agent-team/ci/agent-team-apply-verify.yml

@@ -696,19 +696,22 @@ jobs:
           # The tool installs are best-effort (|| true), but ruff + pytest run
           # AUTHORITATIVELY under `set -e` so a real failure fails the job.
           #
-          # DEPLOY: the build/test invocation is parameterized per target repo at
+          # PER-TARGET (Sea-Haven-Industries/orchestrator): the AUTHORITATIVE test
-          # provisioning (a repo with no pytest suite needs its own command). Until
+          # suite for this target is the self-contained, hermetic `agent-team/`
-          # then this generic ruff+pytest is the gate; a target whose tests need a
+          # subproject — the repo's own `ci / subproject-tests` runs exactly this,
-          # different runner MUST be wired before it is dispatched.
+          # and the ROOT suite is deliberately NOT used (it needs live
+          # ANTHROPIC/COMPOSIO keys, so it is collect-only in CI). Multi-target
+          # support = wire each target's command at provisioning (this command is
+          # author-fixed here, NOT taken from any dispatch input, so it adds no
+          # injection surface).
           if [ -f requirements.txt ]; then
             python3 -m pip install --quiet -r requirements.txt || true
           fi
-          python3 -m pip install --quiet ruff pytest || true
+          python3 -m pip install --quiet ruff pytest pyyaml slack_sdk slack_bolt || true
+          # ruff over the whole repo (lint must hold for the applied diff).
           ruff check .
-          # pytest exit 5 == "no tests collected"; treat ONLY that as non-fatal
+          # The hermetic agent-team suite is authoritative (exit code IS the gate).
-          # (a fix with no test suite), every other non-zero is an authoritative
+          ( cd agent-team && python3 -m pytest -q )
-          # failure. Never blanket-swallow.
-          pytest -q || { rc=$?; [ "$rc" -eq 5 ] || exit "$rc"; echo "no tests collected (exit 5)"; }
 
       - name: Post-build denied-path check (build hook may not write the trust surface)
         if: always()