mandrel 2.60.0 → 2.62.0

package/.agents/scripts/run-coverage.js

@@ -1,197 +0,0 @@
-#!/usr/bin/env node
-// cli-opt-out: top-level CLI driver invoked via npm run test:coverage; spawns child processes rather than parsing argv, so runAsCli() does not apply.
-/**
- * Cross-platform driver for `npm run test:coverage`.
- *
- * Why this exists: setting `NODE_V8_COVERAGE` directly in a package.json
- * script string (`NODE_V8_COVERAGE=... node ...`) is bash-only — Windows
- * cmd.exe (npm's default script-shell on Windows) treats it as a literal
- * argument and node never sees the env var. Wrapping the run in this
- * Node script keeps the env injection portable.
- *
- * Pipeline:
- *   0. Run the full tier's preflight (`runTierPreflight`). Story #4936: this
- *      used to be a `pretest:coverage` npm script that CI had to name
- *      explicitly, because `.npmrc`'s `ignore-scripts=true` (CWE-1357
- *      defence, which stays) suppresses every `pre*` hook. The runner
- *      invokes it now, so it executes however the coverage run is started.
- *   1. Run the test suite under `NODE_V8_COVERAGE` so each worker writes
- *      raw V8 dumps under `coverage/tmp/`. The suite targets are the
- *      shared `FULL_TIER_GLOBS` from `lib/test-tiers.js` — the same set
- *      `run-tests.js` walks — so the measured surface and `npm test`'s
- *      surface are the same set by construction.
- *   2. `c8 report` post-processes the dumps into `coverage/coverage-final.json`
- *      plus the printed text table. Include/exclude scope from `.c8rc.cjs`
- *      is passed explicitly because `c8 report` does not auto-load the
- *      config file.
- *   3. `check-baselines.js --gate coverage` compares the per-file
- *      lines/branches/functions percentages in `coverage-final.json`
- *      against the recorded floors in `baselines/coverage.json` and
- *      fails on any regression. Update the baseline with
- *      `npm run coverage:update` when you intentionally change scope.
- *
- * The previous shape of this script wrapped tests in `c8 <cmd>`. A
- * one-off A/B benchmark (now retired) showed the NODE_V8_COVERAGE +
- * `c8 report` path is ~19% faster end-to-end on a Windows dev host
- * while producing an identical `coverage-final.json` artifact for the
- * CRAP gate.
- *
- * Test-runner flags: the suite spawn reuses `TEST_RUNNER_FLAGS` from
- * `lib/test-runner-contract.js` — the single source of truth for the
- * `node --test` flag set, including the host-derived
- * `--test-concurrency` value clamped to `[TEST_CONCURRENCY_MIN,
- * TEST_CONCURRENCY_MAX]`. Story #4936: sharing the whole flag set (not
- * just the concurrency number) is what stops this runner and
- * `run-tests.js` disagreeing about whether a test can execute at all —
- * `--experimental-test-module-mocks` decides whether `t.mock.module`
- * works, and this is the *required* CI job.
- */
-
-import { spawnSync } from 'node:child_process';
-import { mkdirSync, rmSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { cleanupRepoTestTempArtifacts } from './cleanup-repo-test-temp.js';
-import { C8_CLI } from './lib/c8-cli-path.js';
-import { buildWebhookSafeTestEnv } from './lib/test-env.js';
-import {
-  runTierPreflight,
-  TEST_RUNNER_FLAGS,
-} from './lib/test-runner-contract.js';
-import { FULL_TIER_GLOBS } from './lib/test-tiers.js';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ROOT = path.resolve(__dirname, '..', '..');
-const require = createRequire(import.meta.url);
-const C8_CONFIG = require('../../.c8rc.cjs');
-
-/**
- * Build the `node --test` argv for the coverage suite spawn.
- *
- * Reuses two shared constants so the coverage path cannot drift from
- * `run-tests.js`:
- *
- *   - `TEST_RUNNER_FLAGS` — the single source of truth for the host-aware,
- *     clamped `--test-concurrency` value.
- *   - `FULL_TIER_GLOBS` — the single source of truth for *which files the
- *     full tier runs*. Story #4922: this script used to restate
- *     `tests/**\/*.test.js` on its own, so the 47 colocated `__tests__`
- *     suites under `lib/` and `.agents/scripts/` executed under `npm test`
- *     but never under the measuring run — the coverage and CRAP numbers
- *     were computed over code the coverage run had not executed.
- *
- * Both parameters are injected in tests so the argv can be asserted without
- * touching the OS.
- *
- * @param {object} [opts]
- * @param {readonly string[]} [opts.runnerFlags]
- * @param {readonly string[]} [opts.testGlobs]
- * @returns {string[]}
- */
-export function buildCoverageTestArgs({
-  runnerFlags = TEST_RUNNER_FLAGS,
-  testGlobs = FULL_TIER_GLOBS,
-} = {}) {
-  return [...runnerFlags, ...testGlobs];
-}
-
-/**
- * Execute the coverage pipeline: run the full tier's preflight, run the
- * suite under `NODE_V8_COVERAGE`, post-process the dumps with `c8 report`,
- * then gate on the coverage baseline. Returns the first non-zero exit code
- * across the stages (or the baseline check's status when the prior stages
- * pass); a refused preflight short-circuits before anything is spawned or
- * removed.
- *
- * Every collaborator is injected so the pipeline's wiring — above all
- * *that the preflight actually runs, and runs first* — is assertable
- * without spawning the real suite.
- *
- * @param {object} [opts]
- * @param {typeof spawnSync} [opts.spawn]
- * @param {(opts: { tier: string, repoRoot: string }) => number} [opts.preflight]
- * @param {(opts: { repoRoot: string }) => unknown} [opts.cleanup]
- * @param {string} [opts.repoRoot]
- * @returns {number}
- */
-export function runCoveragePipeline({
-  spawn = spawnSync,
-  preflight = runTierPreflight,
-  cleanup = cleanupRepoTestTempArtifacts,
-  repoRoot = ROOT,
-} = {}) {
-  const coverageDir = path.join(repoRoot, 'coverage');
-  const v8Tmp = path.join(coverageDir, 'tmp');
-
-  const preflightStatus = preflight({ tier: 'full', repoRoot });
-  if (preflightStatus !== 0) return preflightStatus;
-
-  rmSync(coverageDir, { recursive: true, force: true });
-  mkdirSync(v8Tmp, { recursive: true });
-
-  const testRun = spawn(process.execPath, buildCoverageTestArgs(), {
-    cwd: repoRoot,
-    stdio: 'inherit',
-    // GIT_*-scrubbed: under a husky pre-push from a linked worktree the
-    // inherited GIT_DIR poisons fixture `git init` runs (#4580).
-    env: { ...buildWebhookSafeTestEnv(process.env), NODE_V8_COVERAGE: v8Tmp },
-  });
-
-  cleanup({ repoRoot });
-
-  const includeArgs = (C8_CONFIG.include ?? []).flatMap((p) => [
-    '--include',
-    p,
-  ]);
-  const excludeArgs = (C8_CONFIG.exclude ?? []).flatMap((p) => [
-    '--exclude',
-    p,
-  ]);
-
-  // `c8 report` does not auto-load `.c8rc.cjs`, so every scope knob it needs
-  // is forwarded explicitly from the config object — including `all`, which
-  // is what puts a 0 % row on a source file no test ever loaded (Story
-  // #4922). Reading it off the config keeps `.c8rc.cjs` the one declaration.
-  const allArgs = C8_CONFIG.all ? ['--all'] : [];
-
-  const reportRun = spawn(
-    process.execPath,
-    [
-      C8_CLI,
-      'report',
-      '--reporter=json',
-      '--reporter=text',
-      ...allArgs,
-      '--temp-directory',
-      v8Tmp,
-      ...includeArgs,
-      ...excludeArgs,
-    ],
-    { cwd: repoRoot, stdio: 'inherit', shell: false },
-  );
-
-  const checkRun = spawn(
-    process.execPath,
-    [
-      path.join(repoRoot, '.agents', 'scripts', 'check-baselines.js'),
-      '--gate',
-      'coverage',
-    ],
-    { cwd: repoRoot, stdio: 'inherit' },
-  );
-
-  return testRun.status !== 0
-    ? (testRun.status ?? 1)
-    : reportRun.status !== 0
-      ? (reportRun.status ?? 1)
-      : (checkRun.status ?? 1);
-}
-
-// Run the pipeline only when invoked directly as a CLI; importing the
-// module (e.g. from a test asserting the spawn argv) must not spawn the
-// real suite.
-if (fileURLToPath(import.meta.url) === path.resolve(process.argv[1] ?? '')) {
-  process.exit(runCoveragePipeline());
-}

package/.agents/scripts/run-lint.js

@@ -1,133 +0,0 @@
-#!/usr/bin/env node
-// cli-opt-out: top-level-await driver with no main() function — runAsCli wraps an async main, which doesn't apply here.
-/* node:coverage ignore file */
-
-/**
- * Cross-platform parallel driver for `npm run lint`.
- *
- * Spawns `biome ci .` and `markdownlint-cli2` concurrently. They share
- * no state, so running them in series (the prior `&&` form) wasted
- * wall-clock time on every developer save and pre-push. Stdout/stderr
- * stream through unchanged so error context survives. Exit code is
- * non-zero if either tool fails.
- */
-
-import { spawn } from 'node:child_process';
-import process from 'node:process';
-
-// On Windows, npm/npx shims are `.cmd` batch files. Since Node 20,
-// these can only be spawned through a shell (CWE-78 mitigation closing
-// CVE-2024-27980), so `shell: true` is mandatory there. POSIX hosts
-// can spawn directly.
-const useShell = process.platform === 'win32';
-
-/**
- * A Node gate spelled `node .agents/scripts/<script>` — the shape six of the
- * eight tasks share. Spelling it once keeps this list readable as what it
- * actually is (a fan-out roster) instead of a wall of spawn tuples, and keeps
- * adding a gate from costing the module a maintainability regression for the
- * boilerplate rather than the behaviour. Mirrors `run-verify.js`'s `gate()`.
- *
- * Use bare `node` (PATH-resolved) rather than `process.execPath`:
- * `process.execPath` on Windows often expands to `C:\Program
- * Files\nodejs\node.exe`, and spawn(..., { shell: true }) does not quote the
- * executable, so the space breaks invocation.
- *
- * The path is passed WHOLE rather than assembled from a basename. Composing
- * it (`` `.agents/scripts/${script}` ``) reads better and is wrong:
- * `check-knip-entries.js` derives which CLIs something actually invokes by
- * scanning this file's source text for literal script paths, and four of the
- * gates below are invoked from nowhere else. Interpolating the path made them
- * invisible to that derivation, so knip called them dead and the ratchet
- * offered to record live gates as expected-dead — the Story #5012 trap.
- *
- * @param {string} name reported in this driver's own error prefix
- * @param {string} script repo-relative path, spelled as one literal
- * @returns {{ name: string, cmd: string, args: string[] }}
- */
-const nodeGate = (name, script) => ({ name, cmd: 'node', args: [script] });
-
-const tasks = [
-  {
-    name: 'biome',
-    cmd: 'npx',
-    args: ['biome', 'ci', '.'],
-  },
-  {
-    // `docs/**/*.md` sat outside these globs until PR #4970's follow-up,
-    // so `npm run lint` reported "0 error(s)" while the close-time
-    // code-review lens — which lints the whole changed surface, not just
-    // what this driver globs — raised pre-existing `docs/` violations
-    // against whichever Story happened to touch the file. Keep `docs/`
-    // here so the two surfaces agree. `docs/CHANGELOG.md` is linted too;
-    // the generator-owned rules it can never satisfy are exempted by a
-    // `markdownlint-disable-file` directive in its own header.
-    name: 'markdownlint',
-    cmd: 'npx',
-    args: [
-      'markdownlint-cli2',
-      '.agents/**/*.md',
-      'docs/**/*.md',
-      '*.md',
-      '!node_modules/**',
-      '!.worktrees/**',
-    ],
-  },
-  // Lifecycle surface (Story #2227). Enforces (1) no `Promise.all` under
-  // `.agents/scripts/lib/orchestration/lifecycle/**` — the ledger is
-  // append-only and a parallel write interleaves records; and (2) the
-  // auto-merge lockout: the `gh pr merge` literal appears only in
-  // `single-story-close/phases/auto-merge.js`. Neither has a biome
-  // equivalent. Story #5024 dropped the third rule (the wildcard-observer
-  // firewall) with the bus and the `listeners/` directory its predicate
-  // required.
-  nodeGate('lifecycle-lint', '.agents/scripts/check-lifecycle-lint.js'),
-  // Workflow prose surface (Epic #4474 PR5). No workflow may instruct calling
-  // an exported library function that has no CLI entrypoint — the measured
-  // shim-writing failure mode the /mandrel-plan collapse killed. See
-  // check-workflow-cli-lint.js for the paragraph-level heuristic.
-  nodeGate('workflow-cli-lint', '.agents/scripts/check-workflow-cli-lint.js'),
-  // Label-vocabulary citations in `.agents/docs/SDLC.md` and
-  // `.agents/workflows/**/*.md` (Story #2892). Greps inline backtick code
-  // spans for axis-shaped tokens (`type/epic`, etc.) and asserts only the
-  // canonical `<axis>::<value>` separator from `lib/label-constants.js`
-  // appears. Closes the drift gap that let the original `type/epic` typo land.
-  nodeGate('label-vocabulary', '.agents/scripts/lint-label-vocabulary.js'),
-  // GitHub Actions job-timeout gate (Story #4936). Fails a `jobs.<id>` that
-  // sets no `timeout-minutes` (inheriting GitHub's 360-minute default) or sets
-  // one above the ceiling. A deadlocked Windows job burned 44 minutes of a
-  // runner and withheld the failing required check's logs for the whole time.
-  nodeGate('workflow-timeouts', '.agents/scripts/check-workflow-timeouts.js'),
-  // Architecture cycle ratchet (Story #3991). Detects directed import cycles
-  // under `.agents/scripts/` and fails on any cycle not in the committed
-  // allowlist (`baselines/arch-cycles.json`).
-  nodeGate('arch-cycles', '.agents/scripts/check-arch-cycles.js'),
-  // Static Gherkin corpus gate (Story #5013): must-compile with the real
-  // parser, then must-bind scoped per step root. Opt-in behind
-  // `qa.gherkinLint`, so it exits 0 as "not configured" in this repo. Here
-  // rather than in run-verify.js so it reaches CI through the same `lint`
-  // required check as arch-cycles; listing it in both would double-pay it.
-  nodeGate('gherkin-corpus', '.agents/scripts/check-gherkin-corpus.js'),
-];
-
-function runTask({ name, cmd, args }) {
-  return new Promise((resolve) => {
-    const child = spawn(cmd, args, { stdio: 'inherit', shell: useShell });
-    child.on('error', (err) => {
-      process.stderr.write(`[run-lint:${name}] spawn error: ${err.message}\n`);
-      resolve(1);
-    });
-    child.on('exit', (code, signal) => {
-      if (signal) {
-        process.stderr.write(`[run-lint:${name}] killed by ${signal}\n`);
-        resolve(1);
-        return;
-      }
-      resolve(code ?? 1);
-    });
-  });
-}
-
-const results = await Promise.all(tasks.map(runTask));
-const failed = results.findIndex((code) => code !== 0);
-process.exit(failed === -1 ? 0 : results[failed]);

package/.agents/scripts/run-test-profile.js

@@ -1,129 +0,0 @@
-#!/usr/bin/env node
-
-/* node:coverage ignore file */
-
-/**
- * Capture TAP timing from the full test suite and write a human summary under
- * `temp/` (gitignored). Skips npm-test preflight so timings reflect the
- * runner only — set SKIP_PREFLIGHT=0 to include preflight if desired.
- */
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnChild } from './lib/child-exec.js';
-import { runAsCli } from './lib/cli-utils.js';
-import { buildWebhookSafeTestEnv } from './lib/test-env.js';
-import { parseTapOutput } from './lib/test-profile/parse-tap.js';
-import { renderProfileReport } from './lib/test-profile/render-report.js';
-import { buildNodeTestArgs } from './run-tests.js';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ROOT = path.resolve(__dirname, '..', '..');
-const DEFAULT_OUT_DIR = path.join(ROOT, 'temp');
-const TAP_FILE = 'test-profile.tap';
-const SUMMARY_FILE = 'test-profile.summary.txt';
-
-/**
- * @param {string[]} argv
- * @returns {{ outDir: string, topN: number, testArgv: string[] }}
- */
-export function parseProfileArgv(argv) {
-  let outDir = DEFAULT_OUT_DIR;
-  let topN = 20;
-  const testArgv = [];
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === '--out-dir' && argv[i + 1]) {
-      outDir = path.resolve(argv[i + 1]);
-      i += 1;
-      continue;
-    }
-    if (arg === '--top' && argv[i + 1]) {
-      topN = Number(argv[i + 1]);
-      i += 1;
-      continue;
-    }
-    testArgv.push(arg);
-  }
-  if (!Number.isFinite(topN) || topN < 1) {
-    throw new Error('[test-profile] --top must be a positive number');
-  }
-  return { outDir, topN, testArgv };
-}
-
-/**
- * @param {object} [opts]
- * @param {string[]} [opts.argv]
- * @param {string} [opts.cwd]
- * @param {Function} [opts.spawn] - Injected child runner; defaults to the
- *   shared surface's real `spawnSync`.
- * @param {typeof fs} [opts.fs]
- */
-export function runTestProfile({
-  argv = process.argv.slice(2),
-  cwd = ROOT,
-  spawn,
-  fs: fsLike = fs,
-} = {}) {
-  const { outDir, topN, testArgv } = parseProfileArgv(argv);
-  fsLike.mkdirSync(outDir, { recursive: true });
-
-  // The reporter is a *builder option*, not a suffix. Appended after the
-  // file targets it was two more positionals to Node, the default reporter
-  // ran, and every profile parsed `Timed entries parsed: 0` off a full
-  // suite run. `buildNodeTestArgs` places it in flag position.
-  const nodeArgs = buildNodeTestArgs({
-    extraArgs: testArgv,
-    reporter: 'tap',
-  });
-
-  const started = Date.now();
-  const result = spawnChild(process.execPath, nodeArgs, {
-    run: spawn,
-    cwd,
-    encoding: 'utf8',
-    env: {
-      ...buildWebhookSafeTestEnv(process.env),
-      SKIP_PREFLIGHT: process.env.SKIP_PREFLIGHT ?? '1',
-      FORCE_COLOR: '0',
-      NO_COLOR: '1',
-    },
-  });
-  const wallDurationMs = Date.now() - started;
-
-  if (result.error) {
-    throw result.error;
-  }
-
-  const tapText = `${result.stdout ?? ''}${result.stderr ?? ''}`;
-  const tapPath = path.join(outDir, TAP_FILE);
-  const summaryPath = path.join(outDir, SUMMARY_FILE);
-  fsLike.writeFileSync(tapPath, tapText, { encoding: 'utf8' });
-
-  const profile = parseTapOutput(tapText);
-  const summary = renderProfileReport(profile, { topN, wallDurationMs });
-  fsLike.writeFileSync(summaryPath, summary, { encoding: 'utf8' });
-
-  process.stdout.write(summary);
-  process.stdout.write(`\nWrote ${tapPath}\nWrote ${summaryPath}\n`);
-
-  return {
-    exitCode: result.status ?? 1,
-    tapPath,
-    summaryPath,
-    profile,
-    wallDurationMs,
-  };
-}
-
-runAsCli(
-  import.meta.url,
-  async () => {
-    const outcome = runTestProfile();
-    if (outcome.exitCode !== 0) {
-      process.exit(outcome.exitCode);
-    }
-  },
-  { source: 'run-test-profile' },
-);

package/.agents/scripts/run-verify.js

@@ -1,125 +0,0 @@
-#!/usr/bin/env node
-/* node:coverage ignore file */
-
-/**
- * Local full verification — a true CI mirror for the gates that CAN be proven
- * locally, without epic-scoped MI projection or push semantics.
- *
- * Order: audit (SCA) → lint (includes docs:check + the arch-cycles ratchet) →
- * full test suite → unified baselines → the standalone ratchets
- * (dead-exports ×2, context-budget, workflow-citations, cyclomatic,
- * schema-references).
- *
- * The `audit` step runs `npm audit --audit-level=high`, matching CI's
- * "Dependency Vulnerability Audit (SCA)" gate so a local green no longer hides
- * a high-severity advisory that CI would fail on. It is independent of the
- * pre-push `PREPUSH_AUDIT` opt-in, which stays unchanged.
- *
- * The trailing ratchets complete the mirror of CI's "Architecture Cycle Check"
- * step in the `baselines` job (Story #4549). That step runs three checks;
- * `check-arch-cycles.js` is deliberately absent from STEPS because the `lint`
- * step above already runs it (see run-lint.js) — re-running it here would
- * double-pay a gate verify already covers. `check-dead-exports.js` and
- * `check-context-budget.js` had no such cover: they were reachable locally only
- * via the diff-scoped `npm run quality:preview` or a direct invocation, so a
- * clean `verify` could still hide a CI-red — the failure Story #4531 / PR #4548
- * paid for with a full push → CI → fix → push round-trip. Both are pure-Node
- * and baseline-aware, adding ~15s on a cold cache (dominated by knip's
- * full-tree scan in check-dead-exports.js) to a command that already carries
- * the full test suite.
- *
- * Story #5004 closed the last two mirror gaps that were pure omission.
- * `check-cyclomatic.js` (#4923) and `check-schema-references.js` (#4938) were
- * each added to the `baselines` job's standalone-ratchet slot without ever
- * being added here, so a green `verify` still hid both. Like their neighbours
- * they are pure-Node and cost milliseconds.
- *
- * Story #5340 closed the `check-workflow-citations.js` gap the same way, once
- * demoting it to a report made it free: it had been exempted here because
- * `tests/check-workflow-citations.test.js` re-ran the same ratchet, so a
- * `verify` step would have double-paid it. That test now asserts the report,
- * not a ceiling, so the step is the only local surface that prints the count.
- *
- * Still NOT mirrored: `check-baseline-scope.js` runs in CI's `baselines` job
- * only — `.agents/rules/known-tooling-behavior.md` entry 2 carries the current
- * coverage table. (`prune-baseline-orphans.js --check` used to sit in that
- * list; it no longer runs in CI at all — the un-attributed duplicate of the
- * scope gate's `extra` direction reds every open PR on inherited rows.) Nor are the CI gates this command structurally cannot
- * reproduce (action pinning, TruffleHog secret scan) — those are catalogued
- * in docs/ci-contract.md. The nightly full-scope re-score
- * (.github/workflows/baseline-drift.yml) is deliberately outside this
- * mirror too: it re-scores the whole tree, which is the cost `verify` exists
- * to avoid paying on every run.
- */
-
-import { spawnSync } from 'node:child_process';
-import { runAsCli } from './lib/cli-utils.js';
-
-/**
- * A gate step: `node .agents/scripts/<script>` plus any extra args. Eight of
- * the eleven steps share exactly that shape, so spelling it once leaves the list
- * below readable as what it actually is — a gate *order* — instead of a wall
- * of spawn tuples.
- *
- * @param {string} label reported as `failedStep` when the gate exits non-zero
- * @param {string} script basename under `.agents/scripts/`
- * @param {...string} args extra CLI args
- * @returns {{ label: string, cmd: string, args: string[] }}
- */
-const gate = (label, script, ...args) => ({
-  label,
-  cmd: 'node',
-  args: [`.agents/scripts/${script}`, ...args],
-});
-
-const STEPS = [
-  { label: 'audit', cmd: 'npm', args: ['audit', '--audit-level=high'] },
-  { label: 'lint', cmd: 'npm', args: ['run', 'lint'] },
-  { label: 'test', cmd: 'npm', args: ['test'] },
-  gate('baselines', 'check-baselines.js'),
-  // Ordered ahead of the dead-exports pair deliberately. When a new CLI is
-  // missing from knip.json's entry list, both gates fail — but only this one
-  // names the cause. Seeing the ratchet's whole-file diff first is what made
-  // "accept the diff" look like the fix during Story #5012.
-  gate('knip-entries', 'check-knip-entries.js'),
-  gate('dead-exports', 'check-dead-exports.js'),
-  gate('dead-exports-production', 'check-dead-exports.js', '--production'),
-  gate('context-budget', 'check-context-budget.js'),
-  gate('workflow-citations', 'check-workflow-citations.js'),
-  gate('cyclomatic', 'check-cyclomatic.js'),
-  gate('schema-references', 'check-schema-references.js'),
-];
-
-export function runVerifySteps({
-  spawn = spawnSync,
-  shell = process.platform === 'win32',
-} = {}) {
-  for (const step of STEPS) {
-    const result = spawn(step.cmd, step.args, {
-      stdio: 'inherit',
-      shell,
-    });
-    if (result.error) {
-      throw result.error;
-    }
-    if ((result.status ?? 1) !== 0) {
-      return {
-        ok: false,
-        failedStep: step.label,
-        exitCode: result.status ?? 1,
-      };
-    }
-  }
-  return { ok: true };
-}
-
-runAsCli(
-  import.meta.url,
-  async () => {
-    const outcome = runVerifySteps();
-    if (!outcome.ok) {
-      process.exit(outcome.exitCode);
-    }
-  },
-  { source: 'run-verify' },
-);

package/.agents/scripts/test-isolate.js

@@ -1,55 +0,0 @@
-#!/usr/bin/env node
-/* node:coverage ignore file */
-
-/**
- * test-isolate — diagnose test-pollution cascades.
- *
- * Runs the matching test files individually (`--test-concurrency=1`,
- * one process per file), then again as a single suite under default
- * concurrency. Files that pass alone but fail in the suite are
- * **flippers**. For each flipper the script binary-bisects the
- * remaining files to surface the smallest reproducing subset (the
- * polluter suspect set).
- *
- * Files whose process exited with leftover `process.env` mutations are
- * called out so an operator can spot global-state leaks at a glance —
- * even when the failure cascade hasn't yet manifested. See
- * `lib/test-isolate/env-snapshot-loader.js`.
- *
- * Usage:
- *
- *   node .agents/scripts/test-isolate.js                   # all tests
- *   node .agents/scripts/test-isolate.js 'tests/lib/**'    # glob subset
- *   node .agents/scripts/test-isolate.js tests/foo.test.js # single file
- *
- * Output: human-readable text by default; pass `--json` for the raw
- * report envelope.
- *
- * **Shell only (Story #5316).** Nothing imports this file, so nothing here is
- * reachable from a test — which is why every function it used to hold scored
- * the CRAP formula's untested maximum. Argv parsing, report rendering,
- * progress logging and the run orchestration now live under
- * `lib/test-isolate/`, beside the `list-files` / `parse-tap` / `runner`
- * modules that were always there. Keep this file a shell: anything with a
- * branch in it belongs next door, where a test can reach it.
- */
-
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { runAsCli } from './lib/cli-utils.js';
-import { runTestIsolate } from './lib/test-isolate/run-isolate.js';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ROOT = path.resolve(__dirname, '..', '..');
-
-runAsCli(
-  import.meta.url,
-  async () => {
-    const { exitCode } = await runTestIsolate({
-      argv: process.argv.slice(2),
-      repoRoot: ROOT,
-    });
-    if (exitCode !== 0) process.exit(exitCode);
-  },
-  { source: 'test-isolate' },
-);