fix(ci): repair the 17 CI-only test failures the matrix has been masking

The tests job reached pytest for the first time this cycle and reported
19 failures on every Python version. None were new; earlier runs died at the
build or lint step and never got far enough to show them.

expected_symbols.txt was never in the repo (6 failures)
    `.gitignore` carries a blanket `*.txt`, so the public-API contract fixture
    was untracked. test_public_symbols.py therefore passed on any developer
    checkout and failed in CI with FileNotFoundError on all six of its tests -
    the SemVer surface guard was enforced nowhere but locally. Add a negation
    and commit the fixture.

TwoStageDecoder rejected short syndromes (1 failure)
    test_two_stage_decoder_syndrome_validation, added in the v0.7.0 release
    commit, asserts a trimmed syndrome decodes to an all-zero correction. The
    native core is strict, so it raised `ValueError: Syndrome length mismatch`
    and the test had never passed. Zero-pad up to n_checks in the wrapper, the
    same way pymatching_compat.decode_batch already does for the matching
    decoders; over-long input is still rejected.

Stripe tests required production secrets (10 failures)
    They need STRIPE_SECRET_KEY / QECTOR_LICENSE_PRIVATE_KEY_B64, which are
    deliberately absent from CI, so they failed rather than skipped.
    test_stripe_integration.py already had the `_has_stripe_key` + skipif
    convention; extend it to the two files that lacked it. The tests asserting
    the *absence* path - test_raises_without_secret_key,
    test_missing_private_key_is_loud - are left unguarded on purpose, so the
    "fail loudly without a key" guarantee still runs in CI.

Still open: 2 routing tests that monkeypatch gpu_backend and only pass on a
machine with a real GPU. The patch seam is correct locally, so diagnosing it
needs CI evidence rather than guesswork.

Author: qectorlab

.gitignore

@@ -115,6 +115,12 @@ licenses_issued.json
 # --- Log files & scratch test outputs ---
 *.log
 *.txt
+# ...but this one is a committed test fixture, not scratch output. The blanket
+# `*.txt` above kept it untracked, so `test_public_symbols.py` passed locally
+# (where the file exists) and failed in CI with FileNotFoundError on all six of
+# its tests - the public-API contract was never actually enforced anywhere but
+# a developer's own checkout.
+!python/tests/expected_symbols.txt
 *.xml
 run_status.json
 __all_tests_dump.txt

python/qector_decoder_v3/__init__.py

@@ -1439,12 +1439,29 @@ def __init__(self, check_to_qubits, check_types, n_qubits=None, x_decoder="bloss
         c2q, nq = _validate_check_to_qubits(check_to_qubits, n_qubits)
         self._inner = _RustTwoStageDecoder(c2q, check_types, nq, x_decoder, z_decoder)
 
+    def _pad(self, syndrome):
+        """Zero-pad a short syndrome up to ``n_checks``.
+
+        Mirrors ``pymatching_compat.decode_batch``: callers routinely hand over a
+        syndrome whose trailing all-zero detectors were trimmed upstream, and the
+        matching decoders in this package already accept that. The native core is
+        strict, so without this the same input decodes fine through ``Matching``
+        and raises ``ValueError: Syndrome length mismatch`` through
+        ``TwoStageDecoder``. Longer-than-expected input is still rejected: that is
+        a genuine mismatch, not a trimmed tail.
+        """
+        n = self._inner.n_checks
+        if syndrome.shape[-1] < n:
+            pad = _np.zeros(syndrome.shape[:-1] + (n - syndrome.shape[-1],), dtype=_np.uint8)
+            syndrome = _np.concatenate([syndrome, pad], axis=-1)
+        return _np.ascontiguousarray(syndrome, dtype=_np.uint8)
+
     def decode(self, syndrome):
         if not isinstance(syndrome, _np.ndarray):
             syndrome = _np.array(syndrome, dtype=_np.uint8)
         if syndrome.dtype != _np.uint8:
             raise TypeError(f"Syndrome must be dtype uint8, got {syndrome.dtype}")
-        return self._inner.decode(syndrome)
+        return self._inner.decode(self._pad(syndrome))
 
     def batch_decode(self, syndromes):
         if not isinstance(syndromes, _np.ndarray):
@@ -1453,7 +1470,7 @@ def batch_decode(self, syndromes):
             syndromes = syndromes.astype(_np.uint8)
         if syndromes.ndim != 2:
             raise ValueError(f"syndromes must be 2D, got shape {syndromes.shape}")
-        return self._inner.batch_decode(syndromes)
+        return self._inner.batch_decode(self._pad(syndromes))
 
     @property
     def n_qubits(self):

python/tests/expected_symbols.txt

@@ -0,0 +1,148 @@
+# Canonical public API surface of `qector_decoder_v3` (todo8 item 0.2).
+#
+# One name per line; `#` comments and blank lines ignored. This file is the
+# contract `test_public_symbols.py` enforces in both directions:
+#   * a name here that is missing from the installed package fails the build.
+#   * a public name in the package that is *not* here also fails. Adding to the
+#     public surface is a deliberate act with SemVer consequences, so it has to
+#     be recorded here in the same commit.
+#
+# Two releases (0.6.5, 0.6.7) were yanked because a symbol silently vanished
+# from a wheel — `_guard()` substitutes a stub that imports fine and only
+# raises when constructed, so nothing else catches it.
+#
+# Optional, build-dependent backends (CUDA / OpenCL) are listed but exempt from
+# the "must not be a stub" check — see OPTIONAL_SYMBOLS in the test.
+
+AmbiguityClusterDecoder
+AutoDecoder
+AutoRouter
+BPOSDDecoder
+Backend
+BackendConfig
+BatchDecoder
+BatchedBpDecoder
+BeliefMatching
+BenchmarkSuite
+BlossomDecoder
+BpOsdDecoder
+CPUBatchDecoder
+CUDABatchDecoder
+CUDABpOsdDecoder
+ColourCodeDecoder
+DecodeResult
+DecoderName
+DecoderPool
+DetectorGraph
+FastUnionFindDecoder
+GNNBeliefMatcher
+GNNPredecoder
+GNNTrainer
+HardwareProfile
+HybridCascadeDecoder
+HybridDecoder
+LERBenchmark
+LookupTableDecoder
+MAX_WORKERS
+Matching
+NativeAutoDecoder
+NeuralPredecoder
+OpenCLBatchDecoder
+PredecodedDecoder
+Recommendation
+SlidingWindowDecoder
+SpaceTimeDecoder
+SparseBlossomDecoder
+StreamingDecoder
+StreamingResult
+StreamingSession
+StreamingTelemetry
+TwoStageDecoder
+UnionFindDecoder
+Workbench
+backend
+batched_bp_decode
+belief_matching
+benchmarking
+bp_cupy
+bposd
+changelog
+check_to_edges
+clear_decoder_cache
+codes
+colour_code
+compute_detector_differences
+cuda_is_available
+decode_mmap
+decode_with_diagnostics
+decode_with_gnn
+decoder_cache
+decoder_pool
+dem
+detect_hardware
+enforce_distance_cap
+enforce_unlocked
+estimate_distance
+flush_usage
+from_circuit
+generate_biconnected_qldpc_checks
+generate_parity_check_matrix
+generate_repetition_code_checks
+generate_ring_code_checks
+generate_space_time_surface_code_checks
+generate_surface_code_checks
+generate_toy_code_checks
+generate_triangular_color_code_4_8_8_checks
+get_accumulated_shots
+get_backend
+get_decoder
+get_decoder_pool
+get_latency_quantiles
+get_license_info
+gpu_available
+gpu_backend
+has_cuda_rust
+has_cupy
+license
+opencl_is_available
+predecoder
+pymatching
+pymatching_compat
+qiskit_plugin
+recommend
+recommend_decoder
+record_shots
+rest_api
+result
+routing
+run_grpc_server
+run_mcp_server
+set_license_key
+set_license_key_file
+sinter_compat
+sliding_window_decode
+sparse_blossom_radix_neighbors
+start_metrics_server
+stim_compat
+streaming
+stripe_integration
+verify_license_token
+workbench
+
+# Reachable at package level but deliberately NOT promoted into `__all__`:
+#   * Raw PyO3 `py_*` aliases. The supported spellings are the un-prefixed wrappers.
+#   * `qector_decoder_v3`: The compiled extension submodule.
+#   * `qector_memory_align`: Buffer conditioning helper for the PyO3 boundary.
+[reachable]
+bench_quick
+cli
+doctor
+ler
+py_check_to_edges
+py_generate_parity_check_matrix
+py_generate_repetition_code_checks
+py_generate_ring_code_checks
+py_generate_surface_code_checks
+py_generate_toy_code_checks
+qector_decoder_v3
+qector_memory_align

python/tests/test_stripe_integration.py

@@ -29,6 +29,7 @@ def test_stripe_keys_loaded():
     assert keys["secret_key_prefix"].startswith("sk_live_")
 
 
+@pytest.mark.skipif(not _has_stripe_key, reason="STRIPE_SECRET_KEY not set")
 @patch("stripe.checkout.Session.create")
 def test_stripe_checkout_session_structure(mock_create):
     mock_session = MagicMock()

python/tests/test_stripe_sales_workflow.py

@@ -21,6 +21,20 @@
     handle_stripe_webhook_payload,
 )
 
+# Same convention as test_stripe_integration.py. These are production secrets and
+# are deliberately absent from CI, so the tests that need them skip rather than
+# fail. Importing stripe_integration above has already run load_dotenv(), so a
+# local .env is visible here.
+#
+# The tests that assert the *absence* path - `test_raises_without_secret_key`,
+# `test_missing_private_key_is_loud` - are intentionally left unguarded: they are
+# the ones that must keep running in CI.
+_has_stripe_key = bool(os.getenv("STRIPE_SECRET_KEY"))
+_has_license_key = bool(os.getenv("QECTOR_LICENSE_PRIVATE_KEY_B64"))
+
+_needs_stripe = pytest.mark.skipif(not _has_stripe_key, reason="STRIPE_SECRET_KEY not set")
+_needs_signing = pytest.mark.skipif(not _has_license_key, reason="QECTOR_LICENSE_PRIVATE_KEY_B64 not set")
+
 
 class TestPricingRegistry:
     def test_self_serve_tiers_present(self):
@@ -37,13 +51,15 @@ def test_amounts_match_commercial_md(self):
     def test_commercial_alias_matches_evaluation(self):
         assert PRICING["commercial"] is PRICING["evaluation"]
 
+    @_needs_stripe
     def test_keys_snapshot_includes_bot_flag(self):
         keys = get_stripe_keys()
         assert "labs_bot_configured" in keys
         assert keys["secret_key_configured"] is True
 
 
 class TestEnsureProducts:
+    @_needs_stripe
     @patch("stripe.Price.create")
     @patch("stripe.Price.list")
     @patch("stripe.Product.create")
@@ -72,6 +88,7 @@ def _mk_price(**kwargs):
         assert mock_pcreate.call_count == 3
         assert mock_price_create.call_count == 3
 
+    @_needs_stripe
     @patch("stripe.Price.create")
     @patch("stripe.Price.list")
     @patch("stripe.Product.create")
@@ -129,6 +146,7 @@ def test_failure_never_raises(self, _mock):
         with patch.object(si, "QECTOR_LABS_BOT_WEBHOOK_URL", "https://discord.test/hook"):
             assert _notify_labs_bot("sale!") is False
 
+    @_needs_signing
     @patch("urllib.request.urlopen", side_effect=OSError("network down"))
     def test_webhook_fulfillment_survives_bot_outage(self, _mock):
         with patch.object(si, "QECTOR_LABS_BOT_WEBHOOK_URL", "https://discord.test/hook"):
@@ -144,6 +162,7 @@ def test_webhook_fulfillment_survives_bot_outage(self, _mock):
 
 
 class TestPackageInternalSigning:
+    @_needs_signing
     def test_sign_and_verify_roundtrip(self):
         token = create_license_token("rec_xyz", "Buyer@Qector.Store")
         assert verify_license_token(token, "buyer@qector.store") is True
@@ -156,6 +175,7 @@ def test_missing_private_key_is_loud(self):
         ):
             create_license_token("rec_nokey", "a@b.c")
 
+    @_needs_signing
     def test_no_demo_fallback_in_package(self):
         """The package must never mint tokens the production pubkey rejects."""
         token = create_license_token("rec_real", "real@qector.store")

python/tests/test_stripe_zero_dollar_sale.py

@@ -15,7 +15,17 @@
     handle_stripe_webhook_payload,
 )
 
+# Same convention as test_stripe_integration.py: production secrets are absent
+# from CI, so the tests that need them skip instead of failing. The import above
+# has already run load_dotenv(), so a local .env is visible here.
+_has_stripe_key = bool(os.getenv("STRIPE_SECRET_KEY"))
+_has_license_key = bool(os.getenv("QECTOR_LICENSE_PRIVATE_KEY_B64"))
 
+_needs_stripe = pytest.mark.skipif(not _has_stripe_key, reason="STRIPE_SECRET_KEY not set")
+_needs_signing = pytest.mark.skipif(not _has_license_key, reason="QECTOR_LICENSE_PRIVATE_KEY_B64 not set")
+
+
+@_needs_stripe
 def test_zero_dollar_checkout_session_creation():
     """Test creating a $0 test checkout session via Stripe."""
     with patch("stripe.checkout.Session.create") as mock_create:
@@ -32,6 +42,7 @@ def test_zero_dollar_checkout_session_creation():
         assert session["url"].startswith("https://checkout.stripe.com")
 
 
+@_needs_signing
 def test_zero_dollar_webhook_issues_valid_token():
     """Simulate Stripe $0 checkout.session.completed → token issuance → Ed25519 verification."""
     test_email = "test_sale_user@qector.store"
@@ -78,6 +89,7 @@ def test_zero_dollar_webhook_issues_valid_token():
     assert verify_license_token(issued_token) is True
 
 
+@_needs_signing
 def test_license_activates_via_environment(monkeypatch):
     """Verify QECTOR_LICENSE env var activates the license system."""
     test_email = "env_test@qector.store"