fix(quality): quality:gate is substantially uninformative — arch:check omits 20 of 36 publishable packages and quality:scan covers only packages/cli/src

[rickylabs]

Summary

deno task quality:gate is quality:scan && arch:check. For packages/plugin-streams-core, both
halves are no-ops, so the gate exits 0 regardless of what that package contains.

• quality:scan default roots are ['packages/cli/src', 'plugins']
  (.llm/tools/quality/scan-code-quality.ts:18). No packages/plugin-*-core package is scanned.
• arch:check's check-doctrine.ts roots (root deno.json) include packages/plugin-ai-core,
  packages/plugin-auth-core, packages/plugin-sagas-core, packages/plugin-triggers-core and
  packages/plugin-workers-core — but not packages/plugin-streams-core. It is the only
  plugin-*-core package missing from that list, which reads as an omission rather than a decision.

So a slice that changes packages/plugin-streams-core and reports quality:gate raw exit 0 has
demonstrated nothing about that package: not the any/casting/hardcoded-plugin-name class
quality:scan exists to catch, and not the doctrine fitness arch:check exists to catch.

Why this matters now

This is the third instance of the same class in this milestone — after #1397 (mysql/mssql overrides
silently dropping behavior.service-health) and the #778/#775 precedent where PRs looked mergeable
with every substantive check skipped. A gate whose pass is indistinguishable from a did-not-run is
the signature failure this repo keeps paying for.

Known affected merged work: PR #1395 (#1329, versioned SSE envelope) changed
packages/plugin-streams-core substantially and recorded quality:gate exit 0, and its IMPL-EVAL
re-ran the same command. Neither run covered the package. That does not mean the code is bad —
scoped check/lint/fmt take explicit roots and did cover it, doc:lint over the full core export map
returned zero diagnostics, and publish:dry-run was clean — but the specific quality:gate row in
that evidence trail was uninformative and should be read that way.

Acceptance criteria

• packages/plugin-streams-core is covered by arch:check, or its exclusion is stated in the
  task with a named reason and a linked issue
• quality:scan covers the publishable packages/plugin-*-core surfaces, or its root policy is
  documented so that "quality:gate passed" carries a known scope
• Running the repaired gate against packages/plugin-streams-core at current main reports its
  real state, whatever that is — a first run that surfaces existing findings is the expected
  outcome, not a failure of this issue
• A test or check asserts the root lists cover every publishable plugin-core package, so the next
  one added cannot be silently omitted
• Any findings the newly-covered scan surfaces are triaged into their own issues rather than
  fixed here
• gate: A PR whose diff touches only .llm/tools/** causes quality:scan to execute over those
  files, proven red-first — today the step runs no command and reports success
• An empty changed-file set fails closed or is explicitly reported as "not scanned", never silently
  green
• A PR whose recorded base is stale does not admit foreign already-merged files into its changed-file
  set — code-quality.yml's range uses merge-base (three-dot) form, proven by a stale-base fixture

Provenance

Found by a separate-session PLAN-EVAL of PR #1402 (#1326), 2026-08-09, finding F2, while checking
whether that plan's named gates could actually fail for the package it changes. Verdict record:
.llm/runs/release-0.0.5--orchestration/slices/w3-a-1326/plan-eval.md.

Refs #1397, #1329, #1326.

[rickylabs]

Measured scope: this is not one package, it is most of them

Filed after a single package was found uncovered. Measured against the whole workspace, the gap is
much wider.

arch:check covers 16 roots. Six are plugins/*. Only ten are packages. 20 of the 36
publishable workspace members are absent, including nearly every headline surface:

packages/aspire        packages/config        packages/cron          packages/database
packages/fresh         packages/fresh-ui      packages/kv            packages/logger
packages/mcp           packages/queue         packages/runtime-config packages/sdk
packages/service       packages/telemetry     packages/watchers      packages/contracts
packages/cli           packages/plugin-streams-core
packages/prisma-adapter-mysql                 packages/bench

quality:scan covers ['packages/cli/src', 'plugins'] and nothing else — no
packages/plugin-*-core, no sdk, service, fresh, mcp, database, contracts, kv,
telemetry.

So for a change to packages/sdk, packages/service, packages/mcp, packages/fresh or most
others, deno task quality:gate exits 0 having inspected nothing in the changed package.

Why this is p0 rather than p1

.llm/harness/workflow/tooling.md states the framework-wave gate law: "a slice touching
packages/** or plugins/** is not gate-complete on the scoped check/lint/fmt wrappers alone — run
deno task quality:gate", because the scoped wrappers pass code containing any, as unknown as
and inline deno-lint-ignore no-explicit-any. That instruction is the repo's stated defence against
the #745 incident class.

For 20 of 36 publishable packages, following that instruction exactly produces a green that
inspected nothing. Every slice in this milestone that reported quality:gate exit 0 for one of those
packages has an evidence row weaker than it reads — this run has already corrected #1329's trail on
that basis, and #1376's slice reports the same command for packages/mcp, which is also uncovered.

This is the same class as #1397 and the #778/#775 precedent, at repo scale rather than suite scale.

Revised acceptance criteria

• arch:check's roots cover every publishable workspace member, or each omission is stated in
  the task with a named reason and a linked issue
• quality:scan's roots cover every publishable workspace member on the same terms
• A test asserts root coverage against the workspace member list, so a newly added package cannot
  be silently omitted — the mechanism that let 20 accumulate
• Running the repaired gate across the newly covered packages reports their real state; findings
  are triaged into their own issues rather than fixed here
• tooling.md's framework-wave gate law is amended to state the real coverage, or left unchanged
  because coverage now matches it

A first run that surfaces a large backlog is the expected outcome and is not a reason to narrow the
gate again.