Nothing checks the scaffold's devDependencies against the engine release they track #37

Context

A leaf split out of #34, holding its detection half (#34's AC-3 to AC-5), so the PR that delivers it can close something. The split follows @neo-gpt-emmy's review of PR #36. #34 keeps the pin bump (AC-1, AC-2), the v13 AI-tooling decision and the release gate (AC-6).

The Problem

tasks/createPackageJson.mjs writes every scaffolded app's devDependencies. They are meant to track the engine's, and once fell a whole major behind with nothing noticing (#34: 24 drifting ranges). No check compares them to the engine release the scaffold's neo.mjs pin actually installs.

Whether a scaffolded app's bundle scripts consume these hoisted copies, or the engine's own nested ones after the postinstall, is an open hypothesis. #34's AC-6 run settles it. The declared ranges should agree either way: the scaffold advertises them as the engine's.

The Architectural Reality

• tasks/createPackageJson.mjs#init(appName, …, fs, os, path) writes the scaffold's package.json through the fs it is handed, so it can be captured without a disk write.
• The engine a scaffold installs is the newest published neo.mjs its caret pin allows. A checkout can be ahead of what npm serves.
• create-app runs one workflow today, npm-publish.yml, which is workflow_dispatch only.

The Fix

scripts/check-engine-parity.mjs:

• captures the generated package.json;
• resolves the newest neo.mjs the pin allows, via npm view;
• fails on any devDependency both sides declare whose range differs;
• lists the scaffold-only ones without comparing them.

It runs in CI on push and pull request.

Acceptance Criteria

• A planted divergence fails the check, proven by the divergence itself and not by a green run.
• The check runs in CI on push and pull request.
• Its scope is stated where it lives: which packages it compares, why the rest are excluded, and that the bundle-consumption question stays The scaffold pins a v12 engine and 24 drifting devDependencies, and nothing detects it #34's.

Out of Scope

• The pin bump and its devDependency moves (The scaffold pins a v12 engine and 24 drifting devDependencies, and nothing detects it #34 AC-1, AC-2).
• The v13 AI-tooling shape.
• The release-gate run (The scaffold pins a v12 engine and 24 drifting devDependencies, and nothing detects it #34 AC-6).

Related

#34 (the parent concern, which stays open) · PR #36

Live latest-open sweep: the 1 open issue at 2026-09-19T17:00Z (#34, the source of this split). A search for "parity" finds only #34.
A2A sweep: no claim on this check besides mine.
MC sweep: the create-app parity work is this session's own; no prior decision.
Labels: this repository has no ai label, so none was applied.
Decision Record impact: none.

Origin Session ID: 6ecb7b5f-dc26-48a3-8e49-7232159377c1