test: blank-Supabase venue driver with an expected-failures gate (GIT-83)

[nTEG-dev]

Linear: GIT-83. Related: https://linear.app/nteg-labs/issue/GIT-97, https://linear.app/nteg-labs/issue/GIT-98, https://linear.app/nteg-labs/issue/GIT-84, https://linear.app/nteg-labs/issue/GIT-104

What

Adds the blank-Supabase venue driver used to verify #30, #31, GIT-104 and GIT-84. It runs the built server over stdio (Pro tier, isolated HOME and GITMEM_DIR) against a Supabase project that has schema/setup.sql and nothing else: no edge functions, which is what every customer project looks like.

• flow: session_start → list_threads → recall → confirm_scars (with relevance) → create_thread → list_threads → session_close → health. It seeds scars, a prior session and remote threads, plus a local threads.json that deliberately differs from the remote table.
• egress: bytes received on cold and warm starts and around two session_starts (GIT-98). --usage N seeds scar usage so refresh_scar_behavioral_scores() has work to do.
• blank-supabase-netlog.mjs is preloaded into the server with --import and logs every fetch: method, path, status and body bytes. It never logs request bodies or headers.
• Embeddings come from a local fake Ollama endpoint (deterministic, 1536 dimensions), so no API key is needed and every measured byte is venue traffic.

Gate: unexpected failures fail the run

Exit 1 on any 4xx/5xx from /rest/v1/ or /functions/v1/ that isn't on EXPECTED_FAILURES. Each entry names the ticket that removes it, so the list shrinks as fixes merge:

Ticket	Failure
GIT-73	POST gitmem_query_metrics 409: metrics/session_start FK race (intermittent)
GIT-105	POST knowledge_triples 400: thread id into a uuid column
GIT-106	GET scar_enforcement_variants 400: .active does not exist
GIT-84	scar_usage 404: remove once GIT-84 merges
GIT-97	POST /functions/v1/ww-mcp 404: remove once #30 merges. Added beyond the original list: main makes these calls today, so without the entry the gate fails on main.

• On main (d47a625): exit 0, all 6 failure kinds matched.
• Negative control on the GIT-84 branch: exit 1. It flags the new GET gitmem_scar_usage?select=…scar_title… 400, the analytics column drift GIT-84 surfaces. That's the gate working as intended.

Safety

• Credentials come only from a VENUE_ENV file outside the repo. Nothing secret is committed.
• Config problems exit 2 with a plain message, not a stack trace: VENUE_ENV unset or missing, keys missing, bad mode, or no build.
• Production (cjptxyezuxdiinufgrrm) is refused before any request, as is any URL that isn't exactly https://<VENUE_REF>.supabase.co. Both cases were tested.
• The driver wipes the gitmem tables of the venue before seeding. Point it only at a disposable project.

Usage

npm run build
VENUE_ENV=/path/outside/repo/.env node tests/e2e/blank-supabase.mjs flow --label main --out /tmp/venue-runs
VENUE_ENV=/path/outside/repo/.env node tests/e2e/blank-supabase.mjs egress --label pr31 --out /tmp/venue-runs --rows 250 --usage 5

Tests

• npx tsc --noEmit -p .: no errors. npm run test:unit: 74 files / 1213 tests, unchanged. The driver is .mjs under tests/e2e/ and isn't collected by any vitest config.

🤖 Generated with Claude Code