chore(QUAL-007): check the whole test tree with mypy [stacked on #105]

[DoRmAmMu1997]

⚠️ Stacked PR — merge order matters

Base: chore/qual-006-pandas-stubs (#105). Merge #105 first. GitHub retargets this PR to main automatically when the base branch is deleted on merge. Merging this PR before #105 would land it into the feature branch — don't. Stacked at the user's request so the diff shows only QUAL-007's changes.

Ticket scope (QUAL-007 — mypy over tests/, phase 2)

Goal: finish what QUAL-004 started. The mypy files whitelist covered exactly three test modules; every other test file — including any new one — was invisible to the type checker. This PR flips the default: files now says "tests", so the whole tree is checked and new test files are typed from day one.

What full adoption surfaced: 409 mechanical errors in 45 of ~90 test modules — fake clients passed where the real client class is annotated, to_dict("records") rows, unannotated accumulators, append(...) or True recorder lambdas. Per the plan's pre-agreed fallback ("if the count balloons, keep the largest-coverage whitelist and document the remainder"):

In scope

• pyproject.toml: files extended to "tests"; a new shrink-only ignore_errors override enumerates the 29 modules still carrying debt (~385 errors), with a comment forbidding additions — the module names are top-level (no tests. prefix) because tests/ is not a package.
• 16 modules fixed (~24 errors), all behavior-preserving:
  • append(...) or True / append(...) or value lambdas → small named fakes with real return statements (4 sites);
  • Optional-narrowing on ORM reads (metadata_json, scalar()) via explicit assert/str()/comprehension filters;
  • the IPO import-boundary guard now isinstance-filters AST nodes up front (same runtime walk, typed lineno);
  • deliberately-invalid enum/string inputs ("UNKNOWN" coercion test, "bullish" rejection test) marked with cast + comments — the validators they exercise are untouched;
  • UI fakes' capture slots typed as pd.DataFrame so assertions may use frame methods;
  • the same np.log(Series) narrowing the production scoring component uses.
• Net effect: mypy checks 209 files (up from 122), clean. CI's command is unchanged — the gate is config-driven.

Out of scope (deliberate)

• The 29 enumerated modules' ~385 remaining errors — real but mechanical typed-API debt, better burned down incrementally than in one 45-file mega-diff. The override list is the documented TODO.
• No strictness escalation (disallow_untyped_defs etc.).
• Wave interaction: test files added by the sibling PRs (test(TEST-007): render-path tests for fundamentals_panel + scan_view #98–perf(PERF-002): skip discarded parquet reads with footer stats #103) aren't on this branch and will be checked by the new default once everything merges; if any surfaces an error on main, it's a fix-forward. Merging this PR last of the wave avoids even that.

This is ticket 9 of the 10-ticket second improvement wave (TEST-007 #98, REF-003 #99, AI-006 #100, IPO-006 #101, TEST-006 #102, PERF-002 #103, DEPLOY-004 #104, QUAL-006 #105, QUAL-007, DOC-003).

Gates (all green, local, Python 3.13)

Gate	Result
mypy	clean at 209 files (was 122)
pytest on the 16 touched modules	240 passed
Full suite --cov-fail-under=87	1,386 passed, 1 skipped; coverage 88.13%
pre_commit validate-config / compileall / ruff / bandit / pip_audit	clean

Diff vs the #105 base: 17 files, +125/−29 — pyproject.toml (mypy config only; no dependency motion) and 16 test modules.

Review

/code-review: Approve — every fix re-ran its module's tests (240 passed); the two deliberate-invalid-input casts keep the validators' rejection paths exercised; the exclusion list was cross-checked against the actual mypy output so no clean module is accidentally ignored. /security-review: no findings (test/config-only diff; the strengthened IPO boundary-guard typing keeps that policy test enforcing the same rules).

🤖 Generated with Claude Code

[DoRmAmMu1997]

Self-review (posted as COMMENT — the bot runs as the PR author and cannot APPROVE). Verdict: Approve.

1. The flip is the point — before: 3 test modules whitelisted, new test files unchecked forever unless someone remembered to add them. After: checked-by-default (209 files), with the remaining debt enumerated in a shrink-only list. The override comment explicitly forbids additions, making "new untyped test module" a reviewable config change instead of silent drift.
2. Module-name gotcha caught in-flight — the first draft used tests.test_* names, which silently matched nothing because tests/ has no __init__.py; mypy names those files as top-level modules. The committed version uses the correct bare names and the full run proves the override actually bites (409 errors → 0 reported).
3. Behavior-preservation of the 16 fixes — all 240 tests in the touched modules pass. The two riskiest edits were checked closely: the IPO boundary guard's isinstance-first walk visits the same Import/ImportFrom nodes (non-import nodes previously produced an empty modules list, i.e. a no-op inner loop); and the role_changed metadata None-filter removes nothing at runtime because that event always writes metadata (asserted by the same suite).
4. Deliberate-invalid inputs stay deliberate — cast(IpoIssueType, "UNKNOWN") and cast(Any, "bullish") exist precisely so the coercion/rejection tests keep sending the raw values their validators must handle; comments at both sites say so.
5. No dependency motion — the pyproject diff is mypy config only; constraints/requirements untouched on this branch (the pins live in the #105 base).
6. Stacking discipline — base is chore/qual-006-pandas-stubs; the body's top banner spells out the merge order and GitHub's auto-retarget. This PR should merge last of the wave so test files from #98–#103 get checked on main under the new default (any stragglers are fix-forward).

Gates: mypy clean at 209 files; 1,386 passed + 1 skipped, coverage 88.13% (floor 87); ruff/bandit/pip-audit/pre-commit/compileall clean. Security review: no findings (test/config-only).

[DoRmAmMu1997]

Codex review plan before fixes:

• I’m going to merge current GitHub main into chore(QUAL-006): adopt pandas-stubs across the checked application code #105, then merge that updated base into this branch so QUAL-007 is tested against the test(TEST-007): render-path tests for fundamentals_panel + scan_view #98–docs(DEPLOY-004): Postgres worked guide + pool_pre_ping for server DBs #104 files it will actually type-check.
• I’m going to fix the 11 composed-tree mypy errors in the newly landed IPO/Parquet tests without changing their runtime behavior.
• I’m going to turn the 29-module “shrink-only” debt promise into an executable policy guard: removals remain allowed, additions/duplicates/missing files fail.
• I’ll rerun the focused composed-tree tests, full mypy/coverage/security gates, push the update, and report exact evidence here.

No new typing strictness or product behavior is being added.

[DoRmAmMu1997]

Codex found two actionable QUAL-007 integration/policy issues before updating the branch.

[DoRmAmMu1997]

Codex review follow-up complete for QUAL-007.

What I fixed:

• merged the current chore(QUAL-006): adopt pandas-stubs across the checked application code #105/main lineage so the whole-test-tree mypy gate is evaluated against the code already merged through PR docs(DEPLOY-004): Postgres worked guide + pool_pre_ping for server DBs #104;
• typed the newly composed URL-canonicalization, Parquet-statistics, daily-loader, and IPO pipeline tests without changing production behavior;
• added a policy guard that permits the 29-module ignore_errors baseline to shrink, but rejects additions, duplicates, and missing test modules.

Verification on the final local tree:

• 1517 passed, 1 skipped; coverage 89.31% (floor 87%)
• mypy: Success: no issues found in 221 source files
• compileall, Ruff, Bandit, pinned pip-audit, pre-commit validation/hooks, and git diff --check: passed
• Docker is not installed on this workstation; the hosted Docker image check is the authoritative container result

The formal diff-scoped security review found no reportable issues. The change is limited to typing/test-policy code and introduces no runtime behavior.