docs: correct the skip matrix in the agent-context files (#42)

The table claimed a missing Docker daemon degrades to a silent skip.
TestCreateToRunDocker runs in a container runtime context with no tooling
guard, so it fails loudly instead, and the files now say so along with a
warning not to quiet it with a skip guard.

It also omitted nix. CI has no nix and the matrix skips any absent
backend, so TestPythonFastAPILifecycle_Matrix/nix is the one skip in a
green CI run and the nix path is covered nowhere — which the files have
to state, since they direct attention at nix elsewhere.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: antoinetoussaint-byte

.claude/skills/lifecycle-test-triage/SKILL.md

@@ -21,12 +21,20 @@ go test -v ./... 2>&1 | grep -E '^\s*--- SKIP'
 | Missing | Skips |
 | --- | --- |
 | `uv` | the real uvicorn lifecycle |
-| `docker` | destroy-under-docker |
 | `syft`, `docker`, `uv` | the image SBOM inventory |
 | `python3` | the active-environment test |
-
-CI installs `uv` and pins `syft` v1.48.0. If a skip covers the surface you
-changed, install the tool and re-run — do not report the green.
+| `nix` | the lifecycle matrix's nix backend |
+| a stopped daemon | the matrix's docker backend, and destroy-under-docker |
+
+CI installs `uv` and pins `syft` v1.48.0, but **has no `nix`** — so
+`TestPythonFastAPILifecycle_Matrix/nix` is the one skip in a green CI run and
+the nix path is covered nowhere. If a skip covers the surface you changed,
+install the tool and re-run — do not report the green.
+
+A missing Docker daemon is the exception: `TestCreateToRunDocker` has no
+tooling guard and fails rather than skips. That red is correct. Do not add a
+skip guard to make it green — that converts the loudest signal in the suite
+into the silent pass this whole section exists to prevent.
 
 ## 2. `panic: test timed out after 10m0s`
 

AGENTS.md

@@ -81,17 +81,22 @@ matters. The lock order is documented on the struct fields — follow it.
 
 **Nothing is mocked.** The suite drives a real uvicorn through `uv`, real
 containers through the Docker daemon, and a real `syft` scan of an image built
-from the recipe this agent emits. Tests skip rather than fake when a tool is
-absent, so a green run on a bare machine has proved much less than it looks:
-
-| Missing | Silently skips |
-| --- | --- |
-| `uv` | the real uvicorn lifecycle |
-| `docker` | destroy-under-docker |
-| `syft` (+ `docker`, `uv`) | the image SBOM inventory |
-
-CI installs `uv` and pins `syft` v1.48.0 in `setup-run` for exactly that
-reason. Get them locally too, or say which halves you did not exercise.
+from the recipe this agent emits. Where a tool is absent most of these tests
+skip rather than fake, so a green run proves less than it looks — `uv`, `syft`,
+`python3` and `nix` all degrade silently. A missing Docker daemon does not:
+`TestCreateToRunDocker` runs in a container runtime context with no tooling
+guard, so it fails loudly. Never quiet that failure with a skip guard; a loud
+red is the correct outcome and the skip would buy a false green.
+
+**CI has no `nix`, so the nix backend is covered nowhere.**
+`testmatrix.ForEachEnvironment` skips any backend missing from the host, and
+this repo does not pass `Only(...)` to make absence fatal — so
+`TestPythonFastAPILifecycle_Matrix/nix` is the one skip in a green CI run.
+Changing `nixflake.go` or `nix/flake.nix` is unverified by CI: exercise it
+locally with `nix` installed, and say in the PR that you did.
+
+CI installs `uv` and pins `syft` v1.48.0 in `setup-run` so the other halves do
+run. The full skip matrix is in the `lifecycle-test-triage` skill.
 
 The suite is slow because it is real — CI finishes inside `go test`'s default
 10-minute timeout, but a contended local Docker daemon pushes the container