feat(devx): mechanise the sdui-parser lockstep against a vendored record of objectui's side (#13362)

Two copies of the constrained-JSX parser exist: objectui's runs in the renderer,
this one runs in the save gate, and #12719 states that they must byte-agree on
the accepted grammar and on diagnostic codes. That invariant was enforced by
nothing through three manual ports.

`check:sdui-lockstep` recomputes this copy's grammar-region blob id and its
diagnostic-code set and compares both against a vendored record of objectui's
side taken at a named revision. No network, no build and no objectui checkout at
check time; `pnpm gen:sdui-lockstep` re-records objectui's side only, so it
cannot launder a divergence here.

The code extractor resolves a SCREAMING_SNAKE constant at a code position and
refuses on one it cannot resolve: the same code is a quoted literal here and a
constant reference on objectui's side, so a literal-only scan reports a false
24-vs-23 difference on day one.


Claude-Session: https://claude.ai/code/session_01CPrUz21stTFhJRUirdc4yw

Co-authored-by: Claude <noreply@anthropic.com>

Author: Elon Musk

.github/workflows/lint.yml

@@ -532,6 +532,27 @@ jobs:
       - name: Widget `options` census derived from the spec, not pinned
         run: pnpm check:widget-option-census
 
+      # The sdui-parser LOCKSTEP invariant (#12719 / #13150). Two copies of the
+      # constrained-JSX parser exist: objectui's runs in the RENDERER, this one
+      # runs in the SAVE GATE, and #12719 states that they must byte-agree on
+      # the accepted grammar and on the diagnostic codes — an invariant that had
+      # been enforced by NOTHING through three manual ports, two of which landed
+      # only because someone happened to file a card naming the drift.
+      #
+      # Compared against a VENDORED RECORD of objectui's side, so this step
+      # needs no network, no build and no objectui checkout. Read the gate's
+      # header for what that buys and what it costs: it sees this copy moving
+      # away from the recorded objectui state; it does NOT see objectui moving
+      # afterwards, and only a `.objectui-sha` bump — the moment a divergence
+      # starts SHIPPING — brings that direction back into view.
+      #
+      # Unfiltered on purpose. The record lives under packages/sdui-parser/, the
+      # pin is a root dotfile, and this workflow declares no paths: filtering it
+      # to the parser subtree would go dormant on exactly the PR that moves the
+      # pin. Cost is one TypeScript parse of seven small files, ~0.4 s.
+      - name: sdui-parser stays in lockstep with objectui's copy
+        run: pnpm check:sdui-lockstep
+
       # pm-dispatch SKILL.md line ratchet (#7341 / #5925 item 7): the PM skill
       # is read in full by every seat session and every Routine fire, so its
       # size is a per-round tax on the whole fleet. The #7341 extraction moved

package.json

@@ -25,6 +25,7 @@
     "os": "node packages/cli/bin/run.js",
     "objectui:build": "bash scripts/build-console.sh",
     "sdui:manifest": "bash scripts/gen-sdui-manifest.sh",
+    "gen:sdui-lockstep": "node scripts/check-sdui-lockstep.mjs --update",
     "objectui:bump": "bash scripts/bump-objectui.sh",
     "objectui:refresh": "bash scripts/bump-objectui.sh && bash scripts/build-console.sh",
     "objectui:clean": "rm -rf packages/console/dist .cache/objectui-*",
@@ -40,6 +41,7 @@
     "check:bash32-floor": "node scripts/check-bash32-floor.mjs --self-test && node scripts/check-bash32-floor.mjs",
     "check:stack-collection-maps": "node scripts/check-stack-collection-maps.mjs --self-test && node scripts/check-stack-collection-maps.mjs",
     "check:widget-option-census": "node scripts/check-widget-option-census.mjs --self-test && node scripts/check-widget-option-census.mjs",
+    "check:sdui-lockstep": "node scripts/check-sdui-lockstep.mjs --self-test && node scripts/check-sdui-lockstep.mjs",
     "check:doc-authoring": "node scripts/check-doc-authoring.mjs --self-test && node scripts/check-doc-authoring.mjs",
     "check:doc-anchors": "node scripts/check-doc-anchors.mjs --self-test && node scripts/check-doc-anchors.mjs",
     "check:docs-single-h1": "node scripts/check-docs-single-h1.mjs --self-test && node scripts/check-docs-single-h1.mjs",

packages/sdui-parser/objectui-lockstep.json

@@ -0,0 +1,56 @@
+{
+  "$comment": [
+    "GENERATED by `pnpm gen:sdui-lockstep`. Do not hand-edit.",
+    "objectui's side of the sdui-parser lockstep (#12719), recorded at one objectui revision.",
+    "ONE SIDE ONLY: this file holds no diff and blesses no divergence — see scripts/check-sdui-lockstep.mjs."
+  ],
+  "objectui": {
+    "repo": "objectstack-ai/objectui",
+    "rev": "45a9aeb57c1374171a5c95ec8aa02adfd731e915",
+    "revDate": "2026-08-30T06:17:22+00:00",
+    "source": "packages/sdui-parser/src",
+    "files": [
+      "packages/sdui-parser/src/codegen.ts",
+      "packages/sdui-parser/src/dashboard-widget-options.ts",
+      "packages/sdui-parser/src/index.ts",
+      "packages/sdui-parser/src/input-type.ts",
+      "packages/sdui-parser/src/parse.ts",
+      "packages/sdui-parser/src/provenance.ts",
+      "packages/sdui-parser/src/types.ts",
+      "packages/sdui-parser/src/validate.ts"
+    ]
+  },
+  "recordedAgainstPin": "9602dc820450dda956843c6cfe5b329bcf88c757",
+  "grammarRegion": {
+    "file": "packages/sdui-parser/src/parse.ts",
+    "delimiter": "/* ---------------------- the JS literal subset (#6614) ---------------------- */",
+    "lines": 214,
+    "blob": "0131f27cf86dbabec09b4ae55ae131403667e7e9"
+  },
+  "diagnosticCodes": [
+    "bad-attr",
+    "bad-attr-value",
+    "bad-self-close",
+    "bad-tag",
+    "expected-element",
+    "expression-child",
+    "forbidden-attr",
+    "forbidden-tag",
+    "inert-expression",
+    "invalid-enum",
+    "mismatched-tag",
+    "missing-required-prop",
+    "multiple-roots",
+    "no-root",
+    "not-a-container",
+    "type-mismatch",
+    "unclosed-comment",
+    "unclosed-element",
+    "unconsumed-widget-option",
+    "unknown-component",
+    "unknown-prop",
+    "unterminated-brace",
+    "unterminated-open-tag",
+    "unterminated-string"
+  ]
+}