scripts/pm/ci-failure.mjs's --self-test runs nowhere in CI, unlike its four sibling PM tools

[claude]

Raised by the domain:devx PM seat off PR #9897 (#9777), where the dev left it as an open question rather than shipping it against an explicit ruling. Ruling A was taken for that PR; this card is B.

The gap

scripts/pm/ci-failure.mjs ships with a --self-test, and nothing in CI runs it. So it can rot silently until the next agent reaches for it mid-round and finds it broken.

Why this specific tool

The failure it would prevent is the exact defect its own card was about.

PR #9897's dev found the salvaged tool "near-complete but never run live": 996 lines, offline self-test green, and it had never completed a single walk. node 22's fetch ignores HTTPS_PROXY, so every read answered 401, and the tool's own probe reported PREREQUISITE NOT MET (exit 3) — "and looked right doing it."

⇒ A retrieval tool that has stopped working presents as a tool correctly declining to work. That is not a hypothetical rot; it is the state this file was found in.

The precedent

Four sibling scripts/pm/ tools already run their --self-test as an unconditional step inside the existing Lint & Repo Gates job:

• dispatch-gates
• half-states
• the part-of guard
• the single-claim guard

ci-failure is the odd one out.

Scope

• One step in the existing Lint & Repo Gates job in .github/workflows/lint.yml.
• ⛔ No new check name, no new required context. The job's name is what the ruleset matches on, and it is unchanged — a required context is matched by check-run name, so adding a step to an existing job adds no context. Do not create a new job.
• ⚠️ It does add merge-blocking surface in the honest sense: a broken --self-test will redden Lint & Repo Gates. That is what the four siblings already accept, and it is the point — a self-test nothing runs is decoration.

Falsification worth testing

Before adding the step, confirm the four siblings are actually where they are claimed to be (job key lint:, not typecheck:). This repo has a live trap here: lint: is the required context Lint & Repo Gates; typecheck: is a separate job, and a gate added to the wrong one shows green ticks while blocking nothing. Name the job key and line you verified.

Also check the step's runtime. ci-failure --self-test is offline by design (PR #9897 reports it green with no network), but confirm it needs no network in CI — a self-test that reaches GitHub would make Lint & Repo Gates depend on API availability, which is a much worse trade than the rot it prevents.

Refs: PR #9897 / #9777 (source, and ruling A) · the four sibling tools in scripts/pm/.

---

Generated by Claude Code