fix(ci): gate cross-package conformance scans by their real input set (#7802)

A test that resolves the repo root and walks it has an input set far wider
than the package it lives in, and both of CI's scoping layers judged such a
test by its home package:

  - `turbo ls --affected` (ci.yml `test`, the PR path) reaches packages
    through the dependency GRAPH. `packages/spec` declares no dependency on
    `packages/platform-objects` — and should not; the api-methods batch
    conformance scan reads source text precisely to avoid inverting the
    spec -> * direction. Measured on turbo 2.10.7: a platform-objects-only
    diff makes 51 packages affected, `@objectstack/spec` not among them.

  - turbo's task cache hashes `$TURBO_DEFAULT$`, which is package-local, so
    `@objectstack/spec#test` hashed identically before and after the change.
    Even the merge-queue and push builds — which deliberately partition the
    FULL package list — replayed a cached green. Measured: `>>> FULL TURBO`
    in 42ms replaying the prior log, while `--force` on the same tree failed
    the scan. This layer, not the paths-filter, is why #7769 reached `main`.

Packages whose tests read outside themselves now declare that radius once,
and both layers are driven from it: ci.yml unions a declaring package back
into the shard's package set when the diff touches its globs, and turbo.json
carries matching `$TURBO_ROOT$` inputs so the cache hash moves with them.

The declaration list cannot rot, which is the point: the gate finds escaping
tests itself, statically, and fails on a package that has one and no
declaration, on a stale declaration, on a glob turbo.json does not hash, and
on a radius too narrow to cover the paths its own tests name. A new
cross-package scan that nobody registers produces a red gate naming it and
the globs to write — not a silent skip.

Census: 20 such tests in 8 packages. Radii are kept narrow so the
affected-subset optimisation the 3-way shard exists for survives; the
literal-coverage check is what makes narrowing safe.

Author: os-support-ai

.github/workflows/ci.yml

@@ -307,6 +307,34 @@ jobs:
             echo "Affected-set diff base: $SCM_BASE  (merge-base of origin/$BASE_REF and HEAD)"
             echo "Frozen payload base.sha: $PINNED_BASE_SHA  -- $BASE_REF has moved $DRIFT commit(s) since it was frozen, and that drift is exactly what this step used to charge to this PR."
             TURBO_SCM_BASE="$SCM_BASE" pnpm exec turbo ls --affected --output=json > "$RUNNER_TEMP/turbo-ls.json"
+            # `turbo ls --affected` answers "which packages does the dependency
+            # GRAPH reach from this diff" — and some suites read files the graph
+            # does not connect them to. spec's api-methods-batch-conformance scan
+            # walks every `*.object.ts` in the monorepo while spec declares no
+            # dependency on the packages it judges (nor should it: the scan reads
+            # source text precisely to avoid inverting the spec -> * direction).
+            # A platform-objects-only diff therefore left it unrun, and #7769
+            # landed a violation on `main` that only PRs touching `spec` ever saw.
+            # Measured on turbo 2.10.7: 51 packages affected by that diff, spec
+            # not among them.
+            #
+            # So packages that declare a cross-package input radius are unioned
+            # back in when the diff touches it. The declarations, and the static
+            # detector that refuses to let a new cross-package scan go
+            # undeclared, live in the script (`pnpm check:cross-package-test-inputs`).
+            #
+            # Failure here falls back to the FULL package list, never to the
+            # affected-only set: same posture as the merge-base fallback below
+            # (#6195), and the same reason — the full list is a strict superset,
+            # so doubt costs minutes rather than coverage. This is the FILTER
+            # CONTRACT's half 1 applied one layer down.
+            if ! git diff --name-only "$SCM_BASE" HEAD > "$RUNNER_TEMP/changed-files.txt" \
+              || ! node scripts/check-cross-package-test-inputs.mjs \
+                   --union-into "$RUNNER_TEMP/turbo-ls.json" \
+                   --changed "$RUNNER_TEMP/changed-files.txt"; then
+              echo "::warning::Could not union cross-package scans into the affected set; falling back to the full package list for this shard."
+              pnpm exec turbo ls --output=json > "$RUNNER_TEMP/turbo-ls.json"
+            fi
           else
             # Falling back to the FULL package list, never to the frozen
             # base.sha. This is not the #4690 silent-skip anti-pattern: that is

.github/workflows/lint.yml

@@ -537,6 +537,27 @@ jobs:
       - name: Required-context name pin
         run: pnpm check:required-contexts
 
+      # Cross-package test inputs (#7802). A test that resolves the repo root
+      # and walks it has an input set far wider than its own package, and BOTH
+      # of CI's scoping layers judge it by where it LIVES: `turbo ls --affected`
+      # reaches packages through the dependency GRAPH, and turbo's task cache
+      # hashes `$TURBO_DEFAULT$`, which is package-local. So spec's
+      # `*.object.ts` conformance scan went unrun on a platform-objects-only
+      # diff, AND replayed a cached green in the merge-queue build that runs the
+      # full package list — a violation reached `main` with every gate green and
+      # was then charged to the next unrelated PR that happened to touch `spec`.
+      # Twenty such tests, in eight packages, exist today.
+      # This gate finds the escaping tests ITSELF, statically — nothing has to
+      # be registered to be DETECTED — and fails on any package that has one and
+      # no declared input radius, on a declaration gone stale, on a declared
+      # glob turbo.json does not hash, and on a radius too narrow to cover the
+      # paths its own tests name. The point is what happens by default: a new
+      # cross-package scan nobody remembers to register produces a RED GATE
+      # naming it and the globs to write, not a silent skip.
+      # Reads ~2000 test sources; sub-second.
+      - name: Cross-package test inputs
+        run: pnpm check:cross-package-test-inputs
+
       # #4248 packaging-hygiene guard. Without a `files` whitelist npm packs the
       # whole package directory, and 20 of the 49 publishable packages declared
       # none — so consumers installed TypeScript sources, unit tests and build

package.json

@@ -78,6 +78,7 @@
     "check:workflow-status-functions": "node scripts/check-workflow-status-functions.mjs --self-test && node scripts/check-workflow-status-functions.mjs",
     "check:shard-attestation": "node scripts/check-shard-attestation.mjs --self-test && node scripts/check-shard-attestation.mjs",
     "check:required-contexts": "node scripts/check-required-contexts.mjs --self-test && node scripts/check-required-contexts.mjs",
+    "check:cross-package-test-inputs": "node scripts/check-cross-package-test-inputs.mjs --self-test && node scripts/check-cross-package-test-inputs.mjs",
     "check:published-files": "node scripts/check-published-files.mjs --self-test && node scripts/check-published-files.mjs",
     "check:type-check-coverage": "node scripts/check-type-check-coverage.mjs --self-test && node scripts/check-type-check-coverage.mjs",
     "check:type-check-debt": "node scripts/check-type-check-coverage.mjs --self-test && node scripts/check-type-check-coverage.mjs --re-measure",