No CI workflow: the test suite (including the new turn-budget guard) never runs automatically

[the-gigi]

Problem

Genesis has no CI workflow. gh workflow list --all shows exactly two: Genesis Evolver and Dependabot Updates. Nothing runs pytest on a push or a pull request.

That means the 124-test suite only executes when a human remembers to run it locally, which makes every guard in it advisory rather than enforced. #36 just landed a turn-budget floor guard - including test_genesis_own_claude_workflows_meet_orchestrator_floor, which asserts genesis's own workflows meet the floor. The test exists. The enforcement does not. A future change can lower a budget, drop a --max-turns, or add an unclassified Claude-invoking template, and nothing will notice.

Same gap covers everything else the suite protects: the scaffolding e2e tests, the workflow permission assertions, the Loki secret-forwarding guard added in ffe4492, and the log.sh behavior tests added in bda9638.

Concretely, both #36 and the two commits before it were merged on the strength of a human running uv run --frozen pytest by hand and reporting the result. That does not scale, and it is exactly the kind of thing this project fixes by turning a convention into a check.

Proposed fix

Add .github/workflows/ci.yml:

• Triggers: push to main and pull_request.
• Steps: checkout, set up Python (the project requires >= 3.12 per uv.lock), install uv, then uv run --frozen pytest tests/ -q.
• Use --frozen. Without it, uv run re-resolves and rewrites uv.lock. On a contributor machine behind a proxy registry that silently repoints every source URL away from pypi.org - it happened here in f328364 and had to be reverted in 06ad4c4.
• No secrets required. The suite is hermetic: the log.sh tests spin up a local http.server rather than talking to Grafana Cloud, and the scaffolding tests write to tmp_path.
• Consider also asserting the lockfile is unchanged after the run (git diff --exit-code uv.lock), which would have caught the proxy-rewrite before it was pushed.

Nice property while implementing: a ci.yml added inside a PR runs on that same PR for a same-repo branch, so it proves itself before merge.

Notes for whoever picks this up

• Genesis has no auto-merge workflow, so the resulting PR needs a human to merge it. Say so in the PR rather than waiting silently.
• Don't gate on Genesis Evolver - it needs ANTHROPIC_API_KEY and costs money per run. CI should be free and fast.
• Worth deciding in the same change whether genesis-merge.yml-style auto-merge belongs in genesis itself. Right now genesis is the only repo in the family that can't self-advance past a PR, which is why every fix above needed a human hand on the button.

[genesis-dev-bot]

🤖 Evolver run — picking up #37 (smallest open needs:evolver issue; #33 is too large for one run).

Plan:

• Add .github/workflows/ci.yml — push to main + pull_request, checkout / setup-uv / uv run --frozen pytest tests/ -q
• Add git diff --exit-code uv.lock guard (catches the proxy source-URL rewrite class of bug)
• Decide + record the auto-merge question raised in the issue (in-scope or split out)
• Run the suite locally to confirm it's green and hermetic before pushing
• Open PR, note that a human must merge (genesis has no auto-merge), comment outcome here

Scope note: the e2e tests that hit real GitHub (if any) must stay out of the CI path or the job will need secrets — checking that as part of step 4.

[the-gigi]

Note on the SHAs in the description above. History was rewritten on main (2026-07-27) to strip machine-level proxy-registry URLs that a lockfile re-resolve had baked in, so the commits this issue references no longer exist under those hashes. The incident it describes is real; only the identifiers are stale.

That makes the git diff --exit-code uv.lock check proposed here more valuable, not less: pyproject.toml now carries a [[tool.uv.index]] pin to PyPI, and CI asserting the lockfile is unchanged after a run would catch any future drift before it is pushed rather than after.

One caveat for whoever implements it: use uv run --no-sync (or plain python3 -m pytest). Plain uv run re-resolves, and --frozen was verified not to prevent the rewrite.

[genesis-dev-bot]

🤖 Evolver run 2 — continuing #37 (triggered by the --frozen caveat above).

PR #38 is already open and green, but its CI step is built on uv run --frozen, which the comment above says was verified not to prevent the lockfile rewrite. That is the one load-bearing claim in that PR, so it gets checked before anything else.

• Reproduce: does uv run --frozen actually rewrite uv.lock? Test it rather than trusting either the docs or the PR text
• Pick the invocation that provably cannot touch the lockfile, and say why in the workflow comment
• Update ci.yml on evolver/37-ci-workflow + the guard test in tests/e2e/test_workflows.py (it currently asserts --frozen) + the CI section in CLAUDE.md
• Re-run the suite locally, confirm uv.lock clean
• Push, confirm CI green on PR Add CI workflow so the test suite actually gates changes #38, correct the PR body, comment outcome here

Keeping this on PR #38 rather than opening a second one. Still needs a human to merge — genesis has no auto-merge.