docs(P02): complete gitea-scrub-decisions phase (REQ-367, REQ-368, v1.28.2)

---ci---
project: acdl
phase: 2
milestone: v1.29
status: complete
---/ci---

tests/test_forge_action_byte_identical.py

@@ -1,11 +1,12 @@
 """NFR-11 / REQ-326 AC: byte-identical Nova CLI composite action.
 
-This test verifies the structural invariants of the `nova cli-action`
-composite action at `.github/actions/nova-cli/action.yml`. The action is
-discovered by both the production forge (GitHub Actions) and the dev
-forge (act_runner) via the same `.github/actions/nova-cli/` path, so a
-single source file under test guarantees both platforms consume the
-same bytes — which is the byte-identical requirement (NFR-11).
+D-232 (v1.29): the byte-identical cross-forge parity is deliberately
+disabled — the dev-forge mirror was removed and forge parity is no longer
+maintained (forge_parity_disabled). The composite action at
+`.github/actions/nova-cli/action.yml` is now GitHub-only; the structural
+invariants below remain valid as the unit-testable subset of the action's
+correctness. The `test_forge_parity_disabled` assertion documents the
+abandoned parity (REQ-367 AC 3, D-232).
 
 What this unit test can verify (structural invariants):
   (a) action.yml is valid YAML
@@ -18,25 +19,8 @@ What this unit test can verify (structural invariants):
   (g) an install step exists that installs `nova` (CodeArtifact default
       or fallback-index path)
   (h) a run step executes `nova ${{ inputs.command }}`
-
-What this unit test CANNOT verify (and intentionally does not):
-  The full byte-identical cross-platform verification (NFR-11,
-  REQ-326 AC2) requires running the action with identical inputs on a
-  production-forge ubuntu-latest runner AND a dev-forge act_runner, then
-  asserting identical stdout + exit code. That is a CI matrix job
-  (matrix over the two forges), not a unit test — it cannot be
-  reproduced in-process because it depends on two external runner
-  environments. The structural invariants below are the unit-testable
-  subset: if the single action.yml source is structurally correct and
-  both forges consume the same file path, the byte-identical guarantee
-  reduces to "the file does not branch on the forge identity" — which
-  the assertions below enforce (no forge-specific conditionals, single
-  install path selected by env, single run step).
-
-  The CI matrix job that completes the NFR-11 verification is defined
-  out-of-band (a workflow that invokes this action on both forges with
-  a fixed `command: --version` and asserts the outputs match). It is
-  not part of this pytest suite.
+  (i) forge_parity_disabled — the dev-forge mirror dir is absent and no
+      dev-forge references remain in .github/workflows/ (D-232)
 """
 import sys
 from pathlib import Path
@@ -202,10 +186,9 @@ def test_action_run_step_forwards_mode_and_contract_env():
 
 def test_action_source_contains_no_forge_specific_strings():
     """NFR-11: the single action.yml must not embed forge-specific
-    hostnames, org names, or the dev-forge / consumer-mirror names. Both
-    forges consume the same file, so the file must not branch on the
-    forge identity. This is the unit-testable half of the byte-identical
-    guarantee."""
+    hostnames, org names, or the dev-forge / consumer-mirror names. This
+    is the unit-testable half of the byte-identical guarantee (still
+    enforced post-D-232 so the action stays forge-agnostic)."""
     text = ACTION.read_text()
     for needle in _FORBIDDEN:
         assert needle.lower() not in text.lower(), \
@@ -215,7 +198,7 @@ def test_action_source_contains_no_forge_specific_strings():
 def test_action_has_single_install_path_selected_by_env():
     """NFR-11: the install step must select CodeArtifact vs fallback by
     env var at runtime — NOT by a forge-specific conditional. This keeps
-    the file byte-identical across forges (no platform branching)."""
+    the file forge-agnostic (no platform branching)."""
     a = _load_action()
     steps = a["runs"]["steps"]
     install = next(
@@ -233,6 +216,23 @@ def test_action_has_single_install_path_selected_by_env():
         assert needle.lower() not in run.lower()
 
 
+# --- D-232: forge_parity_disabled ------------------------------------------
+
+def test_forge_parity_disabled():
+    """D-232 (v1.29): the dev-forge mirror is removed and forge parity is
+    deliberately disabled (forge_parity_disabled, REQ-367 AC 3). The
+    dev-forge directory must be absent and no dev-forge references may
+    remain in .github/workflows/."""
+    forge_dir = ROOT / f".{_FORGE}"
+    assert not forge_dir.is_dir(), \
+        f"{forge_dir} still present — forge parity should be disabled (D-232)"
+    workflows = ROOT / ".github" / "workflows"
+    for wf in workflows.glob("*"):
+        text = wf.read_text(errors="replace")
+        assert _FORGE.lower() not in text.lower(), \
+            f"{wf} contains a dev-forge reference — parity should be disabled (D-232)"
+
+
 # --- documentation: the CI matrix job is out-of-band ------------------------
 
 def test_action_header_documents_byte_identical_matrix_job():

tests/test_no_forge_mentions.py

@@ -32,14 +32,13 @@ _EXCLUDE = {".ciagent", ".gitea", ".git", "terraform", "demo",
 
 # Internal-only scripts (by basename) excluded from sync.
 _EXCLUDE_SCRIPTS = {
-    "sync_to_gl.sh", "sync_to_nova.sh", "ship_phase.sh",
+    "sync_to_gl.sh", "sync_to_nova.sh",
     "update_atelier_vendor.sh", "post_stage_comment.sh",
     "rotate_spike_key.sh", "run_l2_lifecycle_destroy.sh",
     "run_lifecycle_destroy.sh", "run_lifecycle_test.sh",
     "migrate_dynamodb_data.py", "migrate_ssm_paths.py",
     "untag_acdl_keys.py", "seed_uptime_monitors.py",
-    "push_consumer_image.py", "sync_workflows.py",
-    "attach_release_asset.py", "check_north_star_diff.sh",
+    "push_consumer_image.py", "check_north_star_diff.sh",
     "render_slides.sh",
 }
 

tests/test_pipeline_contract.py

@@ -97,15 +97,18 @@ class TestWorkflowConformance:
     def test_github_workflow_exists(self):
         assert (ROOT / ".github/workflows/ci.yml").is_file()
 
-    def test_sync_workflows_check_passes(self):
-        """P8 (REQ-172): sync_workflows.py --check exits 0 (committed
-        files match the workflows-src/ sources)."""
-        import subprocess
-        rc = subprocess.call(
-            [sys.executable, "scripts/sync_workflows.py", "--check"],
-            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-        )
-        assert rc == 0, "sync_workflows.py --check failed — run scripts/sync_workflows.py --write"
+    def test_forge_parity_disabled(self):
+        """D-232 (v1.29): the byte-identical forge-parity generator
+        (scripts/sync_workflows.py) is removed and the dev-forge mirror
+        is gone. Forge parity is deliberately disabled (forge_parity_disabled,
+        REQ-367 AC 3). This test asserts that state holds."""
+        # Build the dev-forge dir name from chr() so this file does not
+        # contain the forbidden literal (REQ-230 self-matching guard).
+        _forge = chr(103) + chr(105) + chr(116) + chr(101) + chr(97)
+        assert not (ROOT / "scripts" / "sync_workflows.py").is_file(), \
+            "scripts/sync_workflows.py should be removed (D-232 forge_parity_disabled)"
+        assert not (ROOT / f".{_forge}").is_dir(), \
+            "dev-forge mirror should be removed (D-232 forge_parity_disabled)"
 
 class TestRunCiScript:
     def test_run_ci_script_exists_and_executable(self):

tests/test_rotate_key_workflow.py

@@ -5,7 +5,12 @@ daily. v0.2 scope: the mechanism must *exist* (exists-not-ran); the v0.2
 deploy uses the currently-active key. These tests assert the workflow file
 exists, is valid YAML, declares the schedule + dispatch triggers, invokes
 scripts/rotate_spike_key.sh, uses the static-key auth path (not OIDC), and
-that the synced mirror copies are byte-identical to the source.
+that the GitHub copy matches the workflows-src/ source.
+
+D-232 (v1.29): the dev-forge mirror is removed and forge parity is
+deliberately disabled (forge_parity_disabled). The
+test_synced_copies_match assertion now verifies the mirror is absent
+rather than byte-identical.
 
 This test file is itself synced to the consumer mirror, so it must be
 forge-agnostic (REQ-230): the dev-forge directory name + the forge-mention
@@ -87,11 +92,15 @@ def test_workflow_uses_static_key_auth():
 
 
 def test_synced_copies_match():
-    assert GITHUB.is_file(), f"{GITHUB} missing (run scripts/sync_workflows.py --write)"
-    assert FORGE_MIRROR.is_file(), "mirror copy missing (run scripts/sync_workflows.py --write)"
+    """D-232 (v1.29): the dev-forge mirror is removed and forge parity is
+    deliberately disabled (forge_parity_disabled, REQ-367 AC 3). The
+    GitHub copy must still match the workflows-src/ source; the dev-forge
+    mirror must be absent."""
+    assert GITHUB.is_file(), f"{GITHUB} missing"
+    assert not FORGE_MIRROR.is_file(), \
+        f"{FORGE_MIRROR} should be removed (D-232 forge_parity_disabled)"
     src_text = SRC.read_text()
     assert GITHUB.read_text() == src_text, f"{GITHUB} drifted from workflows-src/"
-    assert FORGE_MIRROR.read_text() == src_text, "mirror drifted from workflows-src/"
 
 
 def test_workflow_is_forge_agnostic():

tests/test_untested_scripts.py

@@ -108,7 +108,7 @@ class TestSyncToNovaScript:
         script = (ROOT / "scripts" / "sync_to_nova.sh").read_text()
         # Isolate the EXCLUDE_SCRIPTS=( ... ) block.
         block = script.split("EXCLUDE_SCRIPTS=(")[1].split(")")[0]
-        for internal in ("sync_to_gl.sh", "sync_to_nova.sh", "ship_phase.sh",
+        for internal in ("sync_to_gl.sh", "sync_to_nova.sh",
                          "update_atelier_vendor.sh", "rotate_spike_key.sh",
                          "post_stage_comment.sh", "untag_acdl_keys.py"):
             assert internal in block, f"{internal} missing from EXCLUDE_SCRIPTS"