ci.yml's core filter misses ten more declared cross-package test inputs — content/ (7), docs/, skills/, .github/workflows/

[claude]

Found while implementing #9829 (which closes the scripts/ case only). Filed unassigned.

What was measured

turbo.json states, per task, which paths outside a package that package's tests read — 58
$TURBO_ROOT$/… entries today, each mirroring a declaration in CROSS_PACKAGE_TEST_INPUTS
(pnpm check:cross-package-test-inputs is green: "12 package(s) read outside themselves, all
declared, and turbo.json hashes every declared glob").

Instantiating every one of those 58 declarations to a real tracked file and running it through
ci.yml's core paths-filter — with the matcher dorny/paths-filter@v4 uses, measured under both
picomatch 2.3.1 (what the action bundles) and 4.0.5 (what this tree has); the two agreed on every
row:

unschedulable declared test inputs (core=FALSE), by top-level root:
 content 7 scripts 6 docs 1 skills 1 .github 1

16 of 58 declared $TURBO_ROOT$ test inputs never schedule Test Core.

The scripts/ six are #9829, addressed in PR #10014. The remaining ten are the same defect in
four other roots:

turbo.json line	task	declared input	filter verdict
35	@objectstack/spec#test	content/docs/references/**	core=false (docs=true)
42	@objectstack/spec#test	content/docs/api/error-catalog.mdx	core=false (docs=true)
43	@objectstack/spec#test	docs/audits/2026-07-unknown-key-strictness-ledger.md	core=false
72	@objectstack/cli#test	content/docs/deployment/cli.mdx	core=false (docs=true)
73	@objectstack/cli#test	content/docs/deployment/index.mdx	core=false (docs=true)
74	@objectstack/cli#test	content/docs/permissions/authentication.mdx	core=false (docs=true)
149	@objectstack/dogfood#test	content/docs/protocol/kernel/realtime-protocol.mdx	core=false (docs=true)
161	@objectstack/formula#test	skills/objectstack-formula/**	core=false
195	create-objectstack#test	content/**	core=false (docs=true)
197	create-objectstack#test	.github/workflows/scaffold-e2e.yml	core=false

Each one is a package that declared "my tests read this file", mirrored into turbo.json so the task
hash moves, and then never scheduled at PR time when that file changes — the merge queue is the
first signal, which is the failure #7802 exists to prevent. A reader auditing turbo.json or the
declaration list would conclude the dependency is tracked.

The content/ rows are the sharpest: those seven are docs=true, so those PRs do run Build Docs, and a reader sees a green pipeline with checks in it.

Price, before anyone reaches for the filter

Over the last 100 first-parent commits on origin/main:

candidate added to a filter	commits touching it	of those, core=false today (⇒ would newly run Test Core)
content/**	16	6
.github/workflows/** (other than ci.yml)	11	6
docs/**	5	2
skills/**	2	2

Unlike the scripts/ case, a narrow filter here is plausible: nine of the ten declarations are
single files or a single subtree, so a filter naming exactly the declared paths is not the
"hand-kept list" trap — but it is still a second recognizer that has to stay in step with the
declarations, which argues for deriving the filter entries from CROSS_PACKAGE_TEST_INPUTS at gate
time (option 1 of #9829's own list, held there because it collides with PR #9826's rewrite of
scripts/check-cross-package-test-inputs.mjs). This card is the measured argument for taking that
derivation route once #9826 lands, rather than adding four more roots by hand.

Refs: #9829 (the scripts/ sixth, and the ruling that scoped it to scripts/), #10014
(implementation), #7802 (the defect the mechanism exists for), #9710 (packages/spec/** missing from
the console filter — same class, other direction), #9826 (open rewrite of the declaration gate).

---

Generated by Claude Code

---

Generated by Claude Code