test: remove invented sample_data, demo_exports, QA bad fixtures (SEL-447)

.coderabbit.yaml

@@ -57,8 +57,6 @@ reviews:
     - "!services/test_data/**"
     - "!services/ingestion/tests/data/**"
     # Demo, sample, and export artifacts
-    - "!demo_exports/**"
-    - "!sample_data/**"
     - "!output/**"
     - "!artifacts/**"
     - "!production_bundle/**"

.github/workflows/backend-ci.yml

@@ -32,8 +32,6 @@ on:
       - 'requirements.lock'
       - 'scripts/**'
       - 'tests/**'
-      - 'sample_data/**'
-      - 'demo_exports/**'
       - 'docs/security/route-security-manifest.json'
       - 'docs/security/release-evidence/**'
       - '.github/workflows/backend-ci.yml'
@@ -56,8 +54,6 @@ on:
       - 'requirements.lock'
       - 'scripts/**'
       - 'tests/**'
-      - 'sample_data/**'
-      - 'demo_exports/**'
       - 'docs/security/route-security-manifest.json'
       - 'docs/security/release-evidence/**'
       - '.github/workflows/backend-ci.yml'
@@ -740,40 +736,6 @@ jobs:
           python -m pip install pip-audit==2.10.0
           pip-audit -r requirements.lock --desc on "${pip_audit_ignores[@]}"
 
-  # ── Public Sample Regenerator (drift gate) ──────────────
-  # Re-runs scripts/regenerate_public_samples.py against the synthetic
-  # CTE inputs in sample_data/ and fails if the regenerated artifacts
-  # in demo_exports/ differ from what's checked in. Prevents drift
-  # between the public Proof Surface and current production behavior
-  # for FDA exports / EPCIS / Merkle audit bundles.
-  regenerate-public-samples:
-    name: Regenerate public samples
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
-
-      - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-
-      - name: Install production dependencies
-        run: python -m pip install --require-hashes -r requirements.lock
-
-      - name: Regenerate public samples
-        run: python scripts/regenerate_public_samples.py
-
-      - name: Fail if regeneration produced drift
-        run: |
-          # If regeneration changed any tracked file, the public Proof
-          # Surface no longer matches current production behavior. The
-          # PR author must commit the regenerated artifacts.
-          if ! git diff --exit-code -- demo_exports/; then
-            echo "::error::demo_exports/ drifted from regenerated output. Re-run scripts/regenerate_public_samples.py and commit the result."
-            exit 1
-          fi
-
   # ── Repo-root security / RLS / isolation suite (hard gate) ─
   # The highest-value correctness suites live in the repo-root tests/ dir
   # (cross-tenant isolation, RLS coverage + hardening, hash-chain audit
@@ -1522,7 +1484,7 @@ jobs:
     # jobs that were aborted mid-flight. `!cancelled()` does not relax the
     # script below: every dependency still has to be success.
     if: always() && !cancelled()
-    needs: [dependency-lock, test, lint, lint-shared, lint-repo-roots, ingestion-full-suite, repo-root-suite, seeded-migration-rehearsal, live-db-suite, docker-build, security, rls-fallback-check, alembic-revision-check, dep-version-check, tenant-id-uuid-check, regenerate-public-samples]
+    needs: [dependency-lock, test, lint, lint-shared, lint-repo-roots, ingestion-full-suite, repo-root-suite, seeded-migration-rehearsal, live-db-suite, docker-build, security, rls-fallback-check, alembic-revision-check, dep-version-check, tenant-id-uuid-check]
     runs-on: ubuntu-latest
     steps:
       - name: Check results
@@ -1542,7 +1504,6 @@ jobs:
           echo "Alembic rev IDs:   ${{ needs.alembic-revision-check.result }}"
           echo "Dep drift guard:   ${{ needs.dep-version-check.result }}"
           echo "tenant_id UUID:    ${{ needs.tenant-id-uuid-check.result }}"
-          echo "Public samples:    ${{ needs.regenerate-public-samples.result }}"
           # Lint is now blocking — ruff F821 (undefined name) would
           # have caught PR #1482's NLP NameError class of bugs if this
           # gate had been enforcing. Promoting lint to a hard gate so
@@ -1561,8 +1522,7 @@ jobs:
              || "${{ needs.rls-fallback-check.result }}" != "success" \
              || "${{ needs.alembic-revision-check.result }}" != "success" \
              || "${{ needs.dep-version-check.result }}" != "success" \
-             || "${{ needs.tenant-id-uuid-check.result }}" != "success" \
-             || "${{ needs.regenerate-public-samples.result }}" != "success" ]]; then
+             || "${{ needs.tenant-id-uuid-check.result }}" != "success" ]]; then
             echo "::error::One or more required backend checks failed, were cancelled, or were skipped"
             exit 1
           fi

.github/workflows/deploy.yml

@@ -29,8 +29,6 @@ on:
       - 'requirements.lock'
       - 'scripts/**'
       - 'tests/**'
-      - 'sample_data/**'
-      - 'demo_exports/**'
   workflow_dispatch:
 
 permissions:

.github/workflows/pr-gate.yml

@@ -78,8 +78,8 @@ jobs:
               "frontend/src/lib/public-openapi.ts", "frontend/package-lock.json",
               "alembic/**", "server/**", "services/**", "shared/**", "kernel/**",
               "plugins/fsma/**", "Dockerfile", "railway.toml", "requirements.in",
-              "requirements.lock", "scripts/**", "tests/**", "sample_data/**",
-              "demo_exports/**", "docs/security/route-security-manifest.json",
+              "requirements.lock", "scripts/**", "tests/**",
+              "docs/security/route-security-manifest.json",
               "docs/security/release-evidence/**",
               ".github/workflows/backend-ci.yml",
               ".github/workflows/deploy.yml",

.github/workflows/security.yml

@@ -89,7 +89,6 @@ jobs:
               - 'plugins/fsma/**'
               - 'scripts/**'
               - 'tests/**'
-              - 'sample_data/**'
               - '**/requirements*'
               - 'pyproject.toml'
               - 'Dockerfile*'

.gitignore

@@ -101,8 +101,8 @@ fsma_stress_test_*
 test_data/
 # ...except services/test_data/audit/, which holds 25 intentionally-tracked
 # audit job fixtures that the bare test_data/ rule above was covering (#2873).
-# Same shape as the sample_data/ and demo_exports/ blocks below: re-include the
-# directories, re-ignore their contents, then allow only the fixture extension,
+# Re-include the services/test_data directory, re-ignore its contents, then
+# allow only the fixture extension,
 # so bulk scratch dumps under services/test_data/ stay ignored. Each parent
 # directory must be re-included explicitly — a negation for a file inside an
 # excluded directory has no effect.
@@ -177,24 +177,9 @@ test-write
 .qa-health/
 frontend/test-results/
 
-# Development sample data — public synthetic CTE CSVs are tracked
-# (see sample_data/SYNTHETIC.md). Anything else under the dir stays
-# ignored so local scratch CSVs don't leak.
-sample_data/*
-!sample_data/*.csv
-!sample_data/*.md
-!sample_data/README.md
-# The recall reconstruction fixture (synthetic, see its README.md) is tracked in full,
-# including the retained ERP snapshot and the answer key.
-!sample_data/recall_fixture/
-!sample_data/recall_fixture/**
-
-# Non-code artifacts — public synthetic exports are tracked
-# (see demo_exports/SYNTHETIC.md). Local pilot/sales output stays ignored.
-demo_exports/*
-!demo_exports/*.csv
-!demo_exports/*.json
-!demo_exports/*.md
+# Local data and exports are never tracked.
+sample_data/
+demo_exports/
 sales_enablement/
 output/