lesavka/docs/quality-gate.md

Lesavka quality gate

Lesavka follows the Atlas gate order, with one extra lane for media reliability because the product is latency-sensitive and hardware-facing.

Strict order:

1. style/docs via scripts/ci/hygiene_gate.sh
2. LOC/naming via scripts/ci/hygiene_gate.sh
3. coverage via scripts/ci/quality_gate.sh
4. tests via scripts/ci/test_gate.sh
5. media_reliability via scripts/ci/media_reliability_gate.sh
6. gate_glue via scripts/ci/gate_glue_gate.sh
7. sonarqube via scripts/ci/sonarqube_gate.sh
8. supply_chain and artifact security via scripts/ci/supply_chain_gate.sh

The Jenkinsfile runs those checks in that order. Gate artifacts are archived under target/*-gate/ and release artifacts under dist/.

Repository Hygiene

The hygiene gate fails if generated output is committed, Cargo.lock is missing from git, workspace members drift away from common, client, server, and testing, direct-run shell scripts are not executable, manual scripts are not marked manual, or new LESAVKA_* variables are missing from docs/operational-env.md.

Manual probes live under scripts/manual/. They are useful field tools, but they are not CI dependencies unless converted into deterministic tests.

Coverage

The coverage gate hard-fails when any tracked source file under a workspace src/ tree falls below 95% line coverage. The older strict-contract list still stays in place for the especially important media/device files, but it is now additive rather than the only hard bar.

Media Reliability

media_reliability is not just a test alias. It protects the pieces that keep video moving without accumulating latency:

• bounded appsrc/appsink queues
• stale-frame dropping over latency buildup
• local monotonic sink timestamps
• IDR/keyframe recovery after drops
• HDMI/UVC sink construction
• preview telemetry for FPS, drops, queue depth, and inter-frame gaps

Real hardware evidence still matters. Put manual soak evidence in target/media-reliability-gate/manual-soak.json when validating Zoom/Teams/Slack-class consumers or the Theia HDMI -> UGREEN -> Tethys USB path.

Supply Chain And Artifacts

scripts/ci/supply_chain_gate.sh always generates dependency metadata, a dependency tree, secret-scan evidence, and artifact checksums when dist/*.tar.gz exists. It runs cargo-audit and cargo-deny when those tools are installed. Set LESAVKA_SUPPLY_CHAIN_ENFORCE_TOOLS=1 to hard-fail when either tool is unavailable.

build-dist.sh writes dist/SHA256SUMS and a provenance JSON file with version, branch, commit, build URL, toolchain, target, and timestamp.

SonarQube

scripts/ci/sonarqube_gate.sh emits explicit not_applicable metrics when scanner configuration is absent. Set LESAVKA_SONAR_ENFORCE=1 in CI once SonarQube credentials and sonar-scanner are installed to hard-fail missing or failed Sonar analysis.