build: tests is a string, because a boolean input arrives as false here

format('{0}', inputs.tests) still evaluated to 'false' on a caller that passed a
literal true (hanzoai/openapi run 26662, resolved against this branch — 23 steps,
the step count only this branch has, so it is not a stale reusable). That rules
out the default and the caller both: git.hanzo.ai substitutes a workflow_call
input's declared TYPE ZERO VALUE, and for boolean that is false, always.

So no expression over a boolean input can ever be true on this forge, and the
previous commit's format() normalisation could not have worked. A string's zero
value is '', which is not 'false' — the tests run when the value is absent, run
when it is 'true', and skip only when a caller says the word.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

.github/workflows/build.yml

@@ -49,8 +49,18 @@ on:
           tag build would re-test a commit already proven, at the cost of a
           3108-package link storm. Passing false there runs the gate once instead
           of twice; passing it anywhere else runs it zero times.
-        type: boolean
-        default: true
+        # `string`, NOT `boolean`, and that is the fix. git.hanzo.ai's runner
+        # substitutes a workflow_call input's declared TYPE ZERO VALUE, so a
+        # boolean arrives as `false` whatever the caller passed — measured:
+        # hanzoai/openapi passed a literal `true` and the run still evaluated
+        # `format('{0}', inputs.tests)` to 'false' and skipped the step. NO
+        # expression over a boolean input can be true on that forge. A string's
+        # zero value is '', which is not 'false', so the test step below runs;
+        # github.com fills in 'true' and it runs there too. Only a caller that
+        # says the word false gets the skip, which is the one behaviour that
+        # ever needed to be expressible.
+        type: string
+        default: 'true'
       submodules:
         description: >-
           Passed straight to actions/checkout. Default '' is checkout's own
@@ -336,11 +346,23 @@ jobs:
             fi
             echo "::warning::KMS login failed (org=$ORG client=$KMS_CLIENT_ID) — cross-org private deps & deploy unavailable"; exit 0
           fi
-          # Embedded KMS (HIP-0106): org from the token, flat {"value"}. The old
-          # /v1/kms/orgs/<org>/... + .secret.value pair 404s and `curl -sf` turns
-          # that into "" — which every caller reads as "not in KMS". The standalone
-          # host also holds a STALE key cloud 403s, so reading it ships a dead one.
-          # Embedded first, standalone as fallback.
+          # KMS is embedded in hanzoai/cloud now (HIP-0106, cloud/apps/kms), and its
+          # contract differs from the standalone service in two ways that BOTH fail
+          # silently — you get an empty string, which every caller below already
+          # treats as "not in KMS":
+          #
+          #   url   /v1/kms/secrets/<path>/<name>  — the org comes from the TOKEN,
+          #         not the url. The old /v1/kms/orgs/<org>/... form 404s, and -sf
+          #         turns that into empty output.
+          #   body  {"name","env","value"} — flat. `.secret.value` selects nothing.
+          #
+          # Reading the OLD host is worse than reading nothing: the two instances
+          # hold DIFFERENT values under the same name, and the standalone copy of
+          # deploy/EVENT_INGEST_KEY is stale — cloud rejects it at ingest with 403,
+          # so a build that "found" a key still ships one that cannot write.
+          #
+          # Try the embedded shape first and fall back to the standalone one, so a
+          # repo still pointed at the old host keeps working while the fleet moves.
           get() {
             v=$(curl -sf "$KMS_ENDPOINT/v1/kms/secrets/$PATHQ/$1?env=$ENV" -H "Authorization: Bearer $TOKEN" | jq -r '.value // empty')
             if [ -z "$v" ]; then
@@ -982,7 +1004,26 @@ jobs:
         # it ran nothing AND nothing shows as having run. A gate that is not a test
         # gate — vet, lint, a build, a codegen-freshness check — says neither and is
         # untouched. To silence it legitimately, make the gate run a test.
-        if: inputs.mode != 'delegate' && inputs.tests
+        #
+        # AN INPUT THIS FORGE DOES NOT DELIVER MUST NOT READ AS "RUN NOTHING".
+        # `tests` is declared `type: boolean, default: true`, and on github.com it
+        # arrives that way. On git.hanzo.ai it does not arrive at all, so bare
+        # `inputs.tests` is falsy and this step is skipped — in a job that then
+        # reports SUCCESS. Measured on the forge, five of five repos with a cicd
+        # run: hanzoai/cloud (passes `tests:` outright), hanzoai/ci (its own bare
+        # 7-line caller), hanzoai/openapi (passed a literal `true`), gateway and
+        # commerce. All green, all with this step skipped, none having run one
+        # test. The step above exists to refuse a gate that runs no tests; it
+        # cannot, because it is the step not running.
+        #
+        # An absent value is a caller who said NOTHING, and a caller who says
+        # nothing is asking for the default — which is true. Only an explicit
+        # `false` means skip, so compare the FORMATTED value to it: absent, true,
+        # or anything this forge mangles all run; `false` still skips, which is
+        # the one shape that legitimately uses it (hanzoai/cloud's tag build,
+        # already gated on main). The failure direction becomes "tested when it
+        # need not have" instead of "shipped untested".
+        if: inputs.mode != 'delegate' && inputs.tests != 'false'
         run: |
           set -euo pipefail
           NOTHING='\[no test files\]|\[no tests to run\]|no tests ran|collected 0 items|No tests found|no test specified|running 0 tests|Tests:[[:space:]]+0 total|(^|[^0-9])0 (passing|passed)'

.hanzo/workflows/build.yml

@@ -49,8 +49,18 @@ on:
           tag build would re-test a commit already proven, at the cost of a
           3108-package link storm. Passing false there runs the gate once instead
           of twice; passing it anywhere else runs it zero times.
-        type: boolean
-        default: true
+        # `string`, NOT `boolean`, and that is the fix. git.hanzo.ai's runner
+        # substitutes a workflow_call input's declared TYPE ZERO VALUE, so a
+        # boolean arrives as `false` whatever the caller passed — measured:
+        # hanzoai/openapi passed a literal `true` and the run still evaluated
+        # `format('{0}', inputs.tests)` to 'false' and skipped the step. NO
+        # expression over a boolean input can be true on that forge. A string's
+        # zero value is '', which is not 'false', so the test step below runs;
+        # github.com fills in 'true' and it runs there too. Only a caller that
+        # says the word false gets the skip, which is the one behaviour that
+        # ever needed to be expressible.
+        type: string
+        default: 'true'
       submodules:
         description: >-
           Passed straight to actions/checkout. Default '' is checkout's own
@@ -994,7 +1004,26 @@ jobs:
         # it ran nothing AND nothing shows as having run. A gate that is not a test
         # gate — vet, lint, a build, a codegen-freshness check — says neither and is
         # untouched. To silence it legitimately, make the gate run a test.
-        if: inputs.mode != 'delegate' && inputs.tests
+        #
+        # AN INPUT THIS FORGE DOES NOT DELIVER MUST NOT READ AS "RUN NOTHING".
+        # `tests` is declared `type: boolean, default: true`, and on github.com it
+        # arrives that way. On git.hanzo.ai it does not arrive at all, so bare
+        # `inputs.tests` is falsy and this step is skipped — in a job that then
+        # reports SUCCESS. Measured on the forge, five of five repos with a cicd
+        # run: hanzoai/cloud (passes `tests:` outright), hanzoai/ci (its own bare
+        # 7-line caller), hanzoai/openapi (passed a literal `true`), gateway and
+        # commerce. All green, all with this step skipped, none having run one
+        # test. The step above exists to refuse a gate that runs no tests; it
+        # cannot, because it is the step not running.
+        #
+        # An absent value is a caller who said NOTHING, and a caller who says
+        # nothing is asking for the default — which is true. Only an explicit
+        # `false` means skip, so compare the FORMATTED value to it: absent, true,
+        # or anything this forge mangles all run; `false` still skips, which is
+        # the one shape that legitimately uses it (hanzoai/cloud's tag build,
+        # already gated on main). The failure direction becomes "tested when it
+        # need not have" instead of "shipped untested".
+        if: inputs.mode != 'delegate' && inputs.tests != 'false'
         run: |
           set -euo pipefail
           NOTHING='\[no test files\]|\[no tests to run\]|no tests ran|collected 0 items|No tests found|no test specified|running 0 tests|Tests:[[:space:]]+0 total|(^|[^0-9])0 (passing|passed)'