ci(spec): run the check:generated ledger reconciliation on every PR - #4257
Merged
Conversation
…4255) The aggregate reconciles its GATED/NO_GENERATOR ledger against package.json on every run, in both directions — but only where the aggregate runs, which was locally. CI runs the gates as individual steps, so a PR adding a check:/gen: script without classifying it kept every CI gate green while the wrapper AGENTS.md prescribes exited red on main at the reconcile stage, running zero gates. Twice in three days. #4177 added check:variant-docs and main stayed red for local wrappers until #4194 collided with the same wall (#4203). Then #4232 added check:strictness-ledger — found unclassified while wiring this fix, so the wrapper was red on main again at the moment of writing. Classified here as NO_GENERATOR: it audits the hand-written strictness ledger (docs/audits/) against the code it describes; there is no generator to name. The gate is a --reconcile-only mode (reconcile, report, exit — no gates; reads package.json only, no build, sub-second) wired into lint.yml's "TypeScript Type Check" job. Deliberately not ci.yml's check-generated job: its `generated` paths filter does not watch packages/spec/package.json — the one file every offending PR must touch — and both offenders' changed files missed every entry in that filter, so both skipped the job entirely. The typecheck job is unfiltered and required, so the meta-gate cannot go dormant — the reasoning that already placed check:docs, check:skill-refs and check:react-blocks there. Verified: --reconcile-only exits 0 on this tree (16 check: + 10 gen:, all classified) after catching #4232's script pre-classification; an injected unclassified script and a deleted ledger-named script both fail with the existing diagnostics; the default mode still reconciles and then runs the gates. AGENTS.md's wrapper section now states the CI backstop. Closes #4255 Refs #4203, #4232 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QCrKazC5o5a77yXd7ykaZg
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckNo hand-written docs reference the 0 changed package(s). ✅ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4255. Refs #4203, #4232.
问题
check:generated的台账双向对账只在聚合入口里跑，而 CI 逐个跑单门、从不跑聚合入口——所以"新增check:/gen:脚本而不分类"的 PR 永远 CI 全绿，落地后main上 AGENTS.md 规定的本地 wrapper 立刻在对账阶段退出，一个门都不跑。三天内发生两次：check:variant-docs，红到 fix(spec): five exported symbols resolved toany— type the recursive schemas and gate it in CI (#4171) #4194 恰好撞上同一堵墙才顺手修掉（check:generated 台账缺check:variant-docs分类——#4177 落地后本地 wrapper 在 main 上直接红 #4203）；check:strictness-ledger——写本修复时在main上当场抓到，此刻 wrapper 又是红的。把对账加进
ci.yml的check-generatedjob 无效：该 job 的generatedpaths filter 不含packages/spec/package.json（此形态 PR 必改的唯一文件），实测两个肇事 PR 的改动面对 filter 一条都不命中，job 整体被跳过。修改
check-generated.ts：新增--reconcile-only模式——只跑reconcileLedger即退出，不跑 8 个门；只读package.json与脚本内数组，无需 build，亚秒级。同时把 feat(spec): 让 #4001 严格性账本接受机器校验（首次运行抓到 11 处漂移） #4232 的check:strictness-ledger分类进NO_GENERATOR（审计手写 strictness ledger 文档，无 generator 可登记），恢复main的 wrapper 为绿。lint.yml：required 且无 paths filter 的 "TypeScript Type Check" job 新增一步跑该模式——与check:docs/check:skill-refs/check:react-blocks放这里的理由同构（门不能休眠）。AGENTS.md：wrapper 一节补一句 CI backstop 的存在。@objectstack/specpatch。验证
--reconcile-only在本分支树上 exit 0：16 check: + 10 gen:全部有归属（8 gated / 7 source audits / 2 ungated generators / 1 aggregate），计数自洽；check:strictness-ledger之前跑同一命令，即以 feat(spec): 让 #4001 严格性账本接受机器校验（首次运行抓到 11 处漂移） #4232 为真实用例抓出 exit 1——新门首跑即命中实案，与当年 reconcile 首跑抓到自己的package.json条目同款；exists in package.json but is in neither GATED nor NO_GENERATOR；删台账点名的脚本 →UNGATED_GENERATORS names gen:sbom, which package.json no longer has；lint.yml经 YAML 解析验证，新步骤位于 install 之后、check:docs之前。边界
本步骤不检验任何产物新鲜度（那是各单门的既有职责）；它守的是门的花名册本身——覆盖率账本的双向完整性，以及本地 wrapper 在
main上的可用性。🤖 Generated with Claude Code
https://claude.ai/code/session_01QCrKazC5o5a77yXd7ykaZg
Generated by Claude Code