[cmgrote]

Fixes FND-4539 and FND-4700 (#4757 squashed in). Stacked on #4731 (base christophergrote/fnd-4244). Retarget to main once #4731 merges. Do not merge: 20 apps would be blocked from publishing (see below).

What changes

certify.py contract-drift is an enforced publish gate. It had two holes, and both are closed in contract_drift(). verdict is untouched; FND-4538 (#4738) edits it and is merged into this branch.

1. No poe → fail, not pass (FND-4539). When contract/app.pkl existed but uv run poe was unavailable, the gate logged ::warning:: and passed. Now it fails with ::error::. The message names the fix:

• Add poethepoet to an extra in [project.optional-dependencies]. Certify installs with uv sync --all-extras --frozen, so a [dependency-groups] entry is not installed.
• Define a [tool.poe.tasks] generate task (canonical shape: atlan-mysql-app).
• Re-lock.

2. Whole-tree stale check (FND-4700). The stale check was git diff --exit-code -- generated/ from the app root, which missed two things:

• The pathspec matched only a top-level generated/, not app/generated/ or root files like atlan.yaml.
• git diff ignores untracked output.

After poe generate, the gate now fails when git status --porcelain --untracked-files=all is non-empty. The ::error:: lists the paths (capped at 50), never their contents. Gitignored files don't count.

Apps without contract/app.pkl still skip. docs/standards/app-certification.md covers both rules.

Verification

• pytest on test_build_and_publish_certify.py, test_build_and_publish_certify_wiring.py and test_certify_unit_shards.py: 78 passed. These include the merged-in fix(ci): fail the certify gate closed when an app's dependencies do not install #4738.
• Red/green, no-poe: against the pre-fix(ci): contract-drift gate fails closed without poe and checks the whole working tree [FND-4539, FND-4700] #4736 certify.py, the 2 new assertions fail.
• Red/green, whole tree: the new tests run real git in a temp repo and fake only uv run. Against the pre-FND-4700 certify.py, 6 fail, including a stale tracked app/generated/ file, an untracked new file, and a root atlan.yaml change. On the fix, all pass.

Blast radius

No poe: 6 apps (checked 2026-11-04 on each default branch)

App	Status
atlan-memory-app	✅ merged: atlanhq/atlan-memory-app#43
atlan-model-caster-app	✅ merged: atlanhq/atlan-model-caster-app#650
atlan-sdr-conformance-app	✅ merged: atlanhq/atlan-sdr-conformance-app#31
atlan-csa-uber-import-app	➖ no action: unfilled template, never published
custom-agent-marketplace	🟡 atlanhq/custom-agent-marketplace#93 (open, needs owner review)
atlan-wdcustom-app	➖ dropped (decision): abandoned, no commits since 2026-07-02 and never published; #8 closed

Whole tree: 106 caller apps with contract/app.pkl (measured 2026-11-04)

Each app was run locally through certify's steps (uv sync --all-extras --frozen → poe generate → whole-tree status), with uv user config disabled to match CI. The old check passes all of them.

Result	Apps	Plan
✅ Clean	81	—
➖ Not affected	5: three are the no-poe apps above; two can't sync locally, and their only diff was a local-config uv.lock	—
🟡 Formatting-only drift	13: generated .py differs only by import order or line wrapping, because the toolkit's output isn't ruff-stable and app pre-commit reformats the committed copy	Fix at the source: FND-4703 makes the contract toolkit emit ruff-stable Python, then the apps bump
🔴 Real drift	3 active apps: governance (atlan.yaml), notification (manifest.json), powerbi (app/contracts/*)	🟡 Open, owner review: atlanhq/atlan-governance-app#257, atlanhq/atlan-notification-app#27, atlanhq/atlan-powerbi-app#389. Each is behaviour-neutral (byte- or parse-identical output); poe generate leaves the tree clean
➖ Dropped (decision)	4: notification-tester-internal-only, cube-assets-builder, conversational-ai, se-apps. Abandoned template copies: last commit 2026-07-02 and no publish runs	None. The gate can't block a publish that never happens

The per-app list is on FND-4700.

Merge order

1. FND-4703 toolkit release, then the 13 app bumps.
2. ✅ The 3 real-drift app PRs (all merged).
3. custom-agent-marketplace#93 (the last no-poe app).
4. Then this PR. Merging earlier blocks publishing for the apps still open.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AbKqGboFK2UACRjz2eg4FV

[linear]

FND-4539

FND-4700