Test suite audit: ~280 low-value tests, 8 false-passing negative controls, test-only production seams

[padak]

Summary

A read-only audit of the unit test suite (227 files, ~6,650 tests, ~163k LOC; tests/test_e2e*.py excluded) against main @ 6d764b64, using the openclaw test-audit methodology: junk patterns, a value bar, a retention bar, and per-candidate evidence (what regression the test can detect, which stronger test already owns the contract, recommended action, confidence).

Nothing has been deleted yet. This issue records the findings and proposes a batched cleanup.

Overall the suite is healthy. Merge-request, notification and sync tests have almost no junk: nearly every test pins a named incident or review finding.

Headline numbers

• About 280 tests (~4%) can be deleted or folded into parametrized cases, removing about 4,000 test LOC.
• About 60-80 LOC of dead production code is kept alive only by tests.
• Several negative controls and security checks pass for the wrong reason. They need a rewrite, not deletion; this is the most important finding.

Lane	Scope	Candidates	Approx. LOC
1	test_cli.py, test_services.py, test_client.py (legacy monoliths)	~67 tests	~1,890
2	sync, lineage, transformation, flow, schedule	~60 tests	~1,050
3	storage, workspace, data-app, stream, sharing, branch, merge-request, notification	~26 delete + ~40 to parametrize	~620
4	auth, token, HTTP, config store, permissions, server, SDK, billing	~21 delete + 5 rewrites + 7 merge groups	~420
5	config, component, semantic layer, variables, kai, agent, search	~49 tests	~590
6	tooling/CI tests + cross-cutting sweep + test-only production seams	~45 tests	+ 60-80 prod LOC

Per-lane reports with exact test ids, evidence and the remaining owner test for each candidate follow as comments below.

Findings by category

1. Tests that pass even when the guarded behavior is broken (rewrite)

• test_file_locking.py::TestTryFlock::test_flock_skipped_when_no_fcntl: if the if not _HAS_FCNTL: return guard were removed, fcntl.flock(42, 0) would raise on the bad fd and contextlib.suppress(OSError) would swallow it, so the test still passes. (Verified manually.)
• test_errors.py::test_no_duplicate_values can never fail. A duplicate Enum value becomes an alias, and iterating the enum skips aliases. Replace it with @enum.unique on ErrorCode. (Verified manually.)
• test_server_permissions.py::...::test_app_without_an_engine_fails_closed accepts any non-200 status, so a crash (500) also passes.
• test_permissions_cli.py::...::test_set_rejected_without_confirmation asserts the exit code its own mock raises and never checks that nothing was persisted.
• test_billing_cli.py::...::test_per_project_errors_surface_as_warnings_exit_0 effectively asserts that the letter "b" is in the output.
• test_sentinel_is_set_even_when_body_raises never checks the sentinel.
• test_e2e_lineage_deep.py::test_12 asserts only deep >= shallow, which passes even if --depth is ignored.
• test_multiple_types_deduped (semantic layer) passes no duplicate input, so it doesn't test deduplication.

2. Duplicates of a stronger owner test (delete)

• test_client.py re-tests the retry, timeout, error-truncation, 404-mapping and User-Agent behavior owned by test_http_base.py. The client is a pass-through to BaseHttpClient. One assert (around line 1515) is always true.
• test_services.py: TestResolveProjects duplicates test_base_service.py. TestJobListDeterministicOrder has been stale since feat(ui,serve): cross-project All Jobs and All Tokens views #675: its jobs have no startTime, so it only exercises the tie-break.
• test_cli.py:
  • TestExitCodes: four tests are byte-identical to per-command tests.
  • TestResolveManageToken duplicates the class of the same name in test_helpers.py.
  • TestOrgSetupBasic duplicates TestOrgSetup, and TestSharingEdges duplicates TestSharingEdgesIntegration.
  • Two byte-identical duplicates: the lineage help test and the exit-code-5 test.
• test_lineage_service.py re-runs the max-workers and resolve_projects tests from test_base_service.py, and has two same-input scenario duplicates.
• Service-level tests that replay a CLI test on the same inputs, where the CLI test already runs the real service: config rename, row, oauth-url and change-description tests, the sharing link-stage tests, and the table-definition tests.
• Copy-paste duplicates: Storage client URL tests (truncate, swap, clone); the merge-request client field helper; test_backend_surfaced_from_bucket in the describe service; the permission-engine policy tests (test_vojta_use_case, test_read_only_mode); billing GET/POST and payload tests.

3. Tests that only check what their own mock returned

• 9 test_sync_cli.py::*_json_output tests. Every sync command's --json path passes the service result through unchanged, so they collapse into one parametrized pass-through test (~360 LOC).
• TestLargeResponse in test_client.py.
• Assorted CLI tests in flow/schedule and billing.

4. --help text greps with no contract

About 20 tests across test_cli.py::TestHelp, test_kai_cli.py, test_sync_cli.py and test_config_rename_cli.py.

5. Names that promise more than the test checks

• "concurrent" tests that run sequentially, in test_file_locking.py and test_job_idempotency_store.py. Real multi-thread and multi-process siblings already exist.
• --no-color tests that can't fail, because CliRunner is not a TTY.
• test_feature_gate_checked_before_get_credits asserts no ordering.
• test_default_client_factory_is_used_when_none.

6. Test-only production seams (delete with their tests)

• auto_update._should_skip: no production caller. Its 11 TestShouldSkip tests therefore never exercise the real gates. Retarget them, then delete the alias.
• default_*_client_factory wrappers in the snapshot, org and token services.
• get_nested_value, clear_orphans and build_and_cache.

7. Other

• The error-code guard self-tests in test_integration.py are marked integration, so CI deselects them (-m "not integration"). CI does run scripts/check_error_codes.py itself, so the gate works but its self-tests don't.
• Two AWS-token tests never run anywhere: KBA_TEST_TOKEN_AWS is never set.
• The __all__ public-API test checks "contains at least"; it should assert the exact set (semver contract).
• test_update_config_row_state_returns_full_detail documents behavior that contradicts the config: no CLI path to write configuration state (PUT .../state unused); config update --set 'state...' silently no-ops #593 finding verified against the real API: the endpoint returns the bare row.

Deliberately retained (look like junk, guard real contracts)

• Security:
  • token masking, including on the timeout path;
  • 0600/0700 file and directory modes;
  • manage-token default-deny from env;
  • the session-sentinel guards;
  • the --deny-writes / --deny-destructive firewall (exit 6);
  • the permission category table.
• The real-money guards against a billing top-up POST.
• The sync data-loss and migration regressions: kbagent sync: cannot reliably reconcile a drifted tree with production; sync diff/status report false "in sync" #466, kbagent sync: config isDisabled (enabled/disabled) state is not pulled or tracked — disabled flows/configs are invisible in the working tree and to sync diff #467, sync: production diff/push after 'sync pull --branch' flags the whole orphaned main/ tree as added (mass-duplicate risk) #649, sync push stamps pull_config_hash from disk while diff compares an API-derived hash — every pushed config stays "REMOTE MODIFIED" forever (mirror of #466) #686, sync: ignore keboola.mcp-server-tool workspace records like keboola.sandboxes — and manifest ignoredComponents is never read #689, the ignored-component guard, path traversal and manifest naming.
• The config delete purge guard, the --set top-level-field rejection, and encryption-before-write.
• The CI/release gate tooling tests: version sync, vNEXT, changelog, sentinel guards, license and skill frontmatter.
• The 136 REST-router argument-forwarding tests, and JSON output-shape guards such as app_id.
• test_cli.py is still the only owner of the branch, init, doctor, context, org-setup and sharing edges CLI tests, so it must not be deleted wholesale.

Proposed plan

One coherent PR per batch. Each batch runs the focused owner tests plus make check, and reports test LOC and production LOC separately.

1. Batch 1 (correctness first):
   • Rewrite the false-passing negative controls from category 1.
   • Add @enum.unique to ErrorCode.
   • Fix the test_integration.py CI routing.
   • Delete the high-confidence duplicates in lane 1: test_client.py vs test_http_base.py, plus the byte-identical duplicates in test_cli.py (~55 tests).
2. Batch 2: sync and lineage (lane 2). Parametrize the sync --json pass-through tests and remove the base_service replays.
3. Batch 3: storage, workspace, data-app and merge-request (lane 3). Delete the copy-paste duplicates and parametrize the near-duplicates.
4. Batch 4: auth, permissions, billing and server (lane 4), plus the __all__ exact-set tightening.
5. Batch 5: config, component and semantic layer (lane 5). Fix test_multiple_types_deduped and tighten the oauth-url CLI error test before deleting its service twin.
6. Batch 6: delete the test-only production seams (_should_skip, the dead factories and helpers) together with their tests.

Rules for every batch:

• No candidate is deleted without re-reading it. These findings come from an AI-assisted audit. Two were verified by hand (marked above), the rest were not. Each deletion must name the remaining owner test in the PR description.
• Medium-confidence items are optional. Uncertain candidates are not converted into cleanup just to increase the count.
• No replacement tests that restate the implementation.

[padak]

Lane 1 audit: test_cli.py / test_services.py / test_client.py

Summary

• Files: tests/test_cli.py (8529 LOC), tests/test_services.py (5166), tests/test_client.py (4285).
• Candidates: 67 tests, about 1,890 LOC (counted with ast over the exact test/class spans; excludes shared module-level fixtures such as SAMPLE_ORG_* and _make_list_buckets_client that may become dead once the tests go).
  • High confidence: about 55 tests / 1,560 LOC
  • Medium confidence: about 12 tests / 330 LOC
• The main root cause is that the old monoliths replay contracts that now have a stronger owner:
  • test_http_base.py owns retry, timeout, truncation, status mapping and User-Agent.
  • test_base_service.py owns resolve_projects.
  • test_helpers.py owns map_error_to_exit_code and resolve_manage_token.
  • test_manage_token_cli.py owns the env opt-in for the manage token.
  • test_project_edit_cli.py owns "no changes" on project edit.
  • scripts/check_command_sync.py runs through tests/test_check_command_sync.py::test_live_command_tree_has_no_drift, and owns "AGENT_CONTEXT mentions every command".
• There is also significant in-file duplication inside test_cli.py. These pairs of classes were clearly added twice across eras:
  • TestOrgSetupBasic and TestOrgSetup
  • TestSharingEdgesIntegration and TestSharingEdges
  • TestVerboseFlagBasic and TestVerboseFlag
  • TestExitCodes and the per-command exit-code tests
• Nothing in this lane needs a production change. No test-only seams were found.

Candidates

#	Test id	Junk pattern	Regression it can actually detect	Stronger remaining coverage	Action	Conf
1	tests/test_client.py::TestRetryBehavior (4 tests: test_retry_on_503_then_success, test_retry_exhausted_raises_error, test_retry_on_429, test_no_retry_on_400)	Provider-local replay of a shared helper. KeboolaClient._request is a one-line passthrough to BaseHttpClient._do_request (client/_core.py:134)	None beyond what the base tests catch	tests/test_http_base.py::TestBaseHttpClientRetry::{test_retry_on_503_then_success,test_retry_exhausted_raises_error,test_retry_on_429_rate_limit,test_no_retry_on_400} (these also assert the request count)	delete	high
2	tests/test_client.py::TestTimeoutHandling (2 tests)	Same replay (TIMEOUT / CONNECTION_ERROR wrapping)	None	tests/test_http_base.py::TestBaseHttpClientRetry::{test_timeout_retries_then_raises,test_connect_error_retries_then_raises}	delete	high
3	tests/test_client.py::TestApiErrorMessageTruncation (4 tests: long / short / exactly-500 / Rich markup)	Line-for-line mirror of the base sanitization tests, going through verify_token	None	tests/test_http_base.py::TestBaseHttpClientErrorSanitization::{test_long_error_message_truncated,test_short_error_message_not_truncated,test_exactly_max_length_not_truncated,test_rich_markup_contained_by_truncation}	delete	high
4	tests/test_client.py::TestLargeResponse (2 tests)	Expected values are the mock's own payload echoed back. There is no size-dependent code path in the client	None (httpx/json parse of a big list)	Not needed	delete	high
5	tests/test_client.py::TestStackUrlNormalization::test_404_returns_not_found_error	Misfiled duplicate (the class is about URL normalization)	None	tests/test_http_base.py::TestBaseHttpClientErrorSanitization::test_404_maps_to_not_found	delete	high
6	tests/test_client.py::TestClientHeaders::test_user_agent_header	Replay. The UA is set centrally in BaseHttpClient	None	tests/test_http_base.py::TestUserAgent::test_base_client_sends_enriched_user_agent (asserts the exact value)	delete	high
7	tests/test_client.py::TestMalformedJsonResponse::test_malformed_json_in_error_response	Replay (non-JSON body plus retry exhaustion)	None	tests/test_http_base.py::TestBaseHttpClientErrorSanitization::test_non_json_error_body_handled + TestBaseHttpClientRetry::test_retry_exhausted_raises_error	delete	high
8	tests/test_client.py::TestEmptyResponse::test_empty_body_error_response	Replay (500 exhaustion, retryable)	None	tests/test_http_base.py::TestBaseHttpClientRetry::test_retry_exhausted_raises_error (asserts status 500, retryable, request count)	delete	medium
9	tests/test_client.py::TestMalformedJsonResponse::test_empty_json_error_body	Replay (401 maps to INVALID_TOKEN; the empty body is not a distinct branch)	Marginal	tests/test_http_base.py::TestUnauthorizedErrorMapping::test_401_with_no_message_at_all_stays_invalid_token	delete	medium
10	tests/test_client.py::TestEmptyResponse::test_empty_components_list	Echoes the mock return value ([] in, [] out)	None	Not needed	delete	medium
11	tests/test_client.py::TestTokenMaskingInErrors::test_401_error_masks_token	Security, but a byte-duplicate at the base layer (same token, same 901-...XXXX assertion)	None beyond the base test	tests/test_http_base.py::TestBaseHttpClientErrorSanitization::test_token_masked_in_error_messages + TestUnauthorizedErrorMapping::test_401_masks_the_token_under_both_mappings	delete (keep the timeout sibling, see Retained)	medium
12	tests/test_services.py::TestResolveProjects (4 tests)	Provider-local replay. resolve_projects exists only on BaseService (services/base.py:272), never overridden	None	tests/test_base_service.py::TestResolveProjects (7 tests, a superset: none / specific / unknown / mixed / empty / single / preserves config)	delete	high
13	tests/test_services.py::TestJobListDeterministicOrder::test_jobs_sorted_by_alias_and_job_id	Name promises more than it exercises, and is stale: since 0.90.1 (#675) list_jobs is merged globally by startTime. The jobs here have no startTime, so it only exercises the tie-break	Tie-break only	tests/test_services.py::TestJobServiceListJobs::test_list_jobs_tiebreak_deterministic_on_equal_values + test_list_jobs_missing_start_time_sorts_last_desc	delete	high
14	tests/test_services.py::TestStatusParallel::{test_status_keboola_api_error_produces_status_error,test_status_unexpected_runtime_error}	Duplicate invocations of the same contract	Only response_time_ms on an error row (single extra assertion)	tests/test_services.py::TestStatusParallel::test_status_mixed_ok_api_error_runtime_error (same three outcomes plus alias sort). Move the response_time_ms assertion there	merge	medium
15	tests/test_services.py::TestGetStatus::test_status_mixed_success_failure	Duplicate (ok + API-error mix)	None	tests/test_services.py::TestStatusParallel::test_status_mixed_ok_api_error_runtime_error	delete	medium
16	tests/test_cli.py::TestExitCodes (6 tests)	Duplicate invocations. 4 tests are byte-identical to per-command tests. The 2 "network" tests re-assert the mapping owned by test_helpers.py	None	TestProjectAdd::test_project_add_invalid_token_exit_code_3 (identical to test_auth_error_exit_code_3), TestProjectRemove::test_project_remove_nonexistent_exit_code_5 (identical to test_config_error_exit_code_5), TestConfigDetail::test_config_detail_unknown_alias_exit_code_5, TestConfigDetail::test_config_detail_auth_error_exit_code_3, TestProjectAdd::test_project_add_timeout_exit_code_4, tests/test_helpers.py::TestMapErrorToExitCode::{test_map_error_to_exit_code_connection,test_map_error_to_exit_code_timeout}	delete class	high
17	tests/test_cli.py::TestHelp (9 tests)	--help string greps (subcommand/option names). test_root_callback_registers_firewall_flags is an inspect.signature source check	Removal of a command/option. That is already caught by every behavioral test invoking those options, and by the command-tree drift test	Behavior tests in TestProjectAdd/TestConfigList/TestConfigDetail/TestJobList/TestProjectUse; tests/test_check_command_sync.py::test_live_command_tree_has_no_drift; TestFirewallFlags (8 tests actually invoke --deny-writes/--deny-destructive and check exit 6)	delete class	high
18	tests/test_cli.py::TestVerboseFlagBasic (2 tests)	Assertion-free-ish probe (exit 0 only). Subsumed within the same file	None	tests/test_cli.py::TestVerboseFlag::test_verbose_enables_debug_logging (runs --json --verbose, asserts DEBUG)	delete class	high
19	tests/test_cli.py::TestNoColor::{test_no_color_project_list,test_no_color_doctor}	Name promises more. CliRunner is non-TTY, so effective_no_color = no_color or not is_tty (cli.py:296) is True with or without the flag. Both pass even if --no-color did nothing	Only that the flag parses	Keep one flag-parse test (test_no_color_flag_accepted). tests/test_output.py owns no_color rendering	delete 2	high
20	tests/test_cli.py::TestMissingRequiredArgs::test_config_detail_missing_project	Duplicate with a weaker assertion (!= 0)	None	tests/test_cli.py::TestConfigDetail::test_config_detail_requires_project (asserts exit 2)	delete	high
21	tests/test_cli.py::TestMissingRequiredArgs::{test_project_add_missing_alias,test_project_add_missing_token_non_tty,test_project_remove_missing_alias}	Framework behavior (Typer required option) asserted as exit_code != 0, which passes on any crash. The docstring claims exit 2 but it is never asserted	Nearly none	None needed for Typer's required-option handling. If the non-TTY token path matters, rewrite as == 2 with an error-message check	delete (or rewrite the non-TTY one)	medium
22	tests/test_cli.py::TestResolveManageToken (3 tests)	Same class name duplicated in the owner file, testing the same helper directly	None	tests/test_helpers.py::TestResolveManageToken::{test_returns_env_when_allow_env_true,test_no_env_tty_prompts_normally,test_default_deny_no_tty_no_env_exits_2} (these also check the warning text and no token leak)	delete class	high
23	tests/test_cli.py::TestOrgSetup::test_org_setup_with_env_token	Duplicate, weaker (asserts only status == ok, never that the env token reached the service)	None	tests/test_manage_token_cli.py::TestAllowEnvManageTokenFlag::test_org_setup_allow_env_passes_token_through (asserts manage_token kwarg + no leak)	delete	high
24	tests/test_cli.py::TestOrgSetupBasic::{test_dry_run_json_output,test_success_json_output,test_auth_error_exit_3}	Duplicate invocations within the file. Each asserts the mock's configured return value echoed through the envelope	None	tests/test_cli.py::TestOrgSetup::{test_org_setup_dry_run,test_org_setup_json_with_yes_flag,test_org_setup_api_error} (same shapes, same exit 3 + INVALID_TOKEN)	delete	high
25	tests/test_cli.py::TestOrgSetupBasic::test_skip_existing_projects	Asserts the mock's own projects_skipped back	None (skip logic is in the service)	tests/test_org_service.py test_skip_existing_projects (real OrgService logic)	delete	high
26	tests/test_cli.py::TestSharingEdges::test_lineage_no_subcommand_shows_help	Byte-identical duplicate (same invoke, same asserts); also misnamed (it tests lineage, not sharing)	None	tests/test_cli.py::TestSharingEdgesIntegration::test_lineage_no_subcommand_shows_help	delete	high
27	tests/test_cli.py::TestSharingEdges::test_lineage_config_error_exit_code_5	Duplicate. The mocked service raises ConfigError, so it is weaker than the real-service twin	None	tests/test_cli.py::TestSharingEdgesIntegration::test_lineage_config_error (real LineageService, same exit 5 + CONFIG_ERROR)	delete	high
28	tests/test_cli.py::TestSharingEdgesIntegration::test_lineage_project_filter	Assertion-free probe (exit_code == 0 only). Name promises filtering that is never checked	None	tests/test_lineage_service.py::test_filter_to_single_alias owns filtering	rewrite at the boundary (assert projects_queried == 1) or delete	medium
29	tests/test_cli.py::TestContext::test_context_mentions_all_commands	Hand-copied inventory of 9 command names, a strict subset of the generated check	Removal of one of 9 names from AGENT_CONTEXT	tests/test_check_command_sync.py::test_live_command_tree_has_no_drift (every group/subcommand against the live tree, in pytest and CI)	delete	high
30	tests/test_cli.py::TestDoctor::test_doctor_version_check	Duplicate in the same class	None	tests/test_cli.py::TestDoctor::test_doctor_no_config_file (asserts version pass) + tests/test_doctor_service.py::TestDoctorServiceCheckVersion::test_version_check_passes (the kbagent v substring)	delete	high
31	tests/test_cli.py::TestProjectEdit::test_project_edit_config_error_exit_code_5	Duplicate, weaker	None	tests/test_project_edit_cli.py::TestProjectEditNewAliasErrorPaths::test_no_changes_specified_exits_5 (also asserts the message names all three flags)	delete	high
32	tests/test_cli.py::TestProjectEditTokenReverify::test_project_edit_token_reverify_json	Name promises more. It sets up "Updated"/200 on the second client but asserts only status == ok	Only a crash in project edit --token	tests/test_services.py::TestEditProject::test_edit_token_reverifies (asserts new name/id). CLI --token wiring is also exercised by tests/test_project_edit_cli.py::TestProjectEditTokenOnSessionProject	delete (or add data.project_name == "Updated")	high
33	tests/test_cli.py::TestConfigDetail::{test_config_detail_sandbox_annotation_orphan,test_config_detail_no_sandbox_annotation_for_non_sandbox_component}	Replays of service branching logic through the CLI. The CLI's only contract is passing include_sandbox_annotation=True, which the sibling test covers	None beyond the service tests	Keep TestConfigDetail::test_config_detail_sandbox_annotation (boundary wiring). tests/test_services.py::TestConfigServiceSandboxAnnotation::{test_annotation_orphan_returns_none_for_workspace_id,test_annotation_skipped_for_non_sandbox_component} own the branches	delete 2	medium

Additional rewrite (not counted): tests/test_cli.py::TestOrgSetupBasic::test_project_ids_json_output asserts only the mock's echoed organization_id/projects_found. It never checks that --project-ids 901,9621 was parsed and forwarded. Rewrite it to assert setup_organization.call_args.kwargs["project_ids"] == [901, 9621], or delete it. Either way the leftover TestOrgSetupBasic class (with test_missing_org_id_and_project_ids_exit_2) should be merged into TestOrgSetup.

Suggested focused validation after edits:
uv run pytest tests/test_cli.py tests/test_services.py tests/test_client.py tests/test_http_base.py tests/test_base_service.py tests/test_helpers.py tests/test_manage_token_cli.py tests/test_project_edit_cli.py tests/test_check_command_sync.py tests/test_doctor_service.py tests/test_lineage_service.py tests/test_org_service.py -q, then ruff check tests/ && ruff format --check tests/. After the deletions, remove any fixtures they orphan (for example SAMPLE_LINEAGE_RESULT, _make_org_service_mock, and the _noop_sleep/MAX_RETRIES imports in test_client.py if unused).

Retained false positives

• tests/test_client.py::TestTokenMaskingInErrors::test_timeout_error_masks_token: Security. The only test that proves the token is masked on the timeout/exception path. test_http_base.py checks masking only on HTTP-status errors. Keep it, or move it to test_http_base.py.
• tests/test_client.py::TestClientHeaders::test_storage_api_token_header: Auth wire contract. The X-StorageApi-Token header is KeboolaClient-specific (the base tests use Bearer). test_auth_sentinel_guards.py inspects only client._client.headers, not the request on the wire.
• tests/test_client.py::TestRetryAfterHeader (4 tests): Looks like a base-class replay, but it is the only owner of the Retry-After honouring and 60 s cap for BaseHttpClient (only test_auth_client.py has its own copy for the auth client). Keep it. A good follow-up is to move it to test_http_base.py.
• tests/test_client.py::TestQueueBaseUrl: Reads the private _queue_base_url, but it is the cheapest, and the only, guard of the connection-to-queue host derivation across AWS/Azure/GCP stacks.
• tests/test_cli.py::TestFirewallFlags (8 tests): Security / exit-code-6 contract for --deny-writes/--deny-destructive, including composition with a persisted policy. test_helpers.py::TestApplyFirewallFlags covers only the helper, not the CLI callback. Keep.
• tests/test_cli.py::TestDoctor::{test_doctor_connectivity_with_mock_client,test_doctor_connectivity_failure,test_doctor_invalid_json_config}: These look like duplicates of test_doctor_service.py, but those tests call private helpers (_check_connectivity, _check_config_valid). The CLI tests are the real boundary, and the connectivity ones exercise make_client_factory wiring (session vs static token, 0.80.0).
• tests/test_cli.py::TestProjectListTokenEscaping, TestProjectNameMarkupEscape, TestProjectAddTokenSecurity: Regression tests for Rich-markup injection, and security guards (http:// and file:// URL rejection, token from env or prompt only). Keep.
• tests/test_cli.py::TestConversationIdFlag (kbagent: SKILL.md's one-time export KBAGENT_CONVERSATION_ID is unsatisfiable in Claude Code (no persistent shell), forcing compound commands that defeat permission allow-rules #716), TestOrgSetupBasic::test_missing_org_id_and_project_ids_exit_2 (usage exit 2), and TestConfigDetail::test_config_detail_rejects_empty_component_id (fail-fast before the service is called): named-issue regressions and exit-code contracts with no other owner.

Notes

• sharing edges and lineage (no subcommand) CLI tests exist only in test_cli.py. There is no per-module CLI owner; test_sharing_cli.py covers only link --stage. After deduplication, keep one of each shape: JSON (the real-service integration test), human, warnings, CONFIG_ERROR.
• Branch, init, doctor, context, org-setup and job CLI tests have no newer per-module CLI file. Those classes in test_cli.py are the owners and should not be deleted wholesale. A follow-up could split them into test_branch_cli.py / test_init_cli.py / test_org_cli.py, with no change in coverage.
• TestConfigListUnexpectedException / TestJobListUnexpectedException look like _run_parallel replays, but each worker (config_service.py:226, job_service.py:~330) has its own except Exception that builds UNEXPECTED_ERROR before the shared helper runs. They guard worker code, so they were not flagged.
• TestContext::{test_context_output_contains_key_phrases,test_context_mentions_exit_codes,test_context_mentions_workflows} grep section headings of the agent-facing prompt. That is a borderline prompt-byte contract, so they were left in place. They could be merged into one test, but that was not counted.
• test_client.py::TestMalformedJsonResponse::test_malformed_json_in_success_response asserts pytest.raises((ValueError, KeyError)). It pins the fact that a non-JSON 200 leaks a raw exception instead of a KeboolaApiError. It was left in place as a possible product bug, not treated as junk.

[padak]

Lane 2 test audit: sync, lineage, transformation, flow, schedule

Read-only audit. Scope: tests/test_sync_*.py (23 files), test_lineage_service.py, test_deep_lineage_service.py, test_e2e_lineage_deep.py, test_transformation_{cli,ops}.py, test_normalize_script.py, test_sql_split.py, test_flow_{cli,service,validation,examples}.py, test_schedule_{cli,service}.py, test_scheduler_client.py, test_triggers_client.py. That is about 24.9k LOC.

Summary

• Candidates: 25 rows, covering about 75 test functions. 18 rows are high confidence and 7 are medium.
• Estimated removable: about 60 test functions net, roughly 1,050 test LOC (about 4% of the lane). No production code is unlocked, except two test-only default arguments listed under Notes.
• Biggest wins:
  • test_sync_cli.py: nine *_json_output tests that only echo the mock back. The JSON branch of every sync command is formatter.output(result) verbatim, so these collapse to one parametrized passthrough test, saving about 360 LOC.
  • test_lineage_service.py: exact replays of test_base_service.py, plus two same-input duplicates (about 175 LOC).
  • test_normalize_script.py: replays of the split_statements lexer (about 135 LOC).
• Sync data-loss and regression suites stay as they are: baseline_stamping, reconcile, force_pull_baseline, the sync: production diff/push after 'sync pull --branch' flags the whole orphaned main/ tree as added (mass-duplicate risk) #649/sync: ignore keboola.mcp-server-tool workspace records like keboola.sandboxes — and manifest ignoredComponents is never read #689/sync push creates duplicate configs for every config a dev branch inherits from main (even with zero local changes) #482/sync git-branching: branch_id type confusion + walker scope guard block GitOps workflow #267 classes, and the path-traversal tests. Only the model/identity copiers, the help-text greps and the CLI mock echoes are flagged.

Candidates

#	Test id	Junk pattern	Regression it can actually detect	Stronger remaining coverage	Action	Conf.
1	test_sync_cli.py::TestSyncInitCli::test_sync_init_json_output, TestSyncPullCli::test_sync_pull_json_output, TestSyncStatusCli::test_sync_status_json_output, TestSyncDiffCli::test_sync_diff_json_output, TestSyncPushCli::test_sync_push_json_output, TestSyncPushCli::test_sync_push_with_row_changes_json, TestSyncBranchLinkCli::test_sync_branch_link_json_output, TestSyncBranchUnlinkCli::test_sync_branch_unlink_json_output, TestSyncBranchStatusCli::test_sync_branch_status_json_output (9 tests, ~420 LOC)	Asserting values the test's own mock produced. commands/sync.py does if formatter.json_mode: formatter.output(result) with no reshaping. The docstring of test_sync_push_with_row_changes_json says it proves "pushed_details preserve is_row", but the mock supplies those values.	Only "JSON branch not reached / envelope missing". The per-field asserts cannot fail independently of the mock.	Routing is covered by each command's human-mode test (test_sync_init_human_output, test_sync_pull_human_output, test_sync_status_no_changes, test_sync_diff_no_changes_human, test_sync_push_dry_run_human, test_sync_branch_link_already_linked_human, ..._unlink_not_linked_human, ..._status_not_linked_human). The service result shape is covered in test_sync_service.py.	Parametrize into ONE test over (argv, service method): assert exit 0, status == "ok" and data == mock.return_value.	high
2	test_sync_cli.py::TestSyncHelp::test_sync_status_help, TestSyncBranchUnlinkCli::test_sync_branch_unlink_help, TestSyncBranchStatusCli::test_sync_branch_status_help, TestSyncInitAdoptExistingCli::test_adopt_existing_flag_present_in_help (4)	Exact string greps of --help. They assert only --directory / --adopt-existing, and "Initialize" in output or "init" in output is tautological.	None. --directory appears in 46 functional invocations in test_sync_cli.py, and --adopt-existing is passed by test_adopt_existing_json_output.	Functional CLI tests that pass the same flags.	Delete	high
3	test_sync_cli.py::TestSyncHelp::test_sync_init_help, ::test_sync_pull_help, TestSyncDiffCli::test_sync_diff_help, TestSyncPushCli::test_sync_push_help, TestSyncBranchLinkCli::test_sync_branch_link_help (5)	Help-text greps, near-duplicates of each other.	Removal of --git-branching, --branch-id or --branch-name: those flags appear in no other test_sync_cli.py invocation.	None for those three flags.	Parametrize into one (command, flags) table that keeps only the flags not exercised functionally.	medium
4	test_lineage_service.py::TestLineageParallelExecution::test_default_max_workers_from_config, ::test_max_workers_from_config_file, ::test_env_var_overrides_config, ::test_invalid_env_var_falls_back_to_config (4)	Provider-local replay of a shared helper (BaseService._resolve_max_workers, services/base.py:365).	None beyond the base test.	test_base_service.py::TestResolveMaxWorkers (the same 4 cases plus zero/negative/one).	Delete	high
5	test_lineage_service.py::TestLineageNonexistentAlias::test_nonexistent_alias_in_resolve_projects, TestLineageProjectFilter::test_resolve_projects_returns_filtered, ::test_resolve_projects_no_aliases_returns_all (3)	Replays of inherited BaseService.resolve_projects.	None beyond the base test.	test_base_service.py resolve_projects tests (unknown alias, specific aliases, None → all). The lineage-boundary unknown-alias test test_nonexistent_alias_raises_config_error stays.	Delete	high
6	test_lineage_service.py::TestLineageMultiProjectDedup::test_dedup_with_same_edge_key	Duplicate invocation: byte-identical bucket fixtures to the previous test, with a strict subset of its assertions.	None.	::test_edges_deduplicated_across_two_projects	Delete	high
7	test_lineage_service.py::TestLineageParallelExecution::test_mixed_success_and_failure	Duplicate of the partial-failure scenario (same 403 on prod, dev succeeds; only the bucket kind differs).	None distinct.	TestLineageErrorAccumulation::test_one_project_fails_other_succeeds	Delete (or merge its shared-bucket assert into the kept test)	high
8	test_lineage_service.py::TestLineageProjectFilter::test_no_aliases_queries_all	Duplicate: aliases=None is the default.	"Both projects queried".	TestLineageParallelExecution::test_all_projects_queried_in_parallel (same setup, also asserts close())	Delete	medium
9	test_e2e_lineage_deep.py::TestE2ELineageDeep::test_10_missing_cache, ::test_13_permission_registered (2)	Duplicate invocations. test_10 is fully offline (a nonexistent path, with no API involved). test_13 re-runs lineage info, which test_02 already runs to exit 0.	None distinct.	test_deep_lineage_service.py::TestLineageDeepCli::test_missing_cache_file; test_e2e_lineage_deep.py::test_02_info_summary	Delete	high
10	test_e2e_lineage_deep.py::TestE2ELineageDeep::test_12_depth_limits_traversal	The assertion deep >= shallow passes even when --depth is ignored.	Almost none.	test_deep_lineage_service.py::TestLineageGraph::test_depth_limit	Rewrite (assert that depth 1 returns only direct edges) or delete	medium
11	test_deep_lineage_service.py::TestStripCommentsAndStrings::test_line_comment, ::test_string_literal (2)	Private helper test duplicated at the real boundary.	Same as the boundary tests.	TestExtractSqlTableRefs::test_ignores_comments, ::test_ignores_string_literals. test_block_comment, test_escaped_quotes and test_preserves_length have no boundary twin, so they stay.	Delete	medium
12	test_deep_lineage_service.py::TestLineageDeepCli::test_help	Help-text grep (flags and a docstring phrase).	Flag rename or removal.	--upstream, --downstream, --columns and --load are exercised by test_load_and_query_json, the ambiguity CLI tests and the lineage E2E.	Delete, or trim to flags with no functional use (--ai, --refresh)	medium
13	test_flow_service.py::test_component_id_constant	Self-comparison of a constant.	None independent.	Literal "keboola.flow" asserted at the API call boundary in test_create_flow_uses_keboola_flow_component, test_update_flow_..., test_delete_flow_..., test_get_flow_detail_...	Delete	high
14	test_flow_examples.py::TestGetFlowExamples::test_default_component_is_conditional, TestGetBundledFlowSchema::test_default_component_is_conditional (2)	Preserving a test-only default: every production caller (commands/flow.py:422,487, server/routers/flows.py:92) passes component_id explicitly.	Only a change to a default nobody uses.	CLI default: TestFlowExamplesCommand::test_examples_default_json_is_list_of_conditional_examples	Delete (optionally drop the unused default argument)	medium
15	test_flow_examples.py::TestFlowExamplesCommand::test_examples_explicit_conditional_json	Duplicate invocation: same output as the default test, and flag parsing is already proven by the orchestrator test.	None distinct.	::test_examples_default_json_is_list_of_conditional_examples, ::test_examples_orchestrator_json	Delete	high
16	test_flow_cli.py::TestFlowSchedule::test_schedule_json_includes_activation_result	Asserts activated / warnings that the mock returned. The JSON path is a passthrough.	None.	Service: test_flow_service.py::test_set_flow_schedule_activation_failure_warns_not_raises. Rendering: test_schedule_human_mode_prints_activation_warning	Delete	high
17	test_flow_cli.py::TestFlowList::test_list_empty	Near-assertion-free probe (only exit_code == 0).	A crash on an empty list in human mode.	No-project routing: ::test_list_all_projects_no_project_flag	Strengthen (assert the empty-state text) or delete	medium
18	test_schedule_cli.py::TestFlowListWithSchedulesCli::test_without_flag_no_schedules_key	Duplicate invocation, and the name promises more than it checks: it asserts no "schedules key", only list_flows.assert_called_once_with(..., with_schedules=False).	None distinct.	test_flow_cli.py::TestFlowList::test_list_json (same argv, same assert_called_once_with). Key absence: test_schedule_service.py::TestFlowListWithSchedulesEnrichment::test_without_flag_schedules_key_absent	Delete	high
19	test_sync_manifest.py::TestManifestProject::test_manifest_project_alias	Duplicate of test_manifest_project_model (identical construction via apiHost, subset of its asserts).	None.	::test_manifest_project_model	Delete	high
20	test_sync_manifest.py::TestManifestGitBranching::test_manifest_git_branching_custom, TestManifestConfiguration::test_manifest_configuration_with_rows, ::test_manifest_config_row_with_metadata (3)	Identity copiers: construct a pydantic model and read the same fields back.	None beyond pydantic itself.	TestManifestRoundTrip::test_manifest_round_trip / ::test_manifest_camelcase_output (on-disk format), plus baseline_stamping for metadata hashes	Delete	high
21	test_sync_branch_mapping.py::TestBranchMappingEntry::test_branch_mapping_entry_to_dict, ::test_branch_mapping_entry_production_to_dict; TestBranchMapping::test_branch_mapping_set_get (3)	Duplicate contract: the entry to_dict shapes are asserted verbatim by test_branch_mapping_to_dict_format, and set/get is exercised inside test_branch_mapping_round_trip.	None distinct.	TestBranchMapping::test_branch_mapping_to_dict_format, ::test_branch_mapping_round_trip	Delete	high
22	test_normalize_script.py::TestNormalizeBlocksCodesScript::test_sql_split_respects_block_comments, ::test_sql_split_respects_string_literals, TestSqlResplitListElements::test_semicolon_inside_block_comment_is_not_a_separator, ::test_semicolon_inside_string_literal_is_not_a_separator (4, ~95 LOC)	Provider-local replay of the shared split_statements lexer.	Only a lexer regression, which the owner catches first.	test_sql_split.py::TestSplitStatements::test_block_comment, ::test_single_quoted_string_with_semicolon, ::test_double_quoted_identifier_with_semicolon, test_split_join_roundtrip	Delete	high
23	test_normalize_script.py::TestNormalizeBlocksCodesScript::test_bigquery_uses_sql_split, ::test_duckdb_uses_sql_split, TestSqlResplitListElements::test_bigquery_list_resplit (3)	Near-duplicates: backend routing is is_sql_transformation_component, which is parametrized over all six IDs in TestIsSqlTransformationComponent.	None distinct from the Snowflake case plus the predicate table.	::test_sql_string_split_into_statements, TestIsSqlTransformationComponent::test_known_sql_components	Fold into one parametrized case (component_id × string/list)	medium
24	test_sync_encrypt.py::TestEncryptSecretsSuccess::test_encrypt_secrets_success_with_fallback_flag	Near-duplicate of test_encrypt_secrets_success_default (only the flag differs).	"Fallback flag changes the success path".	::test_encrypt_secrets_success_default	Parametrize the pair over allow_plaintext_fallback	medium
25	test_sync_storage_jobs.py::TestPullWithNewParams::test_pull_both_no_storage_and_no_jobs	Union of the two preceding single-flag tests. The flags are independent branches in pull.	Only an interaction bug between two independent if guards.	::test_pull_with_no_storage, ::test_pull_with_no_jobs, ::test_pull_result_includes_jobs_written_key	Delete	medium

Also low-risk tidy-ups, not counted as junk:

• test_sync_naming.py::TestSanitizeName: seven single-assert tests (_lowercase, _special_chars, _collapse_hyphens, _strip_hyphens, _already_clean, _numbers, plus _max_length). Fold them into the existing test_sanitize_name_various table, saving about 25 LOC.
• test_sync_push_script_guard.py::test_guard_script_shape_records_identity_and_normalizes and ::test_guard_script_shape_is_silent_on_canonical_bodies duplicate the push-boundary tests test_push_update_normalizes_string_script and test_canonical_push_produces_no_normalization_records. They stand in for the untested Phase C variables-backfill caller (services/_sync_bindings.py:276). Rewrite them as one boundary test of the backfill rather than delete them. Medium.

Retained false positives

• test_sync_manifest.py::TestManifestNaming::test_manifest_naming_defaults looks like a restatement of constants. The templates define the on-disk directory layout shared with the Go kbc CLI. Changing one silently moves every synced config, so it is a storage/compat contract.
• test_sync_manifest.py::TestManifestPathsArePortable (4 tests) looks like a trivial string-replace check. It is a platform contract: Windows backslash paths in manifest.json broke cross-OS trees.
• test_sync_branch_mapping.py::test_branch_mapping_to_dict_format and test_load_silently_migrates_legacy_string_ids_on_disk read like serialization trivia. The first guards the Go-CLI-compatible branches.json format. The second guards an on-disk migration (sync git-branching: branch_id type confusion + walker scope guard block GitOps workflow #267).
• test_sync_baseline_stamping.py unversioned/legacy tests (test_unversioned_legacy_hash_diffs_as_in_sync, test_pull_migrates_unversioned_entry, test_legacy_boundary_push_is_refused) look like overlapping hash checks. They are the sync push stamps pull_config_hash from disk while diff compares an API-derived hash — every pushed config stays "REMOTE MODIFIED" forever (mirror of #466) #686 migration contract (config_hash_version, SYNC_LEGACY_BOUNDARY), and a regression here silently rewrites SQL.
• test_sync_reconcile.py::test_push_force_with_phantom_entry_does_not_delete_remote, test_diff_phantom_parent_rows_produce_no_row_deletes, and test_sync_service.py::TestIssue689IgnoredComponents::test_push_touches_nothing_for_stale_ignored_entry look like small variations of diff tests. They are data-loss guards: each prevents a push from deleting production configs.
• test_sync_code_extraction.py SQL round-trip family (test_sql_round_trip, test_multiline_sql_round_trip, test_sql_roundtrip_multi_script, test_sql_roundtrip_multiline_multi_script) looks like four near-duplicates. Each input shape is a separate sync push collapses transformation script[] array → runtime fails #119/sync push stamps pull_config_hash from disk while diff compares an API-derived hash — every pushed config stays "REMOTE MODIFIED" forever (mirror of #466) #686 statement-boundary failure mode. They could be parametrized, but none should be dropped.
• test_sync_encrypt.py::TestEncryptSecretsRaisesOnFailure tests a private static method. It is a fail-closed security contract (no plaintext secrets pushed; GHSA-7jrf warning never contains the secret value), and it is cheaper and more precise than the push-boundary twin.
• test_schedule_service.py::TestListSchedules::test_client_closed and TestGetScheduleDetail::test_client_closed_on_error look like call-shape tests. Client lifecycle on the error path is observable (it leaks httpx connections), so they stay.
• test_flow_examples.py::test_yaml_template_validates_against_bundled_schema looks like a fixture self-check. It is the feat(flow): kbagent flow examples + fix drifted flow schema (port get_flow_examples) #397 drift guard between the hand-written template and the authoritative schema.

Notes

• Shared SQL splitting has one owner. test_sql_split.py owns the split_statements lexer. test_normalize_script.py, test_sync_config_format.py::TestNormalizeScripts and test_sync_code_extraction.py::TestStatementMarkers should assert only their own element/marker semantics, not lexer cases.
  • One further medium overlap was not listed: test_sync_config_format.py::TestNormalizeScripts::test_sql_splits_each_element_into_statements versus test_sync_code_extraction.py::TestStatementMarkers::test_canonical_sql_script_splits_each_element.
• Parametrize candidate (not junk). test_sql_split.py is compact and valuable. Its 17 single-case methods could become one (sql, expected) table. test_split_simple_queries is a near-duplicate of test_multiple_statements.
• test_flow_cli.py / test_schedule_cli.py JSON tests that also assert call_args (flag propagation) are legitimate; only the pure mock echoes are flagged. test_schedule_cli.py::TestFlowListWithSchedulesCli::test_flag_propagates_to_service could drop its echo assert (cron == "0 6 * * *") and keep the assert_called_once_with.
• Client-layer tests are distinct from service tests. test_scheduler_client.py, test_triggers_client.py and test_sync_storage_jobs.py::TestListJobsGrouped/... cover the transport contract (URL, params, error mapping). The service-level filters (e.g. test_flow_service.py::TestGetFlowTriggers::test_numeric_configuration_id_still_matches) are a separate contract, so none were flagged.
• Transformation files are clean. test_transformation_ops.py owns the op semantics, and test_transformation_cli.py checks payload shape, dry-run no-write and error mapping. The only overlap is TestRoundTrip::test_edit_pipeline_split_integration with the CLI test_edit_batch_ops_applied_and_resplit, and it is too small to bother.
• Production seam unlocked (optional). The default component_id argument of get_flow_examples() / get_bundled_flow_schema() in services/flow_service.py has no production caller that relies on it (see candidate 14).
• Validation for any follow-up edit: uv run pytest tests/test_sync_cli.py tests/test_lineage_service.py tests/test_base_service.py tests/test_flow_cli.py tests/test_flow_examples.py tests/test_schedule_cli.py tests/test_sync_manifest.py tests/test_sync_branch_mapping.py tests/test_normalize_script.py tests/test_sql_split.py tests/test_deep_lineage_service.py -q, then make check.

[padak]

Lane 3 test audit: storage / workspace / data-app / stream / sharing / branch / merge-request / notification

Read-only audit. Nothing in the repo was changed.

Summary

• Scope: 41 files, about 31.2k LOC, about 1,400 test functions. I checked every file for assertion-free tests with an AST scan and for --help greps (there are none). I read and compared the candidates below against the production code and the tests that overlap with them.
• tests/test_data_app_secrets_cli.py and tests/test_data_app_secrets_service.py were skipped from manual review because a deny rule blocks them. The only thing that touched them was the AST scan for tests with no assertions, which found nothing.
• High-confidence deletes: 18 tests, about 265 LOC.
• Medium-confidence deletes or merges: 8 tests, about 110 LOC.
• Parametrize consolidations: about 40 tests into about 10 parametrized tests. This saves about 250 LOC and removes no coverage.
• Estimated total: about 26 tests deleted outright and about 30 more folded into parametrized cases. Net about -620 test LOC. No production code is unlocked, except for a note on the _optional_mr_fields signature test (see Notes).
• These suites are healthy overall. Most of them were written recently, have been through review, and are named after specific regressions (merge-request, notification, describe). The junk sits in a few spots: copy-paste leftovers in the Storage client URL tests, service tests that repeat the same scenario as full-stack CLI tests (sharing, table definition), and tests of private helpers that are already exercised through the public path.

Candidates

#	Test id	Junk pattern	Regression it can detect	Stronger remaining coverage	Action	Conf.
1	tests/test_storage_truncate.py::TestTruncateTableClient::test_url_encoding_for_special_characters	Name promises more than the input exercises; duplicate call	None. in.c-bucket-with-dashes.tbl has no characters quote() would encode. The URL shape is identical to the primary test's.	...::TestTruncateTableClient::test_correct_url_and_query_params (same default-branch URL. in.c-foo.data already contains a dot and a dash).	delete	high
2	tests/test_storage_truncate.py::TestTruncateTableClient::test_branch_prefix_in_url	Duplicate invocation; no assertions (only the implicit httpx URL match)	Branch prefix missing from the truncate URL	...::TestTruncateTableClient::test_polls_async_job_to_completion matches the exact /v2/storage/branch/77/.../rows?allowTruncate=1 URL and also asserts the result	delete	high
3	tests/test_storage_swap.py::TestSwapTablesClient::test_dotted_table_id_passed_verbatim_in_path	Duplicate invocation; no assertions	None beyond the primary test. Dots and dashes are unreserved characters on the same quote(..., safe="") line.	...::TestSwapTablesClient::test_correct_url_and_body (in.c-foo.data, which has both a dot and a dash)	delete	high
4	tests/test_storage_clone.py::TestPullTableClient::test_dotted_table_id_passed_verbatim_in_path	Same as #3	Same as #3	...::TestPullTableClient::test_correct_url_and_no_body	delete	high
5	tests/test_storage_truncate.py::TestTruncateTableService::test_branch_id_carried_on_entry + ::test_branch_id_propagates_to_client	Near-duplicate pair	branch_id not forwarded or not recorded	Each test alone covers half of the other	merge into one test that asserts the entry's branch_id, get_table_detail and truncate_table kwargs	medium
6	tests/test_merge_request_client.py::TestOptionalFieldHelper::test_helper_omits_unset_fields	Private helper duplicated at the boundary	_optional_mr_fields emits nulls or the wrong camelCase	TestCreateAndUpdateBodies::test_create_omits_unset_optionals (exact key set), ::test_update_sends_only_provided_fields, ::test_update_sends_every_optional_field	delete	high
7	tests/test_merge_request_client.py::TestOptionalFieldHelper::test_every_field_is_keyword_only	inspect.signature check of a private helper (implementation, not behavior)	A positional parameter is added to _optional_mr_fields	A real transposition shows up on the wire. test_update_sends_every_optional_field uses a distinct value per field. test_create_sends_real_json_types and test_create_sends_auto_merge_and_external_id cover create. ty also rejects a positional call.	delete	high
8	tests/test_merge_request_client.py::TestOptionalFieldHelper::test_namespace_is_cached_on_the_client	Identity check on an internal cache	Namespace rebuilt on each access (no observable behavior change)	Not needed. Only a perf detail with no contract.	delete	medium
9	tests/test_merge_request_cli.py::TestStaticDestructiveClass::test_request_changes_caps_reason	Duplicate invocation	--reason over 1000 chars not rejected with exit 2	TestFieldCaps::test_over_cap_field_is_exit_2_before_any_call[request-changes reason] checks the same argv plus the error code and that no service method was called	delete	high
10	tests/test_storage_describe_service.py::TestGetTableDetailDescriptionExtraction::test_backend_surfaced_from_bucket	Exact duplicate (same class, same input, same assertion)	backend not surfaced from bucket.backend	...::test_surfaces_bucket_backend in the same class. Merge the two docstrings, which name different consumers (semantic-layer and the web UI).	delete	high
11	tests/test_storage_describe_service.py::TestDescribeBatchService::test_invalid_yaml_not_mapping	Near-duplicate across two classes	Top-level non-mapping YAML accepted	TestDescribeBatchShapeValidation::test_top_level_scalar / ::test_top_level_false_errors (same branch, and they also assert no writes and the type name)	parametrize a top-level case (list / string / false) in the ShapeValidation class and delete this one	medium
12	tests/test_storage_table_definition.py::TestServicePassthrough::test_partitions_list_is_not_re_dropped	Strict subset of a sibling assertion	partitions[] dropped	...::test_bigquery_layout_reaches_the_caller_verbatim checks full-dict equality on the same fixture	delete	high
13	tests/test_storage_table_definition.py::TestServicePassthrough::test_bigquery_layout_reaches_the_caller_verbatim	Same scenario replayed at the service layer and at the full-stack CLI	definition filtered or mutated	TestJsonOutput::test_definition_passes_through_json_mode runs the real StorageService behind the CLI and asserts the same equality	delete (the CLI test is the owner)	medium
14	tests/test_sharing_service.py::TestLink::test_link_defaults_to_in_stage	Duplicate invocation	Default stage not in	TestLink::test_link_success (same call, asserts stage="in") and tests/test_sharing_cli.py::TestSharingLinkStage::test_stage_defaults_to_in (full stack)	delete	high
15	tests/test_sharing_service.py::TestLink::test_link_explicit_out_stage	Same scenario replayed at the service layer and at the full-stack CLI	--stage out not forwarded	tests/test_sharing_cli.py::TestSharingLinkStage::test_stage_out_is_forwarded runs the real SharingService with a mocked client. It asserts the client kwarg and the JSON stage, which is a superset.	delete	high
16	tests/test_sharing_service.py::TestLink::test_link_rejects_unknown_stage	Same scenario replayed at the service layer and at the full-stack CLI	Unknown stage reaches the API	tests/test_sharing_cli.py::TestSharingLinkStage::test_invalid_stage_exits_2_without_api_call (real service, checks the error code and that no API call was made). The only extra here is the "Invalid stage" message match.	delete (or keep only if the serve path depends on that message)	medium
17	tests/test_data_app_service.py::TestDataAppCreateAuthBlock::test_invalid_auth_value_rejected	Duplicate invocation	Invalid auth accepted	TestDataAppCreateValidation::test_invalid_auth. Keep the banana value: its comment explains that oauth in test_invalid_auth could become valid later. So delete one test and move the banana value into the survivor.	merge	high
18	tests/test_workspace_service.py::TestLoadTables::test_load_tables_timeout_explicit_positive_passthrough	Duplicate invocation (42.0 vs 900.0)	Explicit timeout not forwarded as max_wait	...::test_load_tables_timeout_passthrough	delete	high
19	tests/test_workspace_service.py::TestLoadTables::test_load_tables_timeout_zero_rejected + ::test_load_tables_timeout_negative_rejected	Near-duplicate pair	Non-positive timeout not rejected	Each other	parametrize [0.0, -5.0] (keep the zero docstring)	medium
20	tests/test_data_app_plain_env_keys.py::TestValidateSecretKeyRequireHash::test_read_path_accepts_plain_and_hashed	No assertions; private method; duplicated at the boundary	Read path rejects a plain or a # key	TestGetPlainAndEncrypted::test_get_plain_returns_value (plain key) and ::test_get_encrypted_is_metadata_only (# key) both call get_data_app_secret, which uses _validate_secret_key(require_hash=False)	delete	high
21	tests/test_workspace_gc.py::TestIsOrphanedWorkspace::test_non_sandboxes_component_never_orphan, ::test_sandboxes_with_missing_config_is_orphan	Private predicate duplicated at the boundary	Orphan classification is wrong	TestWorkspaceServiceGc::test_gc_skips_non_sandbox_workspaces and ::test_gc_dry_run_returns_orphans_without_deleting exercise these same two cases through gc_workspaces	delete these 2. Parametrize the remaining 3 edge cases (existing config / empty id / missing key), which the boundary tests do not cover.	medium
22	tests/test_notification_service.py test_unknown_alias_raises_config_error in 5 classes (List, GetDetail, Create, Delete, ReplaceRecipient)	Local replays of a shared helper	A method bypasses resolve_projects (for example with a raw projects[alias] KeyError)	Owner: tests/test_base_service.py::...::test_unknown_alias_raises_config_error. The per-method routing check still has some value.	collapse into 1 parametrized test over the 5 methods	medium

Parametrize-only consolidations (no coverage loss)

Test id(s)	Count	Action	Conf.
tests/test_storage_files.py::TestFormatFileSize::* (none/bytes/KB/MB/GB)	5	Make it one parametrized table. The rendering is human-only, and no boundary test covers the unit thresholds, so keep the cases.	high
tests/test_data_app_cli.py::TestDataAppLogs::test_logs_mutex_lines_and_since, ::test_logs_since_invalid_format, ::test_logs_since_naive_datetime, ::test_logs_lines_negative_rejected	4	One parametrized test: argv suffix to expected message fragment, exit 2, service not called	high
tests/test_data_app_service.py::TestDataAppLogs mutex / negative lines / invalid since / naive since (the 4 *_raises_invalid_argument tests)	4	Same as above at the service layer. The CLI and the service each validate independently, so keep both layers.	high
tests/test_data_app_service.py::TestDataAppCreateValidation (test_invalid_size, _type, _auth, _slug, test_oversize_name_rejected, the test_control_char_* pair, test_git_repo_rejects_* pair, test_description_rejects_nul_byte, ...)	about 15 with the identical raises VALIDATION_ERROR shape	One or two parametrized tables of overrides to error code. Keep the tests that check a message or a specific branch.	medium
tests/test_stream_client.py::TestDeriveStreamUrl::*, tests/test_notification_client.py::TestDeriveNotificationUrl::*	3 + 3	Parametrize each	medium
tests/test_storage_files.py::TestClientDeleteFile / TestClientDeleteFileBranch, TestClientTagFile / TestClientTagFileBranch	5	Parametrize branch None / N	medium

Retained false positives

• tests/test_storage_empty_definition.py (both tests). These look like duplicates of tests/test_storage_table_definition.py::TestServicePassthrough::test_empty_array_wire_shape_survives, but they are not. They cover the per-column definition: [] shape from a support incident, on both the get_table_detail and download_table paths. The other test covers a top-level definition == []. They guard a named regression with a credible failure mode.
• tests/test_data_app_service.py::TestDataAppEnvelopesNoBareIdKey (11 tests) and TestDataAppListOutputKeys. These look repetitive, but they are the JSON-shape contract for the id to app_id rename in v0.33.0, one test per public envelope. Parametrizing them would be fine. Deleting them would not.
• tests/test_data_app_service.py::TestRedactGitBlock / TestRedactStorageConfig. These are tests of private helpers, but they are the security contract that ciphertext is never echoed and the input is not mutated. Keep them.
• tests/test_merge_request_client.py::TestRequesterSeam::test_namespace_works_against_a_stub_requester. It uses a stub, but it enforces an architecture contract: MergeRequests depends only on the StorageRequester Protocol. It is the cheapest guard against the namespace reaching back into the concrete client.
• tests/test_notification_cli.py::TestNotificationPermissions (5) and tests/test_merge_request_cli.py::TestStaticDestructiveClass::test_destructive_commands_are_denied_before_any_call / test_write_commands_pass_under_deny_destructive. These look like flag restatements, but they check the permission class of each operation (write vs destructive), which is part of the documented contract.
• tests/test_storage_delete.py::TestStorageReadIgnoresActiveBranch (10). They look repetitive across commands, but each one pins a different command's branch semantics: reads ignore the active branch, writes follow it. Each is a separate code path in commands/storage.py.
• tests/test_storage_truncate.py::TestTruncateTableService::test_client_closed_even_when_truncate_raises and tests/test_notification_service.py::TestDeleteSubscription::test_api_404_propagates. They assert mock calls, but they guard the try/finally close() resource contract.
• Validation in both data-app CLI and service tests (logs mutex/since, create PAT-mode mutex). This looks like a cross-layer replay, but the command and the service each validate on their own (the service is also reached via serve and the SDK). Each layer's test covers distinct code, so parametrize within a layer and keep both layers.

Notes

• Cross-layer pattern worth a follow-up sweep: when a CLI test drives the real service behind a mocked client (for example tests/test_sharing_cli.py and tests/test_storage_table_definition.py::_invoke_detail), the pure-service test of the same scenario is redundant (Phase 7: Test Coverage #13 to Close must-have gaps in explorer command #16). Most other CLI suites in this lane mock the service itself, so their service tests are the owners and are not redundant.
• TestCreate*Branch / TestUpload*Branch / TestDelete*Branch in tests/test_storage_write.py and tests/test_storage_delete.py pair a service-to-client hop test with a CLI-to-service hop test. I checked the create-bucket and create-table ones: the service hop is not asserted elsewhere (the legacy-storage and materialize tests do not check the create_* kwargs). They stay.
• tests/test_merge_request_service.py (138 tests) and tests/test_notification_service.py are dense, but almost every test encodes a named review finding (the Zajca/Opus follow-up classes). I found no junk there beyond fix: MCP daemon actually persists between CLI invocations #22. The test_server_field_wins tests in four TestDerive* classes target different functions.
• Deleting Phase 5: Integration tests, edge cases, linting, final polish #6 to Phase 2: Foundation — Shared Constants & HTTP Base #8 leaves _optional_mr_fields imported only by production code, and the inspect import in tests/test_merge_request_client.py becomes unused.
• Suggested validation after edits: uv run pytest tests/test_storage_truncate.py tests/test_storage_swap.py tests/test_storage_clone.py tests/test_merge_request_client.py tests/test_merge_request_cli.py tests/test_storage_describe_service.py tests/test_storage_table_definition.py tests/test_sharing_service.py tests/test_sharing_cli.py tests/test_data_app_service.py tests/test_data_app_plain_env_keys.py tests/test_workspace_service.py tests/test_workspace_gc.py tests/test_notification_service.py tests/test_storage_files.py tests/test_data_app_cli.py -q, then make check.

[padak]

Lane 4 test audit: auth, tokens, HTTP, config store, permissions, server, SDK, billing, project/member

Scope: 63 files, ~34.4k test LOC (the list in the brief; test_member_*, test_org_service, test_dev_portal_* and test_encrypt* were only skimmed, and no candidates were found there). This was a read-only audit. Nothing was edited and no tests were run.

Method: an AST sweep for assertion-free tests, an AST sweep for exact and near-duplicate bodies (constants normalised), then a full read of each candidate and the production code it targets.

Summary

• Delete (high confidence): 15 tests, about 160 LOC.
• Delete (medium confidence): 6 tests, about 110 LOC. This includes EXPECTED_ROUTER_PREFIXES and the 37-line skipped manual-doc "test".
• Rewrite, do not delete: 5 tests. These are negative controls or security checks that pass for the wrong reason or only assert what their own mock produced.
• Consolidate by parametrizing: 7 groups, about 30 tests. This saves roughly 150 LOC and loses no coverage.
• Estimated net deletion: about 21 tests and about 270 LOC outright. Consolidation removes about 150 LOC more.
• The security contracts in this lane are well covered and mostly not duplicated: 0600/0700 modes, manage-token default-deny, sentinel guards, token stripping, the real-money billing guard, and __all__.
• The most important findings are the negative controls that pass for the wrong reason (C2, R1, R2, R3).

Candidates

#	Test id	Junk pattern	What it can actually detect	Stronger remaining coverage	Action	Conf.
C1	tests/test_file_locking.py::TestTryFlock::test_flock_is_called_on_posix	Assertion-free probe; the name promises more than it checks ("is called")	Only "does not raise" on a real fd. It never checks that flock was called	test_file_locking.py::TestFileLockingIntegration::test_save_acquires_exclusive_lock / test_load_acquires_shared_lock (they call the real _try_flock and assert LOCK_EX/SH + LOCK_UN)	Delete	high
C2	tests/test_file_locking.py::TestTryFlock::test_flock_skipped_when_no_fcntl	Negative control that passes for an unrelated reason	None. Suppose the if not _HAS_FCNTL: return guard were removed. Then fcntl.flock(42, 0) raises EBADF/EINVAL, and contextlib.suppress(OSError) swallows it, so the test still passes (config_store.py:72-77)	None	Rewrite: patch config_store.fcntl with a MagicMock plus _HAS_FCNTL=False, then assert_not_called(). Or delete; Windows CI already exercises the real no-fcntl path	high
C3	tests/test_file_locking.py::TestFileLockingIntegration::test_concurrent_save_does_not_corrupt	The name promises concurrency; the saves are sequential. Duplicate of the contract	Only that two sequential add_project calls both persist	test_config_store.py::TestTransaction::test_concurrent_add_project_loses_no_updates (8 real threads) and TestAddProject::test_add_project_success	Delete	high
C4	tests/test_job_idempotency_store.py::TestStorePersistence::test_concurrent_distinct_keys_dont_clobber	The name promises concurrency; it is a sequential loop. Its sibling's docstring says so ("which the loop above does not exercise")	Only sequential record/lookup of 20 keys	TestStorePersistence::test_parallel_processes_do_not_lose_entries (real processes), test_record_then_lookup	Delete	high
C5	tests/test_permissions.py::TestPermissionEngineAllowMode::test_vojta_use_case	Duplicate invocation	Same policy (allow, deny cli:write), with a subset of the assertions	TestPermissionEngineAllowMode::test_category_cli_write_deny (same policy, superset of assertions incl. destructive and admin)	Delete	high
C6	tests/test_permissions.py::TestPermissionEngineDenyMode::test_read_only_mode	Duplicate invocation	Same policy (deny, allow cli:read) with a subset of the assertions	TestPermissionEngineDenyMode::test_category_cli_read_allow	Delete	high
C7	tests/test_permissions.py::TestPermissionPolicyValidation::test_valid_modes	Assertion-free probe	Only that both modes construct; every other test in the file does that already	Every engine test constructs PermissionPolicy(mode="allow"/"deny"); test_invalid_mode covers the rejection	Delete	high
C8	tests/test_permissions.py::TestPermissionEngineNoPolicy::test_check_or_raise_passes	Duplicate invocation, assertion-free	That check_or_raise does not raise when there is no policy	TestPermissionEngineCheckOrRaise::test_passes_on_allowed (non-raise path) plus test_no_policy_allows_everything (is_allowed under None, which check_or_raise delegates to)	Delete	medium
C9	tests/test_server_permissions.py::TestDefaultEngineFromPersistedPolicy::test_denied_operation_answers_403	Duplicate invocation (identical setup, weaker assertion)	403 on the destructive probe under a persisted deny	TestErrorEnvelope::test_403_body_carries_permission_denied_code (same setup, plus error code and operation name) and test_denial_is_403_not_401	Delete	high
C10	tests/test_server_permissions.py::TestOperationRegistryEntry::test_auth_projects_is_a_read_operation	Restates a declared flag	A registry literal	Behavioural: test_server_auth.py::TestPermissionEnforcement::test_get_projects_and_status_pass_through. There /auth/projects passes under --deny-writes (write+destructive+admin), so it can only be read-class	Delete	medium
C11	tests/test_billing_client.py::TestNoTopUpHelper::test_get_credits_never_sends_a_post_request	Duplicate invocation	That get_credits does not POST	TestGetCredits::test_get_credits_issues_get_to_billing_host asserts exactly 1 request with method == "GET", and httpx_mock is registered for GET only. Keep the other three real-money guards in the class (see Retained)	Delete	high
C12	tests/test_billing_client.py::TestGetCredits::test_get_credits_returns_raw_json_verbatim	Duplicate invocation / mock value echoed back	That the client returns the mocked JSON dict unchanged	test_get_credits_issues_get_to_billing_host already asserts result == LIVE_PAYLOAD	Delete	high
C13	tests/test_billing_client.py::TestProjectCreditsParsing::test_tolerates_missing_stats, ::test_tolerates_completely_empty_payload	Duplicated across layers	Tolerant parsing of {} and of a payload with no stats	test_billing_service.py::TestMissingStats::test_payload_without_stats_zeroes_breakdown / test_completely_empty_payload_does_not_raise. The service parses through ProjectCredits.model_validate (billing_service.py:159) and asserts the resulting row, so it is the stronger boundary. Keep test_tolerates_stats_none, the unknown-keys tests and the live-payload test	Delete 2	medium
C14	tests/test_billing_service.py::TestGetCreditsHappyPath::test_feature_gate_checked_before_get_credits	The name promises more than it checks ("before"); no ordering is asserted	Only that has_feature("pay-as-you-go") was called once and get_credits was called	That the gate is actually enforced: TestPaygFeatureGate::test_get_credits_never_called_when_gate_fails. That get_credits fires: test_live_payload_produces_exact_row	Delete. If the literal feature-name string matters, move assert_called_once_with("pay-as-you-go") into the happy-path test	high
C15	tests/test_project_edit.py::TestRenameAliasPathTraversalRejected::test_legal_filesystem_safe_aliases_accepted	Private predicate tested directly, duplicating the real boundary; assertion-free	That ProjectService._validate_alias_format (a private staticmethod that delegates to the shared validator) does not raise on 4 shapes	test_config_store.py::TestValidateAliasFormat::test_legal_slug_accepted (the shared owner). Service happy path: TestRenameAliasConfigCascade::test_rename_to_unique_alias_swaps_dict_key. Optionally move "99_playground_max", "_internal" into the config_store test	Delete	high
C16	tests/test_project_edit.py::TestRenameValidation::test_alias_with_internal_whitespace_rejected	Duplicate invocation	Rejection of "has spaces"	The same file's TestRenameAliasPathTraversalRejected::test_traversal_and_unsafe_chars_rejected[with space-...], which additionally asserts the state is unchanged	Delete	high
C17	tests/test_lib.py::TestModuleLayout::test_pagination_helper_relocated_to_client	Import/source-layout pin of a private helper	Only that _collect_inline_results is importable from client and identical in workspace_service. A behaviour-preserving move breaks it	Behaviour is covered by test_lib.py::TestQuery::* / TestQueryResult::* (the SDK path) and by the workspace query tests	Delete	high
C18	tests/test_server_smoke.py::test_openapi_lists_all_routers + EXPECTED_ROUTER_PREFIXES (~50 LOC)	Copied inventory	A router dropped from create_app	test_serve_telemetry.py::test_command_map_matches_every_route_exactly. A dropped router leaves orphaned SERVE_COMMAND_MAP entries, and that map is a production artifact the middleware consumes	Delete	medium
C19	tests/test_e2e_auth.py::test_device_flow_manual_verification (37 LOC)	Assertion-free; permanently @skip; the body is only a docstring	None. It never runs	Not a test. It is an operator runbook	Move the steps into a comment in auth/device.py (per the "document in code comments" rule), then delete	medium
C20	tests/test_config_store.py::TestCorruptedFile::test_truncated_json	Duplicate invocation (same JSONDecodeError branch)	The same "not valid JSON" path as the other test	TestVersionCheck::test_invalid_json_raises_config_error	Delete, or fold into group G1	medium

Rewrites (keep the intent, fix the proof)

#	Test id	Problem	Fix	Conf.
R1	tests/test_server_permissions.py::TestRequirePermissionDependency::test_app_without_an_engine_fails_closed	Asserts only status_code != 200 with raise_server_exceptions=False. The bare FastAPI app has no PermissionDeniedError→403 handler, so any crash passes, including AttributeError: None.check_or_raise if the explicit fail-closed branch in get_permission_engine (server/dependencies.py:220-225) were deleted. It does catch a fail-open regression (it would get 200), but it cannot tell the deliberate refusal from an accident	Use raise_server_exceptions=True and pytest.raises(PermissionDeniedError, match="not built by create_app")	medium
R2	tests/test_permissions_cli.py::TestPermissionsSet::test_set_rejected_without_confirmation	The mock produces the asserted behaviour: require_random_code_confirmation is patched to raise Exit(6), and the test asserts exit 6. It does not check that nothing was persisted before the refusal. CliRunner already has no TTY, so the real helper would refuse on its own	Drop the patch so the real non-TTY path runs. Assert exit 6 and store.load().permissions is None (mirror test_reset_rejected_without_confirmation, which does check persistence)	medium
R3	tests/test_billing_cli.py::TestBillingCreditsCli::test_per_project_errors_surface_as_warnings_exit_0	assert "b" in result.output is vacuous: the letter appears in almost any output. The second assertion is an or on text the mock supplied	Assert that the rendered warning line contains the alias and PAYG_NOT_AVAILABLE together, and the same under --json if applicable	medium
R4	tests/test_file_locking.py::TestTryFlock::test_flock_skipped_when_no_fcntl	See C2. Listed again because rewriting is preferred to deleting	See C2	high
R5	tests/test_lib.py::TestModuleLayout::test_public_surface	The __all__ semver contract is a superset check (>=) missing CloneResult, JobIdempotencyStore, ScopedTokenResult, StreamSourceResult, TokenListEntryResult. A removal of those from __all__ goes unnoticed (only test_lib_device_enrollment::TestImportableModels covers two of them, and only by attribute import, not __all__)	Pin the full set exactly (==). Removing a name is a semver break, and adding one should be a deliberate edit	medium

Consolidation groups (parametrize; no coverage change)

Group	Tests	Note
G1	test_config_store.py::TestVersionCheck::test_invalid_json_raises_config_error, ::test_invalid_structure_raises_config_error, TestCorruptedFile::test_truncated_json, ::test_json_array_instead_of_object, ::test_json_null_value, ::test_empty_file, ::test_binary_garbage_in_config	One (content, match) table, 7 → 1
G2	test_permissions.py::TestOperationRegistry::test_known_{read,write,destructive,admin}_operations + TestDevPortalPermissions::test_registry_contains_all_dev_portal_ops	One (op, category) table. Keep these as a security-classification tripwire (see Retained)
G3	test_project_edit.py::TestRenameValidation::test_empty_new_alias_rejected, ::test_whitespace_new_alias_rejected	Add ("", ...) and (" ", ...) rows to test_traversal_and_unsafe_chars_rejected, which also asserts the state is unchanged
G4	test_http_base.py::TestBaseHttpClientErrorSanitization::test_401_maps_to_invalid_token / test_403_maps_to_access_denied / test_404_maps_to_not_found, and test_errors_list_shape_serialised / test_detail_list_shape_serialised	Status→ErrorCode table
G5	test_base_service.py::TestResolveMaxWorkers::test_{invalid,zero,negative}_env_var_falls_back_to_config	Env-value table
G6	test_auth_environment.py::TestPlatformOpenerDetection::test_{linux_xdg_open,macos_open,windows_start}_detected	Platform table
G7	test_server_router_calls.py::test_feature_*_passes_* (6) and test_server_smoke.py::test_post_agents_rejects_mcp_tool / test_agents_test_route_rejects_mcp_tool / test_agents_test_stream_route_rejects_mcp_tool	(method, path, body, service_method, expected_kwargs) table; (route) table for the mcp_tool rejects

Retained false positives

1. test_billing_client.py::TestNoTopUpHelper::test_only_get_credits_is_defined_on_the_mixin, ::test_billing_module_source_never_issues_a_post, ::test_billing_dispatcher_takes_no_http_method. They look like source greps and signature pins. They stay because POST /credits triggers a real-money top-up, and these are the cheapest independent guards against a new helper or a reintroduced method parameter. The behavioural GET test cannot see code that is not called. Only the redundant behavioural never_sends_a_post_request (C11) goes.
2. test_config_store.py::TestFilePermissions::* (incl. test_permissions_preserved_on_resave, test_file_never_created_with_broad_permissions) and TestDirectoryPermissions::*; test_auth_state_store.py::TestFilePermissions::*; test_job_idempotency_store.py::test_file_is_0600. These are the 0600/0700 contracts for three different stores, plus the TOCTOU mode-at-open check. The resave test looks redundant, but it guards a real past failure class (mode lost on atomic replace).
3. test_manage_token_cli.py::TestAllowEnvManageTokenFlag::* (4 tests). They look like CLI tests over mocks. Each one independently pins manage-token default-deny on a different consumer surface (refresh / data-app password / org setup). Each asserts the ignored-env warning, that the service is never reached, and that the sentinel does not leak into output. There is no stronger owner.
4. No-raise negative controls, which are assertion-free by design. These are test_http_base_auth.py::TestSessionAuthFeatureGuard::test_guarded_client_accepts_a_static_token / ::test_supplying_http_auth_bypasses_the_guard, test_auth_sentinel.py::TestRequireStaticToken::test_static_token_passes_through, and test_config_store.py::TestValidateAliasFormat::test_legal_slug_accepted. Each is paired with a sibling proving the same call does raise on the other input. That makes each a real control against an over-broad guard, which would break every bearer-mode sub-client.
5. test_server_router_calls.py (136 kwarg-forwarding tests). They resemble call-shape tests, but they sit at the router→service owner boundary. The module docstring documents shipped TypeErrors from kwarg drift (new_name= vs name=), and nothing else exercises those routes with real kwargs. They should be consolidated (G7), not deleted.
6. test_permissions.py::TestOperationRegistry::test_known_* and TestDevPortalPermissions. They restate declared categories. They stay because the category is the security contract (e.g. config.delete = destructive, dev-portal.publish = admin). scripts/check_command_sync.py only checks key existence, not class, so a silent downgrade to read would otherwise pass CI. They should be consolidated (G2), not deleted.
7. test_result_models.py::TestBaseConfig::test_all_models_allow_extra and test_auth_sentinel_guards.py::TestConfigStoreCompatRegression::test_current_config_version_unchanged. They look like restated config. They stay because extra="allow" / populate_by_name is the documented semver contract for every SDK result model (behavioural tests cover only JobResult/ConfigDetailResult), and the config version pins a migration contract.
8. test_serve_ui.py::TestCookieAuth::test_query_param_no_longer_accepted, test_server_permissions.py::TestExplicitEngineWins::test_persisted_policy_is_not_consulted, test_permissions_cli.py::TestPermissionsEnforcement::test_denied_command_returns_exit_6. All three were checked as potential "negative control passes for an unrelated reason" cases, and all three are sound:
   • The query-param test would get 200 if the legacy fallback returned, because the sibling cookie test proves /agents answers 200 when authenticated.
   • The persisted-policy test uses a read probe that the persisted policy denies.
   • Exit code 6 is produced only by the permission firewall.

Notes

• All cited class names were checked against the source files.
• Cross-layer duplication is low in this lane. CLI tests mock the service and assert rendering and exit codes. Service tests mock the client. The overlap is mostly in billing (C11–C14) and alias validation (C15, C16, G3).
• Clean tests: test_auth_client.py (1807 LOC), test_token_provider.py and test_auth_service.py had no exact duplicates. Their loose-duplicate hits were status-code variants: refresh error remapping, 429/5xx not retried. These are parametrize-only candidates at low priority and were not listed.
• Validation for any edit batch: uv run pytest tests/test_file_locking.py tests/test_permissions.py tests/test_server_permissions.py tests/test_billing_client.py tests/test_billing_service.py tests/test_project_edit.py tests/test_lib.py tests/test_server_smoke.py tests/test_config_store.py tests/test_job_idempotency_store.py -q, then make check. uv sync --extra server is needed first in a fresh worktree.
• Suggested first PR: the high-confidence rows only (C1, C3–C7, C9, C11, C12, C14–C17), plus R1, R2 and R4. That removes about 15 tests and about 160 LOC, and tightens three security negative controls.

[padak]

Lane 5 test audit: config / component / semantic-layer / kai / agent / search / utils

Read-only audit. Scope was 50 files, about 30.9k LOC and about 1,370 tests. Every candidate below was read in full, together with the production code it targets and the test at the stronger boundary that covers the same contract.

Summary

• High-confidence deletions: 23 tests, about 330 LOC.
  • 7 --help text greps.
  • 3 identity copiers or flag restatements.
  • 10 cross-layer duplicates, where the same scenario is replayed at both the service layer and the CLI layer.
  • 1 exact duplicate test.
  • 1 private-regex test that duplicates the boundary tests.
  • 1 test that encodes a false API shape.
• Medium-confidence consolidation or deletion: about 26 tests, about 260 LOC net.
  • Most of this is merging near-duplicates into parametrized tables, so coverage stays the same.
  • A few are weak probes.
• Estimated total reduction: about 49 test functions removed or merged, about 590 LOC. That is roughly 2% of lane LOC.
• Where the value sits: the lane is generally well written, with many named-issue regressions and security guards.
• Where the junk sits: it clusters in older files (test_kai_cli.py, test_config_row_service.py, test_config_rename*.py) and in duplicate service-vs-CLI replays. In those replays, the CLI test already runs the real ConfigService with a mocked client, so the service-level twin adds nothing.

Candidates

High confidence

#	Test id	Junk pattern	What it can detect	Stronger remaining coverage	Action
1	test_kai_cli.py::TestKaiPingCli::test_kai_ping_help	--help text grep	Docstring wording change only	TestKaiPingCli::test_kai_ping_json_output invokes the command with --project. The command tree is also checked by make skill-check	Delete
2	test_kai_cli.py::TestKaiAskCli::test_kai_ask_help	--help grep	Wording only	TestKaiAskCli::test_kai_ask_json_output uses --message and --project	Delete
3	test_kai_cli.py::TestKaiChatCli::test_kai_chat_help	--help grep	Wording only	TestKaiChatCli::test_kai_chat_with_chat_id exercises --chat-id	Delete
4	test_kai_cli.py::TestKaiHistoryCli::test_kai_history_help	--help grep	Wording only	TestKaiHistoryCli::test_kai_history_with_limit exercises --limit	Delete
5	test_kai_cli.py::TestKaiPreflightCli::test_kai_preflight_help	--help grep	Wording only	TestKaiPreflightCli::test_kai_preflight_ok_json	Delete
6	test_kai_cli.py::TestKaiChatDetailCli::test_kai_chat_detail_help	--help grep	Wording only	TestKaiChatDetailCli::test_kai_chat_detail_json	Delete
7	test_config_rename_cli.py::TestConfigRenameCli::test_config_rename_help	--help grep	Wording only; every flag it greps is used by real invocations	test_config_rename_with_sync_info passes every flag, including --directory	Delete, and drop "help text" from the module docstring
8	test_config_resolution.py::TestConfigStoreSource::test_custom_source	Identity copier	None: the constructor argument is returned by a one-line property (config_store.py:260)	test_default_source_is_global keeps the default contract. TestResolveConfigDir covers real source labels	Delete
9	test_config_resolution.py::TestConfigStoreSource::test_cli_flag_source	Identity copier (same as #8)	None	Same as #8	Delete
10	test_kai_cli.py::TestKaiPingCli::test_kai_ping_not_enabled	Near-duplicate invocation	None beyond #10's twin: the mocked service raises KeboolaApiError with a different error_code string, and map_error_to_exit_code has no KAI_* special case (both map to exit 1)	TestKaiPingCli::test_kai_ping_api_error runs the identical path. test_kai_service.py::TestKaiServicePing::test_ping_kai_not_enabled owns the real KAI_NOT_ENABLED production	Delete
11	test_semantic_layer_cli.py::TestPermissions::test_model_create_denied_with_deny_writes	Exact duplicate	Same argv, flag and assertion as its twin	TestPermissions::test_deny_writes_blocks_model_create (the twin also asserts create_model was not called, so it is stronger)	Delete
12	test_semantic_layer_service.py::TestModuleConstants::test_constraint_name_regex	Private predicate duplicated at the boundary	Regex change; but each of its 4 cases is already asserted through add_constraint	TestAddConstraint::test_rejects_bad_name_uppercase, test_rejects_bad_name_dashes, test_rejects_leading_digit, test_accepts_valid_name; also TestEditConstraint::test_rejects_bad_new_name	Delete
13	test_config_rename.py::TestRenameConfigApi::test_rename_config_api_error	Cross-layer replay	Service swallowing a 404	test_config_rename_cli.py::TestConfigRenameCli::test_config_rename_api_error runs the real ConfigService with the same client side_effect and also asserts exit code and envelope	Delete
14	test_config_row_service.py::TestCreateConfigRow::test_result_contains_project_alias	Duplicate assertion	project_alias enrichment	TestCreateConfigRow::test_create_minimal asserts result["project_alias"] == "prod" (line 86)	Delete. Keep the update-variant test: nothing else asserts it for update_config_row
15	test_config_row_service.py::TestDeleteConfigRow::test_delete_propagates_api_error	Cross-layer replay	Service swallowing a 404	test_config_row_cli.py::TestConfigRowDeleteCli::test_delete_404_returns_nonzero_exit uses the real service and the same side_effect, and asserts NOT_FOUND	Delete
16	test_config_row_service.py::TestGetOauthUrl::test_returns_url	Cross-layer replay; the URL asserted is the one the mock produced	Result-key shape	test_config_row_cli.py::TestConfigOauthUrlCli::test_returns_url_json makes the identical assertions through the real service, plus the envelope	Delete
17	test_config_row_service.py::TestGetOauthUrl::test_api_error_propagates	Cross-layer replay	Error swallowed	TestConfigOauthUrlCli::test_api_error_exits_nonzero (real service)	Delete. At the same time, tighten the CLI test to assert error.code == "ACCESS_DENIED"; today it only asserts exit != 0
18	test_config_row_service.py::TestUpdateConfigRow::test_custom_change_description_forwarded	Cross-layer replay	Forwarding of change_description	test_config_row_cli.py::TestConfigRowUpdateCli::test_change_description_flag_forwarded runs the same name-only update path through the real service	Delete
19	test_config_update.py::TestConfigServiceUpdateChangeDescription::test_dry_run_includes_change_description	Cross-layer replay with identical inputs	Dry-run echo	TestConfigUpdateChangeDescriptionCli::test_dry_run_echoes_change_description (real service, same --set and --dry-run, also asserts no write)	Delete. Keep test_custom_change_description_forwarded: it uses the metadata-only path, while the CLI twin uses --set
20	test_agents_store_events.py::test_task_action_construction	Identity copier	None: it builds a pydantic model with type="ai_agent" and asserts type == "ai_agent"	test_agent_service.py::TestCrud::test_create_round_trip; test_agent_cli.py::TestAgentCreateAndShow::test_create_cli_command	Delete
21	test_metastore_client.py::TestProjectScope401OverSession::test_metastore_declares_the_opt_out	Capability test restating a declared flag	Flag flip; but the behaviour test reads the same constant	test_session_scope_401_does_not_refresh passes refresh_on_401=MetastoreClient.BEARER_REFRESH_ON_401 and asserts refresh_calls == 0. test_factory_builds_a_non_refreshing_bearer_for_metastore covers the factory wiring	Delete
22	test_config_state.py::TestConfigStateClientUpdateConfigRowState::test_update_config_row_state_returns_full_detail	Mock implements a false contract; the name promises something the API does not do	Only that the client returns response.json() verbatim. Its docstring claims the row endpoint returns the full config detail. TestConfigStateRowWriteResponseShape (issue #593, live-verified) documents that the real endpoint returns the bare row	Passthrough is already covered by test_update_config_row_state_production_url (result["state"])	Delete. It misleads future readers into the #593 bug shape
23	test_config_state.py::TestConfigStateClientUpdateConfigState::test_update_config_state_returns_full_detail_not_bare_state	Asserts the value its own mock produced	A client that unwraps to bare state; but test_update_config_state_production_url already fails on that (it asserts result["state"] and result["version"])	test_update_config_state_production_url; service-level TestConfigStateRowWriteResponseShape::test_root_write_still_reads_state_from_full_detail	Delete (confidence: medium to high)

Medium confidence (consolidate or weak probe)

#	Test id	Pattern	Detects	Remaining coverage	Action
M1	test_repl.py::TestBuildCommandTree::test_builds_tree_from_app and test_repl.py::TestBuildCommandTree::test_tree_includes_top_level_commands	Near-duplicates (same setup, name-membership asserts)	Missing command names	test_tree_not_collapsed_to_empty has the same setup plus count floors	Merge both name lists into test_tree_not_collapsed_to_empty (net: -2 tests, about 25 LOC)
M2	test_repl.py::TestReplCli::test_no_args_non_tty_shows_help	Weak disjunctive assertion ("Commands" in out or "kbagent" in out)	Almost nothing: "kbagent" appears in any output	none needed / tighten	Either assert "Commands" only, or delete
M3	test_json_utils.py::TestComputeDiffEntries::test_compute_diff_formats_entries_identically	Implementation-coupled (its own comment says it "pins the delegation")	A refactor that stops compute_diff delegating	TestComputeDiff pins the output format; TestComputeDiffEntries pins entries	Delete
M4	test_search_service.py::TestResolveApiTypes::test_table_maps_correctly, test_bucket_maps_correctly, test_flow_maps_correctly, test_config_maps_to_configuration	Near-duplicate identity mappings	Mapping table drift	Same tests	Merge into one parametrized test (-3 tests)
M5	test_search_service.py::TestResolveApiTypes::test_multiple_types_deduped	Name promises more than the input exercises (the input ["table","bucket"] has no duplicate)	Nothing about deduplication	none	Fix the input to ["table","table","bucket"], or rename. Do not delete
M6	test_search_cli.py::TestSearchCommandValidation::test_missing_query_shows_help	Tests the framework (Click's missing-argument handling); the name overpromises ("shows help")	Only that QUERY stays required	none needed	Delete, or assert exit 2 and rename
M7	test_component_service.py::TestGenerateFromSchema::test_string_with_default, test_string_without_default, test_integer_with_default, test_integer_without_default, test_boolean_with_default, test_boolean_without_default, test_array_with_default, test_array_without_default (+ test_number_type)	Near-duplicate per-type cases	Per-type default rules	Same tests	Collapse into one parametrized (type, default, expected) table (-8 functions, about 50 LOC)
M8	test_semantic_layer_service.py::TestAddConstraint::test_rejects_bad_name_uppercase, test_rejects_bad_name_dashes, test_rejects_leading_digit	Near-duplicates	Name validation	Same tests	Parametrize over name, and assert VALIDATION_ERROR in every case (only the first asserts it today)
M9	test_agent_prompt.py::TestPilotAgentFile::test_agent_file_exists, TestSlashCommand::test_command_file_exists, TestPluginClaudeMd::test_plugin_claude_md_exists	Subsumed: the agent_body fixture and sibling tests read_text() the same files and would fail first	Missing file (sibling tests already error)	Sibling tests in the same classes	Delete (low value; they only give a friendlier failure message)
M10	test_config_state.py::TestConfigStateClientUpdateConfigState::test_update_config_state_uses_put_method and test_config_state.py::TestConfigStateClientUpdateConfigRowState::test_update_config_row_state_uses_put_method	Separate test for one assertion	HTTP verb, which is a real contract: add_response without method= matches any verb	none elsewhere	Fold assert request.method == "PUT" into the matching *_body_is_json_not_form_encoded test (-2 tests), or pass method="PUT" to add_response in the production_url tests
M11	test_config_rename.py::TestRenameConfigApi::test_rename_config_basic (result-key half only)	Partial cross-layer replay	Its result-key asserts duplicate test_config_rename_cli.py::test_config_rename_json_output	CLI JSON test	Keep the test, but trim it to the unique client call-args assertions

Retained false positives (they look like junk but stay)

1. test_config_set_guard.py (all classes). It layers the private helper _validate_set_paths, the service, and CLI exit-code tests. It looks like a three-layer replay, but each layer owns a distinct risk. The helper tests pin the per-prefix remedy hint text (a user-facing contract). The service tests prove the guard runs before the fetch and even under --dry-run. The CLI tests pin exit 2. This is the --set top-level rejection guard (config: no CLI path to write configuration state (PUT .../state unused); config update --set 'state...' silently no-ops #593); retain.
2. test_config_trash.py::TestDeleteIsNeverRetriedAtTheTransport. Asserting "exactly one DELETE" looks like a call-shape test, but it is the purge-guard contract: a retried DELETE on a trashed config purges it permanently. test_default_delete_still_retries is a deliberate negative control. Retain.
3. test_config_encryption.py::TestCliFlagWiring. These assert that a flag is forwarded to a mocked service, which is call-shape. But they guard that --allow-plaintext-on-encrypt-failure defaults to False on every write command (test_update_defaults_flag_false). That is a security default at the only boundary where it can be dropped. Retain.
4. test_metastore_client.py::TestProjectScope401OverSession::test_default_bearer_would_refresh_reproducing_the_bug. It exercises a configuration production never uses, but it is the negative control proving that test_session_scope_401_does_not_refresh fails for the right reason. Retain.
5. test_agent_prompt.py string greps (TestNonNegotiableRules, TestInlineGotchas, TestToolSelectionMatrix, byte budget). They are exact string greps, but they are the cheapest independent guard of a prompt-byte contract for a shipped plugin, which is not CI-checked elsewhere (CLAUDE.md convention v0.6.0: Branch lifecycle management + security hardening #17). Retain. Only the three file-exists probes (M9) go.
6. test_pricing.py::TestGetRate exact rates. The values are copied from PRICING_USD_PER_MTOK, but they pin the observable cost figures reported by agent runs. Keeping one exact-value check per family is the only guard against silent table corruption. Retain; optionally merge into one parametrized table.
7. test_kai_cli.py JSON tests asserting mock-returned data. These look like "asserting the mock's own values", but the independent contract they pin is the {"status":"ok","data":...} envelope and the passthrough of each command. Retain. Likewise, each command's *_api_error test stays, because every kai command has its own copy-pasted except block (commands/kai.py); they are not replays of a shared helper.
8. test_server_semantic_layer_routes_e2e.py. It overlaps the CLI tests by scenario, but it runs against the real Metastore and is excluded from unit CI (ci.yml:424, make test-e2e). It is the only real-API proof for the 18 routes. Retain.
9. test_semantic_layer_service.py::TestModuleConstants::test_constraint_types_complete and test_constraint_severities, and test_metastore_client.py::TestSemanticTypes. These are copied inventories, but the sets are user-facing CLI choices (documented in CLAUDE.md and commands-reference.md) and API slugs. Removing a member is a breaking change that no boundary test would catch. Retain.

Notes

• Dominant pattern: the service test plus a CLI test that runs the real ConfigService with a MagicMock client, on identical inputs (Phase 7: Test Coverage #13, Implement kbagent catalog generate command #15–Fix: add packaging to dependencies #19). When the CLI test injects a real service, it is the owner-boundary test and the service twin is redundant. Where the CLI test mocks the service (kai, metadata, search), the service tests stay: nothing else exercises the service logic.
• fix: MCP daemon actually persists between CLI invocations #22 is worth landing first. It is not just redundant: its docstring asserts an API shape that the config: no CLI path to write configuration state (PUT .../state unused); config update --set 'state...' silently no-ops #593 regression class, verified live, says is wrong.
• One coverage gap to close alongside v0.6.0: Branch lifecycle management + security hardening #17: TestConfigOauthUrlCli::test_api_error_exits_nonzero only asserts exit_code != 0. Tighten it to ACCESS_DENIED / exit 3 before deleting the service twin.
• Not audited in depth:
  • test_semantic_layer_service.py beyond class-level scanning (3.5k LOC). It is likely to hold more parametrize-able near-duplicates (the TestReferenceData set/get variants, the TestSearchContext filter tests), but I found no high-confidence deletions.
  • test_component_sync_action.py: read by name only. The tests look like named regression tests (fix(AI-3757): forward authorization/runtime in component sync-action #620) and are retained by default.
• Validation command for a cleanup PR: uv run pytest tests/test_kai_cli.py tests/test_config_rename*.py tests/test_config_row_*.py tests/test_config_update.py tests/test_config_state.py tests/test_config_resolution.py tests/test_semantic_layer_*.py tests/test_metastore_client.py tests/test_agents_store_events.py tests/test_repl.py tests/test_json_utils.py tests/test_search_*.py tests/test_component_service.py tests/test_agent_prompt.py -q, then make check.

[padak]

Lane 6 -- tooling/infra tests + cross-cutting pattern sweep

Read-only audit of /Users/padak/github/keboola_agent_cli (no files in the repo touched).
Method: test-audit skill, audit mode (junk patterns, value bar, retention bar, candidate evidence).
Discovery helpers (scratchpad only): noassert.py (AST scan for assertion-free tests), dups.py
(identical test bodies), passthru.py (mock-return passthrough), seams.py (src defs referenced
only by tests).

Summary

• Tooling and release-gate tests (version sync, vNEXT/version gates, changelog, release scope,
  sentinel guards, command sync, license, frozen-dist, ai-kit sync, promotion pipeline) are
  real contracts. Retain them all. The one real problem in this area is CI routing, not the
  tests themselves: the error-code guard self-tests are marked integration, so CI deselects them.
• The strongest findings are test-only production seams:
  • the _should_skip alias in auto_update.py: its only callers are 11 tests, and those tests
    therefore never exercise the real gates;
  • three dead default_*_client_factory wrappers, kept alive by a single test;
  • a handful of dead helpers: get_nested_value, StateStore.clear_orphans,
    DeepLineageService.build_and_cache.
• Other high-confidence junk:
  • a vacuous uniqueness test: ErrorCode duplicates become aliases, so the check can never fail;
  • two byte-identical duplicate tests in test_cli.py and one in test_normalize_script.py;
  • a sentinel test whose name promises an assertion it never makes;
  • identity-copier and isinstance tests in test_errors.py, test_config_resolution.py and
    test_output.py;
  • a provider-local replay of the BaseHttpClient retry/truncation tests in test_client.py,
    which also contains one tautological assert.
• Most "assertion-free" hits from the AST scan are legitimate: pytest-httpx strict mode is the
  assertion, or the test's contract is "must not raise". They are listed under retained false
  positives.

Part A candidates (tooling/infra lane)

#	Test id	Junk pattern	What it can detect	Stronger remaining coverage	Action	Conf.
A1	tests/test_errors.py::TestErrorCode::test_no_duplicate_values	Vacuous check (the negative case can never fail)	Nothing. ErrorCode is a plain StrEnum without @unique, so a duplicate value becomes an alias and [c.value for c in ErrorCode] skips aliases. Verified: class E(StrEnum): A='X'; B='X' gives ['X'] and the test passes.	None today	Replace with @enum.unique on ErrorCode in src/keboola_agent_cli/errors.py (the class declaration enforces it at import) and delete the test. Or assert len(ErrorCode.__members__) == len(ErrorCode).	High
A2	tests/test_errors.py::TestKeboolaApiError::test_is_exception, TestConfigError::test_is_exception	isinstance of a freshly built object whose class subclasses Exception	None: every raise/except site would break first	All CLI error-path tests	Delete	High
A3	tests/test_errors.py::TestKeboolaApiError::test_basic_creation, TestConfigError::test_basic_creation, TestErrorCode::test_keboolaapierror_accepts_enum	Identity copier (constructor args read back)	Only a broken __init__, which every service and CLI error test would also catch	test_output.py::TestOutputFormatterJsonMode::test_error_json_output* and CLI exit-code tests	Delete. Keep test_default_values and test_keboolaapierror_default_uses_enum: the UNKNOWN_ERROR default is a JSON contract.	High
A4	tests/test_errors.py::TestErrorCode::test_str_equality, test_is_str, test_known_codes_present; tests/test_errors.py::test_dev_portal_error_codes_present	Restating enum/language behaviour; copied inventory	Removing a listed member. Any member used in src/ fails ty or import first, and doc/enum parity is enforced by scripts/check_error_codes.py, which CI runs (ci.yml:217).	check_error_codes.py CI step; test_output JSON envelope tests	Delete. Keep test_json_serialisation only if nothing else asserts the envelope code string (the test_output/test_cli asserts on ["error"]["code"] == "CONFIG_ERROR" already do, so it can go too).	Medium-High
A5	tests/test_config_resolution.py::TestConfigStoreSource::test_custom_source, test_cli_flag_source	Identity copier (constructor arg stored on an attribute)	None	test_doctor_service.py::TestDoctorServiceCheckConfigSource::test_reports_local_source exercises source through a real consumer	Delete both. Keep test_default_source_is_global, which guards a default.	High
A6	tests/test_output.py::TestOutputFormatterInit::test_json_mode_flag, test_verbose_flag, test_no_color_creates_console	Identity copier; "is not None" probe	None (no_color is never checked for colour being disabled)	All JSON-mode and human-mode OutputFormatter tests	Delete	High
A7	tests/test_output.py::TestOutputFormatterHumanMode::test_output_without_formatter_does_not_crash, test_error_does_not_crash, test_success_does_not_crash	Assertion-free coverage probes	Only an exception in human-mode error/success	Human-mode CLI tests in test_cli.py assert error/success text	Delete, or add one capsys assertion (message text appears on stderr/stdout) and fold the three into one parametrized test	Medium
A8	tests/test_auto_update.py::TestProcessLevelSentinel::test_sentinel_is_set_even_when_body_raises	Name promises more than the test exercises; duplicate of TestMaybeAutoUpdate::test_exception_never_crashes (identical body)	Only "does not raise", which the sibling already covers. It never reads _AUTO_UPDATE_RAN.	test_exception_never_crashes (swallowing); test_second_call_short_circuits (happy-path sentinel)	Strengthen, do not delete. The contract (sentinel set before the body runs) is real and otherwise untested. Add assert auto_update_module._AUTO_UPDATE_RAN is True and verify a second call does not reach _should_skip_all.	High
A9	tests/test_auto_update.py::TestShouldSkip (all 11 tests)	Tests preserving a test-only production alias (_should_skip)	Regressions in _should_skip_all / _should_skip_kbagent_stage only through an OR-wrapper that production never calls. A bug that swapped which helper maybe_auto_update consults would be invisible.	None directly on _should_skip_all(): only lines 1255/1296 touch it	Retarget the 11 cases to _should_skip_all() (env/dev/opt-out) and _should_skip_kbagent_stage() (versioning subcommand), then delete _should_skip (src/keboola_agent_cli/auto_update.py:264). See Seams S1.	High
A10	tests/test_integration.py::TestCheckErrorCodesGuard::test_guard_passes_on_clean_source, TestErrorCodesDocCompleteness::test_doc_matches_enum	Duplicate invocation of a CI gate	Same failure as uv run python scripts/check_error_codes.py, which runs in ci.yml:217 and release-kbagent.yml:115	The CI step	Delete these two. Also remove @pytest.mark.integration from both classes (lines 252 and 315): they need no credentials, but the marker makes CI (-m "not integration") deselect the guard's real self-tests (test_guard_catches_planted_literal, test_guard_ignores_enum_usage, test_detects_missing_code, test_detects_stale_code), so those only run locally. Routing fix, not deletion.	Medium-High
A11	tests/test_integration.py::TestFullWorkflow (3 tests) and tests/test_sync_e2e.py (1 test)	Permanently skipped	They run only with KBA_TEST_TOKEN_AWS set. No workflow sets it (e2e uses E2E_API_TOKEN), and CI also deselects integration.	tests/test_e2e.py covers project add/list/status/config list/remove and sync against a real project	Confirm with the owner that nobody runs these locally, then delete (or port to the E2E_* env convention). Low risk.	Medium
A12	tests/test_models.py::TestProjectConfig::test_create_with_all_fields, test_json_output_is_valid; TestAppConfig::test_config_with_projects; TestTokenVerifyResponseValidation::test_token_verify_response_with_all_fields; TestErrorResponse::test_create, test_error_type_explicit; TestSuccessResponse::test_with_list_data, test_with_empty_data; TestFeature::test_minimal_name_only (subset of test_defaults_when_empty_dict)	Restating pydantic field assignment; identity copiers	None beyond pydantic itself	JSON round-trip, legacy-load and default tests in the same file; test_output envelope tests exercise ErrorResponse/SuccessResponse (their only production caller is output.py)	Delete. Keep the round-trip, legacy/back-compat, defaults, URL normalization, max-workers bounds and role_hint normalization tests: they are storage and config contracts.	Medium
A13	tests/test_models.py::TestStackUrlValidation::test_project_add_accepts_https_azure, test_project_add_accepts_https_gcp	Near-duplicates of test_project_add_accepts_https_url (same code path, different host)	None extra	TestStackUrlCanonicalization parametrized spellings	Fold into one parametrized case, or delete	Low-Medium

Nothing else in the Part A tooling files (test_check_*, test_gen_*, test_changelog_*,
test_sync_version_script, test_build_hook, test_frozen_dist,
test_release_kbagent_ai_kit_sync, test_generate_promotion_pipeline, test_migrate_cicd,
test_update_runner, test_version_service, test_doctor_service, test_helpers,
test_agent_tombstone, test_license_consistency, test_skill_frontmatter,
test_mcp_migration_recipe, conftest.py, helpers.py) met the bar for removal.

Minor overlap noted, with no action proposed:

• test_doctor_service.py::TestDoctorServiceRunChecks::test_run_checks_has_no_mcp_server_check
  duplicates the mcp_tool_tasks in names assert from
  test_agent_tombstone.py::TestDoctorTombstone::test_check_is_registered_in_run_checks. The
  mcp_server not in names half is a legitimate removal tombstone.
• test_doctor_service.py::TestDoctorServiceCheckVersion::test_version_check_passes is thin but
  cheap.

Part B candidates (cross-cutting, by pattern)

B1. Duplicate invocations (identical test bodies; found by AST hash)

Test id	Duplicate of	Action	Conf.
tests/test_cli.py::TestSharingEdgesIntegration::test_lineage_no_subcommand_shows_help (line 6075)	tests/test_cli.py::TestSharingEdges::test_lineage_no_subcommand_shows_help (line 6577). The bodies are byte-identical and the name is duplicated in the same file. Both are misfiled under Sharing classes.	Delete one and move the survivor to a lineage class	High
tests/test_cli.py::TestExitCodes::test_config_error_exit_code_5 (line 5186)	tests/test_cli.py::TestProjectRemove::test_project_remove_nonexistent_exit_code_5 (line 367): identical body (project remove of an unknown alias, then exit 5 and CONFIG_ERROR)	Delete the TestProjectRemove copy and keep the generic exit-code owner (or vice versa)	High
tests/test_normalize_script.py::TestSqlResplitListElements::test_well_formed_list_is_noop (line 388)	tests/test_normalize_script.py::TestNormalizeBlocksCodesScript::test_already_array_passthrough (line 206): identical body and assertions	Delete one	High

B2. Provider-local replay of a shared helper (retry/backoff/truncation live in BaseHttpClient)

Test id	Owner test	Action	Conf.
tests/test_client.py::TestRetryBehavior::test_retry_on_503_then_success, test_retry_exhausted_raises_error, test_retry_on_429	tests/test_http_base.py::TestBaseHttpClientRetry (same scenarios, and asserts request counts, which the client copies do not)	Delete the three test_client.py copies	Medium-High
tests/test_client.py::TestApiErrorMessageTruncation::test_api_error_message_truncation, test_short_error_message_not_truncated, test_exactly_500_chars_not_truncated, test_rich_markup_in_error_truncated	tests/test_http_base.py::TestBaseHttpClientErrorSanitization (4 matching tests, using the MAX_API_ERROR_LENGTH constant instead of a hard-coded 500)	Delete the test_client.py copies	Medium-High
tests/test_client.py:1515, inside test_short_error_message_not_truncated	Tautological assert: "..." not in msg or short_message in msg is always true once the preceding short_message in msg assert passed	Goes away with the deletion above	High

Keep tests/test_client.py::TestRetryAfterHeader. It is the only coverage of Retry-After
handling: test_http_base.py has none.

B3. Weak or vacuous assertion-free tests (AST scan: 47 hits, confirmed by reading)

Test id	Problem	Action	Conf.
tests/test_file_locking.py::TestTryFlock::test_flock_skipped_when_no_fcntl	Nothing can fail. With _HAS_FCNTL=False it returns immediately, and even if it called flock(42, 0) the OSError would be suppressed. The docstring promises "should not call fcntl", which is unchecked.	Patch fcntl with a mock and assert_not_called(), or delete	High
tests/test_file_locking.py::TestTryFlock::test_flock_is_called_on_posix	The name says flock "is called" but there is no call assertion (a real flock on a temp fd)	Merge into the TestFileLockingIntegration save/load tests, which do assert LOCK_EX/LOCK_SH/LOCK_UN; delete	Medium
tests/test_file_locking.py::TestFileLockingIntegration::test_concurrent_save_does_not_corrupt	The name promises concurrency, but the body runs two sequential add_project calls (the comment admits it)	Rename to what it tests, or delete (test_config_store.py covers add_project)	Medium
tests/test_base_service.py::TestDefaultClientFactory::test_default_client_factory_is_used_when_none	The name is false. The constructor default is make_client_factory(config_store) (services/base.py:270), not default_client_factory. The test only asserts callable(...), so any lambda passes.	Rewrite to assert the bearer-aware behaviour (e.g. a sentinel project yields no x-storageapi-token header, as test_auth_sentinel_guards.py::TestConstructorLevelWiring already does for other services), or delete as covered there	High

B4. Exact source greps and signature pins

Test id	Verdict
tests/test_cli.py::TestHelp::test_root_callback_registers_firewall_flags (line 5378)	Candidate (Medium). It pins Python parameter names (deny_writes, deny_destructive) on cli.main, so it breaks under an identifier-only rename even though the user contract is the --deny-writes flag. test_permissions_cli.py (13 invocations) and test_cli.py (16) already exercise --deny-writes end to end. Delete, or switch to the option-opts walker used in test_mcp_migration_recipe._options_of.
tests/test_billing_client.py::TestNoPostToBilling::* (inspect.getsource, signature, hasattr)	Retained. It guards against real-money auto top-ups (a security/financial contract), and the docstrings justify each layer.
tests/test_merge_request_client.py::TestOptionalFieldHelper::test_every_field_is_keyword_only	Retained. The keyword-only signature is the anti-transposition contract, and the docstring explains why a behavioural test is impossible.

B5. Constants restated

Test id	Verdict
tests/test_flow_service.py::test_component_id_constant (FLOW_COMPONENT_ID == "keboola.flow")	Delete (High). Fully covered by test_create_flow_uses_keboola_flow_component and test_update_flow_uses_keboola_flow_component, which assert the literal on the actual client call.
tests/test_auth_sentinel_guards.py::TestConfigStoreCompatRegression::test_current_config_version_unchanged	Retained: it is a config-schema/migration tripwire tied to the documented "config.json schema unchanged" promise.

B6. Skips and xfails

• There are no xfail markers anywhere outside e2e.
• The permanent skips are listed in A11. All other skips are platform-conditional (Windows/POSIX)
  or optional-extra importorskips, which is legitimate.

Test-only production seams

Found with seams.py (src defs whose only production reference is their own definition), then
confirmed by rg over src/, scripts/ and web/backend/.

#	Seam	Test callers	Evidence	Recommended action	Conf.
S1	src/keboola_agent_cli/auto_update.py:264 _should_skip() ("backwards-compatible alias ... Pre-v0.30.1 callers (and our own tests)")	tests/test_auto_update.py::TestShouldSkip (11 tests)	Zero production callers. maybe_auto_update consults _should_skip_all and _should_skip_kbagent_stage separately.	Retarget the tests (A9) and delete the alias	High
S2	services/snapshot_service.py:46 default_snapshot_client_factory, services/org_service.py:32 default_storage_client_factory, services/token_service.py:51 default_token_client_factory	tests/test_auth_sentinel_guards.py::TestConstructorLevelWiring::test_named_default_factories_still_fail_fast_when_injected_explicitly only	No production callers: the services default to make_client_factory. The docstring says the functions are "kept ... for callers/tests that inject it explicitly", but no such caller exists. They are not in the SDK __all__.	Delete the three wrappers and the one test. The guard itself is still covered by the services.base.default_client_factory tests.	High
S3	src/keboola_agent_cli/json_utils.py:37 get_nested_value	tests/test_json_utils.py	No production caller (added in #156, and the --set path no longer uses it)	Delete the function and its tests	Medium-High
S4	src/keboola_agent_cli/auth/state_store.py:306 StateStore.clear_orphans	tests/test_auth_state_store.py	No production caller	Delete with its test, unless a planned auth logout path needs it	Medium
S5	src/keboola_agent_cli/services/deep_lineage_service.py:498 DeepLineageService.build_and_cache	tests/test_deep_lineage_service.py	No production caller (lineage build does its own build and save)	Verify the lineage build command path, then delete	Medium
S6	auth/state_store.py:70 StateStore.lock_path; auth/state_store.py:239 StateStore.get_refresh_lease	tests/test_token_provider.py, tests/test_auth_state_store.py	Read-only accessors used only to observe state in tests	Low value either way. Keep: they are cheap observability accessors, and removing them forces tests to read private attrs.	Low
S7	client/storage_tables.py:60 KeboolaClient.list_bucket_metadata	tests/test_client.py, tests/test_e2e.py	No production caller; used as an e2e verification probe	Keep (it is e2e verification tooling, and KeboolaClient is reachable via SDK .raw)	Low
(info)	src/keboola_agent_cli/auth/token_provider.py:534 ("Test-only seam; also used by auth logout")	--	Has a production caller	Fine	--

Retained false positives

1. Assertion-free test_client.py / test_storage_*.py httpx tests (e.g.
   test_client.py::TestDeleteDevBranch::test_delete_dev_branch_success,
   test_storage_truncate.py::test_branch_prefix_in_url,
   test_storage_clone.py::test_dotted_table_id_passed_verbatim_in_path). pytest-httpx
   (>=0.30, default strict, not overridden in pyproject.toml/conftest.py) fails on an
   unmatched URL and on an unrequested response. The exact-URL registration is the assertion.
2. test_serve_banner_encoding.py::test_result_is_always_encodable_on_legacy_consoles /
   test_live_banners_survive_legacy_consoles. The .encode(encoding) call is the assertion (a
   UnicodeEncodeError would crash serve on Windows consoles).
3. "Accepts/passes, must not raise" tests, e.g.
   test_generate_promotion_pipeline.py::test_accepts_*,
   test_config_set_guard.py::test_none_is_a_noop, test_permissions.py::test_valid_modes,
   test_helpers.py::test_validate_branch_requires_project_passes_*. They are the positive halves
   of validator contracts whose negatives are tested alongside.
4. test_billing_client.py source scan and signature pin. A real-money safety contract;
   cheapest independent guard.
5. test_choice_enums.py::test_*_enum_matches_constant. Genuine drift guards between two live
   sources of truth. VALID_JOB_MODES, VALID_POLL_STRATEGIES and PROJECT_ROLES are used by
   the services, queue client and help text, independently of the Typer enums.
   test_invalid_choice_exits_2_without_traceback is a real regression test.
6. test_license_consistency.py, test_skill_frontmatter.py, test_mcp_migration_recipe.py.
   They grep shipped files (LICENSE/packaging, the SKILL.md 1024-char load limit, the gotchas.md
   recipe). These are packaging/prompt-byte contracts; each survives identifier refactors and was
   motivated by a shipped incident (feat: add Apache 2.0 LICENSE file #544, Loading the kbagent skill into Claude Desktop fails with error #447, docs(mcp): no migration command -- record the decision and the recipe (#390) #581).
7. test_gen_endpoint_reference.py::test_committed_doc_is_up_to_date and test_deterministic.
   They partially duplicate the make endpoints-check CI step, but they are the pytest-side guard
   against a flapping generator. Cheap; keep.
8. test_auth_sentinel_guards.py::test_current_config_version_unchanged. A migration/schema
   tripwire.

Notes

• Estimated removal if all High/Medium-High items are applied.
  • Tests: about 45 test functions (A1-A6, A8 rewrite, A9 retarget, A10, B1-B5).
  • Production code: about 60-80 lines (_should_skip, 3 factory wrappers, get_nested_value,
    possibly clear_orphans and build_and_cache).
• Suggested batches (one coherent PR each):
  1. errors/models/output/config_resolution junk (A1-A6, A12). Add @enum.unique on
     ErrorCode as the one production change.
  2. Auto-update: retarget TestShouldSkip, strengthen the sentinel test, delete _should_skip
     (A8, A9, S1).
  3. test_client replays and test_cli duplicates (B1, B2, B4 firewall-signature test).
  4. Dead factory wrappers and helpers (S2-S5).
  5. CI routing: remove the integration marker from the error-code guard classes (A10). Decide on
     the KBA_TEST_* tests (A11).
• Stale project memory. "check-error-codes is local-only" is no longer true: ci.yml:217 runs
  scripts/check_error_codes.py.
• Validation for each batch: uv run pytest <touched files> -n auto, then make check.
  make check requires uv sync --extra server in a fresh worktree. After removing _should_skip,
  also run rg "_should_skip\b" src tests to confirm no remaining references.
• Not examined in depth:
  • the bodies of test_version_service.py, test_update_runner.py and test_auto_update.py
    beyond the classes cited above (they are large, and spot checks found behaviour-level mocks
    of real outcomes);
  • Part B heuristics were mechanical (AST and regex), so exotic junk such as mocks implementing
    the asserted behaviour may remain in other lanes' files.