docs(tasks): archive #34 (ops, subsumed by paved road) + #35 (hermetic test suite + CI)

armada/tasks/completed-archive.md

@@ -313,3 +313,40 @@ memory `project_douanier_api`. Named after Le Douanier Rousseau (the customs gat
   small transient uptime dip that self-heals. The admin/api realm split makes /admin trivially
   safe (an api:* token is auto-403'd).
 - **Deps:** built on #43 (admin realm) + #45 capture; Grafana visual layer scheduled as #46.
+
+## #34 — Ops: systemd units, observability, SRE deploy runbook
+- **Description:** the ops half of the audio-API rollout — keep-alive units, observability,
+  a deploy runbook for SRE.
+- **Done:** closed as SUBSUMED by the platform's paved road (which appeared in a parallel SRE
+  session between sessions). Observability shipped earlier (nechapi f89d7f9 — per-call capture,
+  /admin analytics, public uptime status page); the systemd-restart + deploy-runbook half is now
+  the golden base image (nechapi/py) + `nechapi ship` CLI + the onboarding runbook in the SRE
+  repo, not bespoke units here. Reconciliation documented in armada/api/SRE.md (Tidal d228966).
+- **Learnings:** the platform repo had DIVERGED — my 3 unpushed control-plane commits
+  (observability, scope convention, audio-LIVE) vs origin's 10-ahead paved-road refactor (golden
+  base, ship CLI, edge-cache tiers, geo/v1 + iris/v1 onboarded). Resolved by rebasing mine onto
+  origin/main: only docs + the registry + the generated vhost conflicted; the core observability
+  code (_platform/app.py, scopes.py, schema.sql) was untouched upstream and replayed clean. The
+  generated vhost (api.nech.pl.conf) is re-rendered, never hand-merged. PARKED RISK flagged: geo
+  is live with old-style scopes (geo:read) but my central enforcement derives api:geo:* — so if
+  _platform is redeployed WITH central enforcement, geo tokens 403 until re-minted; enforcement
+  stays parked (audio self-enforces) and that reconcile is SRE's.
+- **Deps:** part of the EPIC #21 thread; observability lineage = #45.
+
+## #35 — Test suite + CI for the API
+- **Description:** a real test suite for the audio API plus a CI pipeline.
+- **Done:** the 67-test suite already existed and was green, but only under a
+  --system-site-packages venv (quietly host-dependent). Made it hermetic:
+  requirements-test.txt pins the true test surface (fastapi/uvicorn/multipart + numpy + soundfile
+  + librosa + pyloudnorm + httpx + pytest), NOT system-site-packages; .gitea/workflows/api-ci.yml
+  runs it on git.plnech.fr for any push/PR touching armada/api/**. Tidal 213eb8a. Clean-venv
+  rehearsal: 67 passed.
+- **Learnings:** a system python bump to 3.14 had dropped fastapi/httpx from the old venv → the
+  whole suite reported "no tests collected" (red for an ENV reason, not a code reason) — exactly
+  what a site-packages-inheriting CI would hide. Rehearsing in a clean throwaway venv surfaced
+  TWO deps the system venv had silently supplied: librosa (lazy-imported inside engine functions,
+  not at module load — so a grep for eager imports missed it) and pyloudnorm (the LUFS engine).
+  The heavy ML stack (torch/laion_clap/demucs) is NOT needed by the tests, so CI installs fast.
+  CI is dormant until an act_runner is registered for the repo; the workflow is correct + locally
+  rehearsed.
+- **Deps:** part of EPIC #21; was a blocker on #21.