> For the complete documentation index, see [llms.txt](https://dsg-3.gitbook.io/dsg-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dsg-3.gitbook.io/dsg-docs/dsg-one-v1/dsg-one-canonical-architecture-separation-of-authority/ci-cd-github-actions-tests-coverage-and-e2e.md).

# CI/CD, GitHub Actions, Tests, Coverage & E2E

*Last verified: 2026-08-27 UTC*

This page documents the **actual verification and release architecture** of `tdealer01-crypto/DSG-Cinema-Proof-Agent`. It separates source-code coverage, executable test coverage, staging/live E2E, deployment verification, and external marketplace approval so one PASS is never treated as proof of another boundary.

## Verified inventory

Current repository state for this rollout:

* **44 GitHub Actions workflows** under `.github/workflows/`.
* **40 primary pytest modules** under `tests/test_*.py`.
* **2 additional `tests/check_*.py` utilities**.
* **1 additional fail-closed client test** at `hackathons/agents-for-humans/test_dsg_client.py`.
* Staging and production E2E paths across Azure, Cinema/Z3, Browserbase and Copilot CLI.
* Commit-bound coverage evidence generated by GitHub Actions.

## Instrumented Python coverage is now enforced

The repository now has a dedicated workflow:

`/.github/workflows/coverage-verify.yml`

It uses `pytest-cov==7.0.0` and `coverage==7.15.4`, with branch measurement enabled by `/.coveragerc`.

The first successful measured baseline was GitHub Actions run **33036844728** on PR **#151**:

```
Tests:             509 passed
Measured files:    56
Overall coverage:  76.16%
Line coverage:     79.79% (6174 / 7738)
Branch coverage:   62.77% (1317 / 2098)
```

The enforced floors derived from that measured run are:

```
Overall minimum: 76.00%
Line minimum:    79.50%
Branch minimum:  62.50%
```

The gate fails when any of those three dimensions falls below its floor.

### Coverage evidence

Every run produces:

* `coverage.xml`
* `coverage.json`
* `coverage-gate.json`
* `htmlcov/`

and uploads them as a commit-bound GitHub Actions artifact. The successful measured baseline artifact was **9632311771**.

`coverage-gate.json` records the commit SHA, workflow run ID, tool versions, statement/branch counts, measured percentages, enforced floors and PASS/FAIL status.

## Coverage truth boundary

Three concepts are deliberately separate:

1. **Test-surface coverage** — which contracts, modules, adapters and failure modes have executable tests.
2. **E2E path coverage** — which real client/provider/deployment paths are exercised end to end.
3. **Instrumented source coverage** — measured line/branch execution of the selected first-party Python runtime surfaces.

A high percentage does **not** prove production is healthy. A production E2E PASS does **not** imply every line or branch is tested.

Current status:

```
Test-surface coverage: DOCUMENTED + EXECUTABLE
E2E path coverage: DOCUMENTED + EXECUTABLE
Instrumented overall baseline: 76.16%
Instrumented line baseline:    79.79%
Instrumented branch baseline:  62.77%
Coverage gate: ENFORCED
Coverage reports: XML + JSON + HTML
Machine-readable gate receipt: coverage-gate.json
```

## CI/CD flow

```
SOURCE CHANGE / PR
        |
        v
Path-scoped GitHub Actions
        |
        +-- compile / syntax / package validation
        +-- unit + contract + integration tests
        +-- measured line + branch coverage gate
        +-- deterministic governance assertions
        +-- Marketplace / revenue / browser regressions
        +-- staging/live E2E where applicable
        |
        v
MERGE TO main
        |
        +-- production deployment
        +-- health / readiness / proof probes
        +-- replay / hash / exact-proof validation
        |
        v
PERSISTED EVIDENCE
  .deployment/*.json
  evidence/client/*.json
  docs/evidence/*.md
  coverage.xml
  coverage.json
  coverage-gate.json
  htmlcov/
  GitHub Actions run + artifact records
```

## Primary CI gates

### Coverage — `coverage-verify.yml`

Runs the complete `tests/` pytest suite plus `hackathons/agents-for-humans/test_dsg_client.py`, measures the selected active first-party Python runtime surfaces, independently enforces overall/line/branch floors, writes `coverage-gate.json`, and uploads evidence even when the numeric gate later fails.

Missing reports or a failed pytest run cannot become a coverage PASS.

### DSG ONE API — `api-v1-verify.yml`

Validates the API/control-plane contract and key invariants:

* REST, MCP and mobile authorization converge on the canonical decision core.
* Caller-supplied verdicts cannot become computed truth.
* Verified receipts require exact proof.
* UI cannot ship pre-baked PASS/VERIFIED truth.
* Marketplace entitlement cannot be double-billed through Stripe.
* Production configuration and API/image contracts remain consistent.

Canonical preflight outcomes:

```
ALLOW
WAITING_PERMISSION
BLOCK
```

### Exact Z3 — `verify-z3.yml`

Owns the exact solver/proof regression boundary independently of orchestration.

### Multi-Marketplace — `marketplace-launch-verify.yml`

Checks Cinema/Marketplace tests, launch manifest, revenue claims, GitHub Action package, OpenAI Skills package, Stripe App typecheck, Pydantic contract, landing validation, and retired-runtime rejection.

### Revenue — `revenue-verify.yml`

Checks entitlement-before-solver ordering, fail-closed metering, durable state, secret handling, ledger determinism and the boundary between recorded usage and collected revenue.

## CD / production gates

### `deploy-cinema-production.yml`

Production Cinema deployment plus convergence and production runtime verification.

### `deploy-z3-azure.yml`

Azure exact-verifier deployment boundary.

### `deploy-azure-3d-landing.yml`

Validates the landing contract, mirror invariant, CORS and production `/verify/evaluate`; requires `ALLOW + verified=true + VERIFIED_GLOBAL_OPTIMUM`; deploys through Azure OIDC; verifies the public surface and writes deployment evidence.

### `probe-cinema-azure.yml`

Production operational probe. A probe PASS is evidence for that run time only.

## E2E matrix

| Workflow                                          | Boundary                                        | Real path exercised                                                                                                    |
| ------------------------------------------------- | ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| `cinema-e2e-azure.yml`                            | isolated Azure staging                          | build/deploy Z3 → exact proof → build/deploy Cinema → health → Cinema→Z3 proof + replay                                |
| `cinema-browserbase-planbound-production-e2e.yml` | production Cinema + Browserbase                 | activate → plan → approve → connect → navigate → extract → screenshot → deliberate out-of-plan 403 → disconnect        |
| `copilot-cli-full-governed-e2e.yml`               | Copilot CLI + public plugin + authenticated MCP | plugin → auth → activation → plan/approval/alignment/constraints/execution/evidence/proof → independent proof re-fetch |
| `copilot-cli-mcp-auth-e2e.yml`                    | Copilot CLI + authenticated MCP                 | auth gate → activation → MCP registration → direct status → agent-driven tool call                                     |
| `copilot-cli-plugin-e2e.yml`                      | public plugin/client                            | install + plugin-facing execution contract                                                                             |
| `browserbase-production-smoke.yml`                | live Browserbase                                | provider/session smoke                                                                                                 |
| `stripe-browserbase-surface-smoke.yml`            | Stripe/browser                                  | browser-facing Stripe smoke                                                                                            |
| `deploy-cinema-production.yml`                    | production Azure                                | deploy + convergence/proof checks                                                                                      |
| `deploy-azure-3d-landing.yml`                     | public Azure + Cinema                           | browser proof contract + public release receipt                                                                        |

## Test coverage by domain

### Core API / authority / runtime

`test_api_v1.py`, `test_api_contract.py`, `test_decision_core.py`, `test_decision_core_channels.py`, `test_execution_boundary.py`, `test_mobile_control.py`, `test_chatgpt_remote_actions.py`, `test_console_prototype.py`.

### Solver / proof / Cinema

`test_z3_main.py`, `test_cinema_main.py`, `test_deploy_z3_azure_rest.py`.

### Remote / MCP / browser

`test_browserbase_executor.py`, `test_remote_browser.py`, `test_remote_mcp.py`, `test_remote_pairing.py`.

### Durable state / guarded mutation

`test_durable_store.py`, `test_guarded_mutation.py`, `test_shared_store_durability_contract.py`.

### Marketplace / channel delivery

`test_agent_plugin_v1.py`, `test_azure_devops_marketplace.py`, `test_channel_delivery.py`, `test_github_marketplace.py`, `test_marketplace_surfaces.py`, `test_stripe_app_executor.py`, `test_stripe_marketplace.py`, `test_stripe_marketplace_adaptive_form.py`, `test_stripe_marketplace_shared_browser.py`, `test_stripe_payment_proof.py`.

### Revenue / lifecycle

`test_revenue.py`, `test_revenue_checkout.py`, `test_revenue_events.py`, `test_revenue_intent.py`, `test_revenue_lifecycle.py`, `test_revenue_signals.py`, `test_lifecycle_store.py`, `test_messaging_policy.py`, `test_activecampaign_mcp_users.py`, `test_activecampaign_projection.py`, `test_activecampaign_revenue.py`.

### Observability

`test_sentry_integration.py`.

## Active hardening targets from measured coverage

The baseline identifies the next concrete test-expansion targets instead of using an arbitrary percentage goal:

* Browserbase executor and live-UI paths.
* PostgreSQL-backed revenue paths.
* Error-monitoring paths.
* Selected GitHub Marketplace paths.
* Remote-relay/security branches.

The rule for raising thresholds is: **add executable tests for real untested paths first, then ratchet the floor upward**. Production or exception code must not be excluded simply to make the percentage look better.

## Meaning of PASS

| Result                   | Proves                                                                    | Does not prove                                 |
| ------------------------ | ------------------------------------------------------------------------- | ---------------------------------------------- |
| Unit/contract PASS       | encoded behavior passed for tested revision/input                         | production health                              |
| Coverage gate PASS       | selected complete pytest run passed and measured coverage floors were met | production path is live or all risk is tested  |
| CI workflow PASS         | every executed gate in that workflow passed                               | untriggered workflows passed                   |
| Staging E2E PASS         | named end-to-end path worked in that run                                  | production is identical/live                   |
| Production probe PASS    | named production observations passed at that time                         | all features/future availability               |
| Deployment PASS          | deploy + encoded post-deploy checks passed                                | certification/marketplace approval             |
| Exact Z3 PASS            | encoded formal proof obligation was established                           | legal/compliance correctness outside the model |
| Marketplace package PASS | internal package/manifest contract is valid                               | external marketplace acceptance                |

**No run = no PASS claim. Missing evidence = unresolved, not success.**

## Release review rule

Before describing a revision as production-verified:

1. Identify the exact commit SHA.
2. Identify which path-scoped workflows actually ran.
3. Require all relevant triggered gates to pass.
4. For Python runtime changes, require `coverage-verify.yml` to pass overall, line and branch floors.
5. Retain the commit-bound coverage artifact when source coverage is part of the claim.
6. Require applicable staging/live E2E, deployment and production-probe evidence.
7. Never convert skipped, cancelled, untriggered or external-blocked checks into PASS.