PR #202 - Prekzursil/Reframe

Lean deterministic quality-gate model (proof)

Replaces the SaaS / Quality-Zero-Platform layer with 6 deterministic, local-first
gates behind one CI check quality. Every tool is version-pinned with an in-repo
config; no SaaS, no baselines, no auto-fetched rulesets.

Honest proof: gates 1, 4, 5 are at literal zero; gates 2 (types) and 6 (deps)
have residuals that need a human decision (see below). This is a partial proof by
design — the cleaning procedure stops rather than grind judgment-heavy residuals.

Pinned tool versions (latest stable @ 2026-06-16)

Tool	Version
ruff	0.15.17
oxlint / @oxlint/migrate	1.70.0 (pre-commit mirror v1.69.0)
biome	2.5.0
basedpyright	1.39.8 (`typeCheckingMode=standard`)
gitleaks	8.30.1
osv-scanner	2.3.8
opengrep (CI) / semgrep (local)	1.22.0 / 1.166.0
pre-commit	4.6.0
Rust toolchain	1.96.0 (rust-toolchain.toml)

JS/TS formatter = Biome (format-only), not oxfmt — oxfmt is still beta (0.55.0, no GA).

Per-gate status

Gate	Status
1 lint+format+sec-lint (ruff / oxlint / biome / rustfmt+clippy)	✅ 0
2 types (tsc web+desktop / basedpyright)	tsc ✅ 0 · basedpyright = 182 errors — NEEDS DECISION
3 tests+coverage (pytest 100% branch / vitest 100%)	web vitest ✅ 100% · pytest+desktop run on CI (see notes)
4 SAST (opengrep curated `.quality/opengrep/`)	✅ 0
5 secrets (gitleaks `.gitleaks.toml`)	✅ 0 (current tree)
6 deps (osv-scanner)	76 known CVEs — NEEDS DECISION

NEEDS-DECISION items

Gate 2 — basedpyright: 182 errors. ~60-65% trace to one pattern
(_owner_fields() returning a generic dict **-unpacked into typed models) +
return-type tightening; ~30% is third-party-stub noise (Celery .conf/.task,
SQLModel column.desc()); ~5% genuine null-safety bugs in billing_api.py.
Decide: fix the _owner_fields typing + null guards vs add per-module overrides
for stub noise.
Gate 6 — osv-scanner: 76 CVEs (37 npm + 21 PyPI + 18 crates.io). Runtime:
pyjwt 2.9.0 (7, incl. alg-bypass), python-multipart 0.0.9 (8 DoS). Dev/E2E
stack (vite/undici/esbuild/storybook/vitest) needs SemVer-major bumps. No blanket
ignores added — osv-scanner.toml is documented but empty. Decide: upgrade vs
per-vuln accept-with-reason.
Gate 3 — desktop vitest branch threshold raised 0→100, surfacing ~33
uncovered Tauri IPC/updater branches in apps/desktop/src/main.ts. Decide: write
IPC-mock branch tests vs /* v8 ignore */ the platform branches.

Notes

Python tests + coverage and desktop vitest run green on Linux CI; locally on
Windows a few integration tests hit WinError 32 file-locking and the render
pipeline (environmental, not logic). The conftest SQLite URL was made cross-platform.
react-hooks/exhaustive-deps set off (advisory; auto-fix risks render loops).
CodeQL kept (public repo) but rewired from the QZP wrapper to the native
github/codeql-action with pinned SHAs.

Salvaged

fdd0640 rate-limiter per-test isolation (resolved a conflict to keep async _enforce_policy).
4a90b6a npm audit fix. (Did not bring 8d3ce2e secret-forward — moot.)

Created / deleted

Created: QUALITY-CHARTER.md, .github/workflows/quality.yml, .pre-commit-config.yaml,
.quality/charter_check.py, .quality/opengrep/*, .gitleaks.toml, osv-scanner.toml,
rust-toolchain.toml, apps/web/.oxlintrc.json, apps/desktop/.oxlintrc.json,
biome.json, pyproject.toml, apps/desktop/src-tauri/Cargo.lock.
Deleted (33): sonar/codacy/codecov configs; quality-zero-*, applitools, browserstack,
chromatic, codecov-analytics, ops-weekly-digest, release-readiness, strict23-preflight,
branch-protection-audit workflows; their scripts + tests; dead apps/web/.eslintrc.cjs.
Dependabot config kept. Branch-protection / GitHub Apps untouched (human step).

charter_check.py enforces that this gate list and quality.yml never diverge.

Summary by cubic

Replaces the SaaS quality layer with six deterministic, local-first gates behind a single quality CI check, with all tools version-pinned and configs in-repo. Adds curated SAST, secrets, and dependency gates; rewires CodeQL to the native action; and removes legacy SaaS workflows.

New Features
- Single quality workflow running gates 1–6: lint/format, types, tests+coverage, SAST, secrets, deps (pinned ruff, oxlint, biome, rustfmt/clippy, opengrep, gitleaks, osv-scanner).
- In-repo SAST ruleset (.quality/opengrep/*), gitleaks config, and osv-scanner.toml with no blanket ignores.
- pre-commit setup for auto-fixers; pinned Rust via rust-toolchain.toml; charter/workflow consistency enforced by .quality/charter_check.py.
- Removed QZP/SaaS workflows and scripts; codeql.yml migrated to github/codeql-action with pinned SHAs; JS/TS linting moved to oxlint + biome.
Migration
- Run locally: pre-commit run --all-files and ensure tests hit 100% coverage (desktop Vitest branches now 100%).
- Gate 2: decide on resolving 182 basedpyright errors (tighten types/null checks vs. targeted overrides).
- Gate 6: decide on 76 CVEs from osv-scanner (upgrade vs. per-vuln accept-with-reason).