[pcvantol]

LANE_4 r2 quality gate

Same bounded assignment L4-WORKSPACE-CI-GATES-V1-20261001 in Forge #208. This follows the completed Server slice in PR #35 and closes its explicit hosted-validation gap without changing the existing workflow file or branch protection.

The existing required Foundation validation job already calls bash scripts/validate.sh. That entrypoint now runs the Server tests under Python's standard-library tracer, recursively inventories Workspace product modules (including future subpackages), fails closed on missing module evidence, and requires strictly >80.2% executable-line coverage for every such source. It also builds the canonical 2.4.1 wheel, verifies metadata, browser assets and both role entrypoints, and installs the wheel non-editably in a fresh environment outside the checkout. Three negative tests prove low/missing coverage, missing nested-module evidence and missing wheel files fail.

Product version 2.4.1 is one PATCH operation under the committed Workspace version policy. The owning backlog/HTTP/distribution DAGs record this gate; full peer, public distribution and installed-system parent nodes remain open.

Exact local evidence on 14464e8b81d8336f95174d2ac9337538684a6b0b

• bash scripts/validate.sh: PASS. Strict trace coverage: __init__.py 8/8 (100%), cli.py 45/46 (97.83%), http.py 83/96 (86.46%), service.py 86/90 (95.56%).
• Wheel build, canonical metadata, browser assets, both CLI roles and fresh non-editable install outside checkout: PASS.
• Independent local full installed-wheel acceptance from 2.4.1 bytes: real API/CLI/headless Chrome browser, two isolated instances and normal restart PASS; wheel SHA-256 dabb1ac6e4de4fd86908c64eeaf13ce844cb9c4200789706da078fe49059bb14.
• git diff --check: PASS. First independent read-only review at the prior head found one P2 gap: nested modules were outside the gate. The recursive inventory and a negative nested-module test repair that gap. Fresh independent read-only review at exact head 14464e8 verified the repair and found no remaining actionable issues; it is not a GitHub approval or reviewer grant.
• Exact-head protected Foundation validation and version-source checks: SUCCESS. Non-blocking TDE observe job: SUCCESS; its downloaded artifact reports assessment PASS_WITH_WARNINGS, repository qualification QUALIFIED, assessment_exit=1, qualification_exit=1 and no TDE coverage evidence. This is observation, not a runtime-TDE PASS. The required Foundation validation job itself now performs the strict coverage and wheel gates above.

The wheel gate resolves declared build dependencies via pip in a disposable build environment; the generic projection check remains offline. No peer source, runtime, production credential, service, signer, installer, Mission, reset, T0 or public registry is touched. The first installer DoD is unchanged.

Protected merge and main readback

PR #36 was protected squash-merged at 05ec6d305ab1f1ca732fd7f44c072e0bed8448f2; its source tree is identical to the reviewed head. On exact main, bash scripts/validate.sh passed with the same per-file coverage figures and wheel checks. The fresh main-built 2.4.1 wheel passed non-editable install, real API/CLI/headless-Chrome browser, two-instance isolation and normal restart; SHA-256 afcfb22f81e2b9986eeff0e37bf637a2ef5acde743e21c081b177c06cdc13040. Its differing ZIP digest is not presented as bitwise reproducibility.

Exact-main Foundation validation run 36893899456, canonical versioning run 36893899649, and non-blocking TDE observe run 36893899520 all completed SUCCESS. The TDE artifact still reports PASS_WITH_WARNINGS / QUALIFIED, assessment_exit=1, qualification_exit=1, and coverage_evidence=not_available_for_foundation_only_repository. This remains observation, not runtime-TDE qualification. The checkout is clean on main; the feature branch and local test processes/listeners are gone. WH-PEERS/full WH-Q and public WPK gates remain open.