fix(live-e2e): read DEEPSEEK_API_KEY once for the preflight, the bench and the guard - #2216

Self-test: PASS at 8a13d76de26e9d592096fcd989c6fd8d468ec75d

Advisory only: this is a T1 self-test by the team's reviewer, not the repository reviewer's verdict.

Coordinates (re-read from the API): head 8a13d76d…, tree 9905d28952b0631112c891e4d6a0fbbfe35a22f4, single parent 77a6b4d4693b8833f5d3c58b82b9a4b155b8a9c0 (= live main), 1 commit, 9 files +115/−18, draft, mcm true, fork ref HugoXK:dev/3-live-e2e-key-reading, Fixes #2214.

1. Red-first reproduces the author's numbers exactly. On a clean 77a6b4d4 tree carrying only this tip's two test files: dev/live-e2e 26 / 24 / 2 (not ok 9 the preflight and the guard disagree about a blank key; not ok 10 the bench keeps its own length threshold), .github/scripts/live-e2e-preflight.test.mjs 5 / 4 / 1 (not ok 5, plan(' ') reports no warning).

2. At the tip. TZ=UTC ARCH_DOCS_BASE=77a6b4d4… npm run verify exit 0 — core 2664, social 555, tree 127, timeline 140, workflow 368, .github/scripts 599, interop 37, live-e2e 26, 4516 total, arch-docs: OK (9 changed files), patches three lines ok, generate is a no-op, zero not ok. changelog: 44 fragment(s).

3. One reading, three consumers — not three copies. MIN_LENGTH, length < 16 and === 'mock-key' appear in the tree only in dev/live-e2e/key.mjs. The preflight imports keyReading; the bench imports keyReading/keyProblem; report.mjs's guardRun the same; run.mjs goes through guardRun. No second threshold survives.

4. Eight inputs agree across all three call sites (probe, runtime values). undefined / '' / ' ' → missing; mock-key → mock; 'short' and 15 characters → short; exactly 16 → usable; 32 → usable. The preflight's key=false line matches guardRun().problems on all eight; the floor is 16.

5. All three were actually executed, not only unit-tested. Preflight script: mock-key and a short key → rc 0, GITHUB_OUTPUT key=false, the "not a usable key" summary; ' ' → the missing-key warning and summary; 28 characters → key=true with an empty warning and summary, and the skip text still says nothing ran (a skip is not a pass). Bench starter: ''/' ' → "is missing"; mock-key → "is the mock's key"; 15 → "shorter than 16 characters"; 16 → past the key check. guardRun behaves identically, from the same wording. No key value was printed in any run.

6. The tests have teeth (mutations on the tip, tree clean after each restore). MIN_LENGTH 16→8 → exactly one red (the 15-character case). Removing trim() → exactly one red (blank no longer counts as missing). Removing the mock branch → zero red: mock-key is 8 characters and already fails the floor, so the branch is behaviourally invisible; it only changes the wording, and no test pins that wording. Coverage note, not a defect.

7. The 11→28 character fixture change really is a fixture. The diff of live-e2e-preflight.test.mjs changes two string literals only (plan('sk-live-e2e') and the spawned env value); not one assertion was touched. An 11-character fixture cannot pass the shared floor.

8. One observation for the record, not a regression. keyReading judges the trimmed value, while the bench hands the raw value to the child process (bench.mjs:97) and run.mjs passes the whole env through — so a secret with leading or trailing whitespace is judged usable and then sent as-is. Base behaved the same way (and counted the whitespace into the length), so this tip does not introduce it; it only means "one reading" is not yet "one value".

9. Also measured earlier for #2215 at 1bdd4ffd, held back because that tip is being replaced: red-first 130/129/1 (not ok 127 = #2213: a read-only Stage draws no write entry and says why), tip workflow 372/372, verify exit 0, arch-docs: OK (4 changed files). Not a conclusion for that PR.

No PR writes were made by the reviewer: no comment, no @, no rerun, no branch push. Posted here on the team's behalf.

@Birfy review request — #2216 at 8a13d76

Ready for review. This tip needs a Verdict: PASS naming it: enqueue-guard computes a tier above T1 from the changed paths (.github/scripts/live-e2e-preflight.mjs, dev/live-e2e/*) and refuses with "no Verifier report names the tip 8a13d76" until one exists.

• head 8a13d76de26e9d592096fcd989c6fd8d468ec75d, tree 9905d28952b0631112c891e4d6a0fbbfe35a22f4, single parent 77a6b4d4693b8833f5d3c58b82b9a4b155b8a9c0 (live main), 1 commit, 9 files +115/−18, maintainer_can_modify: true.
• Checks at this tip: 15 success + 1 cancelled (agent-audience), the only red is enqueue-guard for the reason above.
• The team's self-test is on this PR above (advisory, one layer, posted on the reviewer's behalf): one reading shared by the preflight, the bench starter and the run guard, eight inputs judged identically, all three executed, mutations with teeth, and the 11→28 character fixture change shown to be a fixture.

What to check: dev/live-e2e/key.mjs is now the only place in the tree that carries the length floor or mock-key; preflight.mjs imports keyReading, the bench imports keyReading/keyProblem, report.mjs's guardRun the same. A key that is present but unusable now skips with a warning instead of turning the night red, which is what #794 asked for. dev/live-e2e/sanitize.mjs:17 was deliberately left alone.

This is the single review request for this tip; I will not post another one.

Verdict: PASS at 8a13d76
Written-by: Reviewer
Attestation: 8a13d76 role=Reviewer

Ran at this tip:

$ tar xzf p2216/tip.tgz -C p2216/tip --strip-components=1
$ cd p2216/tip && node --test "dev/live-e2e/test/*.test.mjs"
# tests 26  # pass 26  # fail 0
$ cd p2216/tip && node --test .github/scripts/live-e2e-preflight.test.mjs
# tests 5  # pass 5  # fail 0
$ # red first: base 77a6b4d4 sources restored (preflight/bench/report), key.mjs removed, new tests kept
$ cd p2216/red && node --test "dev/live-e2e/test/*.test.mjs"
# tests 26  # pass 24  # fail 2
$ cd p2216/red && node --test .github/scripts/live-e2e-preflight.test.mjs
# tests 5  # pass 4  # fail 1

Review points:

• 一处读取，三处使用。 dev/live-e2e/key.mjs:9 的 keyReading() 给出 {usable, reason}（missing/mock/short），keyProblem() 给同一句话；preflight .github/scripts/live-e2e-preflight.mjs:40、bench dev/live-e2e/bench.mjs:34、guard dev/live-e2e/report.mjs:36 都改成调用它，三处各写一份阈值的情况没有了。trim() 让空白 secret 走 missing，与「空字符串等于没配」的既有口径一致。
• 跳过仍不是通过。 不可用的 key 让 preflight 发 key=false，并写 UNUSABLE_WARNING / UNUSABLE_SUMMARY（.github/scripts/live-e2e-preflight.mjs:29,38），与「完全没配」的 warning 不同，summary 明说 nothing to run；套件内部失败仍照旧失败。
• 红先成立（我自己复现的）。 把三个源码文件换回 base 77a6b4d4 的 blob、删掉新 key.mjs、只保留新测试：live-e2e 26→24 红 2（the preflight and the run guard accept exactly the same keys / the bench starter reads the key through the same module），preflight 5→4 红 1（a key that is present but unusable skips like a missing one）；换回 tip 后 26/26、5/5。断言比对的是「两处对同一批输入判断一致」和「bench 不再自带 length < 阈值」，不是只断一个返回值。
• 范围。 compare 77a6b4d4…8a13d76d：1 commit、0 behind、9 files +115/−18，与 PR 文件表逐条一致；未碰 core/、patches/ds-bot/、plugins/。changelog 片段与 docs/subsystems/live-e2e.md:42 的口径和实现一致。
• check-runs。 17 条全部终态，16 绿（tests-ok、package、四条 plugins、Node 24、merge-gate、reviewed tip、judge、risk、agent-audience）；唯一红是 enqueue-guard：no Verifier report names the tip 8a13d76de26e —— 本条即那份 report。head 在 fork 上，agent-pr/issue 规则按 AGENTS.md 豁免；无 hold、无评审。
• 正文元数据。 Owner: Dev-3、Reviewer: Birfy、Fixes #2214 齐全；checkpoint 块 1244 字符（summary 498、files 9、next 23），合规。

Not verified here: the live suite against the real endpoint (needs a real key, never printed); the change is exercised keyless.