test(local-knowledge): harden #1818 embedding-space governance evidence and gates

[oscharko]

Summary

Post-merge audit hardening for Epic #1818 (embedding-space governance and multi-space retrieval; children #1843–#1848), which shipped in PR #1911 (48958a53) and PR #1912 (f40f9f17) and is already merged and closed.

A read-only multi-agent audit (six per-child verifiers plus one cross-cutting security auditor) found the shipped implementation production-sound with zero critical/high runtime or security defects: the provider-SDK boundary holds (query embeddings route only through the Model Gateway adapter), compareEmbeddingProfiles fails closed, per-capsule embedding prevents cross-space contamination, cross-space fusion is rank-only RRF with a deterministic total order, and diagnostics/evidence stay body-free.

The confirmed gaps were test-coverage, evidence-honesty, and gate hardening only. This PR closes them without changing any production retrieval behavior. The single non-test production edit is a cosmetic rename of placeholder credentials in a hermetic, server-internal eval harness.

Refs #1818, #1843, #1844, #1845, #1846, #1847, #1848

Scope

• In scope: mutation-robustness tests for the embedding-profile compatibility table (Task: Define embedding profile registry and compatibility contract #1843) and the pod-set incompatible projection (Task: Add pod-level embedding compatibility and readiness metadata #1844); a full cross-lane RRF-tie determinism/stability test (Task: Add rank-only cross-space fusion for heterogeneous Knowledge Pods #1846); DOM-render + jest-axe coverage for the incompatible and policy-denied Knowledge Pod guidance states (Task: Surface unavailable-model degradation and reindex guidance for Knowledge Pods #1847); a non-tautology regression probe for the multi-space eval fixture and a corrected closure-state note in the governance ledger (Task: Add multi-space retrieval fixtures, gates, and closure evidence #1848); a placeholder-credential rename in the grounded-retrieval eval harness (security).
• Out of scope: any change to production retrieval, fusion, embedding, policy, or UI behavior; reindexing; ADR changes (ADR-0036 already governs rank-only fusion).

Reuse And No-Duplication

• Existing Keiko functionality was inspected before implementation.
• This PR reuses, extends, generalizes, or consolidates existing functionality where practical.
• Any new implementation is limited to a documented capability gap in the linked issue.
• This PR does not introduce a parallel workspace, graph, relationship, policy, evidence, memory, connector, workflow, or UI subsystem where an existing subsystem can be extended.
• Refactoring or consolidation was considered when existing functionality was close but not shaped for this change.

Rationale: additive tests extend the existing suites; the eval-gate probe extends the existing runLocalKnowledgeRegressionProbes non-tautology mechanism (the ABSENT_CHUNK_SENTINEL decoy path already used by the exact/semantic/multilingual probes). No new subsystem is introduced.

Delivery Board

This is a post-merge hardening PR against already-closed issues (#1818 and #1843–#1848 are CLOSED / status: done). Board-workflow transitions below are therefore recorded as-is rather than re-opened.

• Autonomous agents did not merge into dev, enable auto-merge, close the issue, or bypass human review. This PR was opened only at explicit human request and will not be self-merged.
• N/A: board In Progress/swimlane transitions — the linked issues are already closed; no issue, project, or board state was changed by this PR.

Product Impact

• Evidence, audit, or compliance artifact
• Security or supply chain
• Documentation or repository hygiene
• No user-facing behavior change

Update Impact

• Not release-impacting.
• Release-note category: internal-only.
• Priority: internal.
• User-visible change: none.
• Release-note bullet: none (internal test/evidence/gate hardening).
• Supported-from versions: n/a.
• Affected state stores: none.
• User action required and remediation: none.
• Internal-only rationale: additive tests, one eval-gate probe, a governance-ledger closure-state correction, and a cosmetic eval-harness placeholder-credential rename; no product behavior or persisted state changes.

Verification

Required:

• Required GitHub checks pass before merge. (pending CI on this PR)
• Local verification commands or rationale are listed below.
• Reuse/extension/generalization evidence or gap rationale is listed below.

Local verification:

typecheck ............................ exit 0
lint (root eslint + keiko-ui) ........ exit 0
format:check ......................... exit 0
arch:check / arch:check:negative ..... exit 0 / exit 0
typecheck @oscharko-dev/keiko-ui ..... exit 0
check:retrieval-quality .............. exit 0  (16/16 fixtures; 4 regression probes below floors, incl. new multi-space)
check:grounded-retrieval-quality ..... exit 0
check:grounded-faithfulness .......... exit 0
test:coverage:ui ..................... exit 0  (268 files / 4365 tests)
keiko-server (full suite) ............ exit 0  (280 files / 4715 tests)
keiko-contracts + keiko-local-knowledge  exit 0  (166 files / 3655 tests)
connector-graph.test.tsx ............. exit 0  (47 tests)

Reuse / gap rationale:

All changes extend existing suites/mechanisms. The multi-space probe reuses runLocalKnowledgeRegressionProbes.
No new subsystem; no production retrieval / fusion / embedding / policy / UI behavior changed.

Select only what applies:

• UI behavior manually verified or covered by tests. (connector-graph render + jest-axe for incompatible / policy-denied guidance)
• Core logic covered by unit, integration, property, or fixture tests.
• Security-sensitive change reviewed for trust boundaries, secrets, external calls, and generated artifacts. (dedicated security-auditor pass; placeholder-credential rename)
• Documentation or Markdown change verified by the repository link check or a targeted local equivalent. (format:check)
• Not applicable items are explained below.

Not applicable rationale:

• No CLI change. No package-surface/SBOM change (no public exports altered). Not release-impacting (internal test/evidence/gate/docs). check:editor-release-evidence not regenerated: only a keiko-ui test file changed (not bundled), so the Linux-authoritative bundle fingerprint is unchanged; a macOS regeneration would break CI.

Review And Closure

• The PR implements only the linked issue scope (post-merge hardening of the Epic: Introduce embedding-space governance and multi-space retrieval orchestration #1818 children).
• Actionable review findings are fixed or explicitly dispositioned. Declined items are documented and defensible (AC met): Task: Surface unavailable-model degradation and reindex guidance for Knowledge Pods #1847 dual-guidance precedence, Task: Define embedding profile registry and compatibility contract #1843 runtime validator, Task: Add rank-only cross-space fusion for heterogeneous Knowledge Pods #1846 fused-budget clamp, Task: Implement per-space query embedding lanes through the Model Gateway #1845 hot-path eslint-disable.
• Checks are repeated after the latest pushed fix.
• Uses Refs (not Resolves): the linked issues are already closed; this PR must not reopen or re-close them.

Risk Notes

Low risk. No production retrieval/fusion/embedding/policy/UI behavior changes; changes are additive tests, one eval-gate probe, a docs correction, and a cosmetic eval-harness placeholder-credential rename. The one non-test edit (grounded-retrieval-eval.ts) only changes hermetic in-memory eval fixture values with no network effect; its dedicated test (6/6) passes. The editor-release-evidence fingerprint is unchanged (no bundled UI code touched).

🤖 Generated with Claude Code