fix(devx): check:cross-package-test-inputs sees the new URL, argument-position and climb-and-descend path spellings

[os-project-manager]

Fixes#8698

Verification union re-run at 7f605e543 (tree clean), quoted throughout.

What the card asked, and what measuring it changed

The card offered three directions and the grading made direction 3 mandatory (name the recognised spellings where an author will see them) with 1 and 2 "bounded". Measuring them moved the answer:

Directions 1 and 2, implemented literally, do not fix the card's own headline example. The detector had a second, deeper blind spot the card does not name — it judged a binding by its final depth. A path that climbs past the package root and then descends into a sibling ends at a positive depth while addressing another package entirely, so it scored "inside" no matter how the seed was spelled. Adding a new URL seed on top of final-depth arithmetic catches one file repo-wide and still lets the card's spelling (1) through.

So the fix is three parts, all of which the card's example needs at once:

1. new URL('…', import.meta.url) as a seed and chain step, bare or under fileURLToPath.
2. Path expressions in argument position to an fs read — readFileSync(resolve(HERE, '…')) binds file contents, never a path, so a declaration-only scan sees no path at all in the line that does the escaping.
3. The escape criterion is the shallowest depth a path reaches, not where it ends.

Plus, closing the same class one spelling further: import.meta.dirname / dirname(import.meta.filename). No test uses them today — which is the reason to accept them now rather than file them: the first author to reach for the modern seed would otherwise get silence.

Direction 3 (mandatory) — where an author actually looks

The recognised list is now a published constant (RECOGNISED_PATH_SPELLINGS), printed in the gate's failure text and mirrored in AGENTS.md under Build & Test, with the reason stated: a source scan sees only what it knows, so an unrecognised spelling yields no flag, which means no declaration, silently. Both places tell the author to extend the detector with a --self-test case rather than route around it.

Proof by ablation, not by a green run

A green gate proves nothing about what it can see, so every leg below is a mutation with the mutant verified real (sha + byte delta) and restoration proven byte-identical.

Control — main's detector over the same source tree, main's turbo.json:

OK: 9 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
CONTROL_EXIT=0

That green is over three packages with live, genuinely undeclared cross-package reads. This is not a synthetic ablation — main ships it today.

The card's exact two spellings, end-to-end through the real gate. A probe file in the undeclared @objectstack/objectql, reading a sibling package:

probe	main's detector	this PR
both card spellings	OK: 9 package(s) … all declared — exit 0	RED, names @objectstack/objectql — exit 1
spelling (1) alone — readFileSync(fileURLToPath(new URL(…)), 'utf8')	—	RED — exit 1
spelling (2) alone — readFileSync(resolve(HERE, …), 'utf8')	—	RED — exit 1

Per-package ablation — delete one declaration, confirm the gate goes red for the right reason, naming the right test:

--- ABLATION: @objectstack/metadata-protocol
before: 09388ae… 35404 bytes after: 0af7ddee… 35139 bytes (-265)
mutation reached disk: YES | entry still present: no
- @objectstack/metadata-protocol has test(s) that read outside the package but declares no input radius.
packages/metadata-protocol/src/sys-metadata-repository.draft-drain.test.ts
EXIT=1 | restored byte-identical: true

Same shape for @objectstack/formula (names both of its tests) and @objectstack/downstream-contract. Each isolates a different newly-recognised mechanism: metadata-protocol the multi-line new URL in argument position, the other two the shallowest-depth criterion. All three re-confirmed at 7f605e543, tree clean after.

What the widened detector found — live defects, not hypotheticals

The escaping-package count moves 9 → 12. Every new flag was checked by hand against the source; zero false positives. The most consequential:

• packages/metadata-protocol/src/sys-metadata-repository.draft-drain.test.ts:451 reads scripts/check-durability-degradation-log-level.mjs — a pin on a root gate's source, undeclared, so a change to that gate never re-ran it. Exactly the defect this gate exists to prevent, live on main.
• packages/formula/src/rls-predicate.test.ts:188 pins packages/spec/src/security/rls.zod.ts; skill-catalog-sync.test.ts:19 pins the published formula skill.
• packages/qa/downstream-contract/test/source-resolution.pin.test.ts:87 resolves every spec specifier against spec's real source tree.
• packages/spec/scripts/file-description.test.ts:1001 and category-title.test.ts:44 walk the whole content/docs/references tree; spec declared only index.mdx.

Each newly declared glob is pinned to the read that justifies it, in a comment naming the test, per the file's existing convention. turbo.json gains matching #test inputs so Layer B hashes them — written from the remedy the gate itself prints.

Two things are deliberately not flagged, both documented in the code and AGENTS.md: a path landing in node_modules (an installed dependency is not a repo source input and no turbo glob can name it), and a path that climbs out and comes straight back in.

--self-test

12 → 26 cases. Every newly recognised spelling gained a pin, and so did every deliberate non-flag; the 12 pre-existing cases are untouched and still pass. A newly recognised shape with no pin is the next silent regression, so the constant and the pins move together.

Verification at 7f605e543 (tree clean)

Gate families re-derived from the actual diff via scripts/pm/dispatch-gates.mjs — it returned exactly the two the dispatch named, adding none for AGENTS.md or turbo.json.

check:cross-package-test-inputs EXIT=0
check:nul-bytes EXIT=0
check:pm-skill-id-lint EXIT=0 ← scans AGENTS.md; no issue numbers in the added prose
check:pm-skill-ratchet EXIT=0
node scripts/check-cross-package-test-inputs.mjs (ci.yml raw) EXIT=0
OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.

No package sources are touched, so no package test suite is in scope and ESLint was not run locally — the worktree has no node_modules and a full install for lint-only value is a poor trade in a shared container. CI runs the farm.

Notes for the reviewer

• Declared file surface breach, disclosed: the claim named scripts/check-cross-package-test-inputs.mjs + AGENTS.md. turbo.json is added because the gate requires it — a declaration without matching #test inputs fails Layer B, so the detector change cannot land green without it. No third option leaves main green.
• skip-changeset: root scripts/, AGENTS.md and turbo.json are not published package sources.
• Cross-batch:@objectstack/metadata-protocol's new glob names scripts/check-durability-degradation-log-level.mjs by path — the file check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 is editing. A rename there makes the glob stale (and breaks the pin itself). The metadata door accepts a dashboard widget dataset binding that names nothing — 200 on both save and publish, referential integrity enforced only at runtime #7529 and check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 had no open PR at the time of writing, so their exposure could not be measured directly; the extension was not weakened for either.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 15, 2026 3:49pm