ci(static): run the six invariant gates that ran in no workflow

[jouwdan]

Closes MEI-128.

Six gates chained in pnpm verify ran in no CI workflow: workspace:check, i18n:check, board:gen:check, marketplace:gen:check, board-installer:gen:check, vercel-template:gen:check. CI's static job does not run pnpm verify — it enumerates each gate as its own step, and these were never added. A pull request that broke any of them merged green.

Two of those matter immediately:

• vercel-template:gen:check was cited as proof the Vercel template could not drift from scaffold(). True locally, false on a pull request.
• workspace:check holds MEI-120's @swc/helpers tracing-glob gate. That ticket's entire deliverable never ran on a PR, so the runtime Cannot find module it exists to prevent was as unguarded as before.

Each one proven to fail

Broken deliberately, run, reverted:

Gate	Break	Result
workspace:check	bumped the tracing glob to @swc+helpers@0.5.24	names both versions and the runtime failure it would cause
i18n:check	added an untranslated string	holds 1 untranslated string(s) and the baseline allows 0
board:gen:check	hand-edited the generated community.plugins.ts	quotes the first differing line
marketplace:gen:check	renamed a listing	notes meith.dev serves the feed at a stable URL
board-installer:gen:check	inserted a line into create-board.sh	is stale — run pnpm board-installer:gen
vercel-template:gen:check	changed VERCEL_BUILD_COMMAND in scaffold.ts without regenerating	templates/vercel is stale: README.md differs, vercel.json differs

The last is the exact drift this was claimed to prevent, broken at the source rather than the artifact.

Cost: ~6.7s for all six, 7.3s with the parity gate — less than the existing guards step alone.

The gate that guards the gates

pnpm ci:parity:check parses verify into its gates, parses the static job's steps, and fails naming any gate that runs in neither a step nor a named exception. It runs in verify and in static.

One exception, explicit: test, satisfied by test:coverage, with its reason recorded inline. Not a pattern match — it fails if static stops running pnpm test:coverage, and fails if verify stops running pnpm test.

It refuses to pass vacuously. Proven to fail when: a gate has no step; the static job is renamed; verify is emptied; the job runs no script; the exception stops holding; a verify segment cannot be parsed. Comment lines are stripped before matching, so a commented-out step never counts as coverage. tests/ci-parity.test.ts pins all of it and asserts against the real package.json and ci.yml that both sides parse to more than 20 items.

Comments

AGENTS.md says explanations belong in docs/, never in the code. The 30 comment lines today's pull requests added to ci.yml are removed — 286 lines to 255 — after auditing each for content not already documented. Four things were moved into docs/development.md rather than deleted, including that .next-e2e is deliberately not cached because a build restored from a previous run is the stale-cache problem, which had only been a side note.

The 255 pre-existing comments are untouched. They contain institutional knowledge with no home in docs/ yet; sweeping them is a larger change that deserves its own.

Also

docs/development.md no longer claims verify "covers every gate in CI's static job but two". It now states both directions and that they are deliberately asymmetric: verify→static is enforced by ci:parity:check; static→verify is looser, because the create-meith build, the publish dry run, the Redis install and coverage all need CI's machine.

Known limit: the check is one-directional by design, so a future CI-only gate still gets in with nothing objecting. That asymmetry is now written down rather than implicit.

pnpm verify passes: 7758 tests.

---

Generated by Claude Code