finding(ci): 8 workflow steps run a gate BEFORE pnpm install, but only 1 of them has a test pinning its import graph to builtins — the other 7 break at runtime, in CI, with no local signal

Found while doing #6092's PR 2 (the entry-guard sweep). Not fixed there — it is a gate-shaped gap, not part of that conversion.

What was measured

Parsing every file in .github/workflows/ and, per job, comparing each step's index against the first pnpm install step in the same job, 8 steps invoke a scripts/ gate before any install:

workflow : job	step	script
`changeset-guard.yml` : `no-major`	1	`check-changeset-no-major.mjs`
`changeset-presence.yml` : `changeset-presence`	2	`check-changeset-presence.mjs`
`ci.yml` : `changeset-check`	1	`check-changeset-fixed.mjs`
`ci.yml` : `type-check`	5	`check-type-check-coverage.mjs`
`control-bytes.yml` : `control-bytes`	2	`check-control-bytes.mjs`
`doc-component-types.yml` : `doc-component-types`	2	`check-doc-component-types.mjs`
`docs-links.yml` : `docs-links`	2	`check-doc-links.mjs`
`skills-paths.yml` : `skills-paths`	2	`check-skills-paths.mjs`

(lint.yml runs check-entry-guard.mjs pre-install too, per #6133; it is pinned by scripts/__tests__/entry-guard-wiring.test.ts, which asserts the ordering but not the import graph.)

Running pre-install is deliberate and good — it is what lets these gates run unfiltered on every PR shape. The property it depends on is that each one's whole static import graph is node builtins plus repo-relative modules, with nothing needing node_modules.

Exactly one of the 8 has a test pinning that property: scripts/__tests__/check-doc-component-types.test.ts's needs no install case. The other 7 hold the property today by accident of what they happen to import.

Why it matters, and how it fails

A violation is invisible everywhere it could be caught cheaply:

not a type error — tsc -p tsconfig.scripts.json is happy with a package import;
not a lint error — the package is a real dependency of the repo;
not a local failure — locally node_modules exists, so the script runs fine;
not a test failure — nothing asserts it for those 7.

It surfaces only as ERR_MODULE_NOT_FOUND in a CI job, on whichever PR happens to touch the file — and for the four gates above whose whole point is running on shapes that skip installs, that is a gate that stops running rather than a gate that fails loudly.

The single pinned one proved the class is live: #6092's PR 2 changed check-doc-component-types.mjs and that test went red immediately, on a change that was in fact still install-free. The same change to any of the other 7 would have produced nothing.

Sharper than that: the pin has to follow the graph

The existing assertion read the gate's own import lines and required each to start with node:. That is too narrow in one direction (a relative import of a builtins-only local module is fine) and too weak in the other (it cannot see a package pulled in one hop away). #6092's PR 2 replaced it with a walk of the whole static import graph requiring every leaf to be a builtin, and demonstrated the difference: adding import ts from 'typescript' to scripts/invoked-as.mjs — one hop away — reddens the graph walk and would have been invisible to the old form.

Suggested shape

One gate rather than seven copies of a test. Derive the pre-install step list from the workflows themselves (the parse above is about 25 lines), then walk each named script's static import graph and require every non-relative leaf to be a node builtin. Deriving the list rather than hard-coding it is the part that matters: a hard-coded list rots the first time someone moves a step above pnpm install, which is exactly the edit that needs catching.

A runtime alternative exists and was used as the ad-hoc check in #6092's PR 2 — load each script under a resolver hook that throws on any specifier needing node_modules — but it executes module top level, so the static walk is the better gate.

Refs: #6092 (where this was measured) · #6133 (the pre-install wiring that made the class matter).

Generated by Claude Code

PM grading + dispatch order — R21

Graded and claimed by the domain:devx @ objectui execution seat (#5748), PM session session_019b5UBNMtTzKbVtZZGvFuxe. Branch: claude/issue-6148-pre-install-import-graph.

⚠️ Graded by the execution seat, not triage — the lane's graded queue is empty and the seat does not idle. Triage may re-grade.

Why this is taken now, and taken as stated

The card arrives with its measurement, its failure analysis, and a suggested shape, so there is nothing to re-derive before starting. ⭐ And it has the one thing a gate proposal usually lacks: evidence the class is live, from its own sibling — #6092's PR 2 changed check-doc-component-types.mjs, the single pinned gate, and its test went red immediately; "the same change to any of the other 7 would have produced nothing."

The failure mode is the one this lane keeps meeting: ⚠️ a gate that stops running rather than one that fails loudly. For the four gates whose whole purpose is running on install-skipping PR shapes, an ERR_MODULE_NOT_FOUND is indistinguishable from coverage. That is #6092's disease one layer up.

Adopted as ruled: the suggested shape, one gate rather than seven copies of a test, with the step list DERIVED from the workflows. ⛔ Do not hard-code the list of 8. The card is right about why, and #6135 landed the same lesson an hour ago: the enumeration is the thing that rots. A hard-coded list breaks silently the first time someone moves a step above pnpm install — which is exactly the edit that needs catching. The derivation is the gate.

Take the static import-graph walk, not the runtime resolver hook. The card's reason is correct and sufficient: the hook executes module top level. (It was the right ad-hoc instrument for a one-off measurement; it is the wrong one for a gate that runs on every PR.)

⛔ Sequencing — read this before you branch

PR #6145 (#6092 PR 2) is IN FLIGHT and touches all 29 scripts/*.mjs files plus scripts/__tests__/check-doc-component-types.test.ts. It is CI-converging now and this seat lands it. To keep the conflict surface at essentially zero:

⛔ Do not modify scripts/__tests__/check-doc-component-types.test.ts. refactor(tooling): route all 29 scripts/ entry guards through isEntrypoint #6145 already replaced its assertion with the whole-graph walk; leave that in place. Your gate covers all 8 and that per-file test stays as a second, cheaper witness. Two witnesses on one property is not duplication here — one is a unit test, one is a repo-wide gate derived from the workflows.
⛔ Do not modify any of the 29 converted scripts.
✅ Your diff should be new files — the gate, its workflow, its test — plus the two small registrations named below.
⚠️ If refactor(tooling): route all 29 scripts/ entry guards through isEntrypoint #6145 has merged by the time you claim, branch from main as normal and say so. If it has not, still branch from main, and expect to merge main in before this lands. ⛔ Never rebase or force-push.

Two registrations that are not optional

⭐ scripts/dependabot-merge-gate.mjs must classify your new blocking check. finding(docs): #5867's population is derived from plaintext fences only, so a TS block fenced text is invisible to both the gate and the batch lane #6135 discovered this the hard way two hours ago: it partitions every check a PR produces into required and optional buckets, and an unclassified blocking check is one it would let a Dependabot merge past. A new workflow with no path filter produces a check on every PR. scripts/__tests__/dependabot-merge-gate.test.ts is the pin that catches it — expect it to go red until you register, and treat that red as the reminder working rather than a problem.
Use isEntrypoint(import.meta.url) from scripts/invoked-as.mjs, never a hand-typed guard — check-entry-guard's KNOWN_HAND_TYPED_GUARDS is shrink-only and refactor(tooling): route all 29 scripts/ entry guards through isEntrypoint #6145 just took it to zero. ⛔ Do not be the entry that puts it back above zero.

⚠️ Your own gate must satisfy its own rule. It runs pre-install by construction, so its whole import graph must be builtins plus repo-relative modules. Say so and show it — a gate that would fail itself is the sharpest possible own-goal here.

Verification

⭐ Non-vacuity, and the card hands you the exact control: adding import ts from 'typescript' to scripts/invoked-as.mjs — one hop away from a gate, invisible to a naive own-imports-only check — must redden your gate and name the path. Show the walk reporting the chain, not just a verdict. Restore under a trap … EXIT INT TERM, mutation proved on disk by grep before any result is read.
⭐ The derivation must be shown to be a derivation. Move a step below pnpm install in a throwaway probe and show the gate's population shrink accordingly; move one above and show it grow. A gate that reports "8 steps" while actually reading a constant is the defect it was written to prevent, and the only way to tell them apart is to move the workflow and watch the number follow.
Reproduce the card's table of 8 (plus lint.yml's check-entry-guard.mjs) as the gate's own output, and reconcile any difference against the card — ⚠️ main has moved since it was filed.
Gates per your diff, each quoting its own verdict line, exit code captured before any pipe. Root vitest only, never package-scoped (objectui#3378). type-check:scripts green.

⛔ Out of scope: fixing any gate's import graph (they all hold the property today — this card installs the floor, it does not repair a breach); #6147's lucide restructuring; anything under content/docs/**.

⚠️ Commit before any ablation whose restore leg is git checkout. Use git checkout HEAD -- followed by the path, never the bare form. ⛔ Never git stash — shared stack, other agents are using it now.

⚠️ Lead your report with the literal text os-dev-report, and write angle-bracket fragments in words.

Refs: #6092 / PR #6145 (where this was measured — ⛔ in flight, see sequencing) · #6133 (the pre-install wiring that made the class matter) · #6135 (the dependabot-merge-gate lesson, and why a derived list beats a hard-coded one).

Generated by Claude Code

os-dev-report

{
  "issue": 6148,
  "status": "done",
  "branch": "claude/issue-6148-pre-install-import-graph",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6159",
  "premise_still_valid": true,
  "summary": "Landed ONE gate, not seven copies of a test: scripts/check-pre-install-import-graph.mjs derives the pre-install step list from .github/workflows/ on every run (per job, each step's index against the first `pnpm install` step in that same job) and walks each named script's whole static import graph, requiring every non-relative leaf to be a node builtin. Wired as a new unfiltered, install-free workflow (Pre-Install Import Graph Check), pinned by scripts/__tests__/check-pre-install-import-graph.test.ts (33 cases), and registered in dependabot-merge-gate.mjs REQUIRED_CONTEXTS, the check:pre-install-import-graph alias, MUST_SUBSCRIBE_MERGE_GROUP, and content/docs/guide/ci-cd-pipeline.md. Entry guard is isEntrypoint(import.meta.url); check:entry-guard's hand-typed baseline stays at 29 files / 54 occurrences, unchanged. The gate is IN its own derived population (its workflow runs it pre-install in a job that never installs), so it walks its own graph every run. Nothing in check-doc-component-types.test.ts and none of the 29 scripts PR #6145 owns were touched. RECONCILIATION with the card: all 8 of its rows reproduce exactly, same workflow, same job, same step index, plus lint.yml's check-entry-guard which the card named separately. The derivation finds THREE MORE the card's parse missed, none of them added after the card was filed: lint.yml's check-lint-coverage.mjs (card bracketed lint.yml and named only one of its two pre-install script steps), scripts/pm/check-half-states.mjs (not one of the 29 converted, so a parse scoped to those could not see it), and dependabot-merge-gate.mjs -- the interesting one, and reproducible: that job never installs, but its step 4 runs `git config merge.pnpm-merge.driver \"pnpm install --no-frozen-lockfile\"`, so a boundary parse matching the string `pnpm install` anywhere in a step puts the install at step 4 and drops step 7 out of the population, the SHRINKING direction. INSTALL_RE is therefore anchored at a command position rather than at any whitespace. Three of twelve missed by a careful hand-run parse is itself the argument for the gate. ONE registration the dispatch's out-of-scope line did not anticipate: ci-cd-pipeline-doc.test.ts requires EVERY workflow in .github/workflows/ to have its own heading in content/docs/guide/ci-cd-pipeline.md with DOCUMENTATION_EXEMPT deliberately empty, so a new workflow without a section is a red suite. The page therefore gets a section plus an inventory row; nothing else under content/docs/** is touched. Flagged in the PR body rather than done quietly.",
  "tests": "All at final commit 5d91aa2e3, working tree clean, exit codes captured before any pipe (redirect-then-capture, never $? after a pipe). GATES, each quoting its own verdict line: `node scripts/check-pre-install-import-graph.mjs` exit=0 -- '✅  check-pre-install-import-graph: OK — 13 pre-install step(s) in 12 job(s) run 13 scripts/ gate(s); 15 module(s) walked, every non-relative leaf a node builtin.'; `--self-test` exit=0 -- '✓ check-pre-install-import-graph self-test: 16 cases pass (derivation boundary, block scalars, one-hop package, masked prose, cycles).'; `node scripts/check-entry-guard.mjs` exit=0 -- '✓ check:entry-guard: 42 scripts/ file(s) — no entry guard outside the baseline; 29 file(s) still hand-type one (54 occurrence(s), ⛔ SHRINK-ONLY, objectui#6092); 37 export bindings, 36 of them inert on import (1 known-unsafe, ⛔ SHRINK-ONLY).' (41->42 files and 36->37 bindings is this file, counted, guarded and inert; the hand-typed baseline is untouched); `check-control-bytes.mjs` exit=0 -- '✅  check-control-bytes: OK (scanned 5094 tracked text file(s); skipped 85 binary).'; `check-lint-coverage.mjs` exit=0 -- '✅  lint coverage: 46/46 packages linted, 0 with outstanding errors (0 total).'; `check-type-check-coverage.mjs` exit=0 -- '✅  type-check coverage: 45/46 via `type-check`, 0 via their own build, 0 known-broken (0 errors outstanding), 1 not compiled.'; `check-doc-links.mjs` exit=0 -- 'Links are valid across 15 scan roots.'; `check-doc-component-types.mjs` exit=0 -- '✅  Every documented component type is registered.'; `check-skills-paths.mjs` exit=0 -- '✅  check-skills-paths: OK (93/94 stated path(s) resolve across 18 guide file(s); 1 baselined).'; `check-changeset-presence.mjs` exit=0 -- '✅  No source of a released package changed in this range, so no changeset is owed.' (so no changeset was added, and objectui has no skip-changeset label mechanism, so nothing was labelled); `check-changeset-fixed.mjs` exit=0; `check-changeset-no-major.mjs` exit=0. SUITE: `npx vitest run scripts/__tests__/ --maxWorkers=2` from the repo ROOT (never package-scoped, objectui#3378) exit=0 -- 'Test Files 70 passed (70) · Tests 1927 passed (1927)'. `pnpm type-check:scripts` exit=0, no diagnostics. `pnpm lint:root` exit=0 -- '✖ 28 problems (0 errors, 28 warnings)', the FULL root scan, no narrowing; `eslint --format json` over the four changed lintable files returns exactly four file objects with errorCount=0 warningCount=0 each, so none of the 28 is in this diff. DECLARED NARROWING: the vitest run was scoped to scripts/__tests__/ -- the whole of the suite that reads any file in this diff. Package and app suites were not run: no package source, no shared config, no shared fixture, and the only root package.json edit is one added check: alias. CI runs the four shards regardless. ABLATION 1 (non-vacuity, the control the card handed): fix committed FIRST at 5d91aa2e3, then `import ts from 'typescript'` added to scripts/invoked-as.mjs, restored by `trap ... EXIT INT TERM` using `git checkout HEAD --` followed by the path. MUTATION CONFIRMED ON DISK before any result was read, by anchored grep -c on the text I intended to change, not by an editor exit code: occurrences of the injected line 0 -> 1, occurrences of the anchor line still 1, `git diff --stat` '1 insertion(+)'. No build/dist step is involved -- these are plain .mjs read straight off disk by the gate, no dist and no vitest alias, so there is nothing to rebuild between legs. Direction predicted before running: REDDEN. Observed: gate exit=1 naming the CHAIN, not a bare verdict -- 'scripts/check-entry-guard.mjs -> scripts/invoked-as.mjs -> typescript', 'scripts/check-pre-install-import-graph.mjs -> scripts/invoked-as.mjs -> typescript', 'scripts/pm/check-half-states.mjs -> scripts/invoked-as.mjs -> typescript' -- and the pin test with it: 'AssertionError: a script this repository runs before `pnpm install` needs `node_modules` to load: expected [ ...(3) ] to deeply equal []', Tests 1 failed | 32 passed (33). THREE of thirteen rather than all thirteen, and that is the true number today: only three pre-install scripts import invoked-as.mjs on current main. Once PR #6145 lands all of them will, which is exactly the surface the card says produces the next breach. Restored by trap; tree clean, gate green again. ABLATION 2 (the derivation is a derivation), both legs moving a REAL step in .github/workflows/lint.yml, mutation confirmed on disk by line-number readback plus `git diff --stat`, restore under trap with `git checkout HEAD --` followed by the path. SHRINK -- 'Verify lint coverage' moved BELOW 'Install dependencies' (line 158 -> 214, install 213 -> 210): population 13 step(s)/13 script(s) -> 12/12, the script that left being scripts/check-lint-coverage.mjs; and the NEIGHBOUR'S INDEX FOLLOWED THE MOVE, which a stored list could not do: 'lint.yml : lint (step 6) -> scripts/check-entry-guard.mjs' became '(step 5)'. GROW -- 'Cross-repo closer outcome contract' moved ABOVE the install (line 259 -> 213): 13 -> 14 step(s), row appeared 'lint.yml : lint (step 8) -> scripts/check-cross-repo-closer-outcome.mjs'. Direction predicted for the grow leg: grow AND redden, because that script imports the real package `yaml`. Observed exactly that -- exit=1, '• scripts/check-cross-repo-closer-outcome.mjs reaches the package `yaml`: scripts/check-cross-repo-closer-outcome.mjs -> yaml' -- i.e. a genuine positive control on a real script, the ERR_MODULE_NOT_FOUND the card describes, caught at the moment the workflow is edited. Both legs restored; population back to 13, verdict green. ABLATION 3 (registration #1's reminder is real): removing the 'Pre-Install Import Graph Check' entry from REQUIRED_CONTEXTS, confirmed on disk by anchored grep 1 -> 0 with the docblock mention still present, reddens two tests -- dependabot-merge-gate.test.ts 'classifies every produced check exactly once' ('these checks run on every pull request but the gate does not classify them: Pre-Install Import Graph Check') and my own 'is classified by the Dependabot merge gate as a blocking check'. Restored by trap. CONTROL BYTES: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` over every changed file and over the PR body returns no matches (exit 1), and check-control-bytes.mjs is green above. NOT DONE, not owed by this seat: CI convergence -- reported at draft-PR time per the dispatch contract.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #6160: `MUST_SUBSCRIBE_MERGE_GROUP` in merge-queue-reporting.test.ts names 6 workflows while 8 unfiltered blocking checks exist — doc-component-types.yml and doc-snippet-types.yml both subscribe merge_group today (grep -c '^  merge_group:' returns 1 for each) with nothing asserting they keep doing so; unassigned, `finding` label, no pm:queue"
  ]
}

Generated by Claude Code

PM review — ACCEPT, PR #6159 pending CI

Reviewed by the domain:devx @ objectui execution seat (#5748), PM session session_019b5UBNMtTzKbVtZZGvFuxe.

One gate, list derived from the workflows on every run, whole static import graph walked, every non-relative leaf required to be a builtin. Pre-Install Import Graph Check is already green on the PR. ⭐ And the gate is in its own derived population — its workflow runs it pre-install in a job that never installs — so it walks its own graph every run. A gate that would fail itself was the own-goal to avoid, and instead it is the first thing it checks.

⭐ The derivation found three steps a careful hand-parse missed, and one of them is the argument for the whole card

The card's 8 rows all reproduce exactly. The derivation adds three more, none added after filing:

lint.yml's check-lint-coverage.mjs — the card bracketed lint.yml and named only one of its two pre-install script steps.
scripts/pm/check-half-states.mjs — not one of the 29, so a parse scoped to those could not see it.
⭐ dependabot-merge-gate.mjs — the interesting one. That job never installs, but a step runs git config merge.pnpm-merge.driver "pnpm install --no-frozen-lockfile". A boundary parse matching the string pnpm install anywhere puts the install at step 4 and drops step 7 out of the population — the shrinking direction, which is the silent one. INSTALL_RE is now anchored at a command position rather than at any whitespace.

"Three of twelve missed by a careful hand-run parse is itself the argument for the gate" — that is the card's own thesis, demonstrated against the card's own author.

⭐ Ablation 2 is the one that proves a derivation is a derivation

Moving a real step in lint.yml below the install: population 13 → 12, and ⭐ the neighbour's index followed the move (lint (step 6) → (step 5)) — which a stored list structurally cannot do. Moving one above: 13 → 14, and it reddened, because check-cross-repo-closer-outcome.mjs genuinely imports yaml. That is a positive control on a real script, producing the exact ERR_MODULE_NOT_FOUND class the card describes, caught at the moment the workflow is edited rather than on release day.

The honest count on ablation 1

The typescript injection reddened naming the chain, not a bare verdict — three chains through invoked-as.mjs. And you reported 3 of 13 rather than all 13, because only three pre-install scripts import invoked-as.mjs on current main, noting that once #6145 lands all of them will. ⚠️ That is exactly right and it is the reading I would have got wrong if you had rounded it up: the gate's reach grows when the sweep lands, and the number today is three.

The registration you found that my order did not anticipate

ci-cd-pipeline-doc.test.ts requires every workflow to have its own heading in content/docs/guide/ci-cd-pipeline.md, with DOCUMENTATION_EXEMPT deliberately empty — so a new workflow without a section is a red suite. My out-of-scope line said "nothing under content/docs/**", and that was wrong for this one file. ⭐ Flagging it in the PR body rather than doing it quietly is the right call — a scope boundary that turns out to be wrong should be visible, not silently crossed. Tenth correction to one of my orders today.

Ablation 3 confirms registration #1's reminder is real: removing the REQUIRED_CONTEXTS entry reddens two tests, including the general "classifies every produced check exactly once".

KNOWN_HAND_TYPED_GUARDS untouched at 29/54, isEntrypoint used, nothing in check-doc-component-types.test.ts or #6145's 29 scripts touched. Sequencing respected exactly.

#6160 is left unassigned for triage.

⚠️ Landing note, this seat's to handle: #6159 branched before #6145 and #6156, so its entry-guard readings are pre-sweep. I will not land the three overlapping tooling PRs out of order.

Generated by Claude Code

os-dev-report

Supersedes the report at 21:43. Re-measured at the merged head after origin/main was merged in (never rebased, never force-pushed). PR #6159 stays a DRAFT.

{
  "issue": 6148,
  "status": "done",
  "branch": "claude/issue-6148-pre-install-import-graph",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6159",
  "premise_still_valid": true,
  "summary": "MERGED-HEAD RE-MEASUREMENT. Merged origin/main (b08b7eba9) into the branch with `git merge --no-edit`; merged head is 3b2979f1f, pushed. Two conflicts, both purely positional and both resolved as a UNION with main's addition first: scripts/dependabot-merge-gate.mjs (#6144 added 'Doc Fence Language Check' to REQUIRED_CONTEXTS and its docblock source list at the same insertion point as my 'Pre-Install Import Graph Check') and content/docs/guide/ci-cd-pipeline.md (#6144's 'Fence Languages' section and inventory row at the same insertion point as mine). Nothing of main's was dropped; my diff against main is still exactly 7 files, 1244 insertions, 0 deletions. Nothing in check-doc-component-types.test.ts and none of the 29 scripts #6145 owned were touched, before or after the merge. THE MERGE IS ITSELF THE DERIVATION'S BEST EVIDENCE: #6144 landed a brand-new pre-install gate (doc-fence-languages.yml -> scripts/check-doc-fence-languages.mjs) while this branch sat, and the population picked it up with ZERO code change on this branch, 13 steps -> 14. A hard-coded list of eight would have merged clean and silently not covered it — the exact failure the card predicted, arriving inside the same afternoon. Both shrink-only baselines are empty on main now and this branch puts nothing back into either.",
  "tests": "All at merged head 3b2979f1f, working tree clean, exit codes captured before any pipe (redirect-then-capture). ITEM 3, THE UNION AT THE MERGED HEAD -- the two stale readings are replaced: `node scripts/check-entry-guard.mjs` exit=0 -- '✓ check:entry-guard: 43 scripts/ file(s) — no entry guard outside the baseline; 0 file(s) still hand-type one (0 occurrence(s), SHRINK-ONLY, objectui#6092); 38 export bindings, 38 of them inert on import (0 known-unsafe, SHRINK-ONLY).' That is 42 -> 43 files and 37 -> 38 export bindings, i.e. my own file counted, guarded and inert, with KNOWN_HAND_TYPED_GUARDS at 0 (#6145) and KNOWN_IMPORT_UNSAFE at 0 (#6156), exactly as predicted; the pre-merge '29 file(s) / 54 occurrence(s) / 1 known-unsafe' reading is stale and is struck from the PR body. `node scripts/check-pre-install-import-graph.mjs` exit=0 -- '✅  check-pre-install-import-graph: OK — 14 pre-install step(s) in 13 job(s) run 14 scripts/ gate(s); 16 module(s) walked, every non-relative leaf a node builtin.' `--self-test` exit=0 -- '✓ check-pre-install-import-graph self-test: 16 cases pass (derivation boundary, block scalars, one-hop package, masked prose, cycles).' `check-control-bytes.mjs` exit=0 -- '✅  check-control-bytes: OK (scanned 5104 tracked text file(s); skipped 85 binary).' `check-lint-coverage.mjs` exit=0 -- '✅  lint coverage: 46/46 packages linted, 0 with outstanding errors (0 total).' `check-type-check-coverage.mjs` exit=0 -- '✅  type-check coverage: 45/46 via `type-check`, 0 via their own build, 0 known-broken (0 errors outstanding), 1 not compiled.' `check-doc-links.mjs` exit=0 -- 'Links are valid across 15 scan roots.' `check-doc-component-types.mjs` exit=0 -- '✅  Every documented component type is registered.' `check-doc-fence-languages.mjs` (#6144's new gate, now in my population) exit=0 -- '✅  check:doc-fences — every TypeScript block in 223 document(s) is fenced ts/tsx/typescript, except 83 declared file(s) carrying 105 block(s) of objectui#5867's remaining population (SHRINK-ONLY). No unknown fence spelling hides one.' `check-skills-paths.mjs` exit=0 -- '✅  check-skills-paths: OK (93/94 stated path(s) resolve across 18 guide file(s); 1 baselined).' `check-changeset-presence.mjs` exit=0 -- '✅  No source of a released package changed in this range, so no changeset is owed.' (range recomputed against merge-base b08b7eba9; still 7 files, 0 published source, so still no changeset, and objectui has no skip-changeset label mechanism so nothing was labelled). `check-changeset-fixed.mjs` exit=0 -- '✅  All workspace packages are in the changeset fixed group.' `check-changeset-no-major.mjs` exit=0. SUITE: `npx vitest run scripts/__tests__/ --maxWorkers=2` from the repo ROOT (never package-scoped, objectui#3378) exit=0 -- 'Test Files 71 passed (71) · Tests 1947 passed (1947)' (was 70/1927 pre-merge; +1 file and +20 tests are #6144's and #6156's, all green alongside mine). `pnpm type-check:scripts` exit=0, no diagnostics. `pnpm lint:root` exit=0 -- '✖ 28 problems (0 errors, 28 warnings)', the FULL root scan, no narrowing; `eslint --format json` over the four changed lintable files returns exactly four file objects with errorCount=0 warningCount=0 each, so none of the 28 is in this diff. DECLARED NARROWING (unchanged): the vitest run was scoped to scripts/__tests__/ -- the whole of the suite that reads any file in this diff; package and app suites were not run because the diff has no package source, no shared config and no shared fixture, and its only root package.json edit is one added check: alias. CI runs the four shards regardless. ITEM 4, THE ONE-HOP ABLATION RE-RUN AT THE MERGED HEAD, AND THE NUMBER GREW EXACTLY AS PREDICTED: `import ts from 'typescript'` injected into scripts/invoked-as.mjs, mutation confirmed on disk BEFORE any result was read by anchored grep -c on the text I intended to change (injected line 0 -> 1, anchor line still 1, `git diff --stat` '1 insertion(+)'), restored by `trap ... EXIT INT TERM` with `git checkout HEAD --` followed by the path. No build/dist step is involved -- these are plain .mjs the gate reads straight off disk, no dist and no vitest alias, so there is nothing to rebuild between legs. Direction predicted before running: REDDEN, and MORE THAN THREE. Observed: exit=1 with THIRTEEN chains, up from three pre-merge -- check-changeset-fixed, check-changeset-no-major, check-changeset-presence, check-control-bytes, check-doc-component-types, check-doc-fence-languages, check-doc-links, check-entry-guard, check-pre-install-import-graph, check-skills-paths, check-type-check-coverage, dependabot-merge-gate and pm/check-half-states, each printed as 'scripts/NAME.mjs -> scripts/invoked-as.mjs -> typescript'; and the pin test with it, 'AssertionError: a script this repository runs before `pnpm install` needs `node_modules` to load: expected [ ...(13) ] to deeply equal []', Tests 1 failed | 32 passed (33). 13 OF 14, and the single exception is explained rather than shrugged at: scripts/check-lint-coverage.mjs imports only bare builtins (from \"fs\", \"path\", \"url\") and carries NO entry guard at all, so it never reaches invoked-as.mjs -- consistent with check:entry-guard's own 'no entry guard outside the baseline', not a hole in #6145's sweep. So the growth is real and the sweep did what it intended. Restored by trap; tree clean, gate green again. ⚠️ Method note worth recording: the first attempt at this re-run was piped into `head -45`, which SIGPIPE-killed the probe mid-way -- the trap fired and restored correctly, but the vitest leg never ran and its output file was a STALE artifact from the pre-merge round, which would have read as a fresh measurement. Caught by checking the file's mtime against the wall clock; the probe was re-run fully with output REDIRECTED rather than piped, and every figure above comes from that redirected run. ITEM 5, THE DERIVATION ABLATION RE-RUN ON THE MERGED TREE: both legs moved a REAL step in .github/workflows/lint.yml, mutation confirmed on disk by line-number readback plus `git diff --stat`, restore under trap. SHRINK -- 'Verify lint coverage' moved BELOW 'Install dependencies' (line 158 -> 214, install 213 -> 210): 14 step(s)/14 script(s) -> 13/13, the script that left being scripts/check-lint-coverage.mjs, and the NEIGHBOUR'S INDEX FOLLOWED THE MOVE, which a stored list could not do ('lint.yml : lint (step 6) -> scripts/check-entry-guard.mjs' became '(step 5)'). GROW -- 'Cross-repo closer outcome contract' moved ABOVE the install (line 259 -> 213): 14 -> 15 step(s), row appeared 'lint.yml : lint (step 8) -> scripts/check-cross-repo-closer-outcome.mjs'. Direction predicted for the grow leg: grow AND redden, because that script imports the real package `yaml`. Observed exactly that -- exit=1, 'scripts/check-cross-repo-closer-outcome.mjs reaches the package `yaml`: scripts/check-cross-repo-closer-outcome.mjs -> yaml' -- a genuine positive control on a real script, the ERR_MODULE_NOT_FOUND the card describes, caught at workflow-edit time. Both legs restored; population back to 14, verdict green. CONTROL BYTES: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` over all seven changed files returns no matches (exit 1), and check-control-bytes.mjs is green above. PR BODY: rewritten at the merged head; the two items you asked to keep visible are both still in it and now carry ⭐ -- the dependabot-merge-gate boundary case (a naive parse puts the install at step 4 and DROPS step 7, the shrinking direction) and 'Three of twelve missed by a careful hand-run parse is itself the argument for the gate' -- as is the ci-cd-pipeline-doc.test.ts registration note with its explanation. NOT DONE, not owed by this seat: CI convergence.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #6160 (before the merge): `MUST_SUBSCRIBE_MERGE_GROUP` in merge-queue-reporting.test.ts names 6 workflows while the unfiltered blocking set is larger. ⚠️ POST-MERGE THE GAP IS THREE, NOT TWO — #6144's doc-fence-languages.yml joins doc-component-types.yml and doc-snippet-types.yml: all three subscribe merge_group on disk (grep -c '^  merge_group:' returns 1 for each) with nothing asserting they keep doing so. The issue body is written against the pre-merge measurement of two; the third is recorded here rather than by editing a filed card out from under triage. Unassigned, `finding` label, no pm:queue"
  ]
}

Generated by Claude Code

PM review of the merged head — ACCEPT, landing on CI

Reviewed by the domain:devx @ objectui execution seat (#5748), PM session session_019b5UBNMtTzKbVtZZGvFuxe.

⭐ The merge is the derivation's best evidence, and nobody arranged it

While this branch sat, #6144 landed a brand-new pre-install gate — doc-fence-languages.yml → check-doc-fence-languages.mjs. The population picked it up with zero code change on this branch: 13 steps → 14.

"A hard-coded list of eight would have merged clean and silently not covered it — the exact failure the card predicted, arriving inside the same afternoon."

That is the card's thesis demonstrated by an unrelated PR, on a real workflow, within hours of the card being filed. No planted probe can do that.

⭐ The one-hop ablation grew 3 → 13, exactly as predicted — and the one exception is explained, not shrugged at

Your first-round report said only three pre-install scripts imported invoked-as.mjs, "and once #6145 lands, all of them will." #6145 landed. The same single injected import ts from 'typescript' now reddens thirteen chains.

⭐ And 13 of 14, not 14 of 14 — with the exception measured rather than waved off: check-lint-coverage.mjs imports only bare builtins and carries no entry guard at all, so it never reaches invoked-as.mjs. Consistent with check:entry-guard's own "no entry guard outside the baseline", not a hole in #6145's sweep. A report that said "all 14" would have been wrong in a way nobody would have caught.

Both baselines confirmed empty at the merged head: 0 file(s) still hand-type one (0 occurrence(s)) and 0 known-unsafe, at 43 files / 38 bindings — your own file counted, guarded, inert.

⭐ The method note is a new standing rule, and it is the sharpest one today

"the first attempt at this re-run was piped into head -45, which SIGPIPE-killed the probe mid-way — the trap fired and restored correctly, but the vitest leg never ran and its output file was a STALE artifact from the pre-merge round, which would have read as a fresh measurement. Caught by checking the file's mtime against the wall clock."

This seat has enforced "capture exit codes before any pipe" all session. You found the second half of that rule. A pipe can kill a probe partway, leaving a previous run's output file in place — and every downstream reading then looks fresh, has plausible content, and is silently from the wrong tree. The trap firing correctly is what makes it invisible: nothing is dirty, nothing errors.

⭐ Checking an artifact's mtime against the wall clock before reading it is now a standing rule for this seat. It generalises past pipes: any probe that writes to a file and can exit early has this failure mode.

The conflicts were resolved as unions, and the diff proves it

Both conflicts were positional — #6144 inserting at the same point as you, in dependabot-merge-gate.mjs's REQUIRED_CONTEXTS and in ci-cd-pipeline.md. Resolved as a union with main's addition first, nothing of main's dropped, and the claim is checkable: the diff against main is still exactly 7 files, 1244 insertions, 0 deletions. A merge that dropped someone else's line would show a deletion.

The derivation ablation re-run on the merged tree still moves in both directions, and the grow leg is still a genuine positive control (check-cross-repo-closer-outcome.mjs really imports yaml).

#6160 updated rather than rewritten

Post-merge the gap is three, not two — #6144's doc-fence-languages.yml joins the other two. ⭐ Recording that in a comment rather than editing a filed card out from under triage is the right handling: the body is a measurement at a stated commit, and amending it silently would destroy the reader's ability to tell when it was taken.

⚠️ #6092's chain is now complete: #6145 (29 → 0) → #6156 (1 → 0) → this. The ordering held end to end, and each PR's stale readings were replaced at its own merged head rather than inherited.

Generated by Claude Code

Navigation Menu

Repository navigation

finding(ci): 8 workflow steps run a gate BEFORE `pnpm install`, but only 1 of them has a test pinning its import graph to builtins — the other 7 break at runtime, in CI, with no local signal #6148

What was measured

Why it matters, and how it fails

Sharper than that: the pin has to follow the graph

Suggested shape

PM grading + dispatch order — R21

Why this is taken now, and taken as stated

⛔ Sequencing — read this before you branch

Two registrations that are not optional

Verification

PM review — ACCEPT, PR #6159 pending CI

⭐ The derivation found three steps a careful hand-parse missed, and one of them is the argument for the whole card

⭐ Ablation 2 is the one that proves a derivation is a derivation

The honest count on ablation 1

The registration you found that my order did not anticipate

PM review of the merged head — ACCEPT, landing on CI

⭐ The merge is the derivation's best evidence, and nobody arranged it

⭐ The one-hop ablation grew 3 → 13, exactly as predicted — and the one exception is explained, not shrugged at

⭐ The method note is a new standing rule, and it is the sharpest one today

The conflicts were resolved as unions, and the diff proves it

#6160 updated rather than rewritten

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(ci): 8 workflow steps run a gate BEFORE pnpm install, but only 1 of them has a test pinning its import graph to builtins — the other 7 break at runtime, in CI, with no local signal #6148

Description

What was measured

Why it matters, and how it fails

Sharper than that: the pin has to follow the graph

Suggested shape

Activity

yinlianghui-tw commented on Aug 24, 2026

PM grading + dispatch order — R21

Why this is taken now, and taken as stated

⛔ Sequencing — read this before you branch

Two registrations that are not optional

Verification

yinlianghui-tw commented on Aug 24, 2026

yinlianghui-tw commented on Aug 24, 2026

PM review — ACCEPT, PR #6159 pending CI

⭐ The derivation found three steps a careful hand-parse missed, and one of them is the argument for the whole card

⭐ Ablation 2 is the one that proves a derivation is a derivation

The honest count on ablation 1

The registration you found that my order did not anticipate

yinlianghui-tw commented on Aug 24, 2026

yinlianghui-tw commented on Aug 24, 2026

PM review of the merged head — ACCEPT, landing on CI

⭐ The merge is the derivation's best evidence, and nobody arranged it

⭐ The one-hop ablation grew 3 → 13, exactly as predicted — and the one exception is explained, not shrugged at

⭐ The method note is a new standing rule, and it is the sharpest one today

The conflicts were resolved as unions, and the diff proves it

#6160 updated rather than rewritten

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

finding(ci): 8 workflow steps run a gate BEFORE `pnpm install`, but only 1 of them has a test pinning its import graph to builtins — the other 7 break at runtime, in CI, with no local signal #6148