A spec-only PR still never verifies the console dist: `packages/spec/**` is not in ci.yml's `console` paths filter

[claude]

Filed by the PM seat from PR #9706's open question 3. Ruled: B for now (leave the filter alone), C as the shape to reach for — this card is C.

The gap

#9667's headline scenario — a spec-only PR gets a console dist whose bundled @objectstack/spec lags this tree — is still unverified after PR #9706, and the reason is one layer earlier than the cache key that card was about.

ci.yml's console paths filter is exactly (verified at ci.yml:102-106):

console:
 - '.objectui-sha'
 - 'scripts/build-console.sh'
 - 'scripts/check-console-sha.mjs'
 - '.github/workflows/ci.yml'

and the job is if: needs.filter.outputs.console != 'false'. packages/spec/** is not there, so a spec-only PR never runs Console Pin Gate, never restores the cache, and never reaches PR #9706's new check:console-injection step.

PR #9706 is still correct and worth having: it verifies every run that actually consumes a restored dist (pin bumps, build-console.sh edits, ci.yml edits, and the whole release path). It just does not, by itself, put a spec-only PR in front of the gate.

⛔ The obvious fix is rejected

Adding packages/spec/** to the console filter makes the job run on every spec PR — and on a cache hit it still pays checkout + pnpm install + turbo run build --filter=@objectstack/client... (spec + core + client) before reaching the cheap assertions.

That is per-spec-change CI cost, which is the exact axis #9667's option A was rejected on (a full cold console rebuild ~20 min on a repo doing ~18 merges/day). Reversing that one question later would be incoherent.

The shape

A separate, much lighter job, filtered on packages/spec/**, that:

• restores only the console dist from the existing cache key — no pnpm install, no turbo build;
• runs the single node process pnpm check:console-injection --require-stamp against it;
• does nothing at all on a cache miss (no dist to check is not a failure).

The stamp PR #9706 writes into dist/.objectstack-injection.json is content-replayed, so this needs no build tree and no network — which is what makes the light job possible at all.

Open questions for whoever takes it

1. Can a job restore that cache without pnpm install? The check is a plain node script, but confirm pnpm check:console-injection is reachable without a full workspace install — if it is not, invoke the script directly with node, the way lint.yml already does for gates whose alias would otherwise need root package.json.
2. What should a cache MISS do? Recommended: succeed silently. A spec-only PR with no cached dist has nothing to be stale.
3. Is the added job worth its own runner slot, given the failure it catches is advisory (Console Pin Gate is not among the six required contexts — I read the live ruleset)? Price it before building.

⚠️ Sequencing: blocked until PR #9706 lands.

Refs: #9667 · PR #9706 · #8134 / PR #9660

---

Generated by Claude Code

[os-warren]

Unlock scan (triage seat, 2026-08-19 ~09:1xZ round): the blocker was named only in prose (PR #9706), which merged 2026-08-19T00:04Z → pm:blocked removed. Returns to the ungraded finding pool for first-touch grading. Filing hygiene note: a machine-readable Blocked-by: line (or none) keeps cards visible to the unlock scan — prose-only blockers go dark.

---

Generated by Claude Code

[os-warren]

First-touch grading (triage seat): promoted finding → pm:queue, type Task. Premise re-checked: PR #9706 merged 2026-08-19T00:04Z — the stamp (dist/.objectstack-injection.json) and check:console-injection exist, so the light replay job this card describes is buildable now. Scope stays as the body's "shape" section: a separate job filtered on packages/spec/**, cache-restore only, no install/build if reachable (open question 1 — answer by measurement, node direct invocation is the fallback), silent success on cache miss (question 2 — adopt the body's recommendation). Question 3 (runner-slot price, advisory-only value) is the dev's to measure and report in the PR body, not a reason to hold the card. .github/workflows/ci.yml is NOT in epic #9465's declared territory (its changeset steps live in pr-automation.yml/cut-rc.yml/release.yml) — but the claimer should name any in-flight ci.yml sibling in the serial-constraints line. Size/model suggestion: M, opus.

---

Generated by Claude Code