Harden review flows, add CI/verifier guardrails, and backfill regression coverage

.github/workflows/ci.yml

@@ -29,11 +29,24 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
-      - run: bun install
+          bun-version: 1.3.8
+      - run: bun install --frozen-lockfile
+      - run: bun run lint
+      - run: bun run verify:m056:s03
+      - run: bun run verify:m059:s01
+      - run: bun run verify:m059:s02
+      - run: bun run check:orphaned-tests
       # Bun has been unstable on GitHub runners with one monolithic test process.
       # Keep DB-backed tests on a low concurrency cap and split the suite into
       # two shorter invocations to avoid cross-file schema interference and runner crashes.
-      - run: bun test --max-concurrency=2 scripts src/contributor src/enforcement src/execution src/feedback src/handlers src/jobs src/lib src/review-audit src/review-graph src/routes src/slack src/structural-impact src/telemetry src/triage
+      # The first run covers scripts plus non-knowledge src tests; src/knowledge stays isolated.
+      - run: |
+          mapfile -t non_knowledge_tests < <(
+            {
+              find src -maxdepth 1 -type f -name '*.test.ts'
+              find src -maxdepth 1 -mindepth 1 -type d ! -name knowledge
+            } | sort
+          )
+          bun test --max-concurrency=2 scripts "${non_knowledge_tests[@]}"
       - run: bun test --max-concurrency=2 src/knowledge
       - run: bunx tsc --noEmit

.github/workflows/nightly-issue-sync.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.8
       - run: bun install --frozen-lockfile
       - name: Run issue sync
         run: bun scripts/backfill-issues.ts --sync

.github/workflows/nightly-reaction-sync.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: 1.3.8
       - run: bun install --frozen-lockfile
       - name: Sync triage comment reactions
         run: bun scripts/sync-triage-reactions.ts

bunfig.toml

@@ -1,4 +1,5 @@
 [test]
-# Only scan for tests in the actual codebase.
-# This repo vendors reference code under tmp/ which contains upstream tests.
-root = "src"
+# Scan the repo root so targeted script verifiers can be run by path, but ignore
+# vendored reference code under tmp/ so upstream tests are never discovered.
+root = "."
+pathIgnorePatterns = ["tmp/**"]

eslint.config.mjs

@@ -0,0 +1,39 @@
+import tsParser from "@typescript-eslint/parser";
+
+const typescriptFiles = ["src/**/*.ts", "scripts/**/*.ts"];
+const operatorFacingCliFiles = [
+  // Migration progress and rollback status are intentionally printed for humans.
+  "src/db/migrate.ts",
+  // These are operator/entrypoint surfaces that fail loudly on startup problems.
+  "src/index.ts",
+  "src/config.ts",
+  "src/execution/agent-entrypoint.ts",
+  // Repo-owned scripts are mostly verifiers/CLI utilities, so console output is expected.
+  "scripts/**/*.ts",
+];
+
+export default [
+  {
+    ignores: ["node_modules/**", "tmp/**", ".gsd/**"],
+  },
+  {
+    files: typescriptFiles,
+    languageOptions: {
+      parser: tsParser,
+      ecmaVersion: "latest",
+      sourceType: "module",
+    },
+    rules: {
+      // Start with the repo contract this slice actually needs: catch accidental
+      // console usage in normal source files without introducing a noisy day-one gate.
+      "no-console": "error",
+    },
+  },
+  {
+    files: operatorFacingCliFiles,
+    rules: {
+      // These surfaces intentionally communicate directly with operators.
+      "no-console": "off",
+    },
+  },
+];

package.json

@@ -3,9 +3,14 @@
   "module": "src/index.ts",
   "type": "module",
   "private": true,
+  "packageManager": "bun@1.3.8",
+  "engines": {
+    "bun": "1.3.8"
+  },
   "scripts": {
     "dev": "bun run --watch src/index.ts",
     "start": "bun run src/index.ts",
+    "lint": "eslint src scripts",
     "audit:embeddings": "bun scripts/embedding-audit.ts",
     "repair:embeddings": "bun scripts/embedding-repair.ts",
     "repair:wiki-embeddings": "bun scripts/wiki-embedding-repair.ts",
@@ -61,12 +66,36 @@
     "verify:m048:s02": "bun scripts/verify-m048-s02.ts",
     "verify:m048:s03": "bun scripts/verify-m048-s03.ts",
     "verify:m049:s02": "bun scripts/verify-m049-s02.ts",
-    "verify:m052": "bun scripts/verify-m052.ts"
+    "verify:m053": "bun scripts/verify-m053.ts",
+    "verify:m054:s01": "bun scripts/verify-m054-s01.ts",
+    "verify:m055:s01": "bun scripts/verify-m055-s01.ts",
+    "verify:m055:s02": "bun scripts/verify-m055-s02.ts",
+    "verify:m055:s03": "bun scripts/verify-m055-s03.ts",
+    "verify:m056:s01": "bun scripts/verify-m056-s01.ts",
+    "verify:m056:s02": "bun scripts/verify-m056-s02.ts",
+    "verify:m056:s03": "bun scripts/verify-m056-s03.ts",
+    "verify:m057:s02": "bun scripts/verify-m057-s02.ts",
+    "verify:m057:s03": "bun scripts/verify-m057-s03.ts",
+    "verify:m057:s04": "bun scripts/verify-m057-s04.ts",
+    "verify:m058:s01": "bun scripts/verify-m058-s01.ts",
+    "verify:m058:s02": "bun scripts/verify-m058-s02.ts",
+    "verify:m058:s03": "bun scripts/verify-m058-s03.ts",
+    "verify:m059:s01": "bun scripts/verify-m059-s01.ts",
+    "verify:m059:s02": "bun scripts/verify-m059-s02.ts",
+    "verify:m060:s01": "bun scripts/verify-m060-s01.ts",
+    "verify:m060:s02": "bun scripts/verify-m060-s02.ts",
+    "verify:m054:s02": "bun scripts/verify-m054-s02.ts",
+    "verify:m054:s03": "bun scripts/verify-m054-s03.ts",
+    "verify:m054:s04": "bun scripts/verify-m054-s04.ts",
+    "check:migrations-have-downs": "bun scripts/check-migrations-have-downs.ts",
+    "check:orphaned-tests": "bun scripts/check-orphaned-tests.ts"
   },
   "devDependencies": {
     "@octokit/webhooks-types": "^7.6.1",
     "@types/bun": "latest",
-    "@types/js-yaml": "^4.0.9"
+    "@types/js-yaml": "^4.0.9",
+    "@typescript-eslint/parser": "^8.46.1",
+    "eslint": "^9.38.0"
   },
   "peerDependencies": {
     "typescript": "^5"

scripts/backfill-issues.ts

@@ -137,7 +137,6 @@ async function main() {
       slackKodiaiChannelId: "unused",
       slackDefaultRepo: repo,
       slackAssistantModel: "unused",
-      slackWebhookRelaySources: [],
       port: 0,
       logLevel: "info",
       botAllowList: [],

scripts/backfill-review-comments.ts

@@ -148,7 +148,6 @@ async function main() {
       slackKodiaiChannelId: "unused",
       slackDefaultRepo: repo,
       slackAssistantModel: "unused",
-      slackWebhookRelaySources: [],
       port: 0,
       logLevel: "info",
       botAllowList: [],