
-    monkeypatch.setitem(workflow_cmds._merge_row_sharded_repo_runs.__globals__, "RunInput", _RunInput)
-    monkeypatch.setitem(
-        workflow_cmds._merge_row_sharded_repo_runs.__globals__,
-        "merge_cross_run_results",
-        lambda *args, **kwargs: _Merged(),
-    )
-
-    _aggregate_inputs, _source_run_ids, repo_results_payload = workflow_cmds._merge_row_sharded_repo_runs(
-        state_dsn="postgresql://state",
-        project_key="PAR",
-        shard_run_ids_by_repo={"repo-a": ["run-na", "run-real"]},
-    )
-
-    repo_payload = repo_results_payload[0]
-    row_ids = [row["row_id"] for row in repo_payload["rows"]]
-    assert row_ids == ["rk-real"]
-    assert isinstance(repo_payload["quality_warnings"], list)
-
-
-def test_workflow_project_row_sharded_quality_warning_flows_into_aggregate_and_readiness(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setattr(workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state")
-    monkeypatch.setattr(workflow_cmds, "_resolve_workflow_thread_id", lambda thread_id: thread_id or "phase131-quality")
-    monkeypatch.setattr(workflow_cmds, "list_runtime_profile_names", lambda: ["zai-openai", "alibaba-openai"])
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_evaluate_profiles_availability",
-        lambda **kwargs: {
-            "mode": "active",
-            "checks": [],
-            "available_profiles": ["zai-openai", "alibaba-openai"],
-            "unavailable_profiles": [],
-        },
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_project_repos_from_manifest",
-        lambda *args, **kwargs: (
-            _project_payload("88727304", "PAR"),
-            [("par-merchant-billing", Path("/tmp/merchant-billing"))],
-        ),
-    )
-    monkeypatch.setattr(workflow_cmds, "_resolve_project_junction_bitbucket_keys", lambda **kwargs: None)
-    monkeypatch.setattr(workflow_cmds, "_classify_repo_checklist_topology", lambda **kwargs: {})
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_check_project_already_completed",
-        lambda **kwargs: (
-            False,
-            {
-                "reason": "not_completed",
-                "completed_repo_keys": [],
-                "pending_repo_keys": ["par-merchant-billing"],
-                "completed_run_ids": [],
-                "artifact_status": {},
-                "require_artifacts": True,
-                "retrieval_snapshot_early_exit": False,
-            },
-        ),
-    )
-    monkeypatch.setattr(workflow_cmds, "_materialize_project_repo_report_dirs", lambda **kwargs: None)
-    monkeypatch.setattr(workflow_cmds, "_build_evidence_snapshot_binding", lambda **kwargs: {})
-    monkeypatch.setattr(workflow_cmds, "_build_retrieval_snapshot_binding", lambda **kwargs: {})
-    monkeypatch.setattr(workflow_cmds, "_persist_typed_run_terminal", lambda **kwargs: None)
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_load_manifest_payload_from_state",
-        lambda state_dsn: {"projects": [_project_payload("88727304", "PAR")]},
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_dispatch_multi_profile_workflows",
-        lambda **kwargs: {
-            "completed": 2,
-            "errors": 0,
-            "timeouts": 0,
-            "exceptions": 0,
-            "requeued": 0,
-            "skipped": 0,
-            "results": [
-                {
-                    "status": "ok",
-                    "repo_key": "par-merchant-billing",
-                    "thread_id": "child-run-1",
-                    "row_shard_index": 0,
-                    "row_shard_count": 2,
-                },
-                {
-                    "status": "ok",
-                    "repo_key": "par-merchant-billing",
-                    "thread_id": "child-run-2",
-                    "row_shard_index": 1,
-                    "row_shard_count": 2,
-                },
-            ],
-            "lane_thread_ids": ["child-run-1", "child-run-2"],
-            "fallback_lane_thread_ids": [],
-            "jobs": [],
-            "resume_stats": {},
-        },
-    )
-    monkeypatch.setattr(
-        workflow_cmds,
-        "_merge_row_sharded_repo_runs",
-        lambda **kwargs: (
-            [
-                {
-                    "repository": "par-merchant-billing",
-                    "overall_score": 5.97,
-                    "maturity_level": 1,
-                    "gaps": [
-                        {
-                            "check_id": "CL-001",
-                            "finding": "Evidence shortfall before synthesis: missing_modalities=docs",
-                            "severity": "high",
-                        }
-                    ],
-                    "aligned_practices": [],
-                    "quality_warning": "low_signal_row_sharded_merge",
-                }
-            ],
-            ["child-run-1", "child-run-2"],
-            [
-                {
-                    "repo_storage_key": "par-merchant-billing",
-                    "source": "row_sharded_merged",
-                    "source_runs": ["child-run-1", "child-run-2"],
-                    "overall_score": 5.97,
-                    "merge_level": "row",
-                    "critique_summary": {},
-                    "quality_warnings": [{"kind": "low_signal_row_sharded_merge", "message": "quality degraded"}],
-                    "rows": [
-                        {
-                            "check_id": "CL-001",
-                            "row_id": "r1",
-                            "row_index": 0,
-                            "status": "PARTIAL",
-                            "score": 0.0,
-                            "source_run_id": "child-run-1",
-                        }
-                    ],
-                }
-            ],
-        ),
-    )
-
-    result = runner.invoke(
-        cli.app,
-        [
-            "--json-only",
-            "workflow-project",
-            "--checkpointer",
-            "memory",
-            "--project-storage-key",
-            "88727304",
-            "--report-dir",
-            str(tmp_path),
-            "--profiles",
-            "zai-openai,alibaba-openai",
-            "--profile-availability",
-            "active",
-        ],
-    )
-
-    assert result.exit_code == 0, result.output
-    aggregate = json.loads((tmp_path / "project-aggregate.json").read_text(encoding="utf-8"))
-    readiness = json.loads((tmp_path / "project-readiness.json").read_text(encoding="utf-8"))
-    assert aggregate["quality_warnings"][0]["kind"] == "low_signal_row_sharded_merge"
-    assert readiness["data_quality_notes"][-1].startswith(
-        "Quality degraded: low-signal row-sharded merged results detected"
-    )
-
-
-def test_dispatch_job_identity_payload_distinguishes_row_shards() -> None:
-    job = {
-        "profile": "zai-openai",
-        "origin_profile": "zai-openai",
-        "repo_path": "/tmp/merchant-billing",
-        "repo_key": "par-merchant-billing",
-        "stage": "row_sharded",
-        "extra_target": "CL-001,CL-004",
-        "row_shard_index": 0,
-        "row_shard_count": 2,
-    }
-    identity_a = workflow_cmds._dispatch_job_identity_payload(thread_id="phase131", job=job)
-    identity_b = workflow_cmds._dispatch_job_identity_payload(
-        thread_id="phase131",
-        job={**job, "extra_target": "CL-002,CL-003", "row_shard_index": 1},
-    )
-
-    assert identity_a["dispatch_job_id"] != identity_b["dispatch_job_id"]
-    assert identity_a["lane_thread_id"] != identity_b["lane_thread_id"]
-    assert identity_a["lane_thread_id"].endswith("-shard-0")
-    assert identity_b["lane_thread_id"].endswith("-shard-1")
-
-
-def test_run_command_json_prefers_terminal_workflow_payload(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-    class _Completed:
-        returncode = 0
-        stderr = ""
-        stdout = "\n".join(
-            [
-                json.dumps({"project": "88718977", "ready": True}),
-                json.dumps(
-                    {
-                        "workflow": "project_completed",
-                        "upload_summary": {"enabled": True, "repo_pages_uploaded": 2},
-                        "confluence_aggregate_page_id": "12345",
-                    }
-                ),
-            ]
-        )
-
-    monkeypatch.setattr(subprocess, "run", lambda *args, **kwargs: _Completed())
-
-    payload = workflow_cmds._run_command_json(args=["uv", "run"], cwd=tmp_path)
-
-    assert payload["ok"] is True
-    assert payload["payload"]["workflow"] == "project_completed"
-    assert payload["payload"]["upload_summary"]["enabled"] is True
-    assert payload["payload"]["confluence_aggregate_page_id"] == "12345"
-
-
-def test_rewrite_project_workflow_summary_with_terminal_payload_updates_upload_fields(tmp_path: Path) -> None:
-    summary_path = tmp_path / "workflow-summary.json"
-    md_path = tmp_path / "workflow-summary.md"
-    summary_path.write_text(
-        json.dumps({"status": "completed", "summary": "Dispatch progress only"}, indent=2),
-        encoding="utf-8",
-    )
-    md_path.write_text("# Audit Results - thread\n\n## Summary\nDispatch only\n", encoding="utf-8")
-
-    workflow_cmds._rewrite_project_workflow_summary_with_terminal_payload(
-        run_root=tmp_path,
-        terminal_payload={
-            "workflow": "project_completed",
-            "project_page": {"page_id": "88727304", "title": "PAR"},
-            "department_page": {"page_id": "88716694", "title": "P.NTTT"},
-            "upload_to_confluence": True,
-            "confluence_parent": "88716694",
-            "upload_summary": {"enabled": True, "repo_pages_uploaded": 2, "aggregate_page_uploaded": True},
-            "confluence_repo_page_ids": {"repo-a": "111"},
-            "confluence_aggregate_page_id": "333",
-            "aggregate_report_path": "/tmp/project-aggregate.json",
-            "total_wall_clock_seconds": 12.5,
-        },
-    )
-
-    summary = json.loads(summary_path.read_text(encoding="utf-8"))
-    assert summary["upload_to_confluence"] is True
-    assert summary["project_page"] == {"page_id": "88727304", "title": "PAR"}
-    assert summary["department_page"] == {"page_id": "88716694", "title": "P.NTTT"}
-    assert summary["confluence_parent"] == "88716694"
-    assert summary["upload_summary"]["repo_pages_uploaded"] == 2
-    assert summary["confluence_aggregate_page_id"] == "333"
-    assert summary["aggregate_report_path"] == "/tmp/project-aggregate.json"
-    assert "## Upload" in md_path.read_text(encoding="utf-8")
-
-
-# ---------------------------------------------------------------------------
-# FR-148 / Phase 146: Passthrough tests for --offline, --target, --generate-pdf
-# ---------------------------------------------------------------------------
-
-
-class TestWorkflowProjectsOfflinePassthrough:
-    """Verify --offline propagates to child workflow-project jobs and sets env vars."""
-
-    def _setup_standard_mocks(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        monkeypatch.setattr(
-            workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state"
-        )
-        _patch_parent_manifest_updates(monkeypatch)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_load_manifest_payload_from_state",
-            lambda state_dsn: {"projects": [_project_payload("88727304", "PAR", "P.NTTT", "88716694")]},
-        )
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_prepare_job",
-            lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-        )
-
-    def test_offline_flag_passes_true_to_child(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--offline should pass offline=True to _run_parent_workflow_project_job."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--offline",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["offline"] is True
-
-    def test_offline_sets_env_vars(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--offline should set VDS_AUDIT_OFFLINE_MODE and VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: {
-                "ok": True,
-                "payload": {
-                    "workflow": "project_completed",
-                    "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                    "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                },
-            },
-        )
-
-        # Ensure env vars are not set before invocation
-        monkeypatch.delenv("VDS_AUDIT_OFFLINE_MODE", raising=False)
-        monkeypatch.delenv("VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT", raising=False)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--offline",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        import os
-
-        assert os.environ.get("VDS_AUDIT_OFFLINE_MODE") == "1"
-        assert os.environ.get("VDS_AUDIT_SKIP_CHECKLIST_READINESS_PREFLIGHT") == "1"
-
-    def test_no_offline_flag_defaults_to_false(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Without --offline, child should receive offline=False."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["offline"] is False
-
-
-class TestWorkflowProjectsTargetPassthrough:
-    """Verify --target propagates to child workflow-project jobs."""
-
-    def _setup_standard_mocks(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        monkeypatch.setattr(
-            workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state"
-        )
-        _patch_parent_manifest_updates(monkeypatch)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_load_manifest_payload_from_state",
-            lambda state_dsn: {"projects": [_project_payload("88727304", "PAR", "P.NTTT", "88716694")]},
-        )
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_prepare_job",
-            lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-        )
-
-    def test_target_flag_passes_to_child(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--target CL-002 should pass target='CL-002' to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--target",
-                "CL-002",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["target"] == "CL-002"
-
-    def test_target_comma_separated_passes_to_child(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--target CL-002,CL-007 should pass the full string to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--target",
-                "CL-002,CL-007",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["target"] == "CL-002,CL-007"
-
-    def test_no_target_defaults_to_none(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Without --target, child should receive target=None."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["target"] is None
-
-
-class TestWorkflowProjectsGeneratePdfPassthrough:
-    """Verify --generate-pdf/--no-generate-pdf propagates to child workflow-project jobs."""
-
-    def _setup_standard_mocks(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        monkeypatch.setattr(
-            workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state"
-        )
-        _patch_parent_manifest_updates(monkeypatch)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_load_manifest_payload_from_state",
-            lambda state_dsn: {"projects": [_project_payload("88727304", "PAR", "P.NTTT", "88716694")]},
-        )
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_prepare_job",
-            lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-        )
-
-    def test_generate_pdf_default_is_true(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Without explicit flag, generate_pdf should default to True."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["generate_pdf"] is True
-
-    def test_no_generate_pdf_passes_false_to_child(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--no-generate-pdf should pass generate_pdf=False to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--no-generate-pdf",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["generate_pdf"] is False
-
-    def test_explicit_generate_pdf_passes_true_to_child(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Explicit --generate-pdf should pass generate_pdf=True to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--generate-pdf",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["generate_pdf"] is True
-
-
-class TestWorkflowProjectsCombinedPassthrough:
-    """Verify combined --offline --target --no-generate-pdf passthrough."""
-
-    def test_all_three_new_flags_pass_through_together(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--offline --target CL-003 --no-generate-pdf should all propagate to child."""
-        monkeypatch.setattr(
-            workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state"
-        )
-        _patch_parent_manifest_updates(monkeypatch)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_load_manifest_payload_from_state",
-            lambda state_dsn: {"projects": [_project_payload("88727304", "PAR", "P.NTTT", "88716694")]},
-        )
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_prepare_job",
-            lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-        )
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--offline",
-                "--target",
-                "CL-003",
-                "--no-generate-pdf",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["offline"] is True
-        assert workflow_calls[0]["target"] == "CL-003"
-        assert workflow_calls[0]["generate_pdf"] is False
-        # Verify other defaults remain unchanged
-        assert workflow_calls[0]["failover"] is True
-        assert workflow_calls[0]["ast_grep"] is True
-        assert workflow_calls[0]["upload_to_confluence"] is False
-
-    def test_all_new_flags_with_existing_passthrough(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """New flags should coexist with existing passthrough flags like --failover, --force-rerun."""
-        monkeypatch.setattr(
-            workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state"
-        )
-        _patch_parent_manifest_updates(monkeypatch)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_load_manifest_payload_from_state",
-            lambda state_dsn: {"projects": [_project_payload("88727304", "PAR", "P.NTTT", "88716694")]},
-        )
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_prepare_job",
-            lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-        )
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--offline",
-                "--target",
-                "CL-002",
-                "--no-generate-pdf",
-                "--no-failover",
-                "--force-rerun",
-                "--no-ast-grep",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        # New passthrough
-        assert workflow_calls[0]["offline"] is True
-        assert workflow_calls[0]["target"] == "CL-002"
-        assert workflow_calls[0]["generate_pdf"] is False
-        # Existing passthrough
-        assert workflow_calls[0]["failover"] is False
-        assert workflow_calls[0]["force_rerun"] is True
-        assert workflow_calls[0]["ast_grep"] is False
-
-
-class TestWorkflowProjectsPhase155NamingHarmonization:
-    """FR-155.3: --checklist-topology, --require-confluence, --project-storage-key forwarding."""
-
-    def _setup_standard_mocks(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        monkeypatch.setattr(
-            workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state"
-        )
-        _patch_parent_manifest_updates(monkeypatch)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_load_manifest_payload_from_state",
-            lambda state_dsn: {"projects": [_project_payload("88727304", "PAR", "P.NTTT", "88716694")]},
-        )
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_prepare_job",
-            lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-        )
-
-    def _make_workflow_capture(self, monkeypatch: pytest.MonkeyPatch) -> list[dict]:
-        """Patch _run_parent_workflow_project_job to capture kwargs."""
-        workflow_calls: list[dict] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_workflow_project_job",
-            lambda **kwargs: (
-                workflow_calls.append(kwargs)
-                or {
-                    "ok": True,
-                    "payload": {
-                        "workflow": "project_completed",
-                        "dispatch_summary": {"errors": 0, "timeouts": 0, "exceptions": 0},
-                        "upload_summary": {"enabled": False, "errors": 0, "repo_pages_uploaded": 0},
-                    },
-                }
-            ),
-        )
-        return workflow_calls
-
-    # -- checklist-topology forwarding --
-
-    def test_checklist_topology_auto_forwarded(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--checklist-topology auto should be forwarded to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--checklist-topology",
-                "auto",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["checklist_topology"] == "auto"
-
-    def test_checklist_topology_fixed_forwarded(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--checklist-topology fixed should be forwarded to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--checklist-topology",
-                "fixed",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["checklist_topology"] == "fixed"
-
-    def test_checklist_topology_omitted_defaults_none(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Without --checklist-topology, child should receive None."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["checklist_topology"] is None
-
-    # -- require-confluence forwarding --
-
-    def test_require_confluence_true_forwarded(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--require-confluence should be forwarded as True to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--require-confluence",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["require_confluence"] is True
-
-    def test_no_require_confluence_forwarded(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--no-require-confluence should be forwarded as False to child."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-                "--no-require-confluence",
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["require_confluence"] is False
-
-    def test_require_confluence_omitted_defaults_none(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Without --require-confluence, child should receive None."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["require_confluence"] is None
-
-    # -- project-storage-key singular alias --
-
-    def test_singular_project_storage_key_dispatches(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """--project-storage-key (singular) should dispatch like --project-storage-keys."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-key",
-                "88727304",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        assert workflow_calls, "child workflow-project was not invoked"
-        assert workflow_calls[0]["project_storage_key"] == "88727304"
-
-    def test_singular_and_plural_keys_merged(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Both --project-storage-key and --project-storage-keys should be merged."""
-        monkeypatch.setattr(
-            workflow_cmds, "_require_consumer_state_dsn", lambda state_dsn, command: "postgresql://state"
-        )
-        _patch_parent_manifest_updates(monkeypatch)
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_load_manifest_payload_from_state",
-            lambda state_dsn: {
-                "projects": [
-                    _project_payload("88727304", "PAR", "P.NTTT", "88716694"),
-                    _project_payload("91334048", "CEP2", "P.CEP2", "88716694"),
-                ]
-            },
-        )
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_parent_prepare_job",
-            lambda **kwargs: {"ok": True, "payload": {"ready": True, "readiness_summary": []}},
-        )
-        workflow_calls = self._make_workflow_capture(monkeypatch)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--project-storage-keys",
-                "88727304",
-                "--project-storage-key",
-                "91334048",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code == 0, result.output
-        # Both projects should be dispatched
-        dispatched_keys = {call["project_storage_key"] for call in workflow_calls}
-        assert "88727304" in dispatched_keys
-        assert "91334048" in dispatched_keys
-
-    def test_neither_key_form_nor_registry_fails(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-        """Without any project key source or registry, command should fail."""
-        self._setup_standard_mocks(monkeypatch, tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "workflow-projects",
-                "--report-dir",
-                str(tmp_path),
-            ],
-        )
-
-        assert result.exit_code != 0
-
-
-class TestRunParentWorkflowProjectJobCmdBuild:
-    """Direct unit tests for _run_parent_workflow_project_job CLI arg construction (FR-155.3)."""
-
-    _BASE_KWARGS: dict = {
-        "repo_root": Path("/fake/root"),
-        "state_dsn": "postgresql://state",
-        "project_storage_key": "88727304",
-        "child_thread_id": "tid-001",
-        "child_report_dir": Path("/tmp/reports"),
-        "profiles": None,
-        "profile_availability": workflow_cmds.ProfileAvailabilityMode.ACTIVE,
-        "require_all_profiles": False,
-        "upload_to_confluence": False,
-        "confluence_parent": None,
-        "max_concurrent": 6,
-        "upload_attachments": False,
-        "incremental_upload": False,
-        "aggregate": None,
-        "force_rerun": False,
-        "advisory_search_strategy": True,
-        "ast_grep": True,
-        "cross_repo_evidence": True,
-        "knowledge_agent": True,
-        "failover": True,
-    }
-
-    def _capture_args(self, monkeypatch: pytest.MonkeyPatch, **overrides: object) -> list[str]:
-        """Call _run_parent_workflow_project_job with mocked _run_command_json and return built args."""
-        captured_args: list[list[str]] = []
-        monkeypatch.setattr(
-            workflow_cmds,
-            "_run_command_json",
-            lambda args, cwd: captured_args.append(args) or {"ok": True, "payload": {}},
-        )
-        kwargs = {**self._BASE_KWARGS, **overrides}
-        workflow_cmds._run_parent_workflow_project_job(**kwargs)
-        assert captured_args, "_run_command_json was not called"
-        return captured_args[0]
-
-    def test_checklist_topology_auto_in_args(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        args = self._capture_args(monkeypatch, checklist_topology="auto")
-        idx = args.index("--checklist-topology")
-        assert args[idx + 1] == "auto"
-
-    def test_checklist_topology_fixed_in_args(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        args = self._capture_args(monkeypatch, checklist_topology="fixed")
-        idx = args.index("--checklist-topology")
-        assert args[idx + 1] == "fixed"
-
-    def test_checklist_topology_none_omitted(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        args = self._capture_args(monkeypatch, checklist_topology=None)
-        assert "--checklist-topology" not in args
-
-    def test_require_confluence_true_in_args(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        args = self._capture_args(monkeypatch, require_confluence=True)
-        assert "--require-confluence" in args
-        assert "--no-require-confluence" not in args
-
-    def test_require_confluence_false_in_args(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        args = self._capture_args(monkeypatch, require_confluence=False)
-        assert "--no-require-confluence" in args
-        # Ensure the positive form is not also present as a separate standalone arg
-        non_negated = [a for a in args if a == "--require-confluence"]
-        assert not non_negated, "Should only have --no-require-confluence"
-
-    def test_require_confluence_none_omitted(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        args = self._capture_args(monkeypatch, require_confluence=None)
-        assert "--require-confluence" not in args
-        assert "--no-require-confluence" not in args