**Plan N — Quality-Gate Enforcement** External review of CRAIG's quality gates (2026-06-06) found that the quality-budget + risk-coverage matrix systems are dashboards, not controls. This epic tracks the work to convert them into enforcing gates wired into pre-push + CI. ## Operating principle The gate that lets known-failing code ship is the wrong gate. Pre-push runs everything runnable locally; CI runs everything CI can run; the two stay in lockstep via `cargo xtask validate` as a single source of truth. ## Findings being addressed - `xtask/quality-budgets.toml:6` self-declares `report-only` and "NOT wired into pre-push or CI today." - 5 budgets OVER historical lock: B3a 236→447, B3b 31→63, B4 142→332, B5 175→219, B7 194→197. - 2 budgets silently masked by `actual > r.threshold.max(r.locked)` at `xtask/src/cmd/quality_budgets.rs:149` — B1 (8→11) + B2 (49→56) regressed without firing. - Coverage matrix reports 11/1314 cells covered + 587 untagged API tests (naming-convention-adoption gap). - `.gitlab-ci.yml` `ci-tests` job runs only fmt + clippy + `nextest --lib --bins` — the 6 custom xtask lints (4c–4h), `cargo machete`, workspace nextest, and quality-budgets live in pre-push only. ## User constraint **Strict no-grandfather** (2026-06-06). Don't reset locks to acknowledge current debt. Keep historical baselines, pay down OVER budgets in dedicated sweep MRs, then flip enforcement on. ## Steps 12 steps in 6 phases. See plan body at `docs/modules/ROOT/pages/plans/quality-gate-enforcement.adoc` for full Status table + DAG. | Phase | Steps | Purpose | |---|---|---| | A — Foundations | Step 2 | Semantic fix + comment-skip + counter unit tests | | B — Pay-down | Steps 3–7 | Bring 5 OVER budgets back to historical lock | | C — Coverage tagging | Step 8 | `// @axis:` comment annotation + 587-test sweep | | D — Enforcement flip | Step 9 | Wire `--fail-on-regression` into pre-push [4i/14] + CI ci-tests | | E — CI parity | Step 10 | `cargo xtask validate --skip-devstack` + CI mirror | | F — Hook integrity + close | Steps 11–12 | hooks-exec-check CI job + plan archive | ## Estimated calendar ~7 working days; 15–17 MRs. Phases B + C + E + F interleave; D blocks on B clear.