fix: exit codes & CI gating across report/coverage/deps/score/resolve/diff/changelog (closes #418, closes #419, closes #422, closes #425, closes #430, closes #431, closes #441, closes #444)

[0xLeif]

Summary

One consolidated PR for the W1 exit-code/CI-gating cluster (the changes share a common enforcement core — commands::default_enforcement/compute_exit_code/exit_with_status, SpecSyncConfig.enforcement_set, CoverageReport.missing_files, and main.rs wiring — so they land together).

Core convention: an explicit enforcement key in config is honored as-is (including warn → exit 0). When enforcement is UNSET, gate commands now default to gating on errors (validation failures exit non-zero) instead of the old implicit warn-everything. Wired into check, coverage, generate, comment, score, report.

Issue → fix → regression tests

• changelog never validates refs — fabricates plausible output with exit 0 for unresolvable ranges #418 changelog: parse_range_full splits ... before ..; both endpoints validated via git rev-parse --verify (exit 1 on unknown revision); three-dot uses real git merge-base. Tests: changelog_bogus_ref_exits_1, changelog_valid_range_exits_0. Evidence: changelog HEAD..bogus-ref exit before=0 → after=1.
• deps --require-coverage is inert; scalar depends_on silently disables the edge #419 deps: --require-coverage wired to real coverage computation and gated; scalar depends_on normalized to a list with a warning; duplicate entries deduped at parse. Tests: deps_scalar_depends_on_is_not_silently_dropped, deps_duplicate_depends_on_entries_deduped, deps_require_coverage_gate_enforced. Evidence: scalar missing-dep exit 0→1.
• resolve --remote/--verify fetches the wrong registry path, prints false green, and always exits 0 #422 resolve --remote: fetches .specsync/registry.toml first with legacy fallback; sends GITHUB_TOKEN/GH_TOKEN Bearer auth; fetch failures count as failed verification (exit 1); no false green when zero registries fetched; --json honored. Tests: covered by resolve suite + unit tests in registry.rs.
• coverage exits 0 while reporting 1 failed and prints a false all-referenced summary #425 coverage: validation errors exit 1 by default; referenced-but-missing files counted in the coverage denominator and listed; false green suppressed; JSON gains missing_files. Tests: coverage_missing_referenced_file_exits_nonzero_by_default, coverage_missing_referenced_file_warn_enforcement_exits_zero, coverage_json_includes_missing_files. Evidence: spec referencing ghost file, coverage exit 0→1.
• report cannot gate CI — every enforcement path exits 0 on failure; commits_behind zeroed for non-stale modules #430 report: gating wired via compute_exit_code/exit_with_status (--strict/--enforcement/--require-coverage); stale+incomplete modules count as failures; commits_behind tracks sub-threshold drift; JSON status field; real CSV/Markdown renderers. Tests: report_require_coverage_above_actual_exits_1, report_require_coverage_at_actual_exits_0. Evidence: report --require-coverage 101 exit 0→1.
• diff silently no-ops green in default CI states (detached HEAD, push events); pull_request_review missing from auto-detect #431 diff: pull_request_review in the allowlist; --base is Option<String> so explicit beats env; HEAD fallback prints a loud stderr warning; --strict refuses the fallback (exit 1); git-diff failures exit 1 instead of silent "no drift". Tests: diff_head_fallback_prints_loud_stderr_warning, diff_strict_refuses_head_fallback. Evidence: before silent, after prints "specsync: no PR base detected … comparing against HEAD".
• score undermines its own bar — JSON breaks on zero specs, explain arithmetic self-contradicts, untouched scaffold scores 85/B #441 score: valid JSON for zero specs; Sections arithmetic made self-consistent; scaffold boilerplate counts as placeholder (parser::is_boilerplate_line); version/status values validated; files_exist non-vacuous; --strict exits 1 on F grades/zero specs. Tests: score_json_with_zero_specs_outputs_valid_json, score_strict_with_zero_specs_exits_1. Evidence: score --json on zero-spec project before=invalid JSON → after=valid JSON.
• resolve (local) exits 0 on unresolved deps; no path confinement; malformed refs vanish silently #444 resolve local: unresolved local deps exit 1 regardless of --strict; util::confine_path_to_root rejects absolute/.. paths; malformed repo@ refs reported; "Local Local" heading fixed; one verdict/exit shared by text and JSON. Tests: resolve_local_missing_path_exits_1_without_strict, resolve_local_outside_root_traversal_exits_1, resolve_malformed_cross_project_ref_exits_1, resolve_all_ok_exits_0. Evidence: missing local dep exit 0→1.

Plus default-enforcement tests: check_validation_errors_exit_nonzero_by_default, check_validation_errors_warn_enforcement_exits_zero.

Verification

• cargo check --all-targets: clean
• cargo test: 1720 unit tests pass (1 pre-existing root-only failure: change::tests::non_git_walk_skips_volatile_trees_but_fails_on_relevant_walk_errors, fails on main too); 223 integration tests pass; 20 new regression tests pass
• cargo clippy -- -D warnings (CI invocation): clean
• Before/after evidence generated with released binary vs this build

Closes #418, closes #419, closes #422, closes #425, closes #430, closes #431, closes #441, closes #444

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

❌ Corvin says...

      _
    <(;\  .oO(oh no...)
     |/(\
      \(\\
      " "\\

"Caw... your imports are all over the place."

CI Summary

Check	Status
Validate action.yml	✅ Passed
Packaged Action Consumer	❌ failure
Dependency Audit	✅ Passed
Code Coverage	❌ failure
Format Check	❌ failure
Docs Site	✅ Passed
Spec Validation	❌ failure
Tests (build, test, clippy)	❌ failure
VS Code Extension	✅ Passed

---

_{Powered by corvid-pet}