[brujack]

Summary

PR6 of the fleet ruff spec (ai-config docs/superpowers/specs/2026-11-08-fleet-ruff-defaults-design.md, ADR-0094; reference implementation ai-config#358). Rows R11, R12, R13, R17, V1, V3, N1-N5.

• ruff.toml is byte-identical to ai-config master and math 127a731c: extend-select over ruff's defaults (adds C901), so a ruff pin bump that adds default rules is gated by that PR's lint.
• tests/test_ruff_config.py is a byte copy of ai-config's and pins the whole parsed ruff.toml.
• requirements-ci-test.txt is re-vendored byte-identical from dotfiles master. This moves more than ruff: ruff 0.16.4 -> 0.17.4, mypy 2.3.1 -> 2.4.1, pyright 1.1.411 -> 1.1.414, coverage 7.15.4 -> 7.17.2, hypothesis 6.165.10 -> 6.170.15, plus ast-serialize, iniconfig, librt, mypy-extensions, nodeenv and pluggy. There are no new package names.
• Fixed the 4 findings ruff check scripts/ tests/ reports at 0.17.4, without behaviour change (N1) and without adding any # noqa (R13):
  • EXE001 x2 (scripts/test_metrics.py, tests/test_test_metrics.py): deleted the shebang (R12). Nothing runs either file by path: CI calls python3 scripts/test_metrics.py, and math keeps its own copy, called the same way.
  • SIM115 (_tmp): NamedTemporaryFile is now a with block. delete=False keeps the file, so f.name is still valid.
  • SIM117: merged the nested with. assertRaises stays innermost.
• renovate.json: added "!ruff" to matchPackageNames of packageRules 0 and 2 (the automerge-ok rules), as in ai-config's preset (R17).
• A Backlog row records a pre-existing Bandit B314 (xml.etree in scripts/test_metrics.py) that security-review found. This branch did not add it.

Test Plan

• make test exits 0 at 498414c: nextest 1188/1188, pytest 207 passed, bats 16/16, lint clean (V1, local).
• ruff check scripts/ tests/ at 0.17.4: All checks passed!. ruff format --check: 13 files already formatted.
• RED before GREEN: tests/test_ruff_config.py against the old select config -> 3 failed, 4 passed. Against the new config -> 7 passed.
• V3: in a scratch copy, the unmodified config -> 7 passed. With extend-ignore = ["F"] added under [lint] -> 1 failed, 6 passed (test_whole_config_is_pinned).
• R17: the branch's packageRules start with the preset's (prefix-equal, 5/5). renovate_preset_sync.py reads origin/main, so it reports etch-cli ok only after merge; it will be re-run then.
• Mutation controls (N1): test_propagates_unexpected_exception goes red with the patched exception removed, and dropping _tmp's write reddens 6 tests.
• Coverage: Python floor 90 is gated by CI (--cov-fail-under=90). The Rust 81% floor is unaffected (no .rs change).

Code review

reviewed-sha: ad709b1
diff-hash: 053c347331fcef56d3d2c8d1c114f4138e3f147293a4ec34650d13c41c8b4b8e
branch: chore/fleet-ruff-defaults
worktree: /home/bruce/git-repos/personal/etch-cli-wt-ruff
reviewers: 5/5

No issues found.

Spec alignment

SKIP: no open plan has a spec: line in etch-cli. The spec and its ## Amendments live in ai-config. Manual check against PR6's rows: R11, R12 (EXE001 fixes), R13, R17 and N1-N5 are met. One item needs a spec answer: R12's clause "no file in a gated scope keeps both a shebang and mode 100644" is hit, read literally, by the pre-existing tests/pre_push.bats (bats shebang, mode 100644, not checked by ruff, run as bats tests/pre_push.bats). It is reported to ai-config and not changed here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RMRWKL79zkdDZhRcLHSiJE