embeddings-cli 0.9.0__tar.gz → 0.9.1__tar.gz

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/.github/workflows/tests.yml

@@ -37,6 +37,21 @@ jobs:
         env:
           SONAR_HOST_URL: https://sonarcloud.io
 
+      # Stricter than the quality gate: any issue left Open or Confirmed fails the run.
+      # An issue marked Accepted on SonarCloud does not. The scan step above waits for
+      # the analysis (sonar.qualitygate.wait), so the issue list is complete here.
+      - name: No open SonarCloud issues
+        if: env.SONAR_TOKEN != ''
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          BRANCH_NAME: ${{ github.ref_name }}
+        run: |
+          if [ -n "$PR_NUMBER" ]; then
+            python3 scripts/sonar_open_issues.py --pull-request "$PR_NUMBER"
+          else
+            python3 scripts/sonar_open_issues.py --branch "$BRANCH_NAME"
+          fi
+
   lint:
     runs-on: ubuntu-latest
     permissions:

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/). This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.1] - 2026-11-14
+
+### Added
+
+- CI fails when SonarCloud holds an issue left Open or Confirmed for the pull request or, on main, for the branch (`scripts/sonar_open_issues.py`, run after the scan). An issue marked Accepted does not fail it.
+
+### Fixed
+
+- The 28 SonarCloud issues open on main: composite assertions split in the tests, runs of `append` replaced by `extend` in `gaps`, `map` and `regions`, and the redacted parameters of `export` built as a dict.
+
 ## [0.9.0] - 2026-11-13
 
 ### Added

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: embeddings-cli
-Version: 0.9.0
+Version: 0.9.1
 Summary: Maps the geometry of meaning produced by embedding models — survey a corpus into a semantic landscape, then inspect its regions, neighborhoods, directions, and gaps, and compare models. Backs a Surveyor agent that runs measured experiments against the space and records an evidence-backed Atlas.
 Project-URL: Homepage, https://github.com/agentculture/embeddings-cli
 Project-URL: Issues, https://github.com/agentculture/embeddings-cli/issues

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/embeddings/cli/_commands/export.py

@@ -359,7 +359,7 @@ def _provenance(atlas: Atlas, endpoint_name: str | None) -> dict:
     }
     if endpoint_name is not None:
         provenance["endpoint"] = endpoint_name
-    params = _redact(dict(manifest.params), needles)
+    params = {key: _redact(item, needles) for key, item in manifest.params.items()}
     corpus = params.get("corpus")
     if isinstance(corpus, str) and corpus:
         # The file's own name only (either separator), never the folders above it.

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/embeddings/cli/_commands/gaps.py

@@ -1003,18 +1003,24 @@ def _render(payload: dict) -> str:
         "",
     ]
     for finding in payload["corpus_coverage_findings"]:
-        lines.append(f"- [{finding['type']}] {finding['shows']}")
-        lines.append(f"  does not show: {finding['does_not_show']}")
-        lines.append(f"  asserted: {finding['asserted']} ({finding['stability_verdict']})")
-        lines.append("")
+        lines.extend(
+            [
+                f"- [{finding['type']}] {finding['shows']}",
+                f"  does not show: {finding['does_not_show']}",
+                f"  asserted: {finding['asserted']} ({finding['stability_verdict']})",
+                "",
+            ]
+        )
     if not payload["corpus_coverage_findings"]:
         lines += ["(no area of this atlas met the sparsity or void thresholds above)", ""]
 
-    lines.append(
-        f"## model representation — {payload['counts']['model_representation']} finding(s)"
+    lines.extend(
+        [
+            f"## model representation — {payload['counts']['model_representation']} finding(s)",
+            "   what probing actually showed. Only ever produced by a live probe step.",
+            "",
+        ]
     )
-    lines.append("   what probing actually showed. Only ever produced by a live probe step.")
-    lines.append("")
     if not step["requested"]:
         lines += [
             "no probe step ran (probing is off by default), so no claim about the model is "
@@ -1031,9 +1037,13 @@ def _render(payload: dict) -> str:
         ]
     else:
         for finding in payload["model_representation_findings"]:
-            lines.append(f"- [{finding['verdict']}] {finding['shows']}")
-            lines.append(f"  does not show: {finding['does_not_show']}")
-            lines.append("")
+            lines.extend(
+                [
+                    f"- [{finding['verdict']}] {finding['shows']}",
+                    f"  does not show: {finding['does_not_show']}",
+                    "",
+                ]
+            )
         if not payload["model_representation_findings"]:
             lines += ["(the probe step ran but produced no finding; see inconclusive below)", ""]
 

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/embeddings/cli/_commands/map.py

@@ -614,9 +614,13 @@ def _render_text(payload: dict) -> str:
             lines.append("re-run with --apply to write the artifact. Nothing was written.")
         lines.append("")
 
-    lines.append(payload["caveat"])
-    lines.append("")
-    lines.append("uncertain (belongs in the atlas manifest's uncertain[]):")
+    lines.extend(
+        [
+            payload["caveat"],
+            "",
+            "uncertain (belongs in the atlas manifest's uncertain[]):",
+        ]
+    )
     lines += [f"- {entry}" for entry in payload["uncertain"]]
     lines.append("")
     lines.append(reproduce_line(payload[REPRODUCED_BY_KEY]))

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/embeddings/cli/_commands/regions.py

@@ -489,9 +489,13 @@ def _render(payload: dict) -> str:
     ]
     for region in payload["regions"]:
         names = ", ".join(item["id"] for item in region["representatives"])
-        lines.append(f"region {region['id']} — {region['size']} items")
-        lines.append(f"  representatives: {names}")
-        lines.append(f"  stability:       {region['stability']['verdict']}")
+        lines.extend(
+            [
+                f"region {region['id']} — {region['size']} items",
+                f"  representatives: {names}",
+                f"  stability:       {region['stability']['verdict']}",
+            ]
+        )
         if region["finding"]:
             lines.append(f"  finding:         {region['finding']}")
         lines.append("")

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "embeddings-cli"
-version = "0.9.0"
+version = "0.9.1"
 description = "Maps the geometry of meaning produced by embedding models — survey a corpus into a semantic landscape, then inspect its regions, neighborhoods, directions, and gaps, and compare models. Backs a Surveyor agent that runs measured experiments against the space and records an evidence-backed Atlas."
 readme = "README.md"
 license = "Apache-2.0"

embeddings_cli-0.9.1/scripts/sonar_open_issues.py

@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+"""Fail when SonarCloud holds open issues for this pull request or branch.
+
+    python3 scripts/sonar_open_issues.py --pull-request 12
+    python3 scripts/sonar_open_issues.py --branch main
+
+The quality gate only looks at new code against thresholds, so a pull request can pass it
+while carrying open issues. This check is stricter: any issue whose status is Open or
+Confirmed fails the run. An issue marked Accepted (or False positive, or Fixed) does not:
+accepting an issue on SonarCloud is the way to keep it on purpose.
+
+It reads the project key from ``sonar-project.properties`` and asks SonarCloud's public
+web API for the issues of one analysis scope: a pull request (the issues its analysis
+found in the changed code) or a branch (every issue on it). CI runs it straight after
+the scan step, which waits for the analysis to finish (``sonar.qualitygate.wait``).
+
+The token, if ``SONAR_TOKEN`` is set, is sent only to SonarCloud as a bearer header and
+is never printed. Standard library only.
+
+Exit codes: 0 no open issue, 1 open issues (each one is listed), 2 the check could not
+be made (no project key, the request failed, or the answer was not understood).
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+HOST = "https://sonarcloud.io"
+OPEN_STATUSES = frozenset({"OPEN", "CONFIRMED"})
+PAGE_SIZE = 500
+#: SonarCloud serves at most 10,000 results per search; stop there and say so.
+MAX_RESULTS = 10_000
+
+
+class CheckError(Exception):
+    """The check could not be made (distinct from "open issues were found")."""
+
+
+def project_key(properties: Path) -> str:
+    """``sonar.projectKey`` from a ``sonar-project.properties`` file."""
+    try:
+        lines = properties.read_text(encoding="utf-8").splitlines()
+    except OSError as err:
+        raise CheckError(f"cannot read {properties}: {err}") from err
+    for line in lines:
+        name, sep, value = line.partition("=")
+        if sep and name.strip() == "sonar.projectKey" and value.strip():
+            return value.strip()
+    raise CheckError(f"{properties} has no sonar.projectKey")
+
+
+def fetch_json(url: str, token: str | None) -> dict:
+    """GET one page of the web API. Only ever called with a SonarCloud https URL."""
+    if not url.startswith(HOST + "/"):
+        raise CheckError("refusing to request an address outside SonarCloud")
+    request = urllib.request.Request(url, headers={"Accept": "application/json"})
+    if token:
+        request.add_header("Authorization", f"Bearer {token}")
+    try:
+        with urllib.request.urlopen(request, timeout=60) as response:  # nosec B310
+            return json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as err:
+        raise CheckError(f"SonarCloud answered HTTP {err.code} for the issue search") from err
+    except (urllib.error.URLError, TimeoutError, ValueError) as err:
+        raise CheckError(f"could not read the issue search from SonarCloud: {err}") from err
+
+
+def is_open(issue: dict) -> bool:
+    """Open or Confirmed. Accepted, False positive and Fixed are not open."""
+    status = issue.get("issueStatus") or issue.get("status") or ""
+    return str(status).upper() in OPEN_STATUSES
+
+
+def open_issues(key: str, scope: dict[str, str], token: str | None, fetch=fetch_json) -> list[dict]:
+    """Every open issue of the project in ``scope`` (``pullRequest`` or ``branch``)."""
+    found: list[dict] = []
+    page = 1
+    while True:
+        query = {"componentKeys": key, "resolved": "false", "ps": str(PAGE_SIZE), "p": str(page)}
+        query.update(scope)
+        data = fetch(f"{HOST}/api/issues/search?{urllib.parse.urlencode(query)}", token)
+        if not isinstance(data, dict) or "errors" in data or "issues" not in data:
+            detail = data.get("errors") if isinstance(data, dict) else data
+            raise CheckError(f"SonarCloud did not return an issue list: {detail}")
+        issues = data["issues"]
+        found.extend(issue for issue in issues if is_open(issue))
+        total = int(data.get("total", data.get("paging", {}).get("total", 0)))
+        if not issues or page * PAGE_SIZE >= min(total, MAX_RESULTS):
+            if total > MAX_RESULTS:
+                raise CheckError(f"more than {MAX_RESULTS} issues; the list is incomplete")
+            return found
+        page += 1
+
+
+def describe(issue: dict) -> str:
+    component = str(issue.get("component", ""))
+    path = component.split(":", 1)[1] if ":" in component else component
+    line = issue.get("line")
+    where = f"{path}:{line}" if line else path
+    return (
+        f"{where}  {issue.get('rule', '?')}  "
+        f"{str(issue.get('severity', '')).lower()}  {issue.get('message', '')}"
+    )
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    scope = parser.add_mutually_exclusive_group(required=True)
+    scope.add_argument("--pull-request", metavar="<number>", help="check this pull request")
+    scope.add_argument("--branch", metavar="<name>", help="check this branch")
+    parser.add_argument(
+        "--properties",
+        type=Path,
+        default=Path(__file__).resolve().parents[1] / "sonar-project.properties",
+        help="the sonar-project.properties to read the project key from",
+    )
+    args = parser.parse_args(argv)
+    where = {"pullRequest": args.pull_request} if args.pull_request else {"branch": args.branch}
+    label = f"pull request {args.pull_request}" if args.pull_request else f"branch {args.branch}"
+    try:
+        key = project_key(args.properties)
+        issues = open_issues(key, where, os.environ.get("SONAR_TOKEN") or None)
+    except CheckError as err:
+        print(f"sonar-open-issues: could not check {label}: {err}", file=sys.stderr)
+        return 2
+    if not issues:
+        print(f"sonar-open-issues: no open issue on {label} of {key}")
+        return 0
+    print(f"sonar-open-issues: {len(issues)} open issue(s) on {label} of {key}:", file=sys.stderr)
+    for issue in issues:
+        print("  " + describe(issue), file=sys.stderr)
+    print(
+        "fix each one, or mark it Accepted on SonarCloud if it is kept on purpose",
+        file=sys.stderr,
+    )
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_backend_client.py

@@ -247,7 +247,8 @@ def test_short_data_list_raises_cli_error_code_2() -> None:
         client.embed(["hello", "world"])
 
     assert exc_info.value.code == EXIT_ENV_ERROR
-    assert "1" in exc_info.value.message and "2" in exc_info.value.message
+    assert "1" in exc_info.value.message
+    assert "2" in exc_info.value.message
     assert "one embedding per input" in exc_info.value.remediation
 
 
@@ -461,10 +462,12 @@ def test_no_socket_opened_when_transport_is_injected(monkeypatch: pytest.MonkeyP
 
 def test_endpoint_help_text_states_off_machine_implication() -> None:
     lowered = ENDPOINT_HELP.lower()
-    assert "off" in lowered and "machine" in lowered
+    assert "off" in lowered
+    assert "machine" in lowered
     assert DEFAULT_BASE_URL in ENDPOINT_HELP
     assert ENV_BASE_URL in ENDPOINT_HELP
-    assert isinstance(ENDPOINT_FLAG, str) and ENDPOINT_FLAG.startswith("--")
+    assert isinstance(ENDPOINT_FLAG, str)
+    assert ENDPOINT_FLAG.startswith("--")
 
 
 # --------------------------------------------------------------------------

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_cli_contract.py

@@ -213,7 +213,8 @@ def test_every_subcommand_invalid_flag_is_a_structured_error_json_mode(
     ), f"'embeddings {' '.join(path)} --json {_BOGUS_FLAG}' leaked a result onto stdout"
     payload = json.loads(captured.err)
     assert payload["code"] == 1
-    assert isinstance(payload["message"], str) and payload["message"]
+    assert isinstance(payload["message"], str)
+    assert payload["message"]
     assert "remediation" in payload
 
 

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_corpus.py

@@ -237,7 +237,8 @@ def test_duplicate_ids_are_refused_naming_both_lines(tmp_path) -> None:
         load_corpus(path)
     assert exc.value.code == 1
     # Both the offending line and the first occurrence, so the fix is obvious.
-    assert "3" in exc.value.message and "1" in exc.value.message
+    assert "3" in exc.value.message
+    assert "1" in exc.value.message
     assert "shared" in exc.value.message
     assert "unique" in exc.value.remediation
 

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_directions.py

@@ -143,10 +143,12 @@ def test_directions_overview_json_returns_the_sections_payload(
 ) -> None:
     payload = _run_json(capsys, ["directions", "overview", "--json"])
     assert payload["subject"] == "embeddings-cli directions"
-    assert isinstance(payload["sections"], list) and payload["sections"]
+    assert isinstance(payload["sections"], list)
+    assert payload["sections"]
     for section in payload["sections"]:
         assert section["title"]
-        assert isinstance(section["items"], list) and section["items"]
+        assert isinstance(section["items"], list)
+        assert section["items"]
 
 
 def test_bare_directions_json_matches_overview_json(capsys: pytest.CaptureFixture[str]) -> None:
@@ -364,7 +366,8 @@ def test_holdout_pairs_are_disjoint_from_the_pairs_the_direction_was_derived_fro
 
     train = {(entry["a"], entry["b"]) for entry in candidate["train"]["pairs_used"]}
     holdout = {(entry["a"], entry["b"]) for entry in candidate["holdout"]["pairs_used"]}
-    assert train and holdout
+    assert train
+    assert holdout
     assert not (train & holdout)
     assert len(train) + len(holdout) == PAIR_COUNT
     assert payload["pairs"]["train"] == len(train)
@@ -432,7 +435,8 @@ def test_a_planted_direction_is_stable_across_seed_reruns(
     payload = _run_json(capsys, _discover(planted_atlas, pairs, "--top", "1", "--runs", "4"))
     stability = payload["candidates"][0]["stability"]
     assert stability["verified"] is True
-    assert stability["score"] is not None and stability["score"] > 0.5
+    assert stability["score"] is not None
+    assert stability["score"] > 0.5
 
 
 # --------------------------------------------------------------------------

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_export.py

@@ -383,7 +383,8 @@ def test_a_nan_in_metadata_is_refused_not_written_as_broken_json(tmp_path, capsy
     rc, err = run(capsys, "--atlas", str(target), "--out", str(out), "--apply")
     assert rc == 1
     assert "JSON" in err["message"]
-    assert not out.exists() and not (tmp_path / "v.f32").exists()
+    assert not out.exists()
+    assert not (tmp_path / "v.f32").exists()
 
 
 def test_a_seed_beyond_the_viewers_integer_range_is_refused(tmp_path, capsys) -> None:
@@ -408,8 +409,10 @@ def test_a_value_that_overflows_float32_is_refused(tmp_path, capsys) -> None:
     out = tmp_path / "v.json"
     rc, err = run(capsys, "--atlas", str(target), "--out", str(out), "--apply")
     assert rc == 2
-    assert "doc-2" in err["message"] and "float32" in err["message"]
-    assert not out.exists() and not (tmp_path / "v.f32").exists()
+    assert "doc-2" in err["message"]
+    assert "float32" in err["message"]
+    assert not out.exists()
+    assert not (tmp_path / "v.f32").exists()
 
 
 def test_atlas_without_vectors_is_refused_with_a_survey_hint(tmp_path: Path, capsys) -> None:
@@ -799,7 +802,8 @@ def test_no_group_is_written_without_group_by(atlas: Path, tmp_path: Path, capsy
     out = tmp_path / "v.json"
     rc, payload = run(capsys, "--atlas", str(atlas), "--out", str(out), "--apply")
     assert rc == 0
-    assert payload["group_by"] is None and payload["groups"] == 0
+    assert payload["group_by"] is None
+    assert payload["groups"] == 0
     data, _ = load_pair(out)
     assert all("group" not in point for point in data["points"])
 
@@ -813,7 +817,8 @@ def test_group_by_writes_each_points_group_from_metadata(
     )
     assert rc == 0
     assert payload["group_by"] == "topic"
-    assert payload["groups"] == 3 and payload["grouped_points"] == 12
+    assert payload["groups"] == 3
+    assert payload["grouped_points"] == 12
     assert check_pair(out) == []
     data, _ = load_pair(out)
     assert [point["group"] for point in data["points"]] == [f"topic-{i % 3}" for i in range(12)]
@@ -837,7 +842,8 @@ def test_group_by_leaves_records_without_a_usable_value_ungrouped(tmp_path: Path
         capsys, "--atlas", str(target), "--out", str(out), "--apply", "--group-by", "kind"
     )
     assert rc == 0, payload
-    assert payload["grouped_points"] == 2 and payload["groups"] == 2
+    assert payload["grouped_points"] == 2
+    assert payload["groups"] == 2
     data, _ = load_pair(out)
     assert [point.get("group") for point in data["points"]] == ["alpha", "7"] + [None] * 4
     assert check_pair(out) == []
@@ -850,7 +856,8 @@ def test_group_by_a_key_no_record_carries_is_refused(atlas: Path, tmp_path: Path
     )
     assert rc == 1
     assert "topik" in payload["message"]
-    assert not out.exists() and not (tmp_path / "v.f32").exists()
+    assert not out.exists()
+    assert not (tmp_path / "v.f32").exists()
 
 
 def test_group_by_with_labels_only_is_refused(atlas: Path, tmp_path: Path, capsys) -> None:
@@ -875,6 +882,7 @@ def test_the_corpus_path_is_reduced_to_its_file_name(tmp_path: Path, capsys) ->
     rc, _ = run(capsys, "--atlas", str(target), "--out", str(out), "--apply")
     assert rc == 0
     raw = out.read_bytes()
-    assert b"someone" not in raw and b"private-project" not in raw
+    assert b"someone" not in raw
+    assert b"private-project" not in raw
     data, _ = load_pair(out)
     assert data["provenance"]["params"]["corpus"] == "corpus.jsonl"

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_gaps.py

@@ -580,7 +580,8 @@ def test_probe_flag_without_a_source_is_a_user_error(
 
     assert code == 1
     err = capsys.readouterr().err
-    assert "--probes" in err and "--holdout" in err
+    assert "--probes" in err
+    assert "--holdout" in err
 
 
 def test_missing_probes_file_is_a_user_error(

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_neighbors.py

@@ -473,7 +473,8 @@ def test_boundary_reports_the_largest_gap_between_b_c_and_c_d(
     assert boundary["gaps"] == pytest.approx(expected_gaps, abs=1e-6)
     assert boundary["largest_gap_index"] == expected_gaps.index(max(expected_gaps))
     assert boundary["largest_gap"] == pytest.approx(max(expected_gaps), abs=1e-6)
-    assert isinstance(boundary["note"], str) and boundary["note"]
+    assert isinstance(boundary["note"], str)
+    assert boundary["note"]
 
 
 def test_boundary_with_fewer_than_two_neighbors_reports_no_gap(

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_numeric.py

@@ -55,7 +55,8 @@ def test_distances_are_correct_and_bounded() -> None:
     assert distances[0] == pytest.approx(0.0)
     assert distances[1] == pytest.approx(1.0)
     assert distances[2] == pytest.approx(2.0)
-    assert np.all(distances >= 0.0) and np.all(distances <= 2.0)
+    assert np.all(distances >= 0.0)
+    assert np.all(distances <= 2.0)
 
 
 def test_an_identical_vector_never_yields_a_negative_distance() -> None:

{embeddings_cli-0.9.0 → embeddings_cli-0.9.1}/tests/test_regions.py

@@ -332,7 +332,8 @@ def test_single_run_regions_are_unverified_findings_about_the_parameters(
         assert region["stability"]["verdict"] == VERDICT_UNVERIFIED
         assert region["stability"]["score"] is None
         finding = region["finding"]
-        assert isinstance(finding, str) and finding
+        assert isinstance(finding, str)
+        assert finding
         assert "parameters" in finding
         assert "k=3" in finding
         assert "not" in finding

embeddings_cli-0.9.1/tests/test_sonar_gate.py

@@ -0,0 +1,152 @@
+"""The CI check that fails on open SonarCloud issues (scripts/sonar_open_issues.py).
+
+No request leaves the machine: the fetch function is replaced by a fake.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = REPO_ROOT / "scripts" / "sonar_open_issues.py"
+
+spec = importlib.util.spec_from_file_location("sonar_open_issues", SCRIPT)
+gate = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(gate)
+
+
+def issue(status: str, n: int = 1, legacy: bool = False) -> dict:
+    record = {
+        "rule": "python:S9073",
+        "severity": "MAJOR",
+        "component": "agentculture_demo:tests/test_x.py",
+        "line": n,
+        "message": f"message {n}",
+    }
+    record["status" if legacy else "issueStatus"] = status
+    return record
+
+
+def fake(pages: list[dict]):
+    calls: list[tuple[str, str | None]] = []
+
+    def fetch(url: str, token: str | None) -> dict:
+        calls.append((url, token))
+        return pages[min(len(calls), len(pages)) - 1]
+
+    return fetch, calls
+
+
+def test_project_key_is_read_from_this_repos_properties() -> None:
+    assert gate.project_key(REPO_ROOT / "sonar-project.properties") == "agentculture_embeddings-cli"
+
+
+def test_project_key_missing_is_a_check_error(tmp_path: Path) -> None:
+    (tmp_path / "p").write_text("sonar.organization=x\n", encoding="utf-8")
+    with pytest.raises(gate.CheckError):
+        gate.project_key(tmp_path / "p")
+    with pytest.raises(gate.CheckError):
+        gate.project_key(tmp_path / "absent")
+
+
+@pytest.mark.parametrize(
+    "status,is_open",
+    [
+        ("OPEN", True),
+        ("CONFIRMED", True),
+        ("ACCEPTED", False),
+        ("FALSE_POSITIVE", False),
+        ("FIXED", False),
+    ],
+)
+def test_only_open_and_confirmed_count(status: str, is_open: bool) -> None:
+    assert gate.is_open(issue(status)) is is_open
+    assert gate.is_open(issue(status, legacy=True)) is is_open
+
+
+def test_scope_and_project_are_sent_and_accepted_issues_are_ignored() -> None:
+    fetch, calls = fake([{"total": 3, "issues": [issue("OPEN", 1), issue("ACCEPTED", 2)]}])
+    found = gate.open_issues("agentculture_demo", {"pullRequest": "12"}, "secret", fetch)
+    assert [i["line"] for i in found] == [1]
+    url, token = calls[0]
+    assert url.startswith("https://sonarcloud.io/api/issues/search?")
+    assert "componentKeys=agentculture_demo" in url
+    assert "pullRequest=12" in url
+    assert token == "secret"
+    assert "secret" not in url
+
+
+def test_every_page_is_read() -> None:
+    first = {
+        "total": gate.PAGE_SIZE + 2,
+        "issues": [issue("OPEN", n) for n in range(gate.PAGE_SIZE)],
+    }
+    second = {"total": gate.PAGE_SIZE + 2, "issues": [issue("OPEN", 900), issue("CONFIRMED", 901)]}
+    fetch, calls = fake([first, second])
+    found = gate.open_issues("k", {"branch": "main"}, None, fetch)
+    assert len(found) == gate.PAGE_SIZE + 2
+    assert len(calls) == 2
+    assert "p=2" in calls[1][0]
+
+
+def test_an_error_answer_is_a_check_error_not_a_pass() -> None:
+    fetch, _ = fake([{"errors": [{"msg": "Component key not found"}]}])
+    with pytest.raises(gate.CheckError):
+        gate.open_issues("k", {"branch": "main"}, None, fetch)
+
+
+def test_requests_outside_sonarcloud_are_refused() -> None:
+    with pytest.raises(gate.CheckError):
+        gate.fetch_json("http://127.0.0.1:9/api/issues/search", None)
+
+
+def run(monkeypatch, capsys, pages, argv, token="tok-do-not-print"):
+    fetch, _ = fake(pages)
+    monkeypatch.setattr(gate, "fetch_json", fetch)
+    if token:
+        monkeypatch.setenv("SONAR_TOKEN", token)
+    real = gate.open_issues
+    monkeypatch.setattr(gate, "open_issues", lambda k, s, t: real(k, s, t, fetch))
+    code = gate.main(argv)
+    out = capsys.readouterr()
+    assert token not in out.out + out.err
+    return code, out
+
+
+def test_exit_0_when_nothing_is_open(monkeypatch, capsys) -> None:
+    code, out = run(monkeypatch, capsys, [{"total": 1, "issues": [issue("ACCEPTED")]}],
+                    ["--pull-request", "7"])  # fmt: skip
+    assert code == 0
+    assert "no open issue on pull request 7" in out.out
+
+
+def test_exit_1_lists_each_open_issue(monkeypatch, capsys) -> None:
+    pages = [{"total": 2, "issues": [issue("OPEN", 11), issue("CONFIRMED", 22)]}]
+    code, out = run(monkeypatch, capsys, pages, ["--branch", "main"])
+    assert code == 1
+    assert "2 open issue(s) on branch main" in out.err
+    assert "tests/test_x.py:11" in out.err
+    assert "tests/test_x.py:22" in out.err
+    assert "Accepted" in out.err
+
+
+def test_exit_2_when_the_check_cannot_be_made(monkeypatch, capsys) -> None:
+    code, out = run(monkeypatch, capsys, [{"errors": [{"msg": "nope"}]}], ["--branch", "main"])
+    assert code == 2
+    assert "could not check branch main" in out.err
+
+
+def test_the_workflow_runs_the_check_after_the_scan() -> None:
+    text = (REPO_ROOT / ".github" / "workflows" / "tests.yml").read_text(encoding="utf-8")
+    scan = text.index("SonarCloud Scan")
+    check = text.index("scripts/sonar_open_issues.py")
+    assert scan < check
+    # Guarded like the scan itself: no token, no scan, no check.
+    step = text[text.rindex("- name:", 0, check) : check]
+    assert "env.SONAR_TOKEN != ''" in step
+    assert "sonar.qualitygate.wait=true" in (REPO_ROOT / "sonar-project.properties").read_text(
+        encoding="utf-8"
+    )