Advance the quality-kit pin so complexipy and the import contract actually run

[Antawari]

CONTRACT

.github/workflows/quality.yml pins the shared quality kit to a full commit SHA. That pin was 55 commits behind the kit's main, so three gauges the kit ships had never once executed against this repository:

• complexipy — cognitive complexity through the snapshot ratchet
• cf-import-contract — the layering contract committed in pyproject.toml
• cf-no-bon-ref — the ticket-reference sweep

A gate that has never run is not a gate. This advances the pin to the kit's current main, which also carries the single aggregating cf-gate runner.

WORLD — measured, not inferred

Ran the real cf-gate from the repository root with the kit at the new pin, first against main unchanged:

PASS  ruff-check          PASS  cf-exemptions        FAIL  mypy
PASS  ruff-format         FAIL  cf-no-bon-ref        FAIL  complexipy
PASS  cf-sticky-check     PASS  cf-import-contract   PASS  pytest
PASS  cf-file-budget      PASS  cf-mirror-check      PASS  cf-recursion-check

cf-gate: FAIL — 3 of 12 gate(s) red (exit 1)

Invocation counts, which is the acceptance criterion and not the conclusion: complexipy invoked 1×, cf-import-contract invoked 1×. Both genuinely ran. cf-import-contract passed on its first-ever run against this tree; complexipy failed.

The three reds, in full:

Gate	What it found
complexipy	exactly one offender — src/bonfire/handlers/wizard.py WizardHandler::handle, cognitive complexity 17, threshold 15, absent from the snapshot
mypy	4 new / 5 fixed / 49 unresolved. All 4 "new" are the same four missing-import sites re-spelled import-not-found → import-untyped
cf-no-bon-ref	349 tracker references across 118 files — 116 test modules, one driver script, and the reason prose inside exemptions.json

After baselining, the same command from the same root:

cf-gate: PASS — every gate is clean   (exit 0)

Every baseline entry, with its written reason

Recorded durably in the new docs/quality-baselines.md, because complexipy-snapshot.json and mypy-baseline.txt are machine-generated and have no field for prose. Summary:

• complexipy — 1 entry added. WizardHandler::handle at its measured 17. Snapshot went 20 entries/28 functions → 21/29: exactly one addition, nothing removed, no watermark raised. Shrink-only from here.
• mypy — 4 lines re-spelled, 1 dropped, 0 findings absorbed. The kit's cf_quality.mypy_normalize collapses all three shapes a missing third-party import can take onto one canonical import-untyped line, so the baseline encodes the code rather than the machine that measured it; the previous baseline predates that normalizer. The dropped line is mypy's once-per-run global stub note:, which relocates between files as imports shift and was a source of phantom deltas. The 49 pre-existing findings are untouched.
• cf-no-bon-ref — 118 entries, frozen_count: 118. One explicit entry per file, each with its own reason. Never a glob — tests/unit/* would bless every test file written from now on, the unbounded escape hatch the kit's own docs warn against. Every blessing prints its path, line and reason on each run.

Why the tracker references are registered rather than scrubbed: docs/release-gates.md already scopes this exact debt and says why — the references live in test file names as well as in comments, so cleaning them is a rename sweep across the suite, not a comment sweep, and it is tracked separately. Mounting the gate is what stops the 119th reference. The sweep shrinks these 118.

FAILURE — the control rods. Every newly-mounted gauge was watched going RED.

A passing run cannot tell you a gate works. Each was fed a deliberately broken input:

Gauge	Broken input	Raw result
cf-no-bon-ref	planted unregistered tracker reference in a new source file	src/bonfire/_rod_probe_ticket.py:14: TICKET_REF_IN_SOURCE: ticket reference … in source → cf-no-bon-ref: FAIL (1 ticket reference(s)), exit 1
complexipy (new offender)	planted function of cognitive complexity 22, absent from the snapshot	Failed functions: - src/bonfire/_rod_probe_ticket.py: rod_hairy … exceeds 15 but was not part of the snapshot, exit 1
complexipy (ratchet regression)	a baselined watermark lowered 17 → 16	WizardHandler::handle increased from 16 to 17, exit 1
cf-import-contract	bonfire.models importing bonfire.engine, which the committed contract forbids	CONTRACT_BROKEN: … bonfire.models._rod_probe_import -> bonfire.engine.pipeline (l.11), exit 1
mypy	return "not an int" from a function declared -> int	baseline filter: Your changes introduced new violations, exit 1

All rod probes were removed and the ledgers regenerated; the final full-battery run above is the post-cleanup state.

The complexipy red run also confirmed a property worth naming: a failing complexipy run does not rewrite the snapshot. Only a passing one does.

Residue, stated rather than hidden

• A follow-up pin bump is owed. This pins the kit's main as it stands today. A separate change to the kit hardens the complexipy snapshot against being silently emptied by a passing run; once that lands, this pin must advance again to pick it up.
• Stacked/base-branch note: this PR targets main directly so quality-gate and test (3.12) actually run on it. Please confirm the run started, and read its step list and invocation counts rather than its conclusion.
• The four import-untyped findings resolve when the knowledge extra is installed; they are ordinary typing debt, tracked as such.
• Nothing in this change touches a threshold, deletes a check, or weakens a test.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[Antawari]

The invocation receipt, from real CI runs — before and after

Acceptance for this change is not "green". It is whether the gauges actually ran. Counted, not read off a conclusion.

BEFORE — the last quality-gate run on main at the old pin (run 30384694143, 2026-07-28 17:50, conclusion success)

Its 18 steps, verbatim from the API:

10  success  ruff check (the kit's pinned gauge, never the consumer copy)
11  success  ruff format --check (the kit's pinned gauge)
12  success  cf-sticky-check — the sticky intro is mounted, byte-faithful
13  success  cf-file-budget — new files ≤ 500 lines, baseline shrink-only
14  success  cf-mirror-check — declared mirrors only (skip-if-no-MIRRORS.md)
15  success  cf-recursion-check — recursion declared with a stated bound
16  success  cf-exemptions — every suppression traces to a reasoned entry
17  success  mypy through the baseline ratchet (a Python repo MUST carry a baseline)
18  success  pytest

There is no complexipy step. There is no cf-import-contract step. There is no cf-no-bon-ref step.

cf-import-contract mentions in that entire run log: 0. cf-no-bon-ref: 0. complexipy: 9 mentions, and every one of them is a pip line:

Collecting complexipy==5.6.0 (from candyfactory-quality==0.1.0)
Downloading complexipy-5.6.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (2.5 MB)
Installing collected packages: … import-linter, complexipy
Successfully installed … complexipy-5.6.0 … import-linter-2.11 …

The gate installed its own gauges and never invoked them, and reported success. import-linter likewise: installed, never run.

AFTER — this PR's gate / gate run (30419624647, job 90473548939, conclusion success)

13 steps, the battery collapsed into one aggregating cf-gate step, whose board CI printed:

PASS  ruff-check          PASS  cf-exemptions        PASS  mypy
PASS  ruff-format         PASS  cf-no-bon-ref        PASS  complexipy
PASS  cf-sticky-check     PASS  cf-import-contract   PASS  pytest
PASS  cf-file-budget      PASS  cf-mirror-check      PASS  cf-recursion-check

complexipy: invoked 1×. cf-import-contract: invoked 1×. cf-no-bon-ref: invoked 1×. All three for the first time in this repository's history.

Also confirmed in the run log: kit checkout already rides the declared pin — the kit was not floating on its own main, it rode the SHA committed here.

---

🔴 One finding this run surfaced, and it is not mine to fix

The gate's own in-band self-verification that it is a required, non-bypassable status check did not run:

##[warning]quality-gate: in-band mount self-verification SKIPPED — no CI_KIT_TOKEN
(admin:read) secret is provisioned, so the canary cannot read branch protection
(the automatic GITHUB_TOKEN cannot be granted Administration:read). The out-of-band
Constable sweep + templates/check-required-mount.sh remain the enforcement;
provision a CI_KIT_TOKEN repo/org secret to give this leg teeth.

So one leg of this gate is a gauge listed unrun. It degrades to a warning by design rather than bricking un-provisioned consumers, and the mount is in fact correct here (this repo's ruleset does require gate / gate), but the gate cannot currently prove it. Provisioning a fine-grained CI_KIT_TOKEN with repo Administration: read gives that leg teeth. Repo-admin action, not a code change.