ci(lint): a turbo.json package task must name a real package and a real script

[yinlianghui]

Part of #12046

Adds check:turbo-task-graph — the first gate in the repo whose declared population is turbo.json.

⚠️ Two code spans in the first version of this body were eaten by GitHub's body sanitizer (turbo run [task] --dry=json and one pkg#typecheck, both short angle-bracket fragments even inside backticks — the AGENTS.md "GitHub mutates body BYTES" clause, reproduced). They are spelled with square brackets below.

The measurement the card asked for

The card's central reading holds. check-cross-package-test-inputs.mjs' Layer B (lines 1345–1362) iterates CROSS_PACKAGE_TEST_INPUTS and looks up turbo.tasks[`${name}#test`] — nothing else. A #typecheck task is structurally invisible to it.

Option 1 (widen Layer B) was measured and rejected as dishonest. That table's own header states what it declares: "which packages' tests read outside their own directory", and the escaping detector that keeps it honest walks *.test.* files only. There is no comparable population for #typecheck or #build, so widening Layer B would mean demanding that a pkg#typecheck task carry test-derived globs — a population the gate does not police. That is the #11556 shape from the other side, which the card names as the thing not to do.

A finding the card did not have: option 1 would not have closed the derivation half either. extractWatchHints refuses a literal with no path separator, and check-cross-package-test-inputs.mjs reaches this file as join(REPO_ROOT, 'turbo.json'). Measured:

"turbo.json" -> hints [] | covers turbo.json: false
"./turbo.json" -> hints [] | covers turbo.json: false
"$TURBO_ROOT$/turbo.json" -> hints [] | covers turbo.json: false
"turbo.json/**" -> hints ["turbo.json/**"] | covers turbo.json: true

So whichever gate ends up owning turbo.json has to declare the subtree spelling — the ROOT_FILE_WATCH_HINTS idiom eight gates already use for AGENTS.md/**. This one does.

Before, at 1f6b8bb193:

$ node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack turbo.json
No check family names the given paths in its own source, and no workflow's path filter schedules one for them.

After, on this branch:

Local gates for this card (paste into the dispatch prompt):
- pnpm check:turbo-task-graph [lint.yml] matched via turbo.json ⇢ gate source 'turbo.json/**'

What the gate judges, and why that population and not a wider one

Turbo itself decides the split. Measured on turbo 2.10.10, on a fixture workspace, each case a real turbo run [task] --dry=json:

turbo.json shape	turbo's answer
@fx/nope#build — package does not exist	exit 0, no diagnostic, key never reaches the graph
@fx/a#typecheck — package has no such script	exit 0, task shown in the dry-run graph, never runs
dependsOn: ["prebuildxyz"] — unresolvable	exit 1, x Could not find "@fx/a#prebuildxyz" in root turbo.json or "prebuildxyz"

The gate takes the two silent rows and deliberately leaves dependsOn to turbo, which polices it better — re-checking it would be this gate claiming a population it does not own, which is the failure one level up.

What a silent entry costs is intent, not a red build: misspell the package or the script and the override is not applied, the task falls back to the generic definition, and every signal the author has says the edit landed.

Package membership comes from scripts/workspace-enumerator.mjs — the repo's one parse of pnpm-workspace.yaml. Importing it grants this gate no path population (that module declares none, deliberately), so turbo.json/** stays the whole of what this file names.

What it deliberately does NOT judge — stated, not discovered later

Generic keys (no #) are out of population, and the header says why with the number: test:e2e is defined in turbo.json with outputs: ["playwright-report/**", …] and held by zero of the 78 workspace packages. The real Playwright script in examples/app-showcase is spelled test:smoke, which turbo.json does not configure at all. Repairing that needs an edit to turbo.json, outside this card's declared file surface, and a gate that ships red is worse than no gate. Filed as #12373; widen the population in the same change that repairs the entry.

Ablation — both directions, restored under trap … EXIT INT TERM

No build is involved: this gate is a plain Node script that reads source at runtime, so there is no dist/ for a mutation to hide in and ablation-dist-preflight does not apply. Every mutation was confirmed on disk by grepping both the injected and the removed text before the reading was taken.

Subject mutations (turbo.json), gate unmodified:

leg	on-disk confirm	production
@objectstack/plugin-auth#typecheck → @objectstack/plugins-auth#typecheck	injected 1, removed 0	exit 1, names the key and suggests @objectstack/plugin-auth
@objectstack/spec#test → @objectstack/spec#typechek	injected 1, removed 0	exit 1, names the key and prints the 51 scripts spec does declare

Rule mutations on a clean tree — the #11150 property, that a matching rule's regression is invisible to production because the empty finding set is the fixed point of shrinking:

leg	production	--self-test
unknown-package arm disabled	exit 0, GREEN	exit 1 — an unknown package in a task key is a finding, the unknown-package finding suggests the near miss
missing-script arm disabled	exit 0, GREEN	exit 1 — a task the package has no script for is a finding, the missing-script finding prints what the package DOES declare
ROOT_FILE_WATCH_HINTS reworded to 'turbo.json'	exit 0, GREEN	exit 1 — the root file is declared in the SUBTREE spelling; and dispatch-gates turbo.json collapses back to "No check family names the given paths"

The first rule ablation initially killed the self-test with a TypeError instead of reporting named cases — the #12273 shape, where a mutation aborts the suite exactly when the instrument is being read. The two arms are now independent (scripts && !scripts.has(task)) so each ablation yields named failures; the table above is the re-run after that change.

Restore proof, both files, git hash-object before vs after: byte-identical (f79ad7085715… / a47b23984253…), and git diff --stat -- turbo.json empty.

Verification

Gate union re-derived on the real diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (no hand-written path list), at 86b3bcc195 — all 26 derived families run, exit codes captured before any pipe:

• check:turbo-task-graph — OK: 21 package-scoped turbo task(s) judged against 78 workspace package(s), self-test all cases passed
• check:cross-package-test-inputs, check-ci-filter-parity, check:entry-guard, check:parse-guard, check:agent-test-spelling, check:bash32-floor, check:cli-command-ids, check:pnpm-filter-targets, check:pnpm-acquisition, check:node-version, check:nul-bytes, check:required-contexts, check:aggregator-roster, check:step-collectors, check:self-test-wired, check:self-test-workflow-commands, check:whole-set-label-write, check:workflow-status-functions, check:shard-attestation, check:pm-dispatch-gates (664 cases), scripts/pm/ci-failure.mjs --self-test, scripts/docs-audit/check-drift-comment.mjs — all exit 0
• check:type-check-coverage and check:type-check-debt --re-measure on a built closure, under the shared verify lock: 32 ledger entr(ies) re-measured in 287.0s, 1843 raw tsc error(s) total, none above its recorded number
• pnpm lint (eslint . --no-inline-config, the full repo, not a narrowing) — exit 0, under the lock

bare-root-worklist owes nothing here.--self-test: 46 live row(s), 39 unreachable as spelled, 39 recorded verdict(s) — none stale, none missing, unchanged with this gate present. The species is a population constant holding a bare single-segment top-level directory word; turbo.json/** carries a separator (so bareRootLiterals skips it as already visible), turbo.json is a file rather than a directory, and this gate names no bare root anywhere. So scripts/pm/bare-root-worklist.mjs is untouched.

No changeset: root package.json is private: true and nothing published changes — skip-changeset, matching #12346 / #12347 / #12338, which shipped the same way. ⚠️ The label itself could not be applied from this seat: api.github.com refuses direct REST here (GitHub access is not enabled for this session), and the MCP write path resolves a PR number as an Issue and fails. Needs a hand.

Generated by Claude Code

[yinlianghui]

ACCEPT — devx@objectstack seat (#6023), R9

Reviewed against the diff. Lint & Repo Gates (id 97961849473) read by name: completed + success. Ready + auto-merge SQUASH.

The Zone 1 constraint this had to navigate, and how it did

The dispatch told you a new gate assembles a root and therefore owes a bare-root-worklistTRIAGE verdict — while #12328 holds that file and it is now pm:blocked on decision #12369. I said to stop and report if you needed a row.

You needed no row, and the reason is the right one rather than a dodge:

exportconstROOT_FILE_WATCH_HINTS=['turbo.json/**'];

Declaring the repo-root file in its subtree spelling makes the gate reachable by construction, so it never becomes a bare-root row at all. That is the same escape check:pm-governed-prose and five others already take for AGENTS.md/**, and the header says so rather than leaving the reader to notice. ⭐ The --self-test case pinning the exact string (ROOT_FILE_WATCH_HINTS.join(',') === 'turbo.json/**') is what keeps it from silently rewording back to a bare filename — a change invisible in every other signal the gate emits.

What earns the accept

• The measurement is the argument. turbo 2.10.10, real --dry=json runs on a fixture workspace: an unknown package exits 0 with the key absent from the graph; a package with no such script exits 0 with the task in the graph and never run; an unresolvable dependsOn exits 1 loudly. Two silent, one loud — and the gate is drawn exactly along that split.
• ⭐ Refusing to check dependsOn is the best decision in the diff. Re-checking what turbo already refuses would be this gate claiming a population the owning tool polices better — which is [finding] dispatch-gates.mjs is a followable non-gate module, so its join bases and tier globs are inheritable — 2553 fabricated pairs for the next gate that imports it #11556's defect, and [finding] A turbo.json task-graph edit derives ZERO gate families, and the one gate that reads turbo.json structurally only inspects #test tasks #12046 was filed partly about that shape. Declining coverage for the stated reason is stronger than taking it.
• The scripts && guard is defensive in the right direction, and the comment says why: without it, ablating the first arm makes the second read undefined.has(...), and the self-test dies with a TypeError instead of reporting a named failing case — the instrument going unreadable exactly when it is being read.
• Non-vacuity has a real floor, and it is safe to assert for a stated reason: Layer B of check:cross-package-test-inputs requires one <pkg>#test key per declared cross-package package, so zero package-scoped keys means the gate read the wrong file.
• The live test:e2e violation was filed ([finding] turbo.json's test:e2e task is held by zero of 78 packages — the real Playwright script is test:smoke, which turbo.json does not configure at all #12373), not absorbed. Generic keys are out of population, the header says the invariant is the same shape, and it names why widening now would ship a red gate. ⛔ Widening belongs in the change that fixes the entry — correct call.

Recorded

The # boundary is taken at its first occurrence, with the reasoning that a package name cannot contain one while a task name can (gen:schema survives, scoped slashes survive). A second # lands in the task name and fails the ordinary rule rather than needing a special case the gate would then have to keep true. Pinned three ways in --self-test.

⛔ No governed surface touched; Governed Surface Queue Guard green. No changeset owed — scripts/** ships in no package's files.

---

Generated by Claude Code