Engineering Mandate Completion Notes (2026-07-03)

Companion to 2026-07-03-engineering-mandate.md. All 3 tasks shipped; the gate
is live in the deploy path (proven end-to-end: gated ship dad18cf deployed to
staging, health 200, agents healthy).

What shipped

• scripts/check-conventions.mjs + root pnpm check (294946a) — three rules
  (BOUNDARY, ON-PREM, MUTATION-GUARD), each proven to fail on a deliberate
  violation and pass clean.
• build-and-ship.sh gate wiring + pytest in both agent images (084a451).
• CLAUDE.md "Engineering mandate" section (bc4e200).

Deviations from the plan

1. pytest deps under uv pip sync — sync treats requirements.txt as an
   exact set and does NOT resolve dependencies; bare pytest>=8,<9 produced
   No module named 'pluggy' in-image. Fix: pluggy>=1.5,<2 + iniconfig>=2
   added alongside (packaging was already pinned).
2. Scratch Postgres for in-image tests — the policy suites connect to
   Postgres at import time (only test_embedder.py is hermetic), so the plain
   docker run … pytest from the spec cannot work. The gate now spins up a
   throwaway pgvector/pgvector:pg17 (ahu-gate-pg, user/pass/db = ai) on a
   temp ahu-gate network, points tests at it via DB_HOST, and tears it
   down. Both agents: 23 passed each, ~4s.
3. Ship inbox moved (dad18cf) — first gated ship failed at scp:
   /tmp/ahu-images on Server 2 was obert-owned and /tmp's sticky bit blocked
   efran. Inbox now /home/efran/ahu-ai-staging/inbox; tarballs are deleted
   after docker load (the old inbox had accumulated 1.2 GB; removed via
   obert).

Gotcha for future sessions

docker run … | tail swallows the container's exit code — the first
"successful" pytest proof was actually a masked failure. The gate itself pipes
nothing; when probing manually, use set -o pipefail.