host c127beaa98 ci: expand host-verify with lint, typecheck, security, depscan and coverage gates ...

Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
  no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
  stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.

2026-11-03 02:48:54 +00:00

..

workflows

ci: expand host-verify with lint, typecheck, security, depscan and coverage gates

2026-11-03 02:48:54 +00:00