fix(aspect+e2e): make tests truthful + ums-mcp Mutex + install Elixir (unblocks #149) (#150)

## Summary

Two failing checks (Aspect 27 fails + E2E 1 fail) had four distinct root
causes. Each fixed at source:

### Aspect — Thread Safety + ABI Contract + SPDX  (27 → 0 fails)

| # | Root cause | Fix |
|---|---|---|
| 1 | Comment filters broken — `^\s*--` / `^\s*\|\|\|` never matched
because `grep -rn` output starts with `path:lineno:`, not content |
Anchor at `:[[:space:]]*--` / `:[[:space:]]*\|\|\|` + add trailing `-- …
<pat>` comment filter, factored into `strip_comments_and_docstrings`
helper |
| 2 | `believe_me` check didn't exempt the 5 documented class-J axioms
in `src/abi/Boj/SafetyLemmas.idr` | Added `PROOF_EXEMPT` regex; passes
on documented axioms, fails on any new use elsewhere |
| 3 | Aspect 1 Mutex check fired on purely-functional FFI (e.g.
`burble_admin_ffi.zig` — 3 exports, zero file-scope globals — table
lookups over `i32`) | Refined to only fail when there's ALSO `^(pub
)?var <ident>` file-scope global state. Purely-functional exports now
get an explicit pass message |
| 4 | Aspect 4 had no concept of stub-or-by-design cartridges — 15 fails
for "incomplete layers" included 10 manifest-only stubs (cartridge.json
declares API; abi/ ffi/ not yet written) and 5 intentionally proof-free
observability/glue (boj-health, claude-ai-mcp, lang-mcp,
orchestrator-lsp-mcp, toolchain-mcp) | Added `"status": "stub" \|
"ffi_only" \| "complete"` (default `complete`) field to
`cartridge.json`. Aspect 4 honours it and reports `(N complete, M stub,
K ffi_only)` so categories stay visible in CI logs |
| 5 | **Real bug**: `cartridges/ums-mcp/ffi/ums_ffi.zig` has 15 C-ABI
exports operating on a global `var sessions: [MAX_SESSIONS]SessionSlot`,
no Mutex. Once the filter fixes narrow Aspect 1 to true positives, this
is the one that remains. | Added `var sessions_mu: std.Thread.Mutex` and
`sessions_mu.lock(); defer sessions_mu.unlock();` to all 14
sessions-touching exports. `ums_can_transition` is pure (enum→enum) and
stays lock-free. Mirrors `g_state_mu` in
`cartridges/007-mcp/ffi/oo7_mcp_ffi.zig:79`. `zig build` passes |

After all five: **115 passed / 0 failed / 1 warning** (was 87/27/1). The
one warning (`federation.zig` `catch unreachable`) was pre-existing —
out of scope here.

### E2E — Full REST + MCP Bridge  (failing since 2026-05-20)

`tests/e2e_full.sh` requires `mix` to start the Elixir backend, but
`.github/workflows/e2e.yml` never installed Elixir/OTP. Added an
`erlef/setup-beam@v1.18.2` step (Elixir 1.18 + OTP 27 — matches the
estate convention used in every repo's hypatia-scan.yml) plus a `mix
deps.get` step before the test runs.

## Test plan

- [x] `bash tests/aspect_tests.sh` — 115/0/1 (was 87/27/1)
- [x] `cd cartridges/ums-mcp/ffi && zig build` — clean
- [x] All 15 `cartridge.json` files still valid JSON
- [x] `e2e.yml` YAML parses; step ordering correct (setup-beam before
build-FFI / run-e2e)

## Foundational follow-up (NOT in this PR — flagged)

Same gap as `r-g-t-v#89` and `absolute-zero#42`: `main` branch
protection has no `required_status_checks` block, so red-CI PRs can
merge despite three workflows (E2E + Aspect + Bench, OpenSSF Scorecard
Enforcer, Instant Sync) being persistently red on main. Hypatia PR #316
ships BH001/BH002/BH003 to detect this class estate-wide; the BH001 rule
fires on exactly this repo.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/e2e.yml

@@ -56,9 +56,28 @@ jobs:
         with:
           deno-version: v2.x
 
+      - name: Install Elixir + OTP
+        # tests/e2e_full.sh requires `mix` on PATH to start the Elixir
+        # backend (elixir/ — `mix run --no-halt`). Pinned to match the
+        # estate convention (see hypatia-scan.yml across the org).
+        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93  # v1.18.2
+        with:
+          elixir-version: '1.18'
+          otp-version: '27'
+
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y curl jq
 
+      - name: Fetch Elixir deps
+        working-directory: elixir
+        run: mix deps.get
+
+      - name: Compile Elixir deps
+        # Pre-compile so the in-test `mix run --no-halt` doesn't have
+        # to do it on the critical path of the 60s server-start window.
+        working-directory: elixir
+        run: mix compile
+
       - name: Build FFI libraries
         run: |
           cd ffi/zig && zig build

.github/workflows/zig-test.yml

@@ -52,7 +52,14 @@ jobs:
           all="$(ls -d cartridges/*/ffi/ 2>/dev/null | sed 's|cartridges/||;s|/ffi/||' | sort)"
           if [ "$EVENT" = "pull_request" ]; then
             git fetch --no-tags --depth=50 origin "$BASE_REF" || true
-            changed="$(git diff --name-only "origin/${BASE_REF}...HEAD" -- 'cartridges/**' \
+            # Only scope cartridges whose `ffi/` actually changed —
+            # `cartridge.json` edits (e.g. adding a status field) and
+            # `abi/` edits should not pull a cart into this FFI test
+            # job, which exists to validate Zig builds. Using
+            # `cartridges/*/ffi/**` as the pathspec ensures only
+            # ffi-relevant diffs count (also matches the workflow's
+            # own `on.paths` filter — they were inconsistent before).
+            changed="$(git diff --name-only "origin/${BASE_REF}...HEAD" -- 'cartridges/*/ffi/**' \
                        | awk -F/ '{print $2}' | sort -u)"
             scope=""
             while IFS= read -r cart; do

cartridges/boj-health/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "boj-health",
   "version": "0.1.0",
+  "status": "ffi_only",
   "description": "BoJ server self-health cartridge — status, ping, and uptime queries. Self-contained Zig FFI (.so) reference implementation: no external services required.",
   "domain": "infrastructure",
   "tier": "Ayo",

cartridges/chromadb-mcp/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "chromadb-mcp",
   "version": "0.1.0",
+  "status": "stub",
   "description": "Chroma vector DB — embedded (local persistent) or client/server; LLM-app-focused; metadata + document storage alongside vectors.",
   "domain": "vector",
   "tier": "Teranga",

cartridges/claude-ai-mcp/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)",
   "name": "claude-ai-mcp",
   "version": "0.1.0",
+  "status": "ffi_only",
   "description": "Anthropic Messages API cartridge -- send messages to Claude models, count tokens, manage multi-turn conversations",
   "domain": "AI",
   "tier": "Ayo",

cartridges/echidna-llm-mcp/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
   "name": "echidna-llm-mcp",
   "version": "0.1.0",
+  "status": "stub",
   "description": "LLM advisor cartridge for the ECHIDNA formal verification engine. Provides free-form consultation (consult) and structured proof-tactic generation (suggest_tactics) by routing to Anthropic Claude via ANTHROPIC_API_KEY.",
   "domain": "Formal Verification",
   "tier": "Ayo",

cartridges/elevenlabs-mcp/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "elevenlabs-mcp",
   "version": "0.1.0",
+  "status": "stub",
   "description": "Text-to-speech via ElevenLabs API — high-quality voices, multilingual, voice cloning (premium tier), streaming output.",
   "domain": "multimodal",
   "tier": "Teranga",

cartridges/ffmpeg-mcp/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "ffmpeg-mcp",
   "version": "0.1.0",
+  "status": "stub",
   "description": "Local FFmpeg gateway — probe metadata, transcode formats, extract audio, extract frames, concatenate, trim. Glue between whisper / replicate / browser screenshots. Local-only — requires host ffmpeg binary; not Worker-compatible.",
   "domain": "multimodal",
   "tier": "Teranga",

cartridges/lang-mcp/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)",
   "name": "lang-mcp",
   "version": "0.1.0",
+  "status": "ffi_only",
   "description": "Multi-language session manager for the nextgen-languages family: Eclexia, AffineScript, BetLang, Ephapax, MyLang, WokeLang, Anvomidav, Phronesis, Error-lang, Julia-the-Viper, Me-dialect, Oblibeny. Tracks per-language sessions, delegates type-checking and evaluation to each language's CLI tool, and provides a unified interface across all dialects.",
   "domain": "Languages",
   "tier": "Ayo",

cartridges/orchestrator-lsp-mcp/cartridge.json

@@ -4,6 +4,7 @@
   "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
   "name": "orchestrator-lsp-mcp",
   "version": "0.1.0",
+  "status": "ffi_only",
   "status": "ready",
   "description": "Cross-domain LSP orchestrator. Routes LSP requests across all 12 poly-*-lsp servers (cloud, container, iac, k8s, db, queue, secret, git, ssg, proof, observability, browser) via a single GenLSP supervisor. Inspired by poly-orchestrator-lsp (polystack, archived). Wraps the 12 domain servers into one unified textDocument interface with domain-routing based on workspace root and file type.",
   "domain": "LSP",