test: add enterprise release verification gates

Author: Aitomates

.github/workflows/ci.yml

@@ -1,13 +1,18 @@
 name: CI
 
 on:
+  workflow_dispatch:
   push:
     branches: [ master, main ]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: universal-refiner
@@ -29,10 +34,11 @@ jobs:
         run: npm run build
 
       - name: Run tests
-        run: npm test
+        run: npm run test:coverage
 
   acceptance:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: universal-refiner
@@ -62,6 +68,7 @@ jobs:
 
   stress:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     defaults:
       run:
         working-directory: universal-refiner
@@ -82,3 +89,61 @@ jobs:
           PROMPT_REFINER_STRESS_WORKERS: '4'
           PROMPT_REFINER_STRESS_WRITES: '100'
         run: npm run stress:event-store
+
+  windows:
+    runs-on: windows-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: universal-refiner
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: universal-refiner/package-lock.json
+      - run: npm ci --no-fund
+      - run: npm rebuild better-sqlite3
+      - run: npm run build
+      - run: npm run test:coverage
+      - run: npm run test:acceptance
+      - run: npm run test:stress
+
+  supply-chain:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: universal-refiner
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: universal-refiner/package-lock.json
+      - run: npm ci --no-fund
+      - run: npm run security:audit
+      - run: npm run security:secrets
+      - run: npm run build
+      - run: npm run package:check
+
+  release-gate:
+    if: always()
+    needs: [build-and-test, acceptance, stress, windows, supply-chain]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every enterprise gate
+        env:
+          BUILD: ${{ needs['build-and-test'].result }}
+          ACCEPTANCE: ${{ needs.acceptance.result }}
+          STRESS: ${{ needs.stress.result }}
+          WINDOWS: ${{ needs.windows.result }}
+          SUPPLY_CHAIN: ${{ needs['supply-chain'].result }}
+        run: |
+          test "$BUILD" = "success"
+          test "$ACCEPTANCE" = "success"
+          test "$STRESS" = "success"
+          test "$WINDOWS" = "success"
+          test "$SUPPLY_CHAIN" = "success"

.gitignore

@@ -1,6 +1,7 @@
 # Dependencies and generated outputs
 **/node_modules/
 **/dist/
+**/coverage/
 *.tgz
 
 # Runtime state and local databases
@@ -23,4 +24,4 @@
 .vscode/
 .idea/
 .DS_Store
-Thumbs.db
+Thumbs.db

docs/enterprise-release-gates.md

@@ -0,0 +1,55 @@
+# Enterprise Release Gates
+
+Passing unit tests alone does not prove that PromptImprover is operationally ready. A release is eligible only when every required gate below passes.
+
+## Quality Target
+
+- All owned deterministic production logic reaches 100% statements, branches, functions, and lines.
+- Coverage exclusions are limited to generated artifacts. Bootstrap and integration behavior must be validated through acceptance or end-to-end tests.
+- The coverage threshold is ratcheted upward as gaps close. It must never decrease without an approved, documented exception.
+- Every reproduced defect receives a regression test at the owning boundary.
+
+## Required Gates
+
+1. `npm ci` succeeds from a clean workspace.
+2. TypeScript build succeeds with strict type checking.
+3. Unit and integration tests pass with the enforced coverage threshold.
+4. Every advertised MCP tool schema and dispatcher path passes acceptance tests.
+5. Local semantic-provider primary, fallback, malformed-response, timeout, and outage paths pass.
+6. SQLite restart, migration, backup/restore, contention, and multi-process tests pass.
+7. Claude and Gemini hook pre/post flows pass; Codex MCP-first flow passes.
+8. Dashboard API security, review mutation, health telemetry, and browser smoke flows pass.
+9. Dependency audit reports no known production vulnerabilities.
+10. Package dry-run, global installation, runtime startup, and post-restart smoke tests pass.
+11. Secret scanning finds no committed credentials.
+12. Linux and Windows CI jobs pass before merge.
+
+## Current Coverage Baseline
+
+The first measured baseline on June 14, 2026 exposed substantial untested production behavior:
+
+| Metric | Baseline | Target |
+|---|---:|---:|
+| Statements | 66.33% | 100% |
+| Branches | 61.95% | 100% |
+| Functions | 79.92% | 100% |
+| Lines | 68.09% | 100% |
+
+Initial high-risk gaps include MCP dispatcher behavior, background autonomy, template generation, prompt optimization, configuration failure paths, and operational dashboard branches.
+
+The enforced ratchet is currently 86% statements, 76% branches, 93% functions, and 88% lines. It cannot be lowered without an approved exception.
+
+## Operator Recovery
+
+Build before invoking the recovery commands. Both operations run SQLite integrity checks and fail closed:
+
+```powershell
+npm.cmd run db:backup -- C:\backups\promptimprover-events.db
+npm.cmd run db:restore -- C:\backups\promptimprover-events.db
+```
+
+Stop the PromptImprover runtime before restoring a backup.
+
+## Meaning Of Green
+
+A green release pipeline means all declared gates passed in the tested environments. It substantially increases confidence but does not claim that unknown failures are impossible. Production incidents must become new automated regression gates.