Test Harness Inventory Mapped to Release Gates (YSD-0107)

Compiled 2026-07-18 at working-tree commit 596e6bbfd9. Maps every available harness family to the Section 18 release gates (YSD-18130–18148 "Gate 1–19") and the checklist items each will serve. 102 CI workflows exist under .github/workflows/; only study-relevant ones are listed.

1. Playwright / end-to-end#

• testing/e2e/ — playwright.config.ts, fixtures.ts, page-objects/, setup/, tests/ (including tests/api/{isis,sophia,hathor}/*.e2e.ts); workflow e2e.yml.
• Maps to: Gate 1 (anchor open/inaccessibility, YSD-18130), Gate 12 (manual study without models, YSD-18141), Gate 15 (pin/typed-link traversal, YSD-18144), walking-skeleton journeys YSD-1036/1037, Section 22.1 learner acceptance.
• Gap: no study-workspace page objects; the walking skeleton must add its own journey specs.

2. Accessibility#

• Workflows accessibility.yml, a11y-pa11y-nightly.yml (pa11y nightly); report store infra/a11y-reports/; shell primitive AccessibilityShell (YSD-0106). Study-specific since this file was first compiled: apps/oshun/web/e2e/studio-study-a11y.spec.ts (keyboard-only + screen-reader semantics over the walking skeleton) and studio-study-a11y-modalities.spec.ts (contrast, zoom/reflow, reduced motion, captions + transcript, media alternative + accessible export), both against the real stack.
• Maps to: Gate 10 (keyboard/screen-reader/contrast/reduced-motion/ zoom, YSD-18139), YSD-1037, Section 16.
• Gap (revised 2026-08-09): what this entry recorded on 2026-07-18 — "page-level scanning only — no harness yet for timeline scrubbing, canvas/graph non-spatial alternatives, or accessible media study patterns" — is no longer true of media study patterns; the two suites above cover them. What remains open is the non-spatial alternative for the graph and canvas views, and it is the single scope entry release-gate-evidence.json reports Gate 10 short of. Note the shape of this gate: it is the only one of the nineteen with no release-gate-*.spec.ts, because its subject is a rendered document and no library suite can settle it — and consequently the only one whose evidence survives the conditions test in YSD-22057's register.

3. Contract / schema#

• libs/contracts (canonical zod contracts, e.g. canonical-audit-event); workflows content-slot-contract.yml, api-inventory.yml, external-api-guard.yml, capability-truth-drift.yml; program-local checkers tools/yemaya-study/check-*.mjs (YSD-0101/0103).
• Maps to: Gate 2 (machine-output identity, YSD-18131), Gate 3 (epistemic non-conflation at the contract layer, YSD-18132), YSD-1009, YSD-2008–2010 (schema/OpenAPI/compat tests).
• Gap: no OpenAPI/back-compat pipeline for a study-workspace service yet (created with YSD-1003/1009); no epistemic-type conflation tests anywhere.

4. Evaluation#

• Workflows benchmarks.yml, 3d-quality-continuous-evaluation.yml, generated-evidence-freshness.yml, audit-verification-record.yml, adversarial-review-reconciliation.yml, test-coherence.yml + test-coherence-check.yml (tests-must-fail-on-stubs discipline).
• Gold-set precedent: agentic content-quality program stores gold sets in Postgres (2026-06-13 memory record; ClipMultimodalBackend evaluation).
• Maps to: Section 18.1 rights-cleared evaluation program, 18.2/18.3 metrics, Gate 8 (bias/calibration/cultural/safety eval, YSD-18137).
• Gap: no film/performance/game gold sets exist (YSD-0130 licensing decision precedes them); no calibration harness for confidence values (YSD-2006).

5. Performance#

• testing/performance/ — k6/{aphrodite,bellona} load suites; benchmarks/ (api-benchmark.test.ts, cross-domain-latency.test.ts, tps-models.spec.ts, local-fixture-server.ts); workflow benchmarks.yml; V-series size budgets (v3-cook-size-budgets.yml) as budget-gate precedent.
• Maps to: Gate 11 (UI/API performance, job reliability, scale, cost budgets, YSD-18140), Section 17.
• Gap: no k6 suite for a study-workspace service; no media-pipeline (ingest/proxy/thumbnail) throughput benchmarks.

6. Deletion#

• libs/oshun/persistence/src/dsar-deletion-cascade.ts (+ .test.ts and .integration.test.ts) — DSAR deletion cascade with real tests; libs/oshun/privacy/src/deletion-erasers/, export-deletion/; libs/oshun/auth/src/customer-data-deletion-store.ts; apps/oshun/bff/src/data-export/ durability integration specs (added 2026-07-18); DR workflow v1-disaster-recovery.yml.
• Maps to: Gate 5 (expiry/deletion propagation, YSD-18134), YSD-1035, YSD-3061–3068, Section 22.1 YSD-22018.
• Gap: cascade covers DSAR user data; no media-derivative fan-out (original→proxy→thumbnail→embedding→index→graph→notebook-preview→export) deletion harness — that is new Section 3.4 work.

7. Privacy#

• libs/oshun/privacy/ (erasers, export-deletion), libs/oshun/auth/src/customer-consent-store.ts, libs/oshun/memory-iris/src/consent-ledger.ts + data-rights.ts; apps/v2/telemetry-privacy-compliance (telemetry filtering precedent); shared voice-likeness-consent.ts (audit-platform).
• Maps to: Gate 6 (cross-tenant leakage, YSD-18135 — partially; see security), Gate 7 (consent/roles/retention for performer+learner data, YSD-18136), Section 4.3.
• Gap: no biometric-like-feature handling tests (YSD-4051), no aggregate-threshold harness (YSD-4058), no game-telemetry identifier filter for study ingest (YSD-4057 — v2's is product-local).

8. Security#

• SAST codeql.yml; DAST security-dast.yml; deps+secrets security-deps-and-secrets.yml; domain example iris-security.yml; prompt injection testing/prompt-injection/ (TS + python + held-out/ sets); architecture boundaries testing/boundary/validate-boundaries.ts; stub hygiene stub-indicator-scan.yml + adversarial-grep-trend.yml; chaos testing/chaos/aphrodite; container container-build.yml; IaC terraform.yml, iris-infra-drift-detection.yml.
• Maps to: Gate 4 (restricted-action blocking — partially, via authz tests to be written, YSD-18133), Gate 6 (leakage, YSD-18135), YSD-4099 (SAST/deps/secret/container/IaC/prompt-injection categories exist; parser-fuzz, archive-bomb, SSRF suites do not), YSD-3068 chaos precedent.
• Gap: no media-parser fuzz/sandbox harness, no SSRF/DNS-rebinding suite (agentic-systems memory: ::ffff IPv4-mapped bypass was a real prior bug — reuse that fix's tests as the pattern), no cross-tenant vector/graph/cache leakage suite.

Gate-by-gate coverage summary#

Superseded as a status report (2026-08-09). The table below is the plan as it stood on 2026-07-18 and its "to write" / "new" column is now wrong in most rows: eighteen release-gate-*.spec.ts exist, plus the service integration suites and the studio e2e journeys. It is kept as the record of what was intended. The current answer is machine-held rather than written down here — docs/proposals/yemaya-study-workspace/release-gate-evidence.json names the evidence per gate and release/gate-evidence-register.spec.ts runs it through the real release decision, which is the only form in which this table cannot quietly go stale again.

Bottom line: e2e, accessibility, contract, performance, deletion(DSAR), privacy(consent), and security(SAST/DAST/deps/prompt-injection/chaos) harnesses exist and are extensible; gates 3, 9, 13–19 and the media-specific halves of gates 5/6/7/8/10/11 need harnesses built by their owning sections.