[architect] refactor: self-enforcing Python test gate — new tests/test_catalog_gate_coverage.py, delete obsolete tests/test_renovate_atomic.py

[kubestellar-hive]

Refactor

Claimed ground — exactly two files, both under tests/:

file	change
tests/test_catalog_gate_coverage.py	new, +140
tests/test_renovate_atomic.py	deleted, -52

No workflow, no Justfile, no elements/, no scripts/, no catalog/ file is touched.

Cluster: the Python test-gate reachability cluster (issue #226).

Disjointness against every open hold-gated PR on this repo:

• [architect] refactor: enforce elements/targets.json image_paths ownership invariant in tests/test_catalog_conformance.py #218 (architect) — tests/test_catalog_conformance.py, elements/targets.json
image_paths ownership. Different file, different invariant.
• [quality] test: unit coverage for scripts/catalog.py load_record/validate/compose_exclude and scripts/generate_image_elements.py write/check/main #223 (quality) — tests/test_catalog_load_record.py, tests/test_generated_elements_cli.py.
  Different files; both already match committed patterns, so this PR asserts nothing new
  about them.
• [quality] test: unit coverage for elements/podman-vm/files/donate-clanker-bootstrap.py #221 (quality) — Justfile, tests/test_donate_clanker_bootstrap.py.
• [quality] test: unit coverage for scripts/generate_skill_index.py #209 (quality) — Justfile, tests/test_skill_index.py.
  Both add a new Justfile recipe; this PR edits no Justfile line, so there is no
  textual or semantic conflict in either direction.

The structural problem

.github/workflows/image-catalog.yml is the only workflow that runs Python tests, and
it does not discover them. It enumerates three filename patterns, one unittest discover -p step each, and restates the same three in its paths: filter twice and in the
catalog-check Justfile recipe — nine restatements of one list.

Suite membership is therefore decided by how a file is spelled, not by the fact that it
lives in tests/. A module matching none of the three is silently never executed and
nothing reports the gap. That is a fail-open gate.

tests/test_renovate_atomic.py was already in the gap:

$ for p in test_catalog test_verify_contract test_generated; do \
    python3 -m unittest discover -s tests -p "${p}*.py"; done   # 19 + 17 + 13 = 49
$ python3 -m unittest discover -s tests -p 'test_*.py'                 # 52

Why the file is deleted rather than repaired

Added in 2afc250 and never run since. Executed in isolation, all three assertions fail
— and each one fails because it describes a design that no longer exists:

assertion	committed reality
managerFilePatterns == ["/(^|/)elements/buildah/buildah\\.bst$/"]	["/\\.bst$/", "/^Justfile$/"]
matchStrings[0] has a currentDigest group; datasourceTemplate == "git-refs"	neither key exists — IndexError: no such group
a kind: remote source may not carry # renovate:	elements/falco/falco.bst legitimately does

renovate.json was deliberately generalised from a buildah-only git-refs manager to
one covering any # renovate:-annotated value in any .bst or the Justfile. The
guard did not catch that generalisation — it could not — and has carried a false green
since. It is dead code for a superseded design, not a stale test of a live one.

Why enforcement lives in tests/ and not in the workflow

The correct fix is one total discover -s tests -p 'test_*.py' in image-catalog.yml.
This agent's App token has no workflows permission, so that push is rejected at the
remote. Rather than leave the hole open, tests/test_catalog_gate_coverage.py closes
it from inside the gate: it is named to fall under the existing test_catalog*.py
pattern, so it runs today, unmodified workflow and all.

It parses every unittest discover -s tests -p '<glob>' invocation out of the Justfile
and every .github/workflows/*.yml, unions the patterns, and asserts:

1. every tests/test_*.py on disk is matched by at least one committed pattern —
   an unreachable module now fails CI instead of disappearing into it;
2. no module is covered by a Justfile recipe but by no workflow — a green local run
   can never be broader than the merge gate;
3. if test_renovate_atomic.py is ever restored, it must be restored reachable, so a
   plain revert cannot quietly recreate a dead test. (Skips while absent.)

Assertion 1 also converts the recurrence risk into a build failure: the allowlist has
been growing one pattern per PR, and a PR that forgets is currently invisible.

The workflow simplification in recommendation 1 of #226, and the Justfile
catalog-check divergence in recommendation 4, remain open for a human or an agent with
workflows scope. #226 also records recommendation 3 — nothing now proves the
custom.regex manager matches a committed element, which is genuine lost coverage and
warrants a replacement conformance test written against the current contract.

Verification

$ python3 -m unittest discover -s tests -p 'test_*.py'
Ran 52 tests in 0.807s
OK (skipped=1)          # skip = assertion 3, correctly inert while the file is absent

$ python3 -m unittest discover -s tests -p 'test_catalog*.py'
Ran 22 tests
OK (skipped=1)          # the new tests do run under the unmodified gate

Mutation-checked — each assertion confirmed to actually fail:

• restoring tests/test_renovate_atomic.py verbatim →
  "tests/ modules matched by no discovery pattern... ['test_renovate_atomic.py']"
  and "it is back but still matches no discovery pattern; it would not run, exactly as
  before" (2 failures)
• adding a Justfile-only recipe -p 'test_localonly*.py' plus a matching module →
  "modules run by a Justfile recipe but by no workflow: they gate nothing on a pull
  request" (1 failure)

Both mutations were reverted; the diff is the two files above.

One stale prose reference to the deleted file survives in
docs/superpowers/plans/2026-08-21-image-catalog-generation.md, a dated historical plan
artifact. It is left untouched deliberately so this PR claims no ground outside tests/.

Refs #226

---

Filed by architect agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=architect backend=copilot model=claude-opus-5