golem15/msd-core
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(#4641): make test-conformance the sole Windows selector and narrow the tier to 28.5% (#4643)

Browse Source 
* test(#4641): failing-first tests for the tier ceiling and a single Windows selector

Tests only, committed ahead of the implementation so the RED run is real.

- tests/platform-conformance-tier.test.cjs: tier-size ceiling asserted as a
  ratio against a live denominator (Windows 33%, macOS 25%); per-helper negative
  cases proving seam calls and path-call-plus-slash-literal are not platform
  signals; positive pins that genuine platform content, seam-bypassing spawns,
  chmod and symlink still classify in; macOS signal set and generated list
  unchanged.
- tests/ci-full-lane-sharding.test.cjs: the test job has zero windows-latest
  rows and test-conformance still has 3 windows + 1 macOS.
- tests/ci-test-scope.test.cjs: windows_tests is absent rather than empty, a
  non-tier test file no longer forces full_matrix, a RULE-pulled windows-hint
  test does, and resolveSelection rejects the retired windows scope.

Refs #4589, #4591, #4592, #4593, #4603

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#4641): delete the second Windows selector and narrow the conformance tier

Epic #4589's goal — the OS-agnostic bulk on Linux, a small explicitly-scoped
conformance tier on real Windows/macOS — was not met. Measured on PR #4640
(run 34618834118): 7 non-Linux jobs, a 546/930 (58.7%) "tier", and 5 of 7
changed test files running on a real Windows runner twice.

Two selectors, only one in the epic's scope. The test job's three scope:windows
shards predate the epic (#494, sharded #3057) and gate on product_changed, not
full_matrix, so they fire on every product PR whatever Phase 3's classifier
decides. They are deleted; test-conformance becomes the sole Windows selector,
as it already was for macOS. Non-Linux jobs 7 -> 4.

Gating the lane instead was rejected as provably redundant: for a test file
reachesConformanceTierOrSeam is literally CONFORMANCE_TIER_FILES.includes(file),
and that same predicate sets full_matrix, which turns test-conformance on. Every
file a gated lane would run is already covered in the same run. The lane's one
non-redundant residue -- RULE-pulled tests matched by the isWindowsHint filename
heuristic -- is ported into reachesConformanceTierOrSeam so it sets full_matrix
instead of feeding a parallel lane.

Two detectors matched the repo's own test idiom rather than any platform signal
and carried 226 of the tier's sole-signal membership against 41 for the other
eight: process-seam-subprocess (335 files, 118 unique) matches the
tests/helpers.cjs entry points nearly every CLI test uses, and going through the
seam is the opposite of a platform signal since shell-command-projection takes
platform as an injected parameter; hardcoded-path-vs-path-call (328, 108) needs
only a path call anywhere plus a slash literal anywhere, and that class is
already enforced by ADR-1703's Linux-runnable ESLint rules. Both are removed.
Tier 546 -> 254 (27.3%). src/ reachability is unchanged at 28 files, measured.

Adds the size gate Phase 2 never had, as a ratio against a live denominator so
it cannot stop binding as the suite grows.

292 files leave real-OS Windows execution. The drop-out set was audited: 14 have
a platform-suggestive filename and all 14 are static source-text analyses or
seam-mediated CLI tests. raw-child-process was investigated as a suspected false
negative and left unchanged -- relaxing it adds 13 files, all false positives.

macOS is untouched: MACOS_CATEGORIES is a separate array and the regenerated
macos-conformance-tier.generated.cjs is byte-identical at 196 files.

Fixes #4641
Refs #4589, #4591, #4592, #4593, #4603

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#4641): register the new ADR path in the docs-guard exempt baseline

tests/ci-test-scope.test.cjs references docs/adr/4641-windows-selector-consolidation.md
in a comment justifying the retired windows scope; lint-docs-guard-registration
tracks that reference set, so the baseline needs the new path. Verified the
exemption still holds: the path is prose, not a filesystem read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#4641): make the escalation tier-backed and drop every hardcoded count

Three follow-ups from measuring the first pass rather than trusting it.

The windows-hint escalation now requires tier membership as well as the
filename hint. Setting full_matrix runs test-conformance, which runs only the
tier; escalating on a test that is NOT in the tier costs four jobs and still
never runs that test on Windows. Measured over the 16 RULES entries the
narrowed predicate fires on exactly the same rules today, so this is
correct-by-construction rather than a behavior change. The broader variant --
escalate on any tier member a rule pulls in, ignoring the hint -- was measured
at 14/16 rules and rejected as over-broad.

Removes the hardcoded counts. A hardcoded macOS tier length of 196 broke as
soon as the rebase pulled in one new test file from #4253, which is the whole
argument against them: the ceilings are ratios against a live denominator, the
committed lists are pinned by comparison against a fresh classification of the
live tree, and the three named probe files now assert on their SIGNAL rather
than on membership in a literal list -- asserting by filename is the exact
error this PR fixes in the classifier.

Regenerates both lists against the rebased tree. Same-tree figures are now
547 -> 255 of 931 eligible (58.8% -> 27.4%), 292 entries removed and none
added; macOS is unchanged at 197 with a zero-line diff.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#4641): restore real-shell-spawn coverage and repair assertions the narrowing broke

An isolated adversarial review found a real false negative. Removing the
blanket process-seam-subprocess detector also removed the only coverage for
tests that spawn a REAL shell: tests/helpers/process-seam.cjs's runHook
spawns options.interpreter via real spawnSync, so
runHook('-c', [script], { interpreter: 'bash' }) runs a real bash binary
executing a shell script extracted from workflow markdown. The seam argument
holds for src/shell-command-projection.cts, which takes platform as an
injected parameter; it does NOT hold for the test helpers, which spawn real
binaries. Conflating the two is what made the blanket detector look purely
noisy -- it was 99% noise wrapping a real signal.

Adds a narrow shell-interpreter-spawn category keyed on a real interpreter
option. Measured 2026-09-11: 33 files match, 9 were outside the tier and are
added back, taking it 255 -> 264 of 931 (27.4% -> 28.4%), still under the 33%
ceiling. All 9 confirmed by reading the matching source line, zero comment or
fixture matches. runGit-alone and non-node-spawnSeam alternatives were measured
and rejected -- each adds 9 files but misses the counterexample entirely.

Fixes a real bug the suite caught: jobs.test is ubuntu-only now that its
scope:windows rows are gone, so it must wire GSD_STRICT_LIVE_CONFIG_GUARD
strictly rather than carrying the Windows report-only carve-out. The carve-out
now lives solely on test-conformance, whose matrix does include windows.

Repairs seven pre-existing assertions the category removal invalidated,
preserving each case's purpose rather than deleting coverage, and converts the
last hardcoded tier bounds to live-derived ratios -- including the macOS
sanity range that was still a magic [100, 350].

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#4641): keep the confinement test on a real OS via a documented allowlist

A security review found tests/external-descriptor-confinement.test.cjs had
dropped out of the Windows tier. It must stay in, and no content signal can
express why: it exercises isPathConfined (src/external-descriptor-trust.cts),
which uses the AMBIENT path module -- path.resolve(root, target) and path.sep
-- with no injection. Its win32 semantics (drive letters, UNC, separator) are
only reachable by actually running on Windows, and it is a security-relevant
write-confinement gate. A content classifier cannot see 'this module reads the
ambient path module', so no regex belongs here.

Adds ALWAYS_REAL_OS, a Map of path -> recorded reason, unioned into the Windows
tier only. A Map rather than a list so an entry without a reason is impossible
by construction, and tests assert every entry names a file that exists on disk
so a stale entry fails loudly instead of rotting. This is the centrally-
enumerated single source of truth epic #4589 Phase 2 asked for and ADR-1703's
portability-vocab.cjs already models -- deliberately not a heuristic.

Windows tier 264 -> 265 of 931 (28.5%), still under the 33% ceiling. macOS is
untouched and byte-identical: the win32 concern does not apply to a POSIX
runner, and a test asserts the allowlist does not leak into that tier.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#4641): inject the path impl into isPathConfined and correct the ADR count

Two review findings, both fixed rather than dispositioned.

A security review found tests/external-descriptor-confinement.test.cjs had left
real-OS execution. The allowlist pinned it back, but that only restored
INCIDENTAL coverage: isPathConfined used the ambient path module, and its test
carried POSIX-only literals, so a win32 confinement escape was unverified on
every platform including Windows. isPathConfined now takes an optional third
parameter carrying the path implementation, defaulting to the ambient module.
Blast radius is CRITICAL -- 53 affected symbols across 19 files -- so the change
is purely additive and every existing two-argument caller is byte-identical.

Tests now inject path.win32 and path.posix, covering a different drive letter,
a cross-drive absolute, backslash and forward-slash traversal, UNC, and the
startsWith prefix-boundary bug (.gsdEVIL against root .gsd) on both separators.
Proved load-bearing: dropping the + p.sep from the prefix check fails exactly
the two boundary cases and nothing else. Callers' suites 149/149.

The spec review caught an off-by-one: the ADR narrated a 264-file tier while the
committed list holds 265. The ADR now records the full chain 547 -> 255 -> 264
-> 265 (28.5%).

Also corrects a stale comment in scripts/docs-guard-registry.cjs that narrated
classify() as zeroing windows_tests, a key this change removes -- kept as
historical narration but labelled as such.

Refs #4641

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(#131): make the unwritable-HOME test actually test something

Found by sweeping for the root-bypass class after fixing commit-files-deletion.
This one is the silent variant, and it was broken twice over.

First, the condition: the test made a fake HOME unwritable with chmod 0o500.
The gsd-test Docker bench runs as root, root bypasses mode bits, so HOME stayed
writable and the hostile condition never existed. Replaced with a HOME whose
PARENT is a regular file, so every write under it fails ENOTDIR at the VFS
layer for every uid -- no permission check is involved at all.

Second, and more fundamental: the probe was npm --version, which on npm 11.19.0
performs zero filesystem I/O against HOME. Proven rather than assumed --
neutralizing runNpm()'s isolation turned the sibling test red while this one
stayed green, so its assertion could never detect the regression it guards, on
any uid, with or without the condition fix. npm config get cache was tried next
and proved vacuous the same way (it only string-resolves the path). The probe is
now npm cache verify, which really does mkdir _cacache under HOME.

Re-proved load-bearing after the change: with isolation neutralized the test now
fails with ENOTDIR on <blocker>/home/.npm/_cacache. tests/helpers.cjs was
restored and verified diff-clean; suite 13/13.

Refs #4641

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#4641): correct the net drop-out figure in ADR-4641

The Consequences section still said 292 files leave real-OS Windows execution.
That was the count before the narrow shell-interpreter-spawn replacement
restored 9 and ALWAYS_REAL_OS pinned 1. Net is 282. Also names both real-binary
categories rather than only raw-child-process, and clarifies that the 14-file
filename audit was against the 292 initially dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#4641): record the rejected concentration ceiling and its measurement

Applying Goodhart's own question to the new ceiling -- how would you make this
metric look good without improving what it represents -- surfaces a real
weakness: a ratio can be satisfied by inflating the denominator, so adding
OS-agnostic tests loosens it without narrowing the tier.

The obvious companion gate was a sole-signal concentration ceiling, since the
original defect was one detector carrying half the tier. Measured and rejected:
peak concentration post-fix is raw-child-process at 53/265 = 20.0%, against the
historic offenders at 21.6% and 19.8%. Any threshold above 20% misses the
original defect; any threshold below it fails on a legitimate category. The
discriminator is whether a signal is platform-meaningful, which no threshold
encodes. Weakness disclosed rather than covered by a gate that does not bind.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* chore(#4641): add the changeset fragment for the confinement-check change

changeset-lint failed on PR #4643: the PR touches user-facing paths and carried
no fragment. The earlier no-changeset call matched #4604's CI-only precedent and
was correct then; it was not revisited once the PR grew a src/ change, which is
my miss.

The fragment describes the real user-visible improvement: the external-descriptor
write-confinement check's Windows semantics are now verified deterministically
rather than only when the suite happened to run on Windows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#4641): correct the tier count in TESTING-SUITES.md

Said the tier narrowed from 546 to 254. The final committed list is 265 of 931
eligible (58.8% -> 28.5%) after the shell-interpreter-spawn replacement restored
9 files and ALWAYS_REAL_OS pinned 1. Same error class the spec review caught in
the ADR, in a live reference page rather than a dated record, so it states the
current truth rather than carrying an amendment note.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#4641): record the measured aggregate from real CI job lists

Epic #4589's closeout asserted its reduction from a static count; #4641's
acceptance criterion asks for a figure read off a real run. Recorded here:
test.yml job count 21 -> 15 and non-Linux 7 -> 4, comparing PR #4640's run
against this PR's own. Against the true pre-epic baseline of 9, that is 9 -> 4.

Also states the caveat that a PR's total CHECK count is not a clean before/after
comparison, since many gates are path-scoped and this change touches a broader
path set -- the like-for-like figure is the test.yml job count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#4641): compare job totals the same way on both sides

The measured-aggregate table put #4640's COMPLETED run total (21) against this
run's count at matrix-expansion time (15). Those are not the same measurement:
the completed total includes the post-test Coverage gate and baseline-publisher
jobs. Counted identically, it is 21 -> 17. The load-bearing figure, non-Linux
jobs 7 -> 4, was correct and is unchanged.

Called out in the table rather than silently corrected -- comparing two
differently-derived numbers is exactly the error class this ADR is about.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#4641): record measured conformance wall-clock and date the stale counterfactual

Adds the per-job durations from both runs. The honest read is that this is a
correctness win more than a speed one: file count fell 52% but wall-clock only
9-29%, because what was removed were the cheap static tests and what remains is
concentrated in expensive spawn-heavy work. Stated explicitly so nobody expects
a future narrowing to buy time proportional to file count.

The load-bearing figure is windows shard 3/3: 40m24s against a 45-minute cap on
the 547-file tier -- 90% of the cliff #869 and #3057 were both filed about --
pulled back to 31m27s. macOS moved the wrong way (17m48s -> 21m02s) while its
tier was UNCHANGED at 197 files, which fixes that as runner variance and is
noted as a caution against reading a single duration as signal.

Also dates the symlink-keyword counterfactual, which cited a 254-file tier from
before the replacement category and allowlist took it to its final 265.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(#4641): re-measure against the rebased tree and disclose the allowlist's zero

next gained #4644 mid-flight, so every absolute count shifted. Re-measured on
the tree this actually ships against (932 eligible): 548 -> 257 by detector
removal, 257 -> 266 once shell-interpreter-spawn restores 9. Net 282 removed,
9 restored. macOS 198, unchanged by this PR.

The percentages did not move across three rebases (58.8% -> 28.5%), which is
the whole argument for expressing the ceilings as ratios rather than counts --
noted in the ADR since it is now evidence rather than assertion.

Also discloses that ALWAYS_REAL_OS now contributes ZERO files: this PR's own
win32 test cases introduced the literal win32 into the pinned file, so it
classifies in on content via win32-darwin-literal. The entry stays and the
reason is written down, because the file's real-OS need is a property of the
code under test (isPathConfined reads the ambient path module), not of the
test's text -- the text that currently saves it is incidental and could be
refactored away silently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
2026-09-11 17:00:11 -04:00
committed by GitHub
parent db4d8a9bae
commit 4d65c248e5
18 changed files with 1172 additions and 433 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
scripts/ci-prepare-test-scope.cjs
View File

@@ -4,9 +4,9 @@
// Shell-agnostic: invoked as `node scripts/ci-prepare-test-scope.cjs` from any shell.
//
// Required environment variables (set by the workflow step's `env:` block):
// TEST_SCOPE — "windows" | "targeted"
// TEST_SCOPE — "targeted" (the `windows` scope was retired by #4641:
// test-conformance is now the sole Windows selector)
// TARGETED_TESTS — space-separated test file list (from ci-test-scope.cjs output)
// WINDOWS_TESTS — space-separated test file list for the windows lane
//
// Writes: .ci-selected-tests.txt (one file per line, no blanks)
// Exit 0 = success; exit 1 = unknown scope.
@@ -46,13 +46,14 @@ function isResolvable(entry, root) {
// Resolve the scoped test selection for the lane. Pure (no I/O beyond the
// existence probe under `root`) so it can be unit-tested directly.
function resolveSelection({ scope, targeted, windows, root }) {
function resolveSelection({ scope, targeted, root }) {
let selected;
if (scope === 'windows') {
selected = windows;
} else if (scope === 'targeted') {
if (scope === 'targeted') {
selected = targeted;
} else {
// #4641: the `windows` scope was retired (test-conformance is now the
// sole Windows selector) — an unknown/retired scope must fail loudly
// rather than silently selecting nothing.
throw new ExitError(1, `::error::Unknown test scope: ${scope}`);
}
@@ -75,7 +76,6 @@ function main() {
const lines = resolveSelection({
scope: process.env.TEST_SCOPE || '',
targeted: process.env.TARGETED_TESTS || '',
windows: process.env.WINDOWS_TESTS || '',
root,
});

46
scripts/ci-test-scope.cjs
View File

@@ -485,6 +485,15 @@ function addAll(set, values) {
// fullMatrix=true, so the full Windows lane already runs when those paths
// change. The old six-hint list pulled 102 of ~633 test files into the scoped
// windows lane, turning it into a ~10-minute job on every PR.
// #4641: the scoped windows lane itself is gone. These hints now drive
// full_matrix instead — a matched RULE whose tests[] includes a
// windows-hint filename AND that hinted file is itself in the conformance
// tier (per reachesConformanceTierOrSeam) escalates straight to full_matrix
// (routed to test-conformance, the sole Windows selector) rather than
// feeding a side lane. Tier-backed on purpose: full_matrix only ever runs
// CONFORMANCE_TIER_FILES, so a hint on a non-tier file would cost 4 CI jobs
// with zero Windows coverage of that file. See
// docs/adr/4641-windows-selector-consolidation.md.
const WINDOWS_HINTS = ['windows', 'win32', 'shell', 'path'];
const isWindowsHint = s => WINDOWS_HINTS.some(k => s.toLowerCase().includes(k));
@@ -538,7 +547,6 @@ function reachesConformanceTierOrSeam(file, deps = {}) {
// the real, committed generated file.
function classify(files, reachabilityDeps = {}) {
const targeted = new Set();
const windows = new Set();
const reasons = [];
let productOrPipelineChanged = false; // product/pipeline code (excludes docs)
let inertCiChanged = false; // inert workflow files
@@ -575,7 +583,6 @@ function classify(files, reachabilityDeps = {}) {
if (file.startsWith('tests/') && file.endsWith('.test.cjs')) {
targeted.add(file);
windows.add(file);
// #494 originally narrowed this to skip full_matrix for changed test
// files, on the theory that ubuntu targeted_tests + the scoped windows
// lane already covered them. Rescinded per #4421: PR #4384 landed a
@@ -612,6 +619,32 @@ function classify(files, reachabilityDeps = {}) {
addAll(targeted, rule.tests);
reasons.push(`${file}: ${rule.name}`);
if (rule.fullMatrix) fullMatrix = true;
// #4641: a rule that pulls in a test file matching a Windows-sensitive
// filename hint is the one non-redundant residue of the deleted
// scoped windows lane — escalate to full_matrix (test-conformance)
// instead of feeding a side lane. TIER-BACKED (measured): full_matrix
// routes to test-conformance, which runs ONLY CONFORMANCE_TIER_FILES —
// escalating on the filename hint alone can fire on a hinted test that
// isn't in that tier, costing 4 CI jobs while never actually running it
// on Windows. The predicate below requires BOTH the hint AND tier
// membership (via reachesConformanceTierOrSeam, the same fail-safe
// reachability helper used elsewhere in this file, so error/uncertainty
// behavior stays identical). Measured: over the 16 RULES entries this
// narrowed form fires on the same rules as the un-narrowed form today
// (no behavior change now, correct-by-construction going forward). The
// broader alternative — escalate on ANY tier member a rule pulls in,
// ignoring the filename hint — was measured and rejected: it fires on
// 14 of 16 rules, newly escalating most ordinary product-code PRs
// (src/, agents/, commands/, hooks/, skills/, config paths). Only one
// rule's escalation is live today: 'portability lint rules (ADR-1703)'.
// Four others already had fullMatrix: true (no-op here), and 'inert
// CI''s escalation is overridden downstream by the inert-CI reset.
// Distinct, greppable reason so the conformance-lane coverage for it
// is traceable per rule.
if (rule.tests.some(t => isWindowsHint(t) && reachesConformanceTierOrSeam(t, reachabilityDeps))) {
fullMatrix = true;
reasons.push(`${file}: ${rule.name} (windows-hint rule test, #4641)`);
}
}
}
}
@@ -625,7 +658,7 @@ function classify(files, reachabilityDeps = {}) {
// covered by .github/workflows/install-smoke.yml
'tests/release-tarball-smoke.install.test.cjs',
]);
for (const f of SCOPED_LANE_EXCLUDE) { targeted.delete(f); windows.delete(f); }
for (const f of SCOPED_LANE_EXCLUDE) { targeted.delete(f); }
// code_changed: true when product/pipeline OR inert CI changed.
// Docs-only PRs (neither flag set) get code_changed=false → full matrix skip.
@@ -639,8 +672,6 @@ function classify(files, reachabilityDeps = {}) {
targetedTests.push('unit');
}
const windowsTests = existingTests([...new Set([...windows, ...targetedTests.filter(isWindowsHint)])].sort());
// Inert-CI-only: full_matrix must be false (override any RULES that fired).
if (inertCiChanged && !productOrPipelineChanged) {
fullMatrix = false;
@@ -649,12 +680,11 @@ function classify(files, reachabilityDeps = {}) {
// Normalize: when code_changed is false, the output must be self-consistent.
// A docs file can coincidentally match a coarse content RULE (e.g. docs/installer-migrations.md
// matches the installer rule via path.includes('install')), leaving full_matrix=true and
// non-empty targeted_tests/windows_tests. The workflow skips correctly (gated on code_changed)
// non-empty targeted_tests. The workflow skips correctly (gated on code_changed)
// but the output object would be self-contradictory. Force a clean "nothing to run" result.
if (!codeChanged) {
fullMatrix = false;
targetedTests.length = 0;
windowsTests.length = 0;
}
return {
@@ -662,7 +692,6 @@ function classify(files, reachabilityDeps = {}) {
product_changed: productOrPipelineChanged,
full_matrix: fullMatrix,
targeted_tests: targetedTests,
windows_tests: windowsTests,
reasons: [...new Set(reasons)].sort(),
};
}
@@ -674,7 +703,6 @@ function writeOutputs(result) {
`product_changed=${result.product_changed}`,
`full_matrix=${result.full_matrix}`,
`targeted_tests=${result.targeted_tests.join(' ')}`,
`windows_tests=${result.windows_tests.join(' ')}`,
];
appendFileSync(process.env.GITHUB_OUTPUT, `${lines.join('\n')}\n`);
}

8
scripts/docs-guard-registry.cjs
View File

@@ -9,8 +9,12 @@
*
* A prior version of this PR added a `docs guards` RULE to `RULES` in
* scripts/ci-test-scope.cjs, on the theory that classify()'s `!codeChanged`
* normalization (which zeroes fullMatrix/targeted_tests/windows_tests for
* docs-only diffs) made the RULE inert to classify()'s scope decision.
* normalization (which at the time zeroed fullMatrix/targeted_tests/
* windows_tests for docs-only diffs) made the RULE inert to classify()'s
* scope decision. (#4641 later removed `windows_tests` from classify()'s
* output entirely; the normalization today only zeroes fullMatrix and
* targeted_tests. This paragraph is historical narration of a rejected
* design, not a description of current behaviour.)
*
* That is true for docs-ONLY diffs and FALSE for MIXED docs+code diffs:
* `codeChanged` is true whenever ANY changed file is product/pipeline code,

141
scripts/gen-platform-conformance-tier.cjs
View File

@@ -35,6 +35,27 @@
* is the safe direction — a false positive costs one extra test running on a
* real OS; a false negative silently drops real-OS coverage).
*
* That stance is a correct per-file tiebreak, but proved wrong in aggregate
* (#4641): applied to two categories that matched the house test idiom
* rather than a genuine platform signal, it produced a Windows "tier" of
* 547 of 931 eligible unit-suite files (58.8%, measured 2026-09-11) — most
* of the suite. Measured per-category UNIQUE (sole-signal, i.e. the file
* would have been excluded without it) contribution as of that same
* measurement: `process-seam-subprocess` 118 files, `hardcoded-path-vs-
* path-call` 108 files, every other category 41 files COMBINED. Both were
* removed outright from CATEGORIES; the same-tree, same-day recount put
* the tier at 255 of 931 (27.4%) — exactly 292 entries removed from the
* committed list, none added. The macOS tier was unaffected by this change
* (a diff of macos-conformance-tier.generated.cjs across the same removal
* showed zero changed lines). None of these counts is asserted as a
* literal anywhere in the test suite: the ceilings this generator enforces
* are ratios against a live denominator (the current eligible-file count),
* and the committed lists are pinned by comparing against a fresh
* classification of the live tree, not against a hardcoded number —
* deliberately, since a hardcoded count in a test is a failure scheduled
* for the next time the suite grows. See
* docs/adr/4641-windows-selector-consolidation.md for the full rationale.
*
* KNOWN LIMIT, disclosed deliberately: this is a STATIC content classifier,
* not a real per-file, per-OS behavioral diff. Epic #4589's issue #4591 asked
* for the cutover to be validated by "running the existing full matrix one
@@ -129,10 +150,6 @@ const CATEGORIES = [
name: 'windows-env-var',
test: (content) => /\bPATHEXT\b|\bUSERPROFILE\b|\bHOMEDRIVE\b|\bHOMEPATH\b/.test(content),
},
{
name: 'process-seam-subprocess',
test: (content) => /\brunNode\(|\brunGit\(|\brunHook\(|\brunGsdTools\(|\bgitOrThrow\(/.test(content),
},
{
name: 'raw-child-process',
// Requires BOTH the child_process import/reference token AND one of the
@@ -145,6 +162,32 @@ const CATEGORIES = [
return /\bspawnSync\(|\bexecSync\(|\bexecFileSync\(/.test(content);
},
},
{
name: 'shell-interpreter-spawn',
// Added after an adversarial review (#4641) caught a REAL false negative
// introduced by removing 'process-seam-subprocess' above: that removal
// also dropped the only coverage for tests/execute-phase-worktree-guard.
// test.cjs, which calls tests/helpers/process-seam.cjs's `runHook(...,
// { interpreter: 'bash', ... })`. `runHook` spawns `options.interpreter`
// via a real `spawnSync`, so `interpreter: 'bash'` is a genuine real-shell
// invocation — bash availability, quoting, and git output parsing all
// differ across OSes. This is deliberately narrower than (and does not
// reintroduce) 'process-seam-subprocess': the rationale that going
// through the injected-`platform`-parameter seam in
// src/shell-command-projection.cts is NOT a platform signal (because the
// caller supplies `platform` itself) holds for THAT seam only — it does
// not hold for `runHook`'s `interpreter` option, which spawns a real
// interpreter binary rather than taking platform as injected data.
// Measured 2026-09-11: 33 eligible files match this pattern; 9 of them
// were outside the committed Windows tier and are added back by this
// change, taking the tier from 255 to 264 of 931 eligible files (27.4% ->
// 28.4%), still under the 33% ceiling. All 9 additions were verified by
// reading the matching source line: 0 false positives, every match is a
// live `interpreter:` option on a real `runHook`/`runHookSeam` call. As
// with all counts in this file, these are dated point-in-time
// measurements, not standing facts.
test: (content) => /interpreter:\s*['"`](bash|sh|zsh|dash|pwsh|powershell|cmd)['"`]/.test(content),
},
{
name: 'symlink-keyword',
// A leading `\b` with no trailing one, case-insensitive: this is
@@ -155,25 +198,65 @@ const CATEGORIES = [
// alone still excludes a mid-word embedding like "presymlink".
test: (content) => /\bsymlink/i.test(content),
},
{
name: 'hardcoded-path-vs-path-call',
// Intentionally coarse (design doc: over-inclusion is the safe
// direction): a path.* call ANYWHERE in the file plus a quoted
// forward-slash-leading string literal ANYWHERE in the file, with no
// attempt at proximity/scoping.
test: (content) =>
/path\.(join|resolve|dirname|basename|normalize|relative)\(/.test(content) &&
/['"`]\/[\w.\-/]*['"`]/.test(content),
},
];
// Two CATEGORIES entries precise enough for TEST-file classification (this
// module's own purpose) but far too broad for SOURCE-file reachability
// (scripts/ci-test-scope.cjs's #4592 use). Empirically verified: applying
// classifyContent to every file under src/ (235 files) flags 100 of them,
// driven almost entirely by these two categories; excluding them narrows it
// to 28 files, all verified to carry a genuine platform-conditional branch.
const NOISY_FOR_SOURCE_REACHABILITY = new Set(['hardcoded-path-vs-path-call', 'symlink-keyword']);
// A CATEGORIES entry precise enough for TEST-file classification (this
// module's own purpose) but too broad for SOURCE-file reachability
// (scripts/ci-test-scope.cjs's #4592 use). This set used to hold a second
// member, 'hardcoded-path-vs-path-call', alongside 'symlink-keyword'; that
// category was removed outright from CATEGORIES (#4641 — measured to be the
// single largest driver of Windows-tier over-inclusion, a universal Node
// test-suite idiom rather than a platform signal), not merely exempted here,
// because it was over-broad for BOTH consumers (this module's own Windows
// tier AND source reachability), not source-reachability alone. Only
// 'symlink-keyword' remains: still precise enough for test-file
// classification but, per the same empirical pass described above, too noisy
// for source reachability.
const NOISY_FOR_SOURCE_REACHABILITY = new Set(['symlink-keyword']);
/**
* Escape hatch, WINDOWS TIER ONLY (union'd into `classifyTree`, never into
* `classifyMacosTree`/`MACOS_CATEGORIES` — those stay untouched by this map).
*
* `classifyContent` above is a STATIC CONTENT classifier: it can only see
* text in the test file itself. Some files need real-OS coverage for a
* reason that lives in the CODE UNDER TEST, not in the test's own text — no
* regex over the test file can ever detect that, because the signal simply
* isn't there to find. Rather than chase that gap with ever-more-specific
* content heuristics (the exact failure mode #4641 measured and rolled
* back — see the header comment above), this map is the single, centrally-
* enumerated source of truth for those cases, matching ADR-1703's
* `portability-vocab.cjs` stance and epic #4589 Phase 2's explicit
* requirement that such overrides be "centrally-enumerated, not a naming
* convention". It is deliberately NOT a heuristic: it is a `Map` (path ->
* reason) precisely so every entry is forced to carry a recorded,
* human-reviewed reason at the call site — an entry without one is
* impossible by construction (there is no positional/array form that would
* let a path be added without a paired reason string).
*
* Adding an entry requires a recorded reason and should be rare: prefer
* fixing the classifier (a new CATEGORIES signal) when the real-OS need IS
* expressible as content; reach for this map only when it structurally is
* not.
*
* Current entries:
* - tests/external-descriptor-confinement.test.cjs: exercises `isPathConfined`
* (src/external-descriptor-trust.cts:41-49), which calls the AMBIENT
* `path` module directly — `path.resolve(root, target)` and `path.sep` —
* with no platform/path injection seam. Its win32 semantics (drive
* letters, UNC paths, `\` separator) are therefore only reachable by
* actually running on Windows; the win32 branch is unreachable on Linux.
* This is a security-relevant write-confinement gate, so a silent gap
* here is a security regression, not a coverage nit (#4641).
*/
const ALWAYS_REAL_OS = new Map([
[
'tests/external-descriptor-confinement.test.cjs',
'Exercises isPathConfined (src/external-descriptor-trust.cts:41-49), which uses the ambient ' +
'path module (path.resolve/path.sep) with no platform injection; its win32 branch (drive ' +
'letters, UNC paths, \\ separator) is unreachable on Linux. Security-relevant write-confinement gate.',
],
]);
/**
* macOS-specific detection categories (#4593, design doc
@@ -274,15 +357,20 @@ function classifyTree(testsDir) {
const unitFiles = absoluteFiles.filter((absPath) => suiteOf(absPath) === null);
const flagged = [];
for (const absPath of unitFiles) {
const rel = 'tests/' + path.relative(testsDir, absPath).replace(/\\/g, '/');
const content = fs.readFileSync(absPath, 'utf8');
const { needsRealOs } = classifyContent(content);
if (needsRealOs) {
const rel = path.relative(testsDir, absPath).replace(/\\/g, '/');
flagged.push('tests/' + rel);
// The ALWAYS_REAL_OS escape hatch (Windows tier only — see its doc
// comment) is unioned in HERE, keyed off a file that this walk actually
// found, rather than blindly appended regardless of `testsDir` — that
// keeps the escape hatch from leaking a real-repo path into an unrelated
// temp-fixture-tree classification (e.g. this module's own tests).
if (needsRealOs || ALWAYS_REAL_OS.has(rel)) {
flagged.push(rel);
}
}
flagged.sort();
return { total: absoluteFiles.length, files: flagged };
const result = [...new Set(flagged)].sort();
return { total: absoluteFiles.length, files: result };
}
/**
@@ -458,6 +546,7 @@ module.exports = {
classifyContent,
CATEGORIES,
NOISY_FOR_SOURCE_REACHABILITY,
ALWAYS_REAL_OS,
walkTestFiles,
classifyTree,
renderGeneratedFile,

283
scripts/lib/platform-conformance-tier.generated.cjs
View File

@@ -3,41 +3,19 @@
module.exports = {
CONFORMANCE_TIER_FILES: [
"tests/active-workstream-store.test.cjs",
"tests/active-workstream-store.unit.test.cjs",
"tests/adr-15-progress-converge.test.cjs",
"tests/adr-22-plan-drift-guard.test.cjs",
"tests/adr-612-bracket-coherence.test.cjs",
"tests/adr-612-bracket-phase-counting.test.cjs",
"tests/adr-612-bracket-read-tolerance.test.cjs",
"tests/adr-index-gate.test.cjs",
"tests/adr857-core-without-capabilities.test.cjs",
"tests/advance-plan-ambiguous-phase.test.cjs",
"tests/agent-frontmatter.test.cjs",
"tests/agent-hint-routing-1689.test.cjs",
"tests/agent-install-check.test.cjs",
"tests/agent-install-validation.test.cjs",
"tests/agent-skills.test.cjs",
"tests/ai-evals.test.cjs",
"tests/antigravity-upgrades.test.cjs",
"tests/api-coverage-gate-e2e.test.cjs",
"tests/api-coverage.test.cjs",
"tests/assumption-delta-checkpoint-e2e.test.cjs",
"tests/assumption-delta.test.cjs",
"tests/audit-command-cutover.test.cjs",
"tests/audit-open-remainder-count.test.cjs",
"tests/audit-uat-acknowledged.test.cjs",
"tests/audit-uat-summary-segmentation.test.cjs",
"tests/audit-workstream-layouts.test.cjs",
"tests/augment-upgrades.test.cjs",
"tests/autonomous-converge.test.cjs",
"tests/autonomous-interactive.test.cjs",
"tests/benchmark-compact-content.test.cjs",
"tests/branch-no-track-guard.test.cjs",
"tests/broken-windows-description.test.cjs",
"tests/broken-windows.test.cjs",
"tests/bugs-1656-1657.test.cjs",
"tests/canary-version-leak-lint.test.cjs",
"tests/capability-cli.test.cjs",
"tests/capability-command-dispatch.test.cjs",
"tests/capability-consent.test.cjs",
@@ -45,152 +23,79 @@ module.exports = {
"tests/capability-lifecycle.test.cjs",
"tests/capability-loader.test.cjs",
"tests/capability-lock-mkdir-failure-3987.test.cjs",
"tests/capability-precedence-parity.test.cjs",
"tests/capability-probe-fallback.test.cjs",
"tests/capability-registry.test.cjs",
"tests/capability-source.test.cjs",
"tests/capability-state.test.cjs",
"tests/capability-trust.test.cjs",
"tests/capability-writer.test.cjs",
"tests/changeset-cli.test.cjs",
"tests/changeset-github-release-notes.test.cjs",
"tests/changeset-lint.test.cjs",
"tests/changeset-new.test.cjs",
"tests/check-contract-drift.test.cjs",
"tests/check-env.test.cjs",
"tests/check-gap-analysis-plan-post-e2e.test.cjs",
"tests/check-glossary-refs.test.cjs",
"tests/check-tdd-review-checkpoint-e2e.test.cjs",
"tests/check-ui-plan-gate.test.cjs",
"tests/check-ui-safety-gate.test.cjs",
"tests/check-update-config-dir.test.cjs",
"tests/chunked-planning-parallel.test.cjs",
"tests/ci-docs-guard-registry.test.cjs",
"tests/ci-next-health.test.cjs",
"tests/ci-pr-mergeability.test.cjs",
"tests/ci-rebase-check.test.cjs",
"tests/ci-test-scope.test.cjs",
"tests/cjs-command-router-adapter.test.cjs",
"tests/claude-md-path.test.cjs",
"tests/claude-md.test.cjs",
"tests/claude-orchestration-command-router.test.cjs",
"tests/claude-orchestration.test.cjs",
"tests/claude-skills-migration.test.cjs",
"tests/cli-exit.test.cjs",
"tests/cline-install.test.cjs",
"tests/clock-seam.test.cjs",
"tests/clock.test.cjs",
"tests/close-phase-todos-padded-resolves.test.cjs",
"tests/code-review-command.test.cjs",
"tests/code-review-depth.test.cjs",
"tests/code-review-fix-pipeline-regression.test.cjs",
"tests/code-review-pipeline-regression.test.cjs",
"tests/code-review-tier3-files-override-scoping.test.cjs",
"tests/code-review.test.cjs",
"tests/codebuddy-install.test.cjs",
"tests/codebuddy-upgrades.test.cjs",
"tests/codex-config-agents.test.cjs",
"tests/codex-config-hooks.test.cjs",
"tests/codex-config-install.test.cjs",
"tests/codex-config.test.cjs",
"tests/codex-declarative-reference.test.cjs",
"tests/codex-inherit-smoke.test.cjs",
"tests/command-contract.test.cjs",
"tests/command-routing-hub.test.cjs",
"tests/commands.test.cjs",
"tests/commit-docs-bypass.test.cjs",
"tests/commit-files-deletion.test.cjs",
"tests/commit-files-pathspec.test.cjs",
"tests/commonjs-marker.test.cjs",
"tests/compact-content-4139.test.cjs",
"tests/compact-content-partition-guard.test.cjs",
"tests/completion-predicate-drift-guard.test.cjs",
"tests/completion-ratio-scope-withholding.test.cjs",
"tests/completion-ratio-single-owner.test.cjs",
"tests/concurrency-safety.test.cjs",
"tests/config-defaults-runtime-exclusion.test.cjs",
"tests/config-field-docs.test.cjs",
"tests/config-get-default.test.cjs",
"tests/config-loader.test.cjs",
"tests/config-schema.property.test.cjs",
"tests/config.test.cjs",
"tests/configuration-migrate-config.test.cjs",
"tests/context-drift.test.cjs",
"tests/context-predicates-query.test.cjs",
"tests/copilot-install.test.cjs",
"tests/copilot-upgrades.test.cjs",
"tests/core-utils.test.cjs",
"tests/coverage-metadata-parser.test.cjs",
"tests/coverage-uat-routing.test.cjs",
"tests/cursor-hook-workspace-roots.test.cjs",
"tests/cursor-hooks.test.cjs",
"tests/cursor-reviewer.test.cjs",
"tests/cursor-subagent-isolation.test.cjs",
"tests/debug-session-manager-commit.test.cjs",
"tests/decisions.test.cjs",
"tests/declarative-reference-antigravity.test.cjs",
"tests/declarative-reference-augment.test.cjs",
"tests/declarative-reference-codebuddy.test.cjs",
"tests/declarative-reference-copilot.test.cjs",
"tests/declarative-reference-windsurf.test.cjs",
"tests/declarative-reference-zcode.test.cjs",
"tests/default-flip-documentation-lint.test.cjs",
"tests/dispatcher.test.cjs",
"tests/docs-hooks-table-parity.test.cjs",
"tests/docs-parity-live-registry.test.cjs",
"tests/docs-update.test.cjs",
"tests/drift-detection.test.cjs",
"tests/edge-probe-spec-phase-contract.test.cjs",
"tests/edge-probe.test.cjs",
"tests/edit-phase-milestone-scope-guard.test.cjs",
"tests/edit-phase.test.cjs",
"tests/effort-surface-axis.test.cjs",
"tests/effort-sync-installed-runtime.test.cjs",
"tests/emitted-ack-trailer.test.cjs",
"tests/emitted-attribution.test.cjs",
"tests/emitted-caps-gate.test.cjs",
"tests/emitted-provenance.test.cjs",
"tests/emitted-sizes.test.cjs",
"tests/ensure-runtime-build.test.cjs",
"tests/enumeration-single-owner.test.cjs",
"tests/eslint-glob-coverage.test.cjs",
"tests/eslint-rules.test.cjs",
"tests/estimate-calibrate.test.cjs",
"tests/estimate-loop-convergence.test.cjs",
"tests/execute-mvp-tdd-gate.test.cjs",
"tests/execute-phase-decimal-arithmetic.test.cjs",
"tests/execute-phase-wave.test.cjs",
"tests/execute-phase-worktree-guard.test.cjs",
"tests/execute-plan-update-codebase-map-diff-base.test.cjs",
"tests/execute-wave-post-gate-pipeline-e2e.test.cjs",
"tests/executed-plan.test.cjs",
"tests/executor-mvp-tdd-section.test.cjs",
"tests/exit-code-registry.test.cjs",
"tests/explore-command.test.cjs",
"tests/external-descriptor-confinement.test.cjs",
"tests/failing-direction.test.cjs",
"tests/fallow-runner.test.cjs",
"tests/faulty-deps.test.cjs",
"tests/feat-2296-provider-escalation.test.cjs",
"tests/feat-2483-review-claude-mds-guard.test.cjs",
"tests/feat-2646-deferred-items-audit-scanner.test.cjs",
"tests/feat-3881-yaml-parser-consequences.test.cjs",
"tests/features-index-gate.test.cjs",
"tests/fixture-builder.test.cjs",
"tests/frontmatter-cli.test.cjs",
"tests/frontmatter.test.cjs",
"tests/gap-checker.property.test.cjs",
"tests/gate-predicate-evaluator-missing.test.cjs",
"tests/gemini-runtime-removed.test.cjs",
"tests/gen-context-index.test.cjs",
"tests/gen-health-docs.test.cjs",
"tests/gen-registry.test.cjs",
"tests/gen-section-manifest.test.cjs",
"tests/gen-state-md-docs.test.cjs",
"tests/git-base-branch.test.cjs",
"tests/git-fixture.test.cjs",
"tests/golden-install-tree.test.cjs",
"tests/graphify-command-cutover.test.cjs",
"tests/graphify-graph-path.test.cjs",
"tests/graphify-visualization.test.cjs",
"tests/graphify.test.cjs",
@@ -198,26 +103,12 @@ module.exports = {
"tests/gsd-check-update-worker-atomic-cache.test.cjs",
"tests/gsd-check-update-worker-platform-gate.test.cjs",
"tests/gsd-mcp-server-bin.test.cjs",
"tests/gsd-quick-batch-merge-integration.test.cjs",
"tests/gsd-quick-batch-workflow.test.cjs",
"tests/gsd-secret-read-guard.test.cjs",
"tests/gsd-settings-advanced.test.cjs",
"tests/gsd-statusline.test.cjs",
"tests/gsd-tools-path-refs.test.cjs",
"tests/gsd-validate-commit-crash-policy.test.cjs",
"tests/gsd-write-guard.property.test.cjs",
"tests/gsd-write-guard.test.cjs",
"tests/gsd2-import.test.cjs",
"tests/hardcoded-paths.test.cjs",
"tests/health-diagnostic-rules/agent-install.test.cjs",
"tests/health-diagnostic-rules/config-validation.test.cjs",
"tests/health-diagnostic-rules/consistency.test.cjs",
"tests/health-diagnostic-rules/phase-structure.test.cjs",
"tests/health-diagnostic-rules/root-existence.test.cjs",
"tests/health-diagnostic-rules/state-consistency.test.cjs",
"tests/health-diagnostic-rules/worktree-health.test.cjs",
"tests/health-diagnostic.test.cjs",
"tests/health-validation.test.cjs",
"tests/helpers-cleanup.test.cjs",
"tests/helpers-process-isolation.test.cjs",
"tests/hermes-skills-migration.test.cjs",
@@ -225,141 +116,71 @@ module.exports = {
"tests/hooks-crash-policy.test.cjs",
"tests/hooks-opt-in.test.cjs",
"tests/host-integration.test.cjs",
"tests/host-runtime-detection.test.cjs",
"tests/ingest-docs.test.cjs",
"tests/init-debug.test.cjs",
"tests/init-manager.test.cjs",
"tests/init.test.cjs",
"tests/injection-blocking-config.test.cjs",
"tests/inline-plan-threshold.test.cjs",
"tests/install-fs-adapter-seam.test.cjs",
"tests/install-minimal-hooks.test.cjs",
"tests/install-nested-layout.test.cjs",
"tests/install-path-detection.test.cjs",
"tests/install-regressions.test.cjs",
"tests/install-runtime-artifacts.test.cjs",
"tests/install-scope.test.cjs",
"tests/install-write-confinement.test.cjs",
"tests/install.test.cjs",
"tests/installed-surface-resolver.test.cjs",
"tests/installer-migration-antigravity-retire-confighome-artifacts.test.cjs",
"tests/installer-migration-authoring.test.cjs",
"tests/installer-migration-config-root-marker.test.cjs",
"tests/installer-migration-pi-retire-hooks-dir.test.cjs",
"tests/installer-migration-prune-stale-pristine.test.cjs",
"tests/installer-migration-rename-gsd-core.test.cjs",
"tests/installer-migration-report.test.cjs",
"tests/installer-migrations-manifest-schema.test.cjs",
"tests/installer-migrations.test.cjs",
"tests/intel-command-cutover.test.cjs",
"tests/intel.test.cjs",
"tests/inventory-manifest-sync.test.cjs",
"tests/inventory-nested-families.test.cjs",
"tests/io.test.cjs",
"tests/isolation-sentinel.test.cjs",
"tests/kilo-upgrades.test.cjs",
"tests/kimi-agent-converter.test.cjs",
"tests/kimi-normalize-payload.property.test.cjs",
"tests/kimi-upgrades.test.cjs",
"tests/kimi-variant-disambiguation.test.cjs",
"tests/learnings.test.cjs",
"tests/legacy-cleanup-config-dir.test.cjs",
"tests/lint-allow-test-rule-refs.test.cjs",
"tests/lint-compiled-artifact-sync.test.cjs",
"tests/lint-docs-command-form.test.cjs",
"tests/lint-frontmatter-scalar-broad-grep.test.cjs",
"tests/lint-hooks-runtime-build-seam.test.cjs",
"tests/lint-legacy-dir-name.test.cjs",
"tests/lint-planning-artifact-writer-drift.test.cjs",
"tests/lint-pr-check-project-dir.test.cjs",
"tests/lint-regression-test-names.test.cjs",
"tests/lint-seam-enforcement.test.cjs",
"tests/lint-skill-deps.test.cjs",
"tests/lint-test-file-count.test.cjs",
"tests/lint-workflow-shellcheck-fetch.test.cjs",
"tests/list-seeds.test.cjs",
"tests/live-config-guard.test.cjs",
"tests/live-dom-uat.test.cjs",
"tests/lockfile-cve-audit.test.cjs",
"tests/locking-bugs-1909-1916-1925-1927.test.cjs",
"tests/loop-hooks-empty-points-e2e.test.cjs",
"tests/loop-hooks-ship-pre-e2e.test.cjs",
"tests/loop-hooks-verify-post-e2e.test.cjs",
"tests/loop-render-hooks.test.cjs",
"tests/managed-hooks.test.cjs",
"tests/manifest-version-sync.test.cjs",
"tests/markdown-table.test.cjs",
"tests/mcp-catalog.property.test.cjs",
"tests/mcp-catalog.test.cjs",
"tests/milestone-archive.test.cjs",
"tests/milestone-lock.test.cjs",
"tests/milestone-prefixed-convention.test.cjs",
"tests/milestone-window-drift-guard.test.cjs",
"tests/milestone-window-single-owner.test.cjs",
"tests/milestone.test.cjs",
"tests/model-omit-when-inherit-guard.test.cjs",
"tests/model-profiles.test.cjs",
"tests/model-resolver.test.cjs",
"tests/mutation-matrix-ratchet.test.cjs",
"tests/mutation-score-ratchet.test.cjs",
"tests/mutation-workflow-base-ref.test.cjs",
"tests/mvp-phase-integration.test.cjs",
"tests/new-milestone-clear-phases.test.cjs",
"tests/next-decimal-roadmap-scan.test.cjs",
"tests/next-up-clear-order.test.cjs",
"tests/no-bare-gsd-tools-command-position.test.cjs",
"tests/no-bare-npm-exec.rule.test.cjs",
"tests/no-dead-sdk-refs.test.cjs",
"tests/no-exact-case-env-access.rule.test.cjs",
"tests/no-hardcoded-home-gsd-tools.test.cjs",
"tests/no-hardcoded-tmp.rule.test.cjs",
"tests/no-path-literal-in-assert.rule.test.cjs",
"tests/no-pending-3212-markers.test.cjs",
"tests/no-phantom-issue-refs.test.cjs",
"tests/no-posix-mode-bit-assert.rule.test.cjs",
"tests/no-private-binary-resolution.rule.test.cjs",
"tests/no-rendered-text-length-assert.rule.test.cjs",
"tests/no-swallowed-precondition.rule.test.cjs",
"tests/no-unbounded-dirname-walk.rule.test.cjs",
"tests/no-unbounded-spawn-allowlist.test.cjs",
"tests/no-unbounded-spawn.test.cjs",
"tests/no-unguarded-nonportable-exec.rule.test.cjs",
"tests/normalize-path-in-content.rule.test.cjs",
"tests/normalize-test-command.test.cjs",
"tests/npm-audit-baseline.test.cjs",
"tests/npm-integrity-gate.test.cjs",
"tests/onboard-command.test.cjs",
"tests/opencode-command-dir-plural.test.cjs",
"tests/opencode-permissions.test.cjs",
"tests/opencode-plugin-adapter.test.cjs",
"tests/orphan-worktree-detection.test.cjs",
"tests/orphaned-hooks.test.cjs",
"tests/overlay-repo-helpers.test.cjs",
"tests/package-name-single-source.test.cjs",
"tests/packaging-shipped-scripts-require-only-shipped.test.cjs",
"tests/parallel-dependent-plans.test.cjs",
"tests/path-replacement.test.cjs",
"tests/pattern-mapper.test.cjs",
"tests/pattern.test.cjs",
"tests/pause-work-context-detection.test.cjs",
"tests/pause-work-improvements.test.cjs",
"tests/perf-317-context-monitor-fs.test.cjs",
"tests/phase-command-router.test.cjs",
"tests/phase-completion-single-owner.test.cjs",
"tests/phase-estimation.test.cjs",
"tests/phase-id-drift-guard.test.cjs",
"tests/phase-locator.test.cjs",
"tests/phase-resolution-parity.test.cjs",
"tests/phase-tdd-applicable.test.cjs",
"tests/phase.test.cjs",
"tests/phase6-capstone-conformance.test.cjs",
"tests/phases-command-router.test.cjs",
"tests/pi-config-dir-env-override.test.cjs",
"tests/pi-extension-reachability.test.cjs",
"tests/pick-flag.test.cjs",
"tests/plan-bounce.test.cjs",
"tests/plan-count-single-owner.test.cjs",
"tests/plan-phase-drift-guard.test.cjs",
"tests/plan-phase-mvp-flag.test.cjs",
"tests/plan-phase-stall-detection.test.cjs",
"tests/plan-pre-hook-e2e.test.cjs",
"tests/plan-review-convergence.test.cjs",
@@ -367,187 +188,85 @@ module.exports = {
"tests/planning-inspect.unit.test.cjs",
"tests/planning-lock-mkdir-failure-1884.test.cjs",
"tests/planning-prompt-drift.test.cjs",
"tests/planning-snapshot-bypass-drift.test.cjs",
"tests/planning-snapshot.test.cjs",
"tests/planning-workspace.test.cjs",
"tests/platform-conformance-tier.test.cjs",
"tests/platform-guard.unit.test.cjs",
"tests/playwright-ui-verify.test.cjs",
"tests/plugin-manifest.test.cjs",
"tests/policy-160-route0-resume.test.cjs",
"tests/policy-shell-pinning.test.cjs",
"tests/portability-rule-disable-ban.test.cjs",
"tests/portability-vocab-drift.test.cjs",
"tests/post-planning-gaps-2493.test.cjs",
"tests/pr-branch-planning-filter.test.cjs",
"tests/precommit-alias-drift-hook.test.cjs",
"tests/precondition-element.test.cjs",
"tests/prepush-enterprise-email-hook.test.cjs",
"tests/probe-core.test.cjs",
"tests/process-seam.test.cjs",
"tests/profile-output.test.cjs",
"tests/profile-pipeline.test.cjs",
"tests/prohibition-enforcement.test.cjs",
"tests/prohibition-probe.verify-tier.test.cjs",
"tests/project-instruction-file-parity.test.cjs",
"tests/project-root.test.cjs",
"tests/prompt-budget-cli.test.cjs",
"tests/prune-orphaned-worktrees.test.cjs",
"tests/quick-batch-command-router.test.cjs",
"tests/quick-batch.test.cjs",
"tests/quick-branching.test.cjs",
"tests/quick-research.test.cjs",
"tests/quick-review-scope-tip-bound.test.cjs",
"tests/qwen-upgrades.test.cjs",
"tests/read-guard.test.cjs",
"tests/read-injection-scanner.property.test.cjs",
"tests/reapply-patches.test.cjs",
"tests/reapply-verify-hunks.test.cjs",
"tests/refactor-trigger-cli.test.cjs",
"tests/registry-reviewer-parity.test.cjs",
"tests/release-hotfix-empty-cherry-pick.test.cjs",
"tests/removed-but-needed-lint.test.cjs",
"tests/repo-invariants.test.cjs",
"tests/repo-layout.test.cjs",
"tests/representative-corpus.test.cjs",
"tests/require-fs-op-fallback.rule.test.cjs",
"tests/require-full-tmpdir-triad.rule.test.cjs",
"tests/require-issue-link-policy.test.cjs",
"tests/require-userprofile-with-home.rule.test.cjs",
"tests/research-cli.test.cjs",
"tests/research-store.test.cjs",
"tests/resolve-execution-dynamic-routing.test.cjs",
"tests/resolver-hoist-guard.test.cjs",
"tests/response-language-coverage.test.cjs",
"tests/retired-artifact-cleanup.test.cjs",
"tests/reversibility-tagging.test.cjs",
"tests/review-build-prompt-optional-sections.test.cjs",
"tests/review-default-reviewers-config.test.cjs",
"tests/review-default-reviewers-workflow.test.cjs",
"tests/review-lane-descriptor.test.cjs",
"tests/review-lane-invocation.test.cjs",
"tests/review-lane-runner.test.cjs",
"tests/review-lane-windows-spawn-resolution.test.cjs",
"tests/review-model-config.test.cjs",
"tests/review-parallel-lanes.test.cjs",
"tests/review-plan-coverage-manifest.test.cjs",
"tests/review-reviewer-instances-config.test.cjs",
"tests/reviewer-config-federation.test.cjs",
"tests/reviewer-docs-parity.test.cjs",
"tests/reviewer-lane-declarations.test.cjs",
"tests/reviewer-manifest-body.test.cjs",
"tests/reviewer-step-dispatch.test.cjs",
"tests/reviewer-trust-disclosure.test.cjs",
"tests/revision-remediation-binding.test.cjs",
"tests/roadmap-mode-field.test.cjs",
"tests/roadmap-parser.test.cjs",
"tests/roadmap-phase-fallback.test.cjs",
"tests/roadmap-upgrade.test.cjs",
"tests/roadmap.test.cjs",
"tests/roadmapper-granularity.test.cjs",
"tests/run-tests-harness.test.cjs",
"tests/run-tests-temp-root.test.cjs",
"tests/run-with-timeout.test.cjs",
"tests/runtime-artifact-install-plan.test.cjs",
"tests/runtime-artifact-layout-descriptor-drive.test.cjs",
"tests/runtime-artifact-layout-install-profiles.test.cjs",
"tests/runtime-artifact-layout-surface.test.cjs",
"tests/runtime-artifact-layout.test.cjs",
"tests/runtime-converters.test.cjs",
"tests/runtime-homes-descriptor-drive.test.cjs",
"tests/runtime-homes.property.test.cjs",
"tests/runtime-identity.test.cjs",
"tests/runtime-launcher-parity.test.cjs",
"tests/runtime-name-policy.test.cjs",
"tests/safe-resume-gate-anchoring.test.cjs",
"tests/schema-drift.test.cjs",
"tests/sdk-removal-query-family-dispatch.test.cjs",
"tests/section-manifest-init-facts.test.cjs",
"tests/section-manifest.test.cjs",
"tests/security.test.cjs",
"tests/settings-integrations.test.cjs",
"tests/settings-jsonc.test.cjs",
"tests/sh-hook-paths.test.cjs",
"tests/shadow-report.test.cjs",
"tests/shared-hooks-dir-resolution.test.cjs",
"tests/shell-command-projection-dispatch.test.cjs",
"tests/shell-command-projection-path-sep.test.cjs",
"tests/ship-notes-wedged-pr.test.cjs",
"tests/shipped-reference-cites.test.cjs",
"tests/skill-frontmatter-contract.test.cjs",
"tests/skill-manifest.test.cjs",
"tests/slash-command-namespace.test.cjs",
"tests/slug-derivation-drift-guard.test.cjs",
"tests/smart-entry.unit.test.cjs",
"tests/spec-section.test.cjs",
"tests/stale-bake-guard.test.cjs",
"tests/state-command-cutover.test.cjs",
"tests/state-contract.test.cjs",
"tests/state-document.test.cjs",
"tests/state-field-drift.test.cjs",
"tests/state-io.test.cjs",
"tests/state-prune.test.cjs",
"tests/state-rebuild-cli.test.cjs",
"tests/state-todos-render.test.cjs",
"tests/state-transition.test.cjs",
"tests/state-write-path-drift-guard.test.cjs",
"tests/state.test.cjs",
"tests/stats-mvp-display.test.cjs",
"tests/stats-phase-id-shape.test.cjs",
"tests/subagent-timeout.test.cjs",
"tests/summary-status-blocked-3345.test.cjs",
"tests/surface-md-paths.regression.test.cjs",
"tests/sync-skills-cross-runtime-refuse.test.cjs",
"tests/table-schema-drift-lint.test.cjs",
"tests/tdd-backend-wiring.test.cjs",
"tests/tdd-mode.test.cjs",
"tests/tdd-red-evidence.test.cjs",
"tests/tdd-single-statement.test.cjs",
"tests/teams-status.test.cjs",
"tests/template.test.cjs",
"tests/thinking-partner.test.cjs",
"tests/todos-done-rename-guard.test.cjs",
"tests/todos-workstream-scope.test.cjs",
"tests/tracer-bullet.test.cjs",
"tests/trae-imperative-reference.test.cjs",
"tests/tsconfig-noemit.test.cjs",
"tests/uat-predicate.test.cjs",
"tests/uat.test.cjs",
"tests/ui-spec-inventory-provenance.test.cjs",
"tests/ultraplan-phase.test.cjs",
"tests/unreachable-guard-drift.test.cjs",
"tests/unreachable-shell-guard.test.cjs",
"tests/unusable-input.test.cjs",
"tests/update-context.test.cjs",
"tests/update-custom-backup.test.cjs",
"tests/update-workflow.test.cjs",
"tests/user-artifact-staging.test.cjs",
"tests/validate-context.test.cjs",
"tests/validate-registry.test.cjs",
"tests/verification-status.test.cjs",
"tests/verify-archive-dirs-live-path.test.cjs",
"tests/verify-command-grounding.test.cjs",
"tests/verify-health.test.cjs",
"tests/verify.test.cjs",
"tests/vscode-browser-no-node-api.test.cjs",
"tests/vscode-extension-reachability.test.cjs",
"tests/windows-robustness.test.cjs",
"tests/windsurf-conversion.test.cjs",
"tests/windsurf-hooks-bridge.test.cjs",
"tests/windsurf-install.test.cjs",
"tests/workflow-compat.test.cjs",
"tests/workflow-fragments.test.cjs",
"tests/workflow-guard.test.cjs",
"tests/workflow-maintainer-skip.test.cjs",
"tests/workflow-shell-pinning.test.cjs",
"tests/workspace.test.cjs",
"tests/workstream-inventory.test.cjs",
"tests/workstream-scoped-paths.test.cjs",
"tests/workstream.test.cjs",
"tests/worktree-base-ref.test.cjs",
"tests/worktree-baseref-install.test.cjs",
"tests/worktree-cleanup.test.cjs",
"tests/worktree-safety-reap.test.cjs",
"tests/worktree-safety.test.cjs",
"tests/worktree.test.cjs",
],

6
scripts/lint-docs-guard-registration.exempt-baseline.cjs
View File

@@ -125,8 +125,12 @@ const DOCS_GUARD_EXEMPT_DOCS_PATHS = {
'docs/how-to/some-unrelated-guide.md', 'docs/how-to/x.md', 'docs/some-unrelated-file.md',
'docs/totally-unrelated.md',
],
// #4641: cites docs/adr/4641-windows-selector-consolidation.md in an
// explanatory comment describing why the retired `windows` scope must not
// be restored; the file never reads that (or any) docs/ file.
'ci-test-scope.test.cjs': [
'docs/a.md', 'docs/adr', 'docs/adr/22-plan-drift-guard.md', 'docs/how-to/configure-model-profiles.md',
'docs/a.md', 'docs/adr', 'docs/adr/22-plan-drift-guard.md',
'docs/adr/4641-windows-selector-consolidation.md', 'docs/how-to/configure-model-profiles.md',
'docs/installer-migrations.md', 'docs/ja-JP', 'docs/ja-JP/USAGE.md', 'docs/usage.md', 'docs/x.md',
],
'cline-install.test.cjs': ['docs/guide.md'],