maintainability-agent 3.7.7__tar.gz → 3.7.8__tar.gz

{maintainability_agent-3.7.7/src/maintainability_agent.egg-info → maintainability_agent-3.7.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.7
+Version: 3.7.8
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -46,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.7**.
+Version **3.7.8**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -473,7 +473,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v3.7.7
+- uses: marshallguillory86/maintainability-agent@v3.7.8
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.7**.
+Version **3.7.8**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -432,7 +432,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v3.7.7
+- uses: marshallguillory86/maintainability-agent@v3.7.8
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "3.7.7"
+version = "3.7.8"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 3.7.7
+Version: 3.7.8
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -46,7 +46,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **3.7.7**.
+Version **3.7.8**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Go, Rust, PHP, Ruby, Swift,
 COBOL, Fortran (free-form *and* fixed-form), and the JS/TS/HTML family — each
@@ -473,7 +473,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v3.7.7
+- uses: marshallguillory86/maintainability-agent@v3.7.8
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -203,11 +203,13 @@ tests/test_claimed_languages.py
 tests/test_cli.py
 tests/test_clone_group_class.py
 tests/test_cobol_declarations.py
+tests/test_code_scanning_gets_alerts_not_the_record.py
 tests/test_cognitive_complexity.py
 tests/test_cohort_statistics.py
 tests/test_concealment_properties.py
 tests/test_config_shape.py
 tests/test_consent_and_grant.py
+tests/test_consent_without_command_has_a_remedy.py
 tests/test_consumer_migration.py
 tests/test_contract_claims.py
 tests/test_corroborate.py
@@ -224,6 +226,7 @@ tests/test_declaration_grading.py
 tests/test_declaration_ranges.py
 tests/test_declaration_source.py
 tests/test_declarative_parsers.py
+tests/test_declared_capabilities_match_the_delegate.py
 tests/test_declared_imports.py
 tests/test_delegated_security_pillar.py
 tests/test_demo_tree.py
@@ -344,6 +347,7 @@ tests/test_scope_conformance.py
 tests/test_scoring_calibration.py
 tests/test_security_delegate_versions_agree.py
 tests/test_security_findings_keep_their_handoff.py
+tests/test_security_pillar_asserts_a_scanner_set.py
 tests/test_security_pillar_runs_and_shows.py
 tests/test_semantic_findings_stay_inside_the_audited_files.py
 tests/test_semantic_policy.py

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "3.7.7"
+__version__ = "3.7.8"

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/src/maintainability_audit/_mcp_gate.py

@@ -18,6 +18,7 @@ from pathlib import Path
 from typing import Any
 
 from ._mcp_setup import run_tests_pending, setup_pending, setup_questions
+from ._test_execution import consented_without_command
 from ._user_config import mark_repo_seen
 from .config import VERSION, load_config
 
@@ -100,6 +101,16 @@ def _choose_next(root: Path) -> dict[str, Any]:
             "own test suite for a coverage reading (test effectiveness). "
             "Choose reconfigure to set it up."
         )
+    elif consented_without_command():
+        # The opt-in was answered yes and the command never reached the
+        # person's tier, so `run_tests_pending` reads it as asked-and-done
+        # and said nothing. The suite then does not run on any audit, and
+        # the report explained the refusal without naming a remedy.
+        prompt += (
+            " Note: this host is opted in to running the test suite, but no "
+            "test command is recorded for it, so no suite runs. Choose "
+            "reconfigure to record the command."
+        )
     result["choice_needed"] = {
         "name": "next_action",
         "prompt": prompt,

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/src/maintainability_audit/_security_delegate.py

@@ -61,9 +61,17 @@ from ._runner import Invocation, Outcome, run
 #: `paths:` globs against absolute finding paths. This audit always hands it an
 #: absolute root, so under 0.12.1 every reviewed `paths:` suppression is ignored
 #: and its finding counts as live in the pillar every skin shows (D179).
-SUPPORTED_FLOOR = (0, 12, 2)
+#:
+#: **Raised to 0.12.7 by D186.** The delegate config now declares what this
+#: tool is — `capabilities` — and secure-code-agent sweeps unknown top-level
+#: keys strictly, so anything below 0.12.6 refuses the configuration outright
+#: rather than ignoring the key: the audit would not run at all. 0.12.6 runs
+#: it and prints no reason under the declared axes (its D25), which is a grade
+#: moved in silence. The floor is the first release where the declaration is
+#: both accepted and disclosed.
+SUPPORTED_FLOOR = (0, 12, 7)
 SUPPORTED_CEILING = (1,)
-REQUIREMENT = "secure-code-agent>=0.12.2,<1"
+REQUIREMENT = "secure-code-agent>=0.12.7,<1"
 
 #: How long the child may run before the pillar is reported as unmeasured.
 DEFAULT_TIMEOUT_SECONDS = 300

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/src/maintainability_audit/_test_execution.py

@@ -113,6 +113,25 @@ def opted_in_command() -> list[str]:
     return list(command) if isinstance(command, list) else []
 
 
+def consented_without_command() -> bool:
+    """Opted in to running the suite, with no command in the person's tier.
+
+    `run_tests_pending` covers the config written before the opt-in existed:
+    no `test_execution` key at all, so the question was never asked. This
+    covers the state after it — the answer is recorded, `requested` is true,
+    and `expected_commands.test` never reached the user tier because setup
+    captured the consent without capturing the program.
+
+    Neither surface said anything about it. The report explained why nothing
+    ran and named no remedy, and the MCP gate treats a present `test_execution`
+    key as asked-and-answered, so it offered no discovery line either. A person
+    who said yes got silence on every door.
+    """
+    answers = user_config_answers() or {}
+    requested = bool((answers.get("test_execution") or {}).get("requested"))
+    return requested and not opted_in_command()
+
+
 def _bounded_suite_timeout(configured: Any) -> int:
     """A suite timeout the audited tree cannot weaponise.
 
@@ -153,7 +172,9 @@ def run_test_suite(root: Path, config: dict[str, Any]) -> dict[str, Any] | None:
             "ran": False, "exit_code": None, "passed": False,
             "detail": (
                 "opted in, but no test command is recorded in the user tier; "
-                "the repository's documented command is not run on its own say-so"
+                "the repository's documented command is not run on its own say-so. "
+                "Reconfigure to record the command you consent to, or add it to "
+                "expected_commands.test in the user configuration"
             ),
             "coverage_percent": None,
         }

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/src/maintainability_audit/config.py

@@ -20,7 +20,7 @@ from ._operator_reads import (
 # still the door every caller comes through.
 __all__ = ["DEFAULT_CONFIG", "DEFAULT_IDIOM_GROUPS", "PROJECT_URL", "VERSION"]
 
-VERSION = "3.7.7"
+VERSION = "3.7.8"
 
 PROJECT_URL = "https://github.com/marshallguillory86/maintainability-agent"
 

maintainability_agent-3.7.8/tests/test_code_scanning_gets_alerts_not_the_record.py

@@ -0,0 +1,83 @@
+"""What this repository uploads to code scanning is what should become an alert (D187).
+
+secure-code-agent writes two SARIF documents (its D22). `--sarif-output` is the
+record: every result, a suppressed one carrying its `suppressions` entry and
+reason. `--code-scanning-sarif-output` is the same document without the
+suppressed results — the test tree, documentation, and every reviewed
+`.scignore.yaml` entry.
+
+The difference matters because code scanning opens an alert for every result it
+is handed, `suppressions` array or not, and this repository's branch protection
+requires every resulting review thread resolved before a merge. Uploading the
+record put seventeen threads on one pull request, all of them `assert` in a
+pytest file, and blocked it. That is not a one-off: it is the outcome for every
+pull request that adds a test, forever, and the shape secure-code-agent already
+fixed upstream and this repository had not adopted.
+
+Nothing is hidden by the change. The record is still written, still kept as a
+build artifact, and still carries every finding; so do the JSON report, the
+Markdown report and the work order. What changes is which document becomes
+somebody's blocking alert.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOWS = ROOT / ".github" / "workflows"
+
+#: The record. Never the thing uploaded to code scanning.
+_RECORD = "secure-code.sarif"
+#: The filtered document, which is.
+_FILTERED = "secure-code.code-scanning.sarif"
+
+
+def _uploads() -> list[tuple[str, str]]:
+    """Every `sarif_file:` value handed to the code-scanning upload action."""
+    found = []
+    for path in sorted(WORKFLOWS.glob("*.yml")):
+        for match in re.finditer(r"^\s*sarif_file:\s*(\S+)\s*$", path.read_text(encoding="utf-8"), re.MULTILINE):
+            found.append((path.name, match.group(1)))
+    return found
+
+
+def test_the_security_record_is_never_uploaded_to_code_scanning() -> None:
+    """The record carries the test tree; code scanning turns each one into a thread."""
+    uploads = _uploads()
+    assert uploads, "no workflow uploads SARIF; this sweep would pass vacuously"
+    record = [(name, value) for name, value in uploads if value == _RECORD]
+    assert not record, (
+        f"the full secure-code-agent record is uploaded to code scanning: {record}. "
+        "Every suppressed finding becomes an alert, and under this repository's "
+        "required-conversation-resolution policy, a blocking review thread."
+    )
+
+
+def test_the_filtered_document_is_what_is_uploaded() -> None:
+    """Proving the record is absent is not proving the right file is present."""
+    uploaded = {value for _, value in _uploads()}
+    assert _FILTERED in uploaded, (
+        f"no workflow uploads {_FILTERED}; the security findings that should "
+        "become alerts would reach code scanning from nowhere"
+    )
+
+
+def test_the_audit_asks_the_delegate_to_write_the_filtered_document() -> None:
+    """An upload step naming a file nothing writes fails the job, loudly but late."""
+    writing = [
+        path.name
+        for path in sorted(WORKFLOWS.glob("*.yml"))
+        if f"--code-scanning-sarif-output {_FILTERED}" in path.read_text(encoding="utf-8")
+    ]
+    assert writing, (
+        f"no workflow passes --code-scanning-sarif-output {_FILTERED}; the upload "
+        "step would name a file the security audit never produced"
+    )
+
+
+def test_the_filtered_document_is_not_committed() -> None:
+    """Generated per run, like every other audit output this repository writes."""
+    ignored = (ROOT / ".gitignore").read_text(encoding="utf-8").splitlines()
+    assert _FILTERED in ignored, f"{_FILTERED} is not in .gitignore"

maintainability_agent-3.7.8/tests/test_consent_without_command_has_a_remedy.py

@@ -0,0 +1,66 @@
+"""Consent to run the suite, with no command, must name a way out (D185).
+
+`test_execution.requested` true with no `expected_commands.test` in the user
+tier is a reachable state: setup recorded the answer without recording the
+program. In that state no suite runs on any audit.
+
+Neither surface said what to do about it. The report explained the refusal and
+stopped there, and the MCP gate treats a present `test_execution` key as
+asked-and-answered, so `run_tests_pending` is false and no discovery line is
+offered. A person who opted in got silence on every door, which is how this
+repository's own audit reported "it did not run" for weeks.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from maintainability_audit import _mcp_gate, _test_execution
+
+
+@pytest.fixture
+def consented(monkeypatch):
+    """User tier that opted in and carries no command."""
+    monkeypatch.setattr(
+        _test_execution, "user_config_answers",
+        lambda: {"test_execution": {"requested": True}})
+    return None
+
+
+def test_the_report_detail_names_a_remedy(consented, tmp_path):
+    """The operator is told how to fix it, not only why it happened."""
+    result = _test_execution.run_test_suite(
+        tmp_path,
+        {"test_execution": {"requested": True},
+         "expected_commands": {"test": ["pytest", "-q"]}})
+
+    assert result is not None and result["ran"] is False
+    detail = result["detail"].lower()
+    assert "reconfigure" in detail or "expected_commands" in detail, (
+        f"the refusal names no remedy: {result['detail']!r}")
+
+
+def test_the_predicate_sees_consent_without_a_command(consented):
+    """`run_tests_pending` cannot see this state; this is what does."""
+    assert _test_execution.consented_without_command() is True
+
+
+def test_a_recorded_command_is_not_reported_as_missing(monkeypatch):
+    """The predicate is about the gap, not about opting in."""
+    monkeypatch.setattr(
+        _test_execution, "user_config_answers",
+        lambda: {"test_execution": {"requested": True},
+                 "expected_commands": {"test": ["pytest", "-q"]}})
+    assert _test_execution.consented_without_command() is False
+
+
+def test_the_mcp_gate_offers_reconfigure_for_the_gap(consented, monkeypatch, tmp_path):
+    """The chat door surfaces it too, where `run_tests_pending` is false."""
+    monkeypatch.setattr(_mcp_gate, "run_tests_pending", lambda root: False)
+
+    result = _mcp_gate._choose_next(Path(tmp_path))
+
+    prompt = (result.get("choice_needed") or {}).get("prompt", "").lower()
+    assert "no test command is recorded" in prompt, (
+        f"the gate says nothing about the gap: {prompt!r}")

maintainability_agent-3.7.8/tests/test_declared_capabilities_match_the_delegate.py

@@ -0,0 +1,118 @@
+"""The capabilities this repository declares are ones its delegate will honour (D186).
+
+The security pillar graded 3.82 (B+) on 68 true, permanent reports about what
+this tool is: it spawns analyzer subprocesses, reads analyzer XML it did not
+write, calls the SonarCloud API, and seeds a calibration bootstrap. None is a
+defect and none is going to change.
+
+`secure-code-agent.json` now declares those four, so they are reported on their
+own axes rather than scored. That declaration is only worth anything if the
+delegate actually honours it, and two ways of getting it wrong are silent from
+this side:
+
+* A capability name the delegate does not know declares nothing. The delegate
+  refuses it at config load, so it fails the audit rather than passing
+  quietly — but it fails in CI, and catching it here is cheaper.
+* A delegate below the floor **refuses the whole configuration** on the
+  unknown `capabilities` key, so the audit does not run — and one at 0.12.6
+  routes the findings while printing no reason, which is the grade moved in
+  silence that declaring was supposed to replace (secure-code-agent D25).
+
+These read the checked-in config against the pinned range, so neither can
+drift without the suite saying so.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+#: The first release where a declaration is both *accepted* and *disclosed*.
+#: 0.12.6 accepts it and prints no reason under the axis.
+_DISCLOSING_FLOOR = (0, 12, 7)
+
+#: Every capability name secure-code-agent 0.12.7 defines.
+#:
+#: Copied, not imported. The two tools are independently releasable (ADR 008)
+#: and this suite does not import the delegate, which the declared-imports
+#: sweep enforces, and is right to.
+#:
+#: So this is a second source of truth, and the honest thing is to say what
+#: guards it rather than to pretend it is derived. The delegate itself refuses
+#: a capability name it does not define, loudly, at config load: a name that
+#: drifts out of this set fails the security audit rather than passing it
+#: quietly. This set exists to catch the typo in the suite instead of in CI,
+#: not to be the authority on what the delegate defines.
+_KNOWN_CAPABILITIES = frozenset(
+    {
+        "spawns_processes",
+        "parses_untrusted_xml",
+        "fetches_remote_urls",
+        "uses_nondeterministic_randomness",
+    }
+)
+
+
+def _config() -> dict:
+    return json.loads((ROOT / "secure-code-agent.json").read_text(encoding="utf-8"))
+
+
+def test_every_declared_capability_is_one_the_delegate_defines() -> None:
+    """A name this repository invented routes nothing and reads as a decision."""
+    declared = set(_config().get("capabilities", {}))
+    assert declared, "nothing is declared; D186 records four and this would pass vacuously"
+    unknown = sorted(declared - _KNOWN_CAPABILITIES)
+    assert not unknown, (
+        f"declared capabilities the delegate does not define: {unknown}; "
+        "these route no finding and account for nothing"
+    )
+
+
+def test_every_declaration_states_a_reason() -> None:
+    """The reason is what a reviewer reads to decide the declaration is still true."""
+    declared = _config().get("capabilities", {})
+    assert declared, (
+        "nothing is declared, so this sweep would pass over an empty loop; "
+        "D186 records four declarations and this test exists to hold their reasons"
+    )
+    for name, reason in declared.items():
+        assert isinstance(reason, str) and reason.strip(), f"{name} declares no reason"
+        assert len(reason.strip()) >= 40, (
+            f"{name}'s reason is too short to be one: {reason!r}. "
+            "A declaration without a statement of why is a skip with extra steps."
+        )
+
+
+def test_declaring_capabilities_raised_the_supported_floor() -> None:
+    """Below 0.12.7 the declaration is refused outright, or accepted and unstated."""
+    from maintainability_audit._security_delegate import SUPPORTED_FLOOR
+
+    assert _config().get("capabilities"), "nothing declared; the coupling would not exist"
+    assert SUPPORTED_FLOOR >= _DISCLOSING_FLOOR, (
+        f"this repository declares capabilities but admits secure-code-agent "
+        f"{'.'.join(map(str, SUPPORTED_FLOOR))}, which either refuses the whole "
+        "configuration on the unknown key or routes the findings without printing "
+        "the reason"
+    )
+
+
+def test_no_ci_pin_predates_the_disclosing_release() -> None:
+    """The floor is a declaration; the pins are what actually runs."""
+    pin = re.compile(r"secure-code-agent(?:\[[^\]]+\])?==([0-9][0-9.]*)")
+    pins = [
+        (path.name, found)
+        for path in sorted((ROOT / ".github" / "workflows").glob("*.yml"))
+        for found in pin.findall(path.read_text(encoding="utf-8"))
+    ]
+    assert pins, "no workflow pins the delegate; this sweep would pass vacuously"
+    stale = [
+        (name, found)
+        for name, found in pins
+        if tuple(int(part) for part in found.split(".")) < _DISCLOSING_FLOOR
+    ]
+    assert not stale, (
+        f"CI pins a delegate that will not disclose this repository's declarations: {stale}"
+    )

{maintainability_agent-3.7.7 → maintainability_agent-3.7.8}/tests/test_security_delegate_versions_agree.py

@@ -18,6 +18,13 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
 
+#: A pinned install of the delegate, with or without extras. The job that runs
+#: the security gate installs `secure-code-agent[required-scanners]==X` so the
+#: scanners named in `gates.require_scanners` exist on the runner; a pattern
+#: anchored on a bare `secure-code-agent==` stopped seeing that job's pin
+#: entirely, which would have let the gate job drift unwatched.
+_PIN = r"secure-code-agent(?:\[[^\]]+\])?==([0-9][0-9.]*)"
+
 
 def _version_tuple(text: str) -> tuple[int, ...]:
     return tuple(int(part) for part in text.split("."))
@@ -50,7 +57,7 @@ def test_every_ci_pin_is_a_release_the_audit_runs() -> None:
     workflows = sorted((ROOT / ".github" / "workflows").glob("*.yml"))
     assert workflows, "no workflows found"
     pins = [(path.name, pin) for path in workflows
-            for pin in re.findall(r"secure-code-agent==([0-9][0-9.]*)", path.read_text(encoding="utf-8"))]
+            for pin in re.findall(_PIN, path.read_text(encoding="utf-8"))]
     assert pins, "no workflow pins secure-code-agent; the gate would run whatever pip picks"
     outside = [(name, pin) for name, pin in pins
                if not (SUPPORTED_FLOOR <= _version_tuple(pin) < SUPPORTED_CEILING)]
@@ -82,5 +89,5 @@ def test_every_job_that_runs_the_suite_installs_secure_code_agent() -> None:
         if re.search(r"-m pytest\b", body)
     ]
     assert running, "no workflow job runs pytest; the sweep would pass vacuously"
-    missing = [(name, job) for name, job, body in running if "secure-code-agent==" not in body]
+    missing = [(name, job) for name, job, body in running if not re.search(_PIN, body)]
     assert not missing, f"jobs that run the suite without installing secure-code-agent: {missing}"

maintainability_agent-3.7.8/tests/test_security_pillar_asserts_a_scanner_set.py

@@ -0,0 +1,58 @@
+"""The delegate config asserts which scanners must have run (D184).
+
+secure-code-agent withholds the security grade when no scanner set was
+asserted — "grade withheld: no gates.require_scanners is declared, so no
+scanner set was asserted to have run". This repository's delegate config
+declared `fail_on_severity`, `fail_on_category`, `fail_on_new` and
+`max_unsuppressed` and never that, so the pillar could reach complete
+coverage and still report a posture of `unverified` rather than a grade.
+
+The two halves have to stay together: naming a scanner here that the gate job
+does not install turns coverage from complete into a hard failure, which is
+the loud version of the same mistake.
+"""
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+CONFIG = ROOT / "secure-code-agent.json"
+QUALITY_GATES = ROOT / ".github" / "workflows" / "quality-gates.yml"
+
+
+def _gates() -> dict:
+    return json.loads(CONFIG.read_text(encoding="utf-8"))["gates"]
+
+
+def test_the_delegate_config_asserts_a_scanner_set() -> None:
+    required = _gates().get("require_scanners")
+    assert required, (
+        "secure-code-agent.json declares no gates.require_scanners, so the delegate "
+        "asserts no scanner set and withholds the security grade however complete "
+        "its coverage is"
+    )
+
+
+def test_the_job_that_runs_the_gate_installs_the_scanners_it_requires() -> None:
+    """The asserted scanners must exist on the runner that asserts them.
+
+    The gate job installs the delegate with its `required-scanners` extra for
+    this reason. Without it the runner has none of them, every required
+    scanner reports `unavailable`, and coverage becomes FAILED — the gate
+    fails on the absence of a tool rather than on anything about the code.
+    """
+    text = QUALITY_GATES.read_text(encoding="utf-8")
+    gate_jobs = [
+        body
+        for body in re.split(r"^  [A-Za-z0-9_-]+:\s*$", text, flags=re.MULTILINE)
+        if re.search(r"^\s+secure-code-agent \\\s*$", body, flags=re.MULTILINE)
+    ]
+    assert gate_jobs, "no job runs secure-code-agent; the security pillar is never measured"
+    for body in gate_jobs:
+        assert "secure-code-agent[required-scanners]==" in body, (
+            "the job that runs the security gate installs secure-code-agent without its "
+            "required-scanners extra, so the scanners gates.require_scanners names are "
+            "absent and coverage fails on missing tools"
+        )