fix: address Copilot review round 2

Trace reachability from `local:gate` itself, not only its first stage, when
asserting that no `validate` / `validate:<client>` is reached — a later
stage could reintroduce the bare suite just as easily as the first.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PsmUAZ6aLUAFqenjJKSSRp
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-12 20:09:03 -04:00
commit ae9ba01bb6

View file

@ -633,13 +633,16 @@ describe("the gate's name", () => {
it("starts from `local:validate`, and never from `validate`", () => {
assert.match(scripts["local:gate"], /^npm run local:validate && /);
assert.doesNotMatch(scripts["local:gate"], /\brun validate(?=$|[\s&;])/);
// `local:validate` must not reach a client's `validate` either — that is
// the one door through which the bare `test` leg would come back.
const reached = reachableScripts(scripts, "local:validate");
// Nothing reachable from the WHOLE gate — not just its first stage —
// may run `validate` or a client's `validate:*`: those are the doors
// through which the bare `test` leg would come back, and a later stage
// could open one just as easily as the first (Copilot).
const reached = reachableScripts(scripts, "local:gate");
assert.ok(!reached.has("validate"), "local:gate must not reach validate");
for (const c of clients)
assert.ok(
!reached.has(`validate:${c}`),
`local:validate must not reach validate:${c}`,
`local:gate must not reach validate:${c}`,
);
// Each client is visited AND its `check` is the very next command —
// matched together, so dropping one client's `npm run check` while the