ci(gates): refuse a bare -- between pnpm and vitest in committed commands (#11667)

* ci(gates): refuse a bare `--` between pnpm and vitest in committed commands

`pnpm --filter <pkg> test` with its arguments after a bare separator runs the
WHOLE package suite. pnpm forwards the separator verbatim into the child argv
and vitest's cac parser then discards everything after it, options and
positionals alike, in silence — the file pattern and `--maxWorkers` die
together, the suite passes, and it reads exactly like the narrow run that was
asked for.

#11425 landed the corrected spelling in the instruction files. That is
discipline; this is the mechanical half. Both mechanism layers were re-measured
on this tree rather than recalled, each with a control: pnpm and npx forward the
separator, npm and turbo strip it, and vitest 4.1.10 turns `CACError: Unknown
option` (exit 1) into no output at all (exit 0) when the same flag moves behind
the separator.

The violating population is EMPTY today, so the gate is built to say that out
loud rather than print a bare "0 violations": it reports how many separators it
JUDGED (6 on this tree), refuses a tree whose roots, corpus or workspace
derivation went blind, and carries its non-vacuity in `--self-test`, which
drives this same sweep RED over a temp tree on disk.

Five of those six judged separators are forms a naive bare-`--` selector would
have RED and every one is correct as written — this workflow's own turbo dogfood
shard and the three documented `pnpm dev -- --fresh` spellings — so the rule is
vitest-BOUND, with the vitest-backed script names derived from the workspace
instead of typed in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

* ci(gates): declare this gate's bare roots so the dispatch derivation can see it

`INSTRUCTION_ROOTS` and `EXECUTED_ROOTS` spelled two of their four roots as bare
single-segment words. `extractWatchHints` builds no hint from a literal without
a separator, so a card touching `scripts/**` or `skills/**` derived this gate
NOWHERE — including the cards most likely to add the spelling it exists to
judge. `scripts/pm/bare-root-worklist.mjs --self-test` caught it on the commit
that introduced it.

Declared rather than refused, and the choice is measured from this gate's own
walker rather than taken from the shape: numerator is what `scannedFiles()`
admits, denominator the tracked files under the subtree the declaration names —
`skills/**` 50 of 50 (100%), `scripts/**` 239 of 242 (98.8%, the 3 misses are
`.txt`). This is the `subtree` case, not the `filtered` one: the walk descends
the whole of each root and the only losses are non-code files the extension
filter drops. Both precedents are already in this tree at the same or lower
coverage — `check-pnpm-filter-targets.mjs` declares `scripts/**` at 97.0%, and
`check-role-word.mjs` declares `skills/**`.

`AGENTS.md/**` and `CLAUDE.md/**` take the escapable repo-root-FILE case the
derivation's own residue names: a bare filename is refused as too generic and
reaches its file through the subtree spelling. Measured — `AGENTS.md/**` covers
`AGENTS.md` and does NOT cover `examples/AGENTS.md`, so it claims the one file
this gate reads at that root and does not overclaim the nested ones.

The workspace-manifest read stays UNDECLARED: the only spellable claim is
`packages/**` + `apps/**` + `examples/**`, which would name this gate for ~5200
files to reach ~80 manifests. Refused, and pinned in `--self-test`.

⚠️ The declaration is pinned STRUCTURALLY, derived from the scan roots, not by
importing `hintCovers`. An earlier draft did import it, and `discoverFamilies`
then treated dispatch-gates.mjs as this gate's own source and hoisted ITS path
literals — `packages/spec/src/**`, `packages/plugins`, `packages/drivers`,
`packages/services` — into this gate's hints. That is the fabricated lead the
declaration exists to avoid, arriving through the assertion meant to prevent it.
Measured before and after: 19 hints with the import, 11 without, 0 fabricated.
`scripts/pm/bare-root-worklist.mjs` itself is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

---------

Co-authored-by: Steve Jobs <steve@objectstack.ai>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people

.github/workflows/lint.yml

@@ -2411,6 +2411,48 @@ jobs:
       - name: Every committed pnpm --filter names a real package
         run: pnpm check:pnpm-filter-targets
 
+      # The sibling of the gate above, and the OTHER half of the family its
+      # comment names (#10166). There the `--filter` selector matched nothing;
+      # here the filter matched, the script ran, and the ARGUMENTS were lost.
+      #
+      # ⛔ Hand a vitest-backed script its arguments after a bare separator and
+      # the WHOLE package suite runs. pnpm forwards the separator verbatim into
+      # the child argv (npm and turbo both strip it — pnpm is the odd one out),
+      # and vitest's cac parser then discards EVERYTHING after it, options and
+      # positionals alike, in silence. The file pattern and `--maxWorkers` die
+      # together, so the concurrency discipline is inert in the same breath.
+      # Measured on the card: 415 files / 11045 tests / 358s under the shared
+      # verify lock, where the intended run was one file in 655ms — green, exit
+      # 0, reading exactly like the narrow run that was asked for.
+      #
+      # ⚠️ The broken spelling is written out in the GATE'S header, not here.
+      # The first draft of this comment spelled it, and the gate red on this
+      # file at its own wiring commit — which is the objection a corpus gate was
+      # rejected on once before ("it would fire on the counter-example the
+      # corrected instruction MUST contain"). That objection is real; the answer
+      # is `COUNTER_EXAMPLE_FILES` in the gate, and the reason this file is not
+      # in it is that a whole workflow is too coarse a thing to exempt — a
+      # broken spelling here would EXECUTE.
+      #
+      # ⚠️ The violating population is EMPTY today (#11425 landed the corrected
+      # spelling), so this step's job is to keep it empty — and the gate says so
+      # in its own verdict line rather than printing a bare "0 violations". It
+      # reports how many separators it JUDGED, not just how many it failed: 5 on
+      # the tree it landed against, four of which a naive bare-`--` selector
+      # would have RED (this workflow's own turbo dogfood shard, and the three
+      # documented `pnpm dev -- --fresh` spellings in AGENTS.md). Its rule is
+      # vitest-BOUND, and the vitest-backed script names are derived from the
+      # workspace rather than typed here.
+      #
+      # Reads text under `.claude/**`, `skills/**`, `scripts/**`,
+      # `.github/workflows/**` and every tracked AGENTS.md / CLAUDE.md, plus the
+      # workspace manifests for the derivation. No build, no network,
+      # sub-second. The `check:` key runs `--self-test` first: it drives this
+      # same sweep RED over a temp tree on disk, which is what carries
+      # non-vacuity while the real population is zero.
+      - name: No committed command forwards args to vitest through a bare --
+        run: pnpm check:agent-test-spelling
+
   # Lane 1 of 4 behind the required `TypeScript Type Check` context. The
   # aggregator job at the bottom of this file explains the split, holds the
   # contract, and is the thing the merge queue actually requires — read it

package.json

@@ -52,6 +52,7 @@
     "check:skill-frame-freshness": "node scripts/check-skill-frame-freshness.mjs --self-test && node scripts/check-skill-frame-freshness.mjs",
     "check:skill-compatibility": "node scripts/check-skill-compatibility-version.mjs --self-test && node scripts/check-skill-compatibility-version.mjs",
     "check:agent-model-declared": "node scripts/check-agent-model-declared.mjs --self-test && node scripts/check-agent-model-declared.mjs",
+    "check:agent-test-spelling": "node scripts/check-agent-test-spelling.mjs --self-test && node scripts/check-agent-test-spelling.mjs",
     "check:ratchet-remedy-authority": "node scripts/check-ratchet-remedy-authority.mjs --self-test && node scripts/check-ratchet-remedy-authority.mjs",
     "check:pm-skill-ratchet": "node scripts/pm/check-skill-line-ratchet.mjs --self-test && node scripts/pm/check-skill-line-ratchet.mjs",
     "check:pm-skill-id-lint": "node scripts/pm/check-skill-id-lint.mjs --self-test && node scripts/pm/check-skill-id-lint.mjs",