docs: add the platform repo to the testing comparison (F10, F11)

[jcschaff]

Summary

platform was missing from docs/plan-testing.md and is the most useful comparison in it: the sibling service, same problem, different choices. Figures from main@75dc795 (2026-09-04); PR biosimulations/platform#107 adds practices main lacks, recorded separately.

Two findings that only appear by comparing

F10 — the two repos fail at gating in opposite directions, and both are wrong.

	compose-api	platform
Gate	SLURM_SUBMIT_KEY_PATH absent in CI	none enforced
Effect	16 of 25 tests never run	3 tests hit third-party services on every PR, in a required check

One of those three carries no marker and no skipif, so it survives even the documented -m "not integration". lefthook.yml runs no tests at all, so the drift is never discovered locally. Shared cause: in neither repo does the marker decide where the test runs — which is the argument for F.c. Worth noting platform's own smoke.yaml header states the right policy ("minutes and flaky external state"), which its backend suite then does not follow.

F11 — config shadowing silently disables settings in three repos. pytest takes the first pytest.ini and never merges [tool.pytest.ini_options]. platform, sms-api and biosim-client have both. platform's dead block contains python_files = "main.py" — if that pytest.ini were ever removed as redundant, collection would drop to zero tests with a green suite. This repo has only the pyproject block and is unaffected.

Existing findings refined, not duplicated

• F2 gains platform as the other end of the same failure: no codecov.yaml at all, no pytest-cov in the lockfile, nothing measured — and two documents advertising a --cov command that cannot run. Four repos carry an unenforced 90% target; the fifth carries none. Neither end produces a number anyone acts on.
• F3 gains platform as proof branch protection is achievable here: two required contexts, strict: true, zero required approvals. Notably smoke, its only cross-service test, is not required — the check that would catch a broken integration cannot block.

New in Part 1

• 1.5 how platform tests: 205 backend tests, the same DI singleton-swap pattern executed slightly better (its DB fixtures pair the restore with data cleanup and a comment naming the bug it prevents), real Mongo/Keycloak/Temporal rather than mocks, zero frontend tests.
• 1.6 what Update dependency pytest to v9 [SECURITY] #107 adds that main lacks: a 4×6 failure matrix over MockTransport, zero-upstream-request assertions, leak assertions, OpenAPI contract tests in pytest. main uses no MockTransport anywhere, which is why F10's live calls get through.

Practice sections

Copying: platform's real-identity RBAC tests (a mocked layer and a real-Keycloak layer over the same endpoints, each labelled in its docstring), its smoke.yaml, fixture teardown that names the bug it prevents, negative-authz assertions inside the happy path.

Avoiding: its release path publishing three images with no test dependency — which our own build-containers.yml shares — and documenting a command that cannot run.

Housekeeping

Old F10 renumbered F12; all twelve findings are referenced by at least one action. make check clean; mkdocs build -s passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_018TgVbCXXWAWhNjtKTzrxvN