rafatahmed · Oct 28, 2026 · Oct 25, 2026 · Oct 25, 2026 · Oct 25, 2026 · Oct 25, 2026
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -9,11 +9,16 @@ on:
 permissions:
   contents: read
 
+env:
+  CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
 jobs:
   style:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
@@ -40,31 +45,39 @@ jobs:
             python-version: "3.13"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install
         run: python -m pip install -e . build
       - name: Unit tests
-        if: matrix.python-version != '3.13' || runner.os != 'Linux'
+        if: matrix.python-version != '3.13'
         run: python -m unittest discover -s tests -t .
-      - name: Unit tests with coverage (coverage is a CI tool only, not a dependency)
-        if: matrix.python-version == '3.13' && runner.os == 'Linux'
+      - name: Install coverage and support-test dependencies
+        if: matrix.python-version == '3.13'
+        run: python -m pip install coverage==7.17.0 PyYAML==6.0.3 -r benchmarks/requirements.txt -r tools/requirements-benchmark-report.txt
+      - name: Candidate-bound native coverage
+        if: matrix.python-version == '3.13'
+        shell: bash
         env:
-          COVERAGE_FILE: build/.coverage
+          COVERAGE_FILE: build/coverage/.coverage
         run: |
-          python -m pip install coverage==7.17.0
-          mkdir -p build
-          python -m coverage run --source=src/flahax -m unittest discover -s tests -t .
-          python -m coverage xml -o build/coverage.xml
-          python -m coverage report
-      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
-        if: matrix.python-version == '3.13' && runner.os == 'Linux'
+          python -m tools.ci_coverage record --candidate "$CANDIDATE_SHA" --output build/coverage
+          set +e
+          python -m coverage run -m tools.ci_coverage run --candidate "$CANDIDATE_SHA" --output build/coverage 2>&1 | tee build/coverage/tests.log
+          test_status=${PIPESTATUS[0]}
+          set -e
+          python -m tools.ci_coverage report --candidate "$CANDIDATE_SHA" --output build/coverage
+          exit "$test_status"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always() && matrix.python-version == '3.13'
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: build/coverage.xml
-          flags: unittests
-          fail_ci_if_error: false
+          name: coverage-evidence-${{ matrix.os }}-${{ matrix.python-version }}
+          include-hidden-files: true
+          if-no-files-found: error
+          path: build/coverage/
       - name: Clean wheel and sdist verification
         run: python tools/verify_distribution.py
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
@@ -78,6 +91,8 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
@@ -89,7 +104,7 @@ jobs:
       - name: Required live reference replay and runtime equivalence
         shell: pwsh
         run: |
-          python -m unittest tests.test_product_phreeqc tests.test_acid_reference -v 2>&1 | Tee-Object -FilePath phreeqc-validation.log
+          python -m unittest tests.test_product_phreeqc tests.test_acid_reference tests.test_preserved_chemistry_evidence tests.test_live_reference_policy tests.test_reference_integrity -v 2>&1 | Tee-Object -FilePath phreeqc-validation.log
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
@@ -101,10 +116,62 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.13"
       - name: Install package and docs tooling
         run: python -m pip install . -r docs/site/requirements.txt
       - name: Build documentation (warnings are errors)
         run: python -m sphinx -W --keep-going -b html docs/site build/docs-html
+
+  coverage-gate:
+    name: coverage-gate
+    needs: [style, test, phreeqc-live, docs]
+    if: always() && !cancelled()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every prerequisite to pass
+        env:
+          REQUIRED_RESULTS: ${{ toJSON(needs) }}
+        run: |
+          python -c 'import json, os; results = json.loads(os.environ["REQUIRED_RESULTS"]); assert results and all(v["result"] == "success" for v in results.values()), results'
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+      - name: Install exact coverage reporter
+        run: python -m pip install coverage==7.17.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: coverage-evidence-*
+          path: build/native-coverage
+      - name: Enforce revision, native shards and exact statement/branch counts
+        id: aggregate
+        run: python -m tools.ci_coverage aggregate --candidate "$CANDIDATE_SHA" --inputs build/native-coverage --output build/coverage-gate
+      - name: Verify validated upload input
+        run: python -m tools.ci_coverage verify-upload --candidate "$CANDIDATE_SHA" --output build/coverage-gate
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: build/coverage-gate/coverage.xml
+          flags: unittests
+          name: native-aggregate
+          override_commit: ${{ env.CANDIDATE_SHA }}
+          plugins: noop
+          disable_search: true
+          disable_file_fixes: true
+          fail_ci_if_error: true
+      - name: Verify uploaded report was preserved
+        if: always() && steps.aggregate.outcome == 'success'
+        run: python -m tools.ci_coverage verify-upload --candidate "$CANDIDATE_SHA" --output build/coverage-gate
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
+        with:
+          name: coverage-gate-${{ env.CANDIDATE_SHA }}
+          include-hidden-files: true
+          if-no-files-found: error
+          path: build/coverage-gate/