fix(quality): make quality gate coverage informative

[rickylabs]

Summary

Repair quality:gate coverage in all three missing dimensions: discover all 36 top-level doctrine roots, make PR quality scanning execute for .llm/tools/** changes without silently succeeding on an empty set, and use merge-base (three-dot) range semantics. The matched A14 origin-awareness fix now lands here so the expanded doctrine gate remains truthful and green.

Scope

• Archetype / area: repository tooling and doctrine fitness coverage

Closes #1403

• References fix(ci): pull_request.base.sha is stale on long-lived PRs, so every gate that computes a range from it silently inspects the wrong changeset #1564 without a closing keyword; this PR fixes only code-quality.yml's range consumer.
• Box 5 of docs(doctrine): the codebase verdict table names five deleted packages, omits 14 live units, and its arch:check:repo gate has been accepted-red since 2026-06-21 #1380 is implemented here by resolveIdentifierOrigin(); PR-C will cite commit 48fcef438 and tick that box. This PR does not close or mutate docs(doctrine): the codebase verdict table names five deleted packages, omits 14 live units, and its arch:check:repo gate has been accepted-red since 2026-06-21 #1380.
• chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549 owns scanner comment-awareness and deletion of the two temporary allowances added here.

Slices

• B1 discover the final 36-root set and prove it against an independently derived filesystem expectation — ca52c3a8f
• B2 repoint arch:check in one transition and make A14 fire only for unresolved identifiers — 48fcef438
• B3 repair changed-file scope, explicit empty behavior, and three-dot range semantics; triage surfaced findings — ca52c3a8f, b64550722, 48fcef438

Validation

Final head: 48fcef4382f90ea33c70ebd99089990ea163528e

• Fitness + quality tests — exit 0; 15 passed, 0 failed. The A14 test drives imported, locally-bound, and synthetic unresolved fixtures through the actual CLI; unresolved remains RED.
• deno task arch:check — exit 0 across all 36 roots.
• deno task quality:gate — exit 0.
• deno task quality:scan:repo — exit 0; 0 findings; allowCount 8 → 10 because two reversible comment false-positive allowances point to chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549.
• Workflow-equivalent changed-file scan — exit 0; .llm/tools files scanned; 0 findings; 2 reported allowances. Its committed pre-allowance run at b64550722 exited 1 on both comments, proving this path executes and reports where the old workflow ran no command and returned success.
• Owned scoped check/lint/fmt over .llm/tools/quality and .llm/tools/fitness — all exit 0; 10 files; 0 diagnostics/findings.
• Asset generation second run — exit 0; subsequent git status --porcelain empty.
• Workflow policy tests — 3/3 pass; code-quality.yml YAML parse exit 0.
• Raw remote verification — refs/heads/fix/1403-quality-gate-coverage resolves to 48fcef4382f90ea33c70ebd99089990ea163528e.

Harness

• Run dir: .llm/runs/release-0.0.6-internals--orchestration/slices/pr-b-1403/
• Plan: plan-quality-rail.md revision 4; formal PLAN-EVAL cycle 5 PASS
• Phase: impl complete; awaiting orchestrator-owned re-sync and ready transition.
• Do not merge until the mandatory separate-session IMPL-EVAL passes.

Drift / Debt

• D-1 resolved by orchestrator rescope: R-5 moved into PR-B because root expansion and A14 origin-awareness are a matched pair.
• D-2 resolved by correcting wrapper scope to the owned fitness/quality trees; unrelated .llm/tools/harness/extract-verdict.ts remains untouched.
• D-3 resolved by two temporary per-line chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549 allowances. Repo-scan allowance count is now 10 and should fall to 8 when chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549 adds comment-awareness.
• Triage retains exactly 1 actionable finding: packages/plugin-streams-core/src/application/durable-stream-producer-supervisor.ts:501, A8/AP-1/F-1, 515 lines over the 500-line warning threshold. It is not fixed or suppressed here.

issue: 1403
entries:
  - box-index: 1
    evidence: "check-doctrine_test.ts independently enumerates 36 roots and includes packages/plugin-streams-core; arch:check exit 0 at 48fcef438"
  - box-index: 2
    evidence: "scan-code-quality.ts documents default quality:scan policy; quality:scan:repo covers packages, plugins, fitness, and quality tools and exits 0"
  - box-index: 3
    evidence: "focused plugin-streams-core scan: quality 0 findings; doctrine 0 FAIL, 1 WARN, 1 INFO; triage.md preserves the 515-line A8 warning"
  - box-index: 4
    evidence: "independent filesystem census equals discoverDoctrineRoots(), includes plugin-streams-core, excludes nested cli/e2e; 15-test gate exit 0"
  - box-index: 5
    evidence: "triage.md records the actionable finding with file, line, rule, and assessment; no package/plugin source fix or suppression"
  - box-index: 6
    evidence: "committed pre-allowance workflow-equivalent scan at b64550722 exited 1 on two .llm/tools findings, proving execution where the old step ran no command; final scan exits 0 with two #1549 allowances"
  - box-index: 7
    evidence: "empty-set CLI fixture exits 2 with explicit 'not scanned' message"
  - box-index: 8
    evidence: "stale-base git-graph fixture proves BASE...HEAD merge-base selection excludes a foreign already-merged file"

Definition of Done

• All B1–B3 contracts and all eight fix(quality): quality:gate is substantially uninformative — arch:check omits 20 of 36 publishable packages and quality:scan covers only packages/cli/src #1403 acceptance boxes have evidence.
• Newly surfaced findings are triaged without package/plugin source fixes.
• All seven required final gates pass at the final head.
• The PR remains draft for the orchestrator-owned ready transition.

[rickylabs]

[PHASE: IMPL] [VERDICT: RED_FIRST]

Committed the B1/B3 negative fixtures before implementation.

• Commit: 190c11445
• Command: deno test --allow-read --allow-env --allow-write --allow-run .llm/tools/fitness/check-doctrine_test.ts .llm/tools/quality/changed-source-files_test.ts
• Exit: 1
• Evidence: TS2305 for missing discoverDoctrineRoots; TS2307 for missing changed-source-files.ts.
• Fixtures explicitly cover a .llm/tools-only diff, an empty diff, and a stale-base/foreign-merge graph.

Next: implement the locked B1–B3 contracts; this is expected red history, not a completion claim.

[rickylabs]

[PHASE: IMPL] [VERDICT: BLOCKED_B2]

The locked 36-root transition exposes a contradiction in the passed plan.

• deno task arch:check exit: 1
• Discovered roots: 36
• Blocking findings: 54 pre-existing A14 (52 packages/cli, 1 packages/database, 1 packages/mcp)
• The rail plan already records this exact A14 population inside the baseline arch:check:repo result (55 = 54 A14 + 1 root A1).
• This PR is forbidden to change A14 (PR-C docs(doctrine): the codebase verdict table names five deleted packages, omits 14 live units, and its arch:check:repo gate has been accepted-red since 2026-06-21 #1380), forbidden to fix surfaced findings, and required to keep arch:check exit 0.

I applied no suppression and no package source fix. The conflict is recorded in slice drift.md D-1. B1 and B3 continue; B2's final gate needs orchestrator direction.

[rickylabs]

[PHASE: IMPL] [VERDICT: PARTIAL_GREEN]

B1 and B3 landed; B2 is implemented but its final gate remains escalated.

• Commit: ca52c3a8f
• Root coverage: independently enumerated 36 top-level units; includes packages/plugin-streams-core, excludes nested packages/cli/e2e.
• PR selector: includes .llm/tools/**; empty set exits 2 with explicit not scanned; stale-base fixture excludes foreign merged files through three-dot semantics.
• Tool tests: 14 passed, 0 failed, exit 0.
• Workflow policy tests: 3 passed, 0 failed, exit 0.
• YAML parse: exit 0.
• Focused plugin-streams-core quality scan: exit 0, 0 findings, 0 allowances.
• Focused doctrine scan: 0 FAIL, 1 WARN, 1 INFO; exactly 1 actionable finding recorded in slice triage.md, with no package source fix.
• Generated agent-tool assets refreshed in the same commit.

Blocked evidence remains: deno task arch:check exits 1 on 54 pre-existing A14 findings when the final 36-root selector is applied; see D-1 and the prior escalation comment.

[rickylabs]

[PHASE: IMPL] [VERDICT: BLOCKED_FINAL_GATES]

Final non-blocked evidence is recorded at b64550722.

Additional truthful results:

• Workflow-equivalent changed-file scan: exit 1, after actually scanning the PR's .llm/tools files. It reports 2 pre-existing false positives where English “any” appears in comments at check-doctrine.ts:169 and :237.
• Total triage: 3 findings (1 actionable plugin-streams-core doctrine warning + 2 tool-comment scanner false positives), all with file/line/rule/assessment; none fixed.
• deno task quality:scan:repo: exit 0, 0 findings, 8 allowances.
• deno task quality:gate: exit 1 because its default scan passes and the new 36-root doctrine half reaches the 54 known A14 failures.
• Second deno task gen:assets-barrel: exit 0; subsequent git status --porcelain is empty.
• Exact scoped check/lint wrappers: exit 0.
• Exact scoped fmt wrapper: exit 1 solely for pre-existing out-of-scope .llm/tools/harness/extract-verdict.ts; all PR-owned TS files format clean.
• Workflow YAML parse: exit 0.

C6 forbids fixing surfaced findings and the brief forbids A14 work, suppressions, or out-of-boundary cleanup. The PR remains draft with status:impl; I have not claimed acceptance completion or flipped it ready.

[rickylabs]

[PHASE: IMPL] [VERDICT: COMPLETE]

Orchestrator decisions are implemented at final head 48fcef4382f90ea33c70ebd99089990ea163528e.

Resolutions

1. R-5 moved into PR-B. resolveIdentifierOrigin() returns imported | locally-bound | unresolved; A14 fires only on unresolved. One actual-CLI test proves imported quiet, locally-bound quiet, and synthetic bare global RED.
2. Two reversible chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549 allowances. The committed pre-allowance run at b64550722 exited 1 on the two comment false positives, proving the repaired .llm/tools path executes. Final scans are green; repo allowance count is 10 (8 + 2).
3. Corrected wrapper scope. Check/lint/fmt cover only .llm/tools/quality and .llm/tools/fitness; unrelated extract-verdict.ts remains untouched.

Final-head gates

• Fitness + quality tests: exit 0 — 15 passed
• arch:check: exit 0 — all 36 roots
• quality:gate: exit 0
• quality:scan:repo: exit 0 — 0 findings, allowCount 10
• Owned check/lint/fmt: all exit 0 — 10 files, 0 diagnostics/findings
• Workflow-equivalent scan: exit 0 — 0 findings, 2 chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549 allowances
• Workflow policy/YAML: exit 0 — 3/3 tests and parse PASS
• Asset barrel second run: exit 0; git status --porcelain empty
• Remote ref: 48fcef4382f90ea33c70ebd99089990ea163528e

The one actionable 515-line plugin-streams-core A8 warning remains triaged and unchanged. Box 5 of #1380 is implemented here for PR-C to cite; #1380 remains open and untouched. The PR remains draft with status:impl for the orchestrator-owned re-sync and ready flip.

[rickylabs]

[PHASE: REVIEW] [VERDICT: PASS — flipping to ready]

Orchestrator slice review at re-synced head c740ff6e0 (base merged forward to db1d79c68 before the
flip, so the head is final when IMPL-EVAL fires). All executed by the reviewer.

The decisive result

deno task arch:check        →  exit 0     ← at 36 roots, with A14 origin-aware
deno task quality:gate      →  exit 0
deno task quality:scan:repo →  exit 0
deno test .llm/tools/fitness/ .llm/tools/quality/  →  15 passed | 0 failed
deno task gen:assets-barrel →  exit 0, git status empty (idempotent)

arch:check green at 36 roots is the whole point. It was only ever green at 16 because packages/cli
was not among them.

Selector census, executed

discoverDoctrineRoots() → count=36   plugin-streams-core=true   packages/cli/e2e=false

Exactly the contract: the 36 live units, the omitted plugin-*-core package now covered, and the nested
e2e member excluded — with that exclusion stated in the doctrine rather than left implicit in code.

The three added properties are real, in code

.llm/tools/quality/changed-source-files.ts replaces the inline bash — a better call than the brief asked
for, because it is testable:

`${base}...${head}`                  // three-dot: merge-base semantics (box 8)
'packages', 'plugins', '.llm/tools'  // pathspec now includes .llm/tools (box 6)
Deno.exit(2)  + 'not scanned: no changed source files matched …'   // fail closed (box 7)

And the if ((${#args[@]})) guard that made an empty set silently green is gone. So the three defects
this PR was widened to cover are each addressed at the mechanism, not papered over.

My plan was wrong once and the implementer caught it

The rail put the 36-root selector in PR-B (R-6) and A14 origin-awareness in PR-C (R-5). That ordering was
incoherent: expanding to 36 roots is precisely what makes A14's pre-existing false positives visible to
arch:check, so the two are a matched pair. It escalated rather than either fixing A14 silently or leaving
the gate red. R-5 moved into this PR; arch:check is green as a result.

Counts corroborate the plan's measurement exactly — 52 CLI + 1 database = the 53 sanctioned
@std/testing/bdd imports, and the MCP one is the locally-bound const describe = … helper. Zero genuine
bare globals, so origin 3 is a synthetic fixture that must stay red; without it the fix would be
unfalsifiable.

#1380 box 5 is implemented here, so this PR references #1380 without a closing keyword. PR-C ticks
that box citing this commit; nothing on #1380 is ticked by a PR that does not close it.

Findings triaged, not fixed — which is the point of box 5

Three surfaced, none fixed:

Finding	Assessment
durable-stream-producer-supervisor.ts:501 — A8/AP-1/F-1, 515 lines over the 500 threshold	pre-existing decomposition debt, package-owned follow-up
check-doctrine.ts:169 and :237 — explicit-any on the English word "any" in comments	scanner comment-unawareness, a real false-positive class; routed to #1549

The two false positives carry per-line // quality-allow: naming the class and referencing #1549. Repo-wide
allowCount therefore rises 8 → 10, stated here rather than left to be discovered; both are deleted when
#1549 lands comment-awareness, so the count falls again. No budget is wired yet, so nothing is violated.

That the changed-file scan exits 1 on those two is itself the proof of box 6: the .llm/tools path now
executes and reports, where before it ran no command and reported success.

Two brief errors of mine, recorded

The gate scope --root .llm/tools swept in .llm/tools/harness/extract-verdict.ts, a pre-existing
unformatted file this PR does not own; narrowed to the two roots it does own, and that file left alone. That
is the fourth gate my briefs got wrong on this lane, all the same shape — a command I named without checking
what it covers.

Flipping to ready so the automatic IMPL-EVAL triggers exactly once. No impl-eval:skip.

[rickylabs]

@openhands-agent model=openrouter/deepseek/deepseek-v4-flash-0731 output=pr-comment iterations=800 phase=impl head=c740ff6e03377b2bec75ade200850356d75a2bd7

Trusted base SHA: db1d79c
Evaluated head SHA: c740ff6

use harness

SKILL

• netscript-harness — apply the formal IMPL-EVAL protocol and verdict vocabulary.
• openhands-handoff — publish one machine-readable OpenHands verdict.
• netscript-tools — run the smallest decisive repository-native gates without mutating source.
• netscript-doctrine — apply package/plugin doctrine when the changed surface requires it.

Act as the formal IMPL-EVAL session for this pull request. Do not edit files, create commits, push,
or repair findings. The trigger metadata supplies the trusted base SHA and immutable head SHA: read
the evaluator protocol, verdict definitions, and selected profiles from that base commit, then
evaluate the PR body, linked issues, run artifacts, final diff, review threads, and architecture
debt at the immutable head. Verify the approved plan or recorded PLAN-EVAL: N/A, design
checkpoint, acceptance criteria, static/runtime/consumer gates, public surface, lock hygiene, and
false-done states. For documentation changes, also read every changed document fully and hand-test
representative executable claims.

Return concise, severity-ranked findings with exact evidence and required action. End with exactly
one supported verdict line using OPENHANDS_VERDICT: PASS, OPENHANDS_VERDICT: FAIL_FIX,
OPENHANDS_VERDICT: FAIL_RESCOPE, OPENHANDS_VERDICT: FAIL_DEBT, or
OPENHANDS_VERDICT: FAIL_PLAN. Write the same verdict to OPENHANDS_SUMMARY_PATH.

[rickylabs]

OpenHands Agent — Completed

OPENHANDS_VERDICT: PASS

Model: openrouter/deepseek/deepseek-v4-flash-0731
Provider: OPENROUTER
Job status: success
Verdict source: summary-file
Verdict comment: #1570 (comment)
Summary source: agent
Housekeeping: ack=success trace=success commit-artifacts=skipped replies=skipped draft-pr=skipped
Trace: .llm/tmp/run/openhands/pr-1570/run-31603391461-1 (in the Actions artifact)
Artifact: openhands-agent-31603391461-1

OpenHands IMPL-EVAL — PR #1570 fix(quality): make quality gate coverage informative

Target: PR #1570 (Closes #1403), branch fix/1403-quality-gate-coverage, evaluated head
c740ff6e03377b2bec75ade200850356d75a2bd7 (merge of origin/main), trusted base
db1d79c68f7861a43902313f5d7a68274b0ef12a. Separate-session evaluator. No files edited, no
commits, no findings repaired.

Summary

The PR makes quality:gate informative in all three dimensions #1403 names: (1) replace the
hand-curated 16-root arch:check list with discoverDoctrineRoots() covering all 36 top-level
packages/* + plugins/* units (ending the plugin-streams-core omission); (2) widen the PR
quality scan to .llm/tools/** and make an empty changed-file set report "not scanned" instead of
silently succeeding; (3) switch code-quality.yml's range to three-dot merge-base semantics so a
stale base no longer admits foreign already-merged files. The matched A14 origin-awareness fix
(resolveIdentifierOrigin) resolves the 54 pre-existing CLI/database/MCP false positives so the
expanded doctrine gate is green and truthful.

Changes

• .github/workflows/code-quality.yml — pathspec .llm/tools/quality/** → .llm/tools/**; changed
  scan delegates to .llm/tools/quality/changed-source-files.ts; removed the if ((${#args[@]}))
  skip so the scan always executes.
• .llm/tools/quality/changed-source-files.ts (+ test) — collects packages/plugins/.llm/tools
  changed files over BASE...HEAD, exits 2 with "not scanned" on an empty set.
• .llm/tools/fitness/check-doctrine.ts (+ test) — discoverDoctrineRoots(), --all-roots mode,
  resolveIdentifierOrigin() driving A14; A14 fires only on unresolved bare Jest/Vitest globals in
  test files.
• deno.json — arch:check → one --all-roots invocation; quality:scan:repo adds fitness +
  quality tool roots.
• docs/architecture/doctrine/09-anti-patterns-and-fitness-functions.md — states the
  packages/cli/e2e exclusion (C2).
• packages/cli/src/kernel/assets/agent-tools.generated.ts — regenerated bundle hash (idempotent).
• .llm/runs/.../pr-b-1403/* — context-pack, drift, implement, triage, worklog.

Validation (independently re-run at head)

• deno test check-doctrine_test.ts changed-source-files_test.ts — 5 passed / 0 failed,
  including the independent 36-root census and the imported/local/unresolved A14 CLI fixture.
• deno task arch:check — exit 0 across all 36 discovered roots (incl. plugin-streams-core).
• deno task quality:gate — exit 0.
• deno task quality:scan:repo — exit 0, 0 findings, allowCount 10 (8 base + the two
  reversible #1549 comment allowances at check-doctrine.ts:210,:278).
• Focused scan-code-quality --root packages/plugin-streams-core — exit 0, 0 findings, 0 allowances.
• check-doctrine.ts --all-roots (with --allow-run) — exit 0.
• code-quality.yml parses via @std/yaml; pathspec '.llm/tools/**' present.
• A14 false positives eliminated: arch:check green over CLI/database/MCP confirms origin
  resolution works on real code.

Responses to review / issue comments

• No review threads or PR comments exist on fix(quality): make quality gate coverage informative #1570 (verified via API). No reply threads required.
• Issue fix(quality): quality:gate is substantially uninformative — arch:check omits 20 of 36 publishable packages and quality:scan covers only packages/cli/src #1403 (OPEN) — all 8 acceptance boxes carry evidence in the PR body's fenced
  acceptance-evidence block; every box is corroborated by the gates above.

Findings

• None blocking. Two minor, non-blocking observations:
  • [informational] On the push (main) branch the workflow passes empty SHA args to
    changed-source-files.ts, which exits 2 with a usage/not scanned message on stderr; the job
    continues and scans default roots. Not a regression (prior two-dot form was also empty-base on
    push) and the gate still executes.
  • [informational] The two temporary #1549 comment allowances and the triaged
    plugin-streams-core A8 515-line warning are recorded in the slice triage.md/drift.md with
    owner/reason/linked issue; no package source was edited or suppressed. Satisfies fix(quality): quality:gate is substantially uninformative — arch:check omits 20 of 36 publishable packages and quality:scan covers only packages/cli/src #1403 box 5
    and C6.

Remaining risks

• The #1549 comment-aware allowances are reversible by design; the repo-scan allowance count is
  expected to drop 10 → 8 when chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549 lands. The 515-line durable-stream-producer-supervisor.ts
  A8 decomposition warning remains open as a package-owned follow-up.
• PR remains draft pending the orchestrator-owned ready transition and separate-session IMPL-EVAL
  sign-off (this report is that IMPL-EVAL pass).

Verdict

OPENHANDS_VERDICT: PASS

Run: https://github.com/rickylabs/netscript/actions/runs/31603391461

[rickylabs]

[OWNERSHIP] The fresh-ui-quality red on this PR is not owned by this issue's code — it is a stale private lock, now tracked as #1580 and owned by the runtime/Fresh lane.

Reproduced at current main db1d79c68 in an isolated Deno 2.9.5 worktree:

• deno task check in packages/fresh-ui (frozen, --lock=deno.lock) → failedBatches: 2 of 2.
• The canonical deno task lock:update generates exactly one line — + "jsr:@fresh/plugin-vite@^1.1.2", — numstat 1 0, no other movement.

Cause: #1558 added a direct @fresh/plugin-vite@^1.1.2 dependency to packages/fresh; packages/fresh-ui's private lock was never regenerated, so its frozen check fails. Same root-cause class as root-lock PR #1572, in a different lock file.

No action needed from internals — do not chase it in your code, and do not regenerate the lock from your branch (parallel writers on the same derived file would conflict). A Codex slice is dispatched for #1580 from current main; it will land before Canary.3. I'll comment here when it merges so you can re-run.

Filed and owned by the runtime lane; the root-lock counterpart is #1571/#1572.

[rickylabs]

OPENHANDS_VERDICT: PASS

IMPL-EVAL — PR #1570 fix(quality): make quality gate coverage informative

Separate-session evaluator at head c740ff6e0 (merge of origin/main), base db1d79c68. No files edited, no commits pushed.

What the PR proves (re-run independently)

• Discovered doctrine roots: discoverDoctrineRoots() enumerates 36 top-level packages/*+plugins/* units (verified by an independent census and by the PR's own test) — plugin-streams-core is no longer skipped. deno task arch:check → exit 0 over all 36 roots; --all-roots mode with --allow-run → exit 0.
• Gate coverage: .llm/tools/** now part of the PR scan pathspec (workflow YAML validated, parses clean); changed-source-files.ts fails closed (exit 2 + not scanned on an empty set) and uses three-dot merge-base, so a stale base no longer admits foreign already-merged files (fixture proves main-merged files are excluded).
• A14 contradiction resolved: resolveIdentifierOrigin() distinguishes imported/locally-bound/unresolved; A14 fails only on unresolved bare globals in test files. Real CLI/database/MCP code is now clean — the 54 pre-existing findings are gone with zero A14 changes, satisfying the D-1 drift record. Tests drive all three origins through the actual CLI (unresolved → exit 1).
• Quality gate: deno task quality:gate → exit 0. quality:scan:repo → 0 findings, allowCount 10 (8 base + two reversible #1549 comment allowances at check-doctrine.ts:210,:278). Focused scan-code-quality --root packages/plugin-streams-core → 0 findings, 0 allowances.
• Tests: new fitness+quality suites — 5 passed / 0 failed.

Findings (none blocking)

1. [informational] On the push-to-main branch the workflow passes empty SHA args to changed-source-files.ts, which writes not scanned to stderr and exits 2; the job continues and scans default roots. Not a regression (prior two-dot form was equally empty-base on push) and the gate still executes.
2. [informational] The temporary #1549 allowances and the triaged plugin-streams-core A8 515-line warning are recorded in the slice triage.md/drift.md with owner (chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549) and linked issue; no package source was edited or suppressed. Allowance count should drop 10→8 when chore(quality): land the provable half of the quality-scan rail — docs fences, exemption assertions, and a budget that can only fall #1549 lands.

Required action

None. All acceptance criteria carry corroborated evidence; no false-done states, no lock churn committed, no A14 source changes.

[rickylabs]

[PRE-MERGE GATE] [VERDICT: PASS — merging]

Run at head 807d29003, which is exact current main plus this PR's implementation.

#	Check	Result
1	close-gate green	PASS — red until the mirror could see status:ready-merge; green on the same head after a workflow re-run, not a push
2	zero unticked boxes on closed issues	PASS — #1403 8/8 mirrored from structured box-index evidence
3	no new ignore/cast in the diff	PASS — none beyond the two deliberate // quality-allow: lines documented below; no deno.lock churn
4	named gates SUCCESS, not skipped	PASS — pr-checks 22 checks, 0 current failures. fresh-ui-quality green (run 31605497993), the red having been a foreign defect (#1580)
5	decisive claim re-verified independently	PASS — arch:check exit 0 at 36 roots; quality:gate 0; quality:scan:repo 0; 15 tests; gen:assets-barrel idempotent; discoverDoctrineRoots() → 36 / streams-core in / cli-e2e out
6	changed-file audit	PASS — .llm/tools/{fitness,quality}, deno.json, one doctrine file, the regenerated asset barrel, slice dir. Nothing else
7	PR body matches what shipped	PASS — verified box by box against executed results
—	review-threads	PASS — 0 threads

Evaluator provenance, preserved on proof

IMPL-EVAL PASS at c740ff6e0 (run 31603391461, trigger gen=29343539580 head=c740ff6e0). The head then
moved to 807d29003 via gh pr update-branch by another lane. That is normally verdict-invalidating here —
this lane has paid for it twice — and it is not this time, because:

git diff --stat c740ff6e0..807d29003 -- .llm/tools/quality .llm/tools/fitness deno.json \
    .github/workflows/code-quality.yml docs/architecture/doctrine    → EMPTY
merge-base vs main = 50739a7ae = exact current main

The evaluated implementation is byte-identical; the entire delta is main's commits. So the verdict names
the shipped implementation and no re-evaluation is owed. No evaluator capacity was spent re-running an
identical tree.

What this PR actually fixes — three defects on one gate

1. Curated root list. arch:check gated 16 hand-listed roots; packages/plugin-streams-core was the only
   plugin-*-core absent. Now discoverDoctrineRoots() returns the 36 live top-level units, with
   packages/cli/e2e excluded and that exclusion stated in the doctrine rather than implicit in code.
2. The PR gate never scanned .llm/tools/**, and skipped entirely when nothing else changed. The pathspec
   was -- packages plugins, and if ((${#args[@]})) meant an empty set ran no command and reported
   success. Now a checked-in script includes .llm/tools and exits 2 with an explicit not scanned
   message instead of silent green.
3. The range was two-dot, so a stale recorded base enumerated other lanes' already-merged files — nine of
   them on PR fix(release): restore release-cut truth #1539, with zero lines of the PR under review. Now ${base}...${head}.

Sequencing correction, mine

The rail put the 36-root selector here and A14 origin-awareness in PR-C. Incoherent: expanding to 36 roots is
exactly what makes A14's pre-existing false positives visible to arch:check. The implementer escalated
instead of silently fixing A14 or leaving the gate red. R-5 moved into this PR, and arch:check is green as
a result. #1380 box 5 is implemented here, so this PR references #1380 without a closing keyword —
PR-C ticks that box citing this commit.

Findings triaged, not fixed — box 5 working

Finding	Disposition
durable-stream-producer-supervisor.ts:501 — 515 lines over the 500-line threshold	pre-existing decomposition debt, package-owned follow-up
check-doctrine.ts:169, :237 — explicit-any matching the English word "any" in comments	scanner comment-unawareness, routed to #1549; per-line // quality-allow: naming the class

Repo-wide allowCount therefore rises 8 → 10, stated rather than discovered; both allowances are deleted
when #1549 lands comment-awareness. No budget is wired yet, so nothing is violated.

That the changed-file scan exits 1 on those two is itself the proof of the .llm/tools box: that path now
executes and reports, where before it ran no command and reported success.

Merging.