Overhaul CI and test quality across the monorepo

Status reconciliation — 2026-10-22

PR #31 is merged. The remaining enforcement blocker is resolved: live GitHub reads on 2026-10-22 confirm active main ruleset requiring pull requests and ci-gate, with no bypass actors. Develop also has active enforcement, superseding the historical 'develop stays open' description below. No settings were changed during reconciliation. Further coverage work belongs to PAR-499/PAR-502.

Reconciliation — 2026-10-17, develop 253b14f

PR #31 has merged: unified CI, static analysis, mutation testing, schema/ledger checks, API security tests, Explorer component/accessibility tests and lint upgrades are implemented. Keep open for scope item 2: on 2026-10-17, GitHub repository rulesets and effective main branch rules both returned [], and main/protection returned 'Branch not protected' (404). Remaining: enforce PR + ci-gate on main; develop stays open per the task's decision. No repository protection settings were changed during this reconciliation.

Reviewed source/test definitions and merged history; tests were not rerun during this task reconciliation.

CI had good coverage numbers but gated nothing and measured the wrong thing. This tracks the overhaul, delivered as one PR into develop.

Problems found (2026-10-16 audit)

• No enforcement. develop and main had no protection, and PRs #21, #23 and #26 merged with Explorer e2e red. The 18 path-filtered workflows couldn't be required.
• Tests that never ran in CI: treasury-api and business-api unit tests, :business:testWithoutCarbon, and :common except as a side effect.
• Coverage gates that reward padding. The gates were 95% for treasury/business and 99% for chestshop. Exclusion lists hid real logic (TaxCycleTask, command amount parsing). There were getter tests, enum-count tests, verify-only tests and no-assertion tests.
• Money paths: concurrency tests throttled by a 4-connection pool, no check of the ledger invariants in tests, untested balance triggers, and no property tests. Business↔treasury was only ever tested with mocks.
• REST API: default permitAll, no HTTP-level auth tests, a hand-written 19-table test schema, and no API contract.
• Explorer: e2e flaky, an 11% line threshold, weak lint, a stand-in schema, and no accessibility checks.
• Migrations: applied migrations could be edited unnoticed, and flywayValidate was non-fatal.
• Live suite: 58 Thread.sleep calls, sleep-then-assert-nothing checks, and 4 @Disabled tests.
• No static analysis and no dependency updates.

Scope

1. One ci.yml with a single required ci-gate job, ./gradlew build as the contract, SHA-pinned actions, timeouts and Dependabot.
2. Enforce ci-gate + PR on main only via a ruleset (decided 2026-10-16); develop stays open, with full CI on every push and nightly.
3. Error Prone, NullAway (on the API modules and common), Spotless (ratcheted against develop) and ArchUnit.
4. PIT mutation testing with score ratchets, lower line gates, padding tests removed, and logic pulled out of excluded commands/tasks.
5. Shared DB test setup in test-support, money-invariants.sql run after every DB test, trigger tests, jqwik properties, a TreasuryApi contract suite, and sharper concurrency tests.
6. REST API: default-deny, a route-table auth test, a committed OpenAPI spec plus a breaking-change check in CI, and the real Flyway schema in tests.
7. Explorer: e2e flake root causes, the real schema, meaningful thresholds, component tests, axe checks, and stricter TypeScript and lint.
8. Migration checks (edited migrations, naming lint, upgrade test from the base branch) and a fatal validate.
9. Live suite: positive barriers instead of sleeps, re-enabled tests, and admin REST tests.

Related: ADT-71 (quality audit epic, Testing C+), ADT-169, ADT-170, ADT-171.