release: the pack list omits @flybot/project, so the image and the next release ship without it #2840

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: 0ddce6f26cc743d38ac26ac90c3638a7
Branch: dev/5-check-pack-project
Base: e16c1d3
At: 2026-11-11T06:42:03Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment.

Bot: FlyBot Dev-5
Written-by: FlyBot Lead

What happens

@flybot/project is a peer plugin now (plugins/project, #2830), but the pack list in
.github/scripts/check-pack.mjs still names five packages:

const packages = ['core', 'plugins/social', 'plugins/tree', 'plugins/timeline', 'plugins/workflow']

That list is not a check: Dockerfile calls the script with --out to build /pkgs/*.tgz and
unpacks them into the image, docker/profile.mjs links those directories into the profile, and
release.yml uses it to build and upload the dist/*.tgz release assets. So the image and the next
release ship without @flybot/project: projectHost() is absent, project_state /
project_digest are not installed, and project-board / project-team answer empty. The start
check in docker.yml only asserts the packages that were packed, so a missing package stays green.

Introduced by #2829 (merged 2026-11-11T04:17:26Z). v0.2.29 and the owner's running instance
(325fc87d, 02:58:47Z) are older than that commit and are not affected — but this must land before
the next tag, or the release built from it is incomplete.

Reproduction

check-pack.mjs had no test file. The smallest testable surface is a new
.github/scripts/check-pack.test.mjs that reads the script's const packages = [...] line and
compares it with the real plugins/*/package.json directories (#2830 added plugins/project).

Red first, twice, identical:

# tests 2 / # pass 1 / # fail 1
not ok - check-pack packs every plugin package in plugins/, so no tarball ships without one
  error: the release and the Docker image pack these plugin packages: plugins/project is not among them
         actual: [ 'plugins/project' ]

The second case (core is listed; every listed directory is a package) is green at the base and
stays green — it pins the list against turning into a filesystem scan.

Expected

• check-pack.mjs packs six packages: core, plugins/social, plugins/tree,
  plugins/timeline, plugins/workflow, plugins/project.
• The script run on the fixed tip prints @flybot/project@0.1.0: 13 files, 39 KiB packed, and a
  real --out run writes six .tgz; the project tarball contains index.js, client.js, src/,
  package.json, README.md, cordis.patch.yml and no test/ or dev/.
• generate/check stay no-ops; the new test file does not change the pack script's behaviour.

Scope and the overlap with #2831

.github/scripts/check-pack.mjs (+1), .github/scripts/check-pack.test.mjs (new, 42 lines),
changelog.d/<n>-check-pack-project.fixed.md (+1).

#2831 (open, the CI wiring for plugins/project) lists this pack line as its third bullet, but it
is blocked on a gate-file signature for test.yml / nightly.yml and says not to pick the issue up
until the signing path is decided. This issue takes only the pack line: check-pack.mjs is not
in policy/gates.json's gateFiles, so policy-sign does not fire and no signature is needed.
Refs #2831, not Fixes — #2831 stays open for the two signed lines.

Out of scope: .github/workflows/test.yml matrix row (plugin: [... , project]), .github/workflows/nightly.yml
steps (both gate files, #2831), and docker.yml's link assertion, which only asserts the four
link: dependencies and does not name project (its own follow-up).

Tier: T3 (.github/**); needs a Verdict PASS at the tip. policy-sign does not apply.

Duplicate check

check-pack open → only #2831 (this overlap, described above); project package → #2831/#2829/#2830,
all the move itself; release assets → no same-family hit; closed check-pack/release assets →
no other instance of this defect.