# Infra CI gate inventory — every gate is one coordinate (stage, task_category) -> workflow:job.
# Gate ids carry the `infra_ci.` prefix (structurally disjoint from app's `ci.*`, so the two
# repos' inventories cannot overlap). `stage` references the infra2-sdk delivery vocabulary;
# docs/ssot/delivery-stages.yaml is the pinned local mirror, not a second definition.
# Validated by tools/ci_gate_audit.py.
#
# Phase 1 (shadow): .github/workflows/infra-ci.yml is fully covered below. Other CI
# workflows (ops-checks, reconcile-iac-inputs, apply-observability, drift reports) are the
# unregistered backlog — the audit runs report-only until they are covered, then flips
# fail-closed (Phase 2).
version: 1
repo_prefix: infra_ci.
gates:
  - id: infra_ci.compose_validate
    stage: github_ci.merge_authority
    task_category: compose_validate
    workflow: .github/workflows/infra-ci.yml
    job: validate-compose
    blocks_merge: true
    failure_semantics: A compose file is invalid or pins a bare :latest image.
  - id: infra_ci.deployer_logic
    stage: github_ci.merge_authority
    task_category: deployer_contract
    workflow: .github/workflows/infra-ci.yml
    job: test-deployer-logic
    blocks_merge: true
    failure_semantics: Deployer config-hash idempotency, service discovery, or unit tests fail.
  - id: infra_ci.op_healthcheck
    stage: github_ci.merge_authority
    task_category: secret_preflight
    workflow: .github/workflows/infra-ci.yml
    job: test-1password-healthcheck
    blocks_merge: true
    failure_semantics: The 1Password healthcheck binary fails to build or pass.
  - id: infra_ci.vault_agent
    stage: github_ci.merge_authority
    task_category: vault_agent
    workflow: .github/workflows/infra-ci.yml
    job: validate-vault-agent
    blocks_merge: true
    failure_semantics: vault-agent.hcl is missing required settings.
  - id: infra_ci.required_env_drift
    stage: github_ci.merge_authority
    task_category: secret_preflight
    workflow: .github/workflows/infra-ci.yml
    job: validate-required-env
    blocks_merge: true
    failure_semantics: finance_report's required-env manifest and secrets.ctmpl have drifted (#482).
  - id: infra_ci.vault_policy
    stage: github_ci.merge_authority
    task_category: vault_policy
    workflow: .github/workflows/infra-ci.yml
    job: validate-vault-policy
    # The job itself is `continue-on-error: true` (GHA container issues with vault
    # policy fmt, infra-ci.yml:303) so it can never fail the run — it cannot
    # structurally block merge. blocks_merge: false makes the declaration match
    # that reality instead of claiming a gate that can't actually gate (#504).
    blocks_merge: false
    failure_semantics: vault-policy.hcl syntax is invalid (advisory only; does not block merge).
  - id: infra_ci.deployer_classes
    stage: github_ci.merge_authority
    task_category: deployer_contract
    workflow: .github/workflows/infra-ci.yml
    job: validate-deployers
    blocks_merge: true
    failure_semantics: A Deployer subclass violates the deployer contract.
  - id: infra_ci.lint_python
    stage: github_ci.merge_authority
    task_category: static_contract
    workflow: .github/workflows/infra-ci.yml
    job: lint-python
    blocks_merge: true
    failure_semantics: Python lint (ruff) fails.
  - id: infra_ci.harness_check
    stage: github_ci.merge_authority
    task_category: workspace_harness
    workflow: .github/workflows/infra-ci.yml
    job: harness-check
    blocks_merge: true
    failure_semantics: harness/repos.yaml is internally inconsistent (schema, governance/role mismatch, missing authority file, or an unexpected non-optional uninitialized checkout).
  - id: infra_ci.detect_changes
    stage: github_ci.merge_authority
    task_category: change_detection
    workflow: .github/workflows/infra-ci.yml
    job: detect-changes
    # Not itself one of the 7 required-status-check names in the branch
    # ruleset, so it cannot directly block merge the way the other gates
    # above do -- but every other job in this workflow depends on it
    # (needs: detect-changes) and is skipped, not merely deprioritized, if
    # it fails, which transitively blocks every gate below. Declared here
    # (rather than left unregistered) because it IS a real job of a
    # fully-covered workflow -- the audit's own coverage invariant.
    blocks_merge: false
    failure_semantics: The PR-vs-base diff could not be computed (e.g. a force-pushed/rewritten base), so every other infra-ci job that depends on it is skipped rather than run.