Skip-gated evidence is invisible to the gate and to reviewers

[tylerwillis]

A skipif-gated test currently counts as full coverage and can hold a passing verdict indefinitely. The tool has no skip handling at all (verified by grep across src/), so a requirement whose only evidence never executes on the runner is indistinguishable from one that is genuinely proven.

Why this is the dangerous case, not a cosmetic one

This is the undelivered fix / inert in production class, and the gate is what people trust instead of looking.

Concrete instance in panopticon, REQ-052 (base-image source invalidation — a requirement that exists specifically to stop merged code from never reaching production containers):

• The only test proving revised source actually reaches a built image is skipif-gated on a live Docker daemon.
• A reviewer mutation confirmed the exposure: changing the installer's default PANOPTICON_SOURCE_ROOT to a path production never stages was caught by that test alone. Both non-gated tests inject the path themselves, so they cannot see the contract break.
• Separately, an accumulator-reset mutation (digest = sha256() inside the loop) was caught only by the same Docker-gated test.

So the requirement guarding against undelivered fixes is itself one skipped test away from being unverified — and the gate reports it as fully covered.

A second, quieter instance from the same verdict: two non-gated tests in that file "fail on BSD/macOS userland… only pass on GNU coreutils." That caveat currently lives in a verdict summary string, tracked nowhere.

A subtle related bug

Evidence blocks start at the annotation line. A @pytest.mark.skipif decorator placed above the annotation therefore lands in the previous block's hash — so the marker that determines whether the test runs is not part of the evidence for the requirement it gates.

Proposed

1. Static detection of skip/conditional markers inside evidence blocks — skipif, .skip, xfail, runIf, and per-language equivalents.
2. Warn when every enforced-requirement evidence block is skip-gated. Not an error — a legitimately environment-dependent requirement exists — but it must be visible.
3. Unconditional disclosure in the review packet, so the reviewer has to address executability rather than discovering it by accident. Include the decorator lines even when they sit outside the block.

Frame this as heuristic lint plus forced disclosure, not proof. Whether a runtime condition holds on a given runner is undecidable statically, and overclaiming here would itself be evidence-that-cannot-fail.

Priority

Quality, top tier. Cost is near zero (static scan). Sibling of the degenerate-evidence lint in #27, not a duplicate.