QTZPOC-20

QTZPOC-20: Refactor model import workflow, introduce atomic model ID generation, and clarify MinIO expiry.

Fuses bundle download, decryption, MLflow experiment creation, and artifact upload into a single activity to prevent cross-worker issues. Implements an atomic counter for MongoDB model IDs, replacing the max(id) + 1 scan to avoid collisions during concurrent imports. Adds comprehensive documentation for MinIO object expiry mechanisms and refines lifecycle rule application. Improves error handling with clearer responsibility classification and centralizes MLflow repository injection.

tests/laborious/utils/bundle/test_reader.py

@@ -367,6 +367,25 @@ def test_gate_4_rejects_an_entry_that_is_neither_a_file_nor_a_directory(work_dir
     assert error.value.gate == 4
 
 
+def test_gate_4_and_gate_5_read_the_central_directory_once(
+    golden_bundle, golden_password, work_dir, reader, monkeypatch
+):
+    """Achado #11: gate 5 extracts using the entries gate 4 already read, instead of reopening the
+    archive to call `infolist()` a second time."""
+    original_infolist = zipfile.ZipFile.infolist
+    calls: list[None] = []
+
+    def _counting_infolist(self):
+        calls.append(None)
+        return original_infolist(self)
+
+    monkeypatch.setattr(zipfile.ZipFile, 'infolist', _counting_infolist)
+
+    reader.open(golden_bundle, golden_password, work_dir / 'extract', work_dir)
+
+    assert len(calls) == 1
+
+
 # ------------------------------------------------------------------- gate 5
 
 
@@ -580,6 +599,21 @@ def test_gate_7_rejects_a_non_regular_file_left_in_the_tree(work_dir, reader):
     assert error.value.gate == 7
 
 
+def test_gate_7_rejects_disallowed_content_regardless_of_traversal_order(work_dir, reader):
+    """Achado #12: gate 7 no longer sorts the tree before walking it, so a disallowed file that
+    would not be first or last alphabetically must still be caught."""
+    root = work_dir / 'unsorted_root'
+    root.mkdir()
+    for name in ('a_file.txt', 'b_file.txt', 'y_file.txt', 'z_file.txt'):
+        (root / name).write_bytes(b'ok')
+    (root / 'n_disallowed.sh').write_bytes(b'#!/bin/sh\n')
+
+    with pytest.raises(BundleGateError, match='should not carry') as error:
+        reader._gate_7_content_policy(root)
+
+    assert error.value.gate == 7
+
+
 # ------------------------------------------------------------------ ordering