From ae9ba01bb6387f78f0cbd4547cf62e77170073d0 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Sat, 12 Sep 2026 20:09:03 -0400 Subject: [PATCH] fix: address Copilot review round 2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trace reachability from `local:gate` itself, not only its first stage, when asserting that no `validate` / `validate:` is reached — a later stage could reintroduce the bare suite just as easily as the first. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01PsmUAZ6aLUAFqenjJKSSRp Signed-off-by: cliffhall --- scripts/lib/workflow-gate.test.mjs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/scripts/lib/workflow-gate.test.mjs b/scripts/lib/workflow-gate.test.mjs index 45809984..8525c09e 100644 --- a/scripts/lib/workflow-gate.test.mjs +++ b/scripts/lib/workflow-gate.test.mjs @@ -633,13 +633,16 @@ describe("the gate's name", () => { it("starts from `local:validate`, and never from `validate`", () => { assert.match(scripts["local:gate"], /^npm run local:validate && /); assert.doesNotMatch(scripts["local:gate"], /\brun validate(?=$|[\s&;])/); - // `local:validate` must not reach a client's `validate` either — that is - // the one door through which the bare `test` leg would come back. - const reached = reachableScripts(scripts, "local:validate"); + // Nothing reachable from the WHOLE gate — not just its first stage — + // may run `validate` or a client's `validate:*`: those are the doors + // through which the bare `test` leg would come back, and a later stage + // could open one just as easily as the first (Copilot). + const reached = reachableScripts(scripts, "local:gate"); + assert.ok(!reached.has("validate"), "local:gate must not reach validate"); for (const c of clients) assert.ok( !reached.has(`validate:${c}`), - `local:validate must not reach validate:${c}`, + `local:gate must not reach validate:${c}`, ); // Each client is visited AND its `check` is the very next command — // matched together, so dropping one client's `npm run check` while the