test(tools): all-tools integration round-trip canary (follow-up to #157)

[cipher813]

Summary

Adds tests/test_tools_integration.py — every-MCP-tool round-trip canary that catches the failure class of the 2026-05-22 memory_check_contradictions incident on Fly. This was intended to ship inside PR #157 (per Brian's "add 1 to pr157" directive) but #157 squash-merged before I could push the additional commit, so it lands here as a follow-up.

Brian's question that drove this: "given the difficulty of checking each individual mnemon tool available, are we properly using unit tests to confirm that everything works as expected without having to manually run each tool?"

Honest answer pre-PR: no. Unit tests in test_server.py mock every external dep (LLM, NLI, embedder, vecstore), which is right for asserting per-tool behavior in isolation but leaves a gap: a tool's real call path can raise an uncaught exception (or hang) that no mocked test exercises — the exact failure class that produced the opaque Error occurred during tool execution envelope from memory_check_contradictions.

What ships

Three test classes covering the gap:

1. test_every_tool_invokes_cleanly — iterates mcp._tool_manager._tools, calls each tool with minimal-valid inputs against a seeded vault, asserts no unhandled exception + return shape matches MCP contract (str / dict / list). Coverage-check assertions force every newly-registered tool to have a fixture input AND every removed tool to have its fixture cleaned up (registered-vs-fixture diff).

2. test_no_tool_returns_opaque_error_string — outputs must not contain Error occurred during tool execution or Internal server error verbatim. Opaque envelopes come from the MCP transport wrapping an escaped Python exception — never acceptable as a tool's own output.

3. test_destructive_tools_respect_dry_run — locks the dry_run contract on memory_check_contradictions + memory_sweep. Mutating inputs stubbed to "would-decay" labels via mocked NLI; pre-state == post-state.

Heavy paths (NLI classify, FastEmbed re-embed) are stubbed so the suite stays under ~17s. Real-model paths validated separately by scripts/calibrate_capture_threshold.py and the operator Layer-3 web test ritual (which gets --exercise-all-tools mode in PR #159, per Brian's follow-up plan).

Composability

• Catches the failure class that bit memory_check_contradictions on 2026-05-22 (the LLM-required path would have raised through the broad try/except, and "no unhandled exception" would have fired on PR feat(salience): Phase 1 — first-class standing tier (default-off, soak-gated) #154 when the salience-tier tools were added — forcing the fix before merge).
• Composes with feedback_no_silent_fails: every tool must catch failures at its boundary and return a clean error string, never let an exception escape.
• Doesn't yet exercise the [server]-only install matrix (that's PR ci(server-extras): [server]-only matrix + layer3 --exercise-all-tools #159). It catches any tool that raises through its wrapper regardless of extras — the universal subset of the gap.

Test plan

• 3 new tests passing locally
• Full suite 847 → 850 passing
• Real-model smoke test (NLI inference) preserved separately

Two follow-ups already filed in this session per Brian's plan:

• PR ci(server-extras): [server]-only matrix + layer3 --exercise-all-tools #159 — [server]-extras-only CI matrix + extended Layer-3 with --exercise-all-tools
• PR test(coverage): enforce ≥80% coverage + README badge — 86% baseline #160 — push test coverage to ≥80% + add README coverage badge

After all three follow-ups merge, soak substrate is ready per Brian's "known bugs fixed before soak" standard.

🤖 Generated with Claude Code