[JUM-903][CI] Run ci:gate checks that no CI job ran as a branch-gate preflight

[web2solutions]

Summary

Every ci:gate step now runs in some CI path. Hosted CI never executes the ci:gate script, so twelve steps listed only there ran nowhere — including cli:check-template-freshness, which was failing on dev with all required checks green (fixed by JUM-902). New ci:gate:static groups the cheap checks and runs as a branch-gate preflight on every gate; frontend:coverage:check joins the CircleCI coverage job; a coverage suite fails when a step is added to ci:gate alone.

Problem Statement

Measured on dev dd9c2da: deps:check-overrides, deps:audit, arch:check-http-adapters, governance:check-authorship, packages:check-suites, packages:check-build-freshness, cli:check-template-freshness, website:check-content-routes, rtdb:check-indexes, ci:check-provider, frontend:coverage:check, oas:check-relations appear in no preflight, no strict-matrix cell and no CircleCI step. Same failure shape as JUM-683 / JUM-786.

• Related issue(s): JUM-903
• Related PR(s): none
• Related check run(s): none yet

Project Tracking (Required)

• Linear Project: Jumentix (https://linear.app/jumentix)
• Focused epic link: https://linear.app/jumentix/project/epicdocs-unified-jumentix-documentation-9981763642b6
• Epic milestone: Audience-clean docs and refreshed website visuals — 2026-10-31
• Primary task nature: ci
• Epic-delegated agent ID: claude-code-opus5-001
• Child task issue link: https://linear.app/jumentix/issue/JUM-903/ci-twelve-cigate-checks-run-in-no-ci-job-the-cli-template-freshness
• Project Update: https://linear.app/jumentix/project/epicdocs-unified-jumentix-documentation-9981763642b6/activity#project-update-95278508
• Linear Project link(s): https://linear.app/jumentix/project/epicdocs-unified-jumentix-documentation-9981763642b6
• Linear Issue link(s): https://linear.app/jumentix/issue/JUM-903/ci-twelve-cigate-checks-run-in-no-ci-job-the-cli-template-freshness
• Linear Issue ID list (comma separated): JUM-903
• Item status at PR creation: In Progress
• Target cycle (Start date -> End date): 2026-09-26 -> 2026-10-06
• Priority group for this PR (P0 / P1 / P2): P1
• This PR contains tasks from only one priority group.

Branch Promotion Path (Required)

• Source branch: claude/ci/JUM-903-static-gates-preflight
• Target branch: dev
• Required PR title format: [JUM-XXXX][Nature] <concise outcome>
• The leading JUM-XXXX matches the single Linear Issue declared above.
• This task PR targets dev.
• If this PR targets main, it is a release promotion sourced from dev, references the task PRs/issues already merged into dev, and introduces no unreviewed changes.
• This PR is not a direct task/topic branch promotion to main.

Bidirectional Traceability (Required)

• Every linked issue already contains this PR URL.
• Every linked issue already contains commit hash/range evidence.
• PR description includes mapping of task -> commit(s).
• Task -> commit(s) mapping:
  • JUM-903: 2f9587e

Scope of Change

Domain / Business Rules

• None.

Application / Use Cases

• None.

Adapters / Infrastructure

• package.json: ci:gate:static (11 steps).
• ci-cd/run-branch-quality-gate.js: static-gates preflight on task, unit, full-matrix and generated-automation gates.
• .circleci/config.yml: bun run frontend:coverage:check after frontend:test:coverage in the coverage job.
• ci-cd/test/ci-gate-coverage.test.ts: ci:gate ⊆ preflight ∪ gate scripts ∪ matrix ∪ ci:gate:static ∪ named CI steps; negative control with an imaginary step; stale exception entries fail.

API / Contracts (OpenAPI, DTOs, handlers, controllers)

• None.

Detailed Technical Changes

1. deps:audit measured on a clean bun install --frozen-lockfile: [deps:audit] no blocking advisories. (2539 packages). A reused local store reported 11 fatal advisories from stale versions (next 16.3.0, happy-dom 20.0.11, …) that the lockfile no longer resolves — CI always installs fresh, so this is a local-only false positive, noted here rather than fixed.
2. ci:gate:static runs in ≈5.5 s locally.
3. TESTING-CI-AND-QUALITY.md (EN + pt-BR) documents the preflight.

Architecture and Design Alignment

• Domain logic remains inside domain/application layers.
• Controllers/handlers do not instantiate repositories/services directly.
• Ports/adapters boundaries are respected.
• No new circular dependencies introduced.
• Event publishing/listening flow remains consistent.

Security Impact

• Security impact: No security impact.
• Secrets handling reviewed: [ ] Yes [ ] No [x] N/A
• Input/output sanitization reviewed: [ ] Yes [ ] No [x] N/A
• AuthN/AuthZ impact: [ ] Yes [x] No
• Data exposure risk (password/salt/token/PII): [ ] Yes [x] No
• Sonar security findings addressed or unaffected: [x] Yes [ ] No

Data and Migration Impact

• Data model impact: none.
• Migration required: [ ] Yes [x] No
• Rollback strategy: revert the PR.

Breaking Changes

None.

Acceptance Criteria

• Feature/bug behavior matches expected functional outcome.
• Error paths and edge cases are covered.
• API contract changes (if any) are documented and validated.
• Architecture boundaries remain enforced.
• No regression in existing workflows.

Test Plan (Evidence)

• bun run lint — clean
• bun run test:unit — task gate: Tests: 1156 passed, 1156 total
• bun run ci:gate:static — all 11 passed after JUM-902 rebuilt the templates
• bun run frontend:coverage:check — lines 90.60% (threshold 85%), functions 87.51% (80%)
• bun run ci:gate — not run in full locally; CircleCI is authoritative

Extra evidence:

[ci] preflight: static-gates (ci:gate:static)
[deps:audit] no blocking advisories.
Package build freshness check passed: every built entrypoint carries its source exports.
CLI template freshness check passed: packaged templates match seeds at HEAD.

# before (dev dd9c2daf)
[cli-init template-freshness] manifest hash drift: frontend/src/data/sync.ts — run `bun run cli:build-templates`

Feedback Resolution (Required)

• Every GitHub review thread is resolved natively.
• Every general comment has a visible resolution response by the PR author or a repository maintainer.
• Each resolution response uses exactly one marker and, for resolved, a SHA from this PR.

Coverage

• Project coverage >= 95%: [x] Yes [ ] No
• Patch coverage >= 95%: [x] Yes [ ] No
• Codecov status passing: [ ] Yes [ ] No (pending CI)

SonarQube Cloud

• Quality Gate passing: [ ] Yes [ ] No (pending CI)
• New vulnerabilities introduced: [ ] Yes [x] No
• New security hotspots reviewed: [ ] Yes [ ] No [x] N/A

Performance / Reliability Impact

No measurable impact.

Observability

• Logs updated: [ ] Yes [x] No
• Metrics/Tracing updated: [ ] Yes [ ] No [x] N/A

Deployment and Rollout

• Deployment notes: none.
• Feature flag needed: [ ] Yes [x] No
• Rollout strategy: merge to dev, promote with the next release.
• Rollback steps: revert the PR.

Risks and Mitigations

1. Risk: none material.\n Mitigation: n/a.

Documentation Updates

• README updated (if needed)
• Additional docs updated (if needed)
• Changelog untouched; GitHub Actions synchronizes it only after the validated main merge

Reviewer Checklist

• Changes are clear and scoped.
• Acceptance criteria are testable and satisfied.
• Tests are sufficient for risk level.
• Security and data impacts are addressed.
• CI checks pass fully.

🤖 Generated with Claude Code

---

Note

Low Risk
CI orchestration and test expectations only; no application runtime or auth/data paths change, with regression guarded by new coverage tests.

Overview
Fixes JUM-903: hosted CircleCI never runs the monolithic ci:gate script, so several checks (including CLI template freshness) could fail on dev while required PR checks stayed green.

Adds ci:gate:static in package.json to bundle eleven cheap static/audit checks and wires a new static-gates preflight (ci:gate:static) into every branch-quality-gate path in run-branch-quality-gate.js (task, unit, full matrix, generated automation). The CircleCI coverage job now runs frontend:coverage:check after frontend patch coverage.

A new gate-tier suite ci-gate-coverage.test.ts asserts every ci:gate step is exercised via preflight, strict matrix, ci:gate:static, or a named CI job, with branch-gate tests and EN/pt-BR CI docs updated accordingly.

^{Reviewed by Cursor Bugbot for commit 7f2df35. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_c38964c2-e860-4f6f-95a1-31353176ffa1)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_dbde3baa-3c7f-45e9-a1cf-01fe73556fb0)