fix(prepush): map src/brainlayer/cli/__init__.py to the CLI command suites (XS)

[EtanHey]

Size: XS. Two files, the #762 shape exactly.

The bug

src/brainlayer/cli/__init__.py — the Typer app root — had no mapping. The generic src/brainlayer/*.py rule derives tests/test___init__.py from the basename, finds nothing, and escalates the whole unit suite. Practical effect: no CLI change on this repo could be pushed scoped. Every one demanded a full-suite run.

Not theoretical. It blocked a denylist PR whose only unmapped path was this file, on a machine already running two other full suites — where test_arbitration.py::test_real_concurrent_writers_keep_interactive_store_searchable_under_sla hung at 0.0% CPU for 12 minutes under the load, and an earlier attempt took a SIGTERM at 95% with zero FAILED lines.

The fix

Names the suites that actually drive the app through CliRunner: the test_cli_*.py set, plus test_setup_mcp_migration.py (the setup command's migration path) and test_agent_profiles.py (the agent-profile group).

Fail-closed, per the rule #762 established for src/brainlayer/__init__.py: ALL named suites must exist to count as mapped. A per-file mapped=1 would let a deleted or renamed suite silently narrow this gate while it still looked mapped — partial coverage here is worse than none. A missing sibling escalates to the full suite instead, which is the safe side. test_cli_root_mapping_is_fail_closed_when_a_named_suite_is_missing pins that behaviour.

Verification

• test_changed_only_scope_maps_cli_root_to_the_cli_command_suites fails on the base commit (no mapping → falls back), passes with it.
• Against the real tests directory: 0 escalations, and the unit invocation carries exactly the 9 mapped files. test_engine.py / test_vector_store.py appear only as the pre-existing --ignore= real-DB exclusions — they are not run.
• tests/test_run_tests_script.py: 25 passed.
• bash -n clean; shellcheck warning count unchanged from origin/main (7 vs 7) — the SC2221/SC2222 pairs are pre-existing, shifted by the added lines.
• Pushed scoped: gate green on all five phases, no full suite.

One honest note: the fail-closed test passes on the base commit too (everything is unmapped there, so it "escalates" for the wrong reason). It is a regression guard for the new mapping, not a red-first test — the first test is the red-first one.

🤖 Generated with Claude Code

---

Note

Low Risk
Only the pre-push test scoping script and its contract tests change; no runtime CLI or auth behavior is modified.

Overview
Pre-push changed-only scope no longer treats every edit to src/brainlayer/cli/__init__.py as unmapped (which forced a full unit suite). run_tests.sh now has an explicit case that runs 20 pytest files—the suites that import from brainlayer.cli import app—when that path changes.

The mapping is fail-closed like src/brainlayer/__init__.py: all listed suites must exist on disk before any are selected; if one is missing, the path stays unmapped and the script escalates to the full unit suite with a visible unmapped: warning.

test_run_tests_script.py adds a shared CLI_ROOT_SUITES list plus contract tests for the happy path (all suites invoked, no full-tree -v) and for missing-sibling escalation (test_watch_backfill_cli.py omitted).

^{Reviewed by Cursor Bugbot for commit 2a951ce. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Map src/brainlayer/cli/__init__.py to 20 CLI test suites in run_tests.sh

• Updates map_changed_files_to_pytests in run_tests.sh to map src/brainlayer/cli/__init__.py to 20 specific test suites importing the Typer application.
• Leaves the source unmapped and falls back to the full unit suite if any of the 20 required test files are missing.
• Adds tests in test_run_tests_script.py to verify the successful mapping and fail-closed fallback.

^{Macroscope summarized 2a951ce.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3b2f81b7-33f4-4492-b812-f7bea039fa25)

[coderabbitai]

Warning

Review limit reached

Next included review available in 12 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: ce273250-9f8f-44ea-830a-29a393561847

📥 Commits

Reviewing files that changed from the base of the PR and between 3cc9eca and 2a951ce.

📒 Files selected for processing (2)

• scripts/run_tests.sh
• tests/test_run_tests_script.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[EtanHey]

@coderabbitai review

Reviewer focus, in priority order:

1. Fail-closed correctness. All 9 named suites must exist for mapped=1. Confirm a missing sibling escalates rather than silently narrowing the gate — that is the fix(prepush): map src/brainlayer/__init__.py to the version-consistency suite (XS) #762 rule this follows.
2. Case ordering. The new case must precede the generic src/brainlayer/*.py case, since * spans / in a bash case glob and would otherwise shadow it. Verified against the real tests dir (0 escalations), but worth a second pair of eyes.
3. Completeness of the named set. If a CLI command's behaviour is exercised by a suite I did not name, this mapping is a fail-open for that path — that is the failure mode most worth catching here.

Not requesting @codex (standing rule until ~09-07). No Bugbot.

— brainlayerClaude-6c94f25f (Opus 5, 1M context)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 3cc9eca...2a951ce on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Sep 5, 2026 4:34p.m.	Review ↗
Swift		Sep 5, 2026 4:34p.m.	Review ↗
JavaScript		Sep 5, 2026 4:34p.m.	Review ↗
Shell		Sep 5, 2026 4:34p.m.	Review ↗
Secrets		Sep 5, 2026 4:34p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

BrainLayer ratchet

Every Value below was measured by this run. A row this machine cannot measure says n/a — <reason> instead of a number; baselines in Notes name their own machine, method and date and were not measured here.

Row	Status	Value (measured by this run)	Method	Notes
commit provenance	🟢 GREEN	measured 2a951cec12cc == PR head · checkout 09afe3dd29c3	commit graph + live PR head · in-process · runner	Which commit this whole table is about. On a pull_request event the checkout is GitHub's synthetic merge ref, whose sha is not on the PR — #759's table printed 13fa724278bf while that PR's head was 4632f979 — so this row names the PR-head parent instead, the sha a reviewer can actually see. The comparison sha is read live from repos/{owner}/{repo}/pulls/{n} when the table is collected, not taken from the event payload, because the payload cannot know the run has been overtaken. Residual window, stated rather than papered over: a push landing between that read and the comment being posted is not caught here — the run for that push refreshes the table.
baseline attestation	🟢 GREEN	baseline f421d1a7c5e6 matches the main attestation (run 33977684550 · main 3cc9eca386bd · 2026-09-05T16:23:10Z)	main attestation artifact via Actions API · in-process · runner	What every comparison is measured AGAINST, and who says so. The baseline fields of tests/fixtures/sprint_gate/corpus.json (queries, latency_baseline_ms, thresholds) are compared to the ratchet-attestation artifact of the latest successful push or (no-input) workflow_dispatch run of ratchet-attest.yml on main, fetched through the Actions API — a PR run cannot write to another run's artifacts. A field that differs is RED unless that main run measured the new value; today no runner-side collector measures any baseline field, so today the baseline cannot move by PR at all, and this row says so instead of a hand edit passing. Boundary: the comparator is this PR's checkout of ci_ratchet_table.py, diff-reviewable, not tamper-proof.
provenance	🟢 GREEN	stamped 09afe3dd29c3 == HEAD, tree clean	wheel stamp · in-process · runner	Sha half of #749 keg-mode provenance: a keg built from this wheel can answer __build_sha__. The helper-age and served-process predicates need a running BrainBar and are measured only by scripts/sprint_gate.py on an installed Mac. The sha here is the checkout's — the merge ref on a PR — because that is what publish.yml stamps at release time; the PR-head sha this table describes is the one in commit provenance above.
mapped bytes	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Baseline 26.2 GB — installed Mac, socket, 2026-09-03, after R2 drained 15,070 → 0. Up from 16.8 GB because the drain left more vectors mapped under the same cap: the change is the drain, not a leak. Not measured by this run.
search p50/p95	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	socket · installed Mac	Margin p50: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin p95: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Calibrated on MacBook-Pro.local at 2026-09-01T08:42:22Z under active_sprint_load (tests/fixtures/sprint_gate/corpus.json). Not measured by this run.
idle CPU	⚪ n/a	n/a — no BrainBar daemon at /tmp/brainbar.sock: this row needs the daemon, its hybrid helper and the indexed corpus running together, and no GitHub-hosted runner has them (macOS included) — only a self-hosted Darwin/arm64 runner on an installed Mac would	ps sampling · installed Mac	Ceiling: average CPU < 30% over a 60 s window (resource_budget in scripts/sprint_gate.py), ratified and kept as a hard budget. Margin daemon: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin helper: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Margin watcher: margin unmeasured — 0 of the 5 attested green main runs it needs; no verdict is rendered from fewer. Needs the BrainBar daemon, helper and watcher actually running. Not measured by this run.
signature_valid	⚪ n/a	n/a — the macOS signature-parity job is trigger-gated and did not run on this PR: it touches no release or signing path (pyproject.toml, scripts/release-*, scripts/brainlayer-version-check.sh, publish.yml, ratchet.yml) and carries no ratchet:signatures label — a GitHub macOS runner bills at ~10× Linux minutes and rebuilds the keg venv from source	codesign · installed keg	scripts/release-verify-signatures.sh <keg> codesign-verifies every *.so/*.dylib under libexec/venv. The macOS parity job installs the published tap formula (etanhey/layers/brainlayer), so this row measures the release path — formula, published sdist and Homebrew's relocation — and not this PR's tree. Release-time baseline for the same keg on a different machine: 442 valid / 0 invalid — installed Mac (M4 Max), brew --prefix brainlayer 1.5.11, 2026-09-03.

🟢 GREEN measured, within budget · 🔴 RED measured, out of budget — a finding to clear before merge · ⚪ n/a not measurable on this machine, never guessed.

No RED rows.

Measured on Linux/x86_64 · measured 2a951cec12cc · PR head 2a951cec12cc · checkout 09afe3dd29c3 · run · updated 2026-09-05 16:34:51 UTC

[deepsource-io]

'subprocess.run' used without explicitly defining the value for 'check'.

subprocess.run uses a default of check=False, which means that a nonzero exit code will be
ignored by default, instead of raising an exception.

You can ignore this issue if this behaviour is intended.

[deepsource-io]

'subprocess.run' used without explicitly defining the value for 'check'.

subprocess.run uses a default of check=False, which means that a nonzero exit code will be
ignored by default, instead of raising an exception.

You can ignore this issue if this behaviour is intended.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== PR diff metadata ==='
git diff --stat origin/main...HEAD
git diff --name-status origin/main...HEAD
echo
echo '=== PR patch ==='
git diff --unified=80 origin/main...HEAD

echo
echo '=== Candidate pre-push/test-scope files ==='
fd -t f . | rg '(^|/)(pre-push|run_tests|test_run_tests_script)\.(sh|py)$|(^|/)run-tests\.sh$' || true

echo
echo '=== CLI root and test module inventory ==='
fd -t f . src/brainlayer/cli tests 2>/dev/null | sort | rg 'src/brainlayer/cli/|tests/test_(cli_.*|setup_mcp_migration|agent_profiles)\.py$' || true

echo
echo '=== Test references to CLI entry points, CliRunner, or command names ==='
rg -n -i -C 3 \
  -e '\bCliRunner\b' \
  -e 'brainlayer\.cli' \
  -e 'from brainlayer\.cli' \
  -e 'import brainlayer\.cli' \
  -e '\bagent-profile\b' \
  -e '\bsetup\b' \
  tests -g '*.py' || true

Length of output: 110018

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '=== CLI module outline ==='
ast-grep outline src/brainlayer/cli/__init__.py --items all --view expanded

echo
echo '=== CLI registration and command decorators ==='
rg -n -C 2 \
  -e '^(app|[A-Za-z_][A-Za-z0-9_]*)\.(command|callback|add_typer)\b' \
  -e '^def [A-Za-z_][A-Za-z0-9_]*\(' \
  src/brainlayer/cli/__init__.py

echo
echo '=== Every test that directly invokes brainlayer.cli.app ==='
python3 - <<'PY'
from pathlib import Path
import re

mapped = {
    "test_cli_direct_sqlite.py", "test_cli_enrich.py", "test_cli_index_watchdog.py",
    "test_cli_launchd_mode_a.py", "test_cli_provenance.py", "test_cli_version.py",
    "test_cli_writer_telemetry.py", "test_setup_mcp_migration.py", "test_agent_profiles.py",
}
for path in sorted(Path("tests").glob("test_*.py")):
    text = path.read_text(encoding="utf-8")
    imports_app = bool(re.search(r"(?:from brainlayer\.cli import app|import brainlayer\.cli as cli)", text))
    invokes = re.findall(r'(?:CliRunner\(\)|runner)\.invoke\(\s*(?:app|cli\.app)\s*,\s*\[\s*["\']([^"\']+)', text)
    if invokes:
        label = "MAPPED" if path.name in mapped else "OMITTED"
        print(f"{label:7} {path}: {', '.join(sorted(set(invokes)))}")
PY

echo
echo '=== Omitted CLI app test excerpts ==='
for f in \
  tests/test_watch_backfill_cli.py \
  tests/test_status_truthfulness.py \
  tests/test_doctor.py \
  tests/test_runtime_store.py \
  tests/test_installable_build.py \
  tests/test_retire_python_mcp.py \
  tests/test_launchd_hygiene.py \
  tests/test_git_learning.py \
  tests/test_reembed_backfill.py \
  tests/test_sandbox_db.py
do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    rg -n -C 2 '(CliRunner\(\)|runner)\.invoke\(\s*(app|cli\.app)\s*,' "$f" || true
  fi
done

Length of output: 34350

---

@EtanHey I found one issue.

• P1 — Include the omitted root-app CLI suites in the mapping. src/brainlayer/cli/__init__.py registers commands that existing tests exercise through CliRunner, but the mapping does not run those tests. Examples include tests/test_doctor.py (doctor), tests/test_status_truthfulness.py (status), tests/test_watch_backfill_cli.py (watch-backfill), tests/test_runtime_store.py (migrate, migrate-store, and repair-fts), and tests/test_sandbox_db.py (sandbox). A root-app change can therefore be scoped while skipping behavior tests for registered commands. Add all suites that invoke brainlayer.cli.app to cli_root_tests, or use a maintained complete root-app suite set.

The other requested properties are correct:

• The script checks all nine named paths before it sets mapped=1. A missing named suite causes escalation.
• The src/brainlayer/cli/__init__.py case precedes src/brainlayer/*.py. The generic Bash glob cannot shadow the specific case.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_aeadbe16-7bc3-4ecf-8c15-fd5d78a2f37f)