Add Python lint and browser coverage to CI

.github/workflows/quality.yml

@@ -32,6 +32,12 @@ jobs:
       - name: Install dependencies
         run: python -m pip install -r requirements.txt
 
+      - name: Install Python quality tooling
+        run: python -m pip install "ruff==0.15.17"
+
+      - name: Lint Python
+        run: python -m ruff check backend tests tools main.py
+
       - name: Run headless tests
         run: python -m pytest
 
@@ -53,6 +59,10 @@ jobs:
         working-directory: frontend
         run: npm ci
 
+      - name: Install Playwright Chromium
+        working-directory: frontend
+        run: npx playwright install chromium
+
       - name: Check frontend types
         working-directory: frontend
         run: npm run typecheck
@@ -65,6 +75,11 @@ jobs:
         working-directory: frontend
         run: npm test -- --run
 
+      - name: Run frontend browser tests
+        working-directory: frontend
+        timeout-minutes: 10
+        run: npm run e2e -- --workers=1
+
       - name: Build frontend bundle
         working-directory: frontend
         run: npm run build

backend/cortex_backend/execution/local_runtime.py

@@ -15,7 +15,7 @@
 
 from __future__ import annotations
 
-from collections.abc import Iterable, Mapping
+from collections.abc import Mapping
 import json
 import multiprocessing
 from threading import Event, Lock, Thread

backend/cortex_backend/execution/native_broker.py

@@ -22,7 +22,7 @@
 import struct
 import sys
 from time import sleep
-from typing import Any, Callable, Literal
+from typing import Any, Callable
 
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric.x25519 import (
@@ -850,13 +850,14 @@ def accept(
                 server_pid=os.getpid(),
                 client_pid=peer.process_id,
             )
-            authorization = lambda message: authorize_message(
-                message,
-                peer=peer,
-                peer_policy=self.config.peer_policy,
-                expected_principal_id=expected_principal_id,
-                owner_for_job=owner_for_job,
-            )
+            def authorization(message: BrokerMessage) -> None:
+                authorize_message(
+                    message,
+                    peer=peer,
+                    peer_policy=self.config.peer_policy,
+                    expected_principal_id=expected_principal_id,
+                    owner_for_job=owner_for_job,
+                )
             pipe = _PipeIO(win, handle)
             return NativeBrokerConnection(
                 pipe,
@@ -935,11 +936,12 @@ def connect(
             # The client cannot safely invent a server token identity. The pipe
             # DACL and expected server PID bind the transport; responses are then
             # bound to the trusted installation/job without a fake PeerIdentity.
-            authorization = lambda message: _authorize_principal_and_owner(
-                message,
-                expected_principal_id=expected_principal_id,
-                owner_for_job=owner_for_job,
-            )
+            def authorization(message: BrokerMessage) -> None:
+                _authorize_principal_and_owner(
+                    message,
+                    expected_principal_id=expected_principal_id,
+                    owner_for_job=owner_for_job,
+                )
             return NativeBrokerConnection(
                 pipe,
                 peer=None,

tests/test_phase2_bundle_installer.py

@@ -146,7 +146,7 @@ def test_rollback_requires_explicit_authorization_and_recovery_is_explicit(tmp_p
     source = tmp_path / "incoming"
     installer = SignedBundleInstaller(tmp_path / "store", keys)
     _source(source, b"version one")
-    first = installer.install(
+    installer.install(
         _payload(signer, content=b"version one"),
         source,
     )

tests/test_phase2_resource_watchdog_qualification.py

@@ -6,7 +6,8 @@
 
 
 def test_resource_watchdog_report_is_reproducible_without_native_details(monkeypatch):
-    green = lambda: {"name": "native", "status": "pass"}
+    def green():
+        return {"name": "native", "status": "pass"}
     monkeypatch.setattr(qualification, "_native_job_accounting", green)
     monkeypatch.setattr(qualification, "_native_tree_reaping", green)
 

tests/test_services.py

@@ -188,7 +188,7 @@ def test_response_generation_does_not_call_optional_title_model(self):
             engine_factory=lambda snapshot: engine,
         )
 
-        result = service.generate(_snapshot(), progress_sink=_ProgressRecorder())
+        service.generate(_snapshot(), progress_sink=_ProgressRecorder())
 
         self.assertIsNone(engine.title_history)
 

tools/execution_spikes/assemblyscript_qualification.py

@@ -11,7 +11,6 @@
 import argparse
 import hashlib
 import json
-import os
 from pathlib import Path
 import shutil
 import subprocess
@@ -23,6 +22,7 @@
 
 
 VERSION = "0.28.19"
+BLOCKED = "blocked"
 TARBALL_SHA512 = (
     "C8E02501BF44B2B234D2851A7FAA944ED4DC61879E946DA20B77F52E7038E575"
     "1E4A532BA763B6145E4B963E0FF98F3866222587F722104A4E68FC3098E2AAF2"

tools/execution_spikes/resource_watchdog_qualification.py

@@ -21,7 +21,7 @@
 sys.path.insert(0, str(ROOT / "backend"))
 sys.path.insert(0, str(ROOT / "tools" / "execution_spikes"))
 
-from cortex_backend.execution.resource_accounting import (
+from cortex_backend.execution.resource_accounting import (  # noqa: E402
     ResourceAccountingError,
     ResourceBudget,
     ResourceGovernor,