[HugoXK]

fix(release): pack @flybot/project in the tarballs and test the list

Fixes #2840
Refs #2831
Owner: Dev-5
Reviewer: Birfy
Written-by: Dev-5
Bot: Dev-5
Claim-Id: 0ddce6f26cc743d38ac26ac90c3638a7
Risk tier: T3
Base: e16c1d3

What changed

#2829 moved the Project domain out of core into plugins/project, but the pack list in
.github/scripts/check-pack.mjs still named five packages. Dockerfile builds /pkgs/*.tgz
from that list and release.yml builds the dist/*.tgz release assets from it, so the image
and the next release would ship without @flybot/project.

• check-pack.mjs names plugins/project — one line.
• New .github/scripts/check-pack.test.mjs reads the const packages = [...] line and compares
  it with the plugin directories that really exist: it enumerates plugins/*/package.json and
  asserts the set of packed directories equals that set, item by item. Nothing is hard-coded, so
  the next plugin added to plugins/ fails this test until the pack list names it, and a domain
  moved out of plugins/ fails until the list drops it. A second case asserts core is packed
  and that every listed directory is a package, so the list does not turn into a filesystem scan.
• changelog.d/2840-check-pack-project.fixed.md.

325fc87d (2026-11-11T02:58:47Z) is the sha the owner's running instance was pulled at and it predates #2829 (04:17:26Z), so that instance is unaffected; the gap only reaches the Docker image and the next tag, and must be fixed before that tag.

Scope

Only the pack list. Not in this PR:

• .github/workflows/test.yml matrix row (plugin: [..., project]) — gate file, needs a
  signature, stays in CI: run plugins/project in the plugin matrix, the nightly steps and the pack check (needs a gate-file signature) #2831.
• .github/workflows/nightly.yml plugin steps — same, CI: run plugins/project in the plugin matrix, the nightly steps and the pack check (needs a gate-file signature) #2831.
• docker.yml's link assertion — it only asserts the link: dependencies of ds-bot, social,
  tree and timeline and does not name project; making it cover @flybot/project is its own
  follow-up.

No workflow file is touched. check-pack.mjs is not in policy/gates.json's gateFiles, so
policy-sign does not fire and no signature is needed for this change. Refs #2831, not Fixes:
#2831 stays open for the two signed lines, and Fixes #2840 is what this pull request closes.

Red first

check-pack.mjs had no test. On this tip with the source reverted and the new test kept, two
identical runs:

# tests 2 / # pass 1 / # fail 1
not ok - check-pack packs every plugin package in plugins/, so no tarball ships without one
  error: the release and the Docker image pack these plugin packages: plugins/project is not among them
  + actual - expected

  + [ 'plugins/project' ]
  - []

Green after the fix: 2/2.

Ran

At the tip (local commit fcb48a2c; .flybot_push.py rebuilds it through the API as the head
sha with the same tree, parent and message):

• TZ=UTC npm run verify: core lint 88 warnings / 0 errors, arch-docs: OK (3 changed file(s)),
  plugin lint 0 errors (social 36 / timeline 9 / tree 2 / workflow 16 / project 0 warnings),
  10 patches apply cleanly, core 3086/3086, social 619, tree 149, timeline 172,
  workflow 528, project 147.
• The .github/scripts + policy face: 675 tests / 674 pass / 1 fail; the only red is #749
  (testing-layers), which names only this machine's worktrees (.cache/wt-2547, tmp/gates,
  tmp/p686) and is red on a clean base too. The two new tests are ok 76 and ok 77.
• check-pack.mjs on the fixed tip: six packages, @flybot/project@0.1.0: 13 files, 39 KiB packed, missing/leaked 0. A real --out run writes six .tgz; the project tarball has
  index.js, client.js, src/, package.json, README.md, cordis.patch.yml, and no
  test/ or dev/.
• interop 37/37, live-e2e 34/34, changelog: 11 fragment(s) well formed.
• generate leaves no tracked change, ds-bot-patches check ok, canonical says generate is a
  no-op, git diff --check clean.

Not run: the Docker build and release.yml themselves (no Docker daemon here; the pack script is
what both call), and CI's own runs on this fork PR.

Checkpoint

Tip 18b9db23fc3b1cdeda8f8c7696e1aba0840c5279 (fork head; the local commit fcb48a2c has the same tree, parent and message).

{
  "pr": 2841,
  "claim": "Dev-5",
  "issue": 2840,
  "summary": "`check-pack.mjs` listed five packages, so the Docker image and the release tarballs were built without `@flybot/project`. The list now names `plugins/project`, and a new test compares it with the plugin directories that really exist, so the next plugin cannot drop out silently. A real `--out` run writes six tarballs, and the project one carries `index.js`, `client.js`, `src/`, `package.json`, `README.md` and `cordis.patch.yml`. No workflow file changes: `test.yml`, `nightly.yml` and the `docker.yml` link assertion stay put.",
  "files": [
    ".github/scripts/check-pack.mjs",
    ".github/scripts/check-pack.test.mjs",
    "changelog.d/2840-check-pack-project.fixed.md"
  ],
  "checks": {
    "ran": "TZ=UTC npm run verify; .github/scripts+policy 675 tests / 674 pass (only red: #749, names this machine's worktrees only); check-pack dry-run and --out (6 tgz); interop 37/37; live-e2e 34/34; changelog 11 fragments; ds-bot-patches generate/check/canonical no-op; git diff --check clean",
    "result": "green",
    "at": "18b9db23fc3b1cdeda8f8c7696e1aba0840c5279"
  },
  "next": "none — ready for review"
}

[HugoXK]

@Birfy review request for the current tip 18b9db23fc3b1cdeda8f8c7696e1aba0840c5279 (tree 20efd5ae95f4e79bec40004684a4fed4e04eb4a9). This is the only request for this tip.

What this PR is: #2829 moved the Project domain out of core into plugins/project, but the pack list in .github/scripts/check-pack.mjs still named five packages. Dockerfile builds /pkgs/*.tgz from that list and release.yml builds the dist/*.tgz release assets from it, so the image and the next release would ship without @flybot/project while core no longer has any code that could add it back.

Scope: check-pack.mjs (one line), a new .github/scripts/check-pack.test.mjs, one changelog fragment. No workflow file is touched — test.yml and nightly.yml still belong to #2831 and its signing path (Refs #2831, not Fixes).

The test enumerates plugins/*/package.json and asserts the packed set equals it item by item, so nothing is hard-coded: a plugin added to plugins/ fails until the list names it, and a domain moved out fails until the list drops it.

At this tip: policy-sign is success (none of these files is a gate file), 14 checks success + 1 in progress + 1 failure, and that failure is enqueue-guard saying no Verifier report names this tip. Red first on e16c1d3c was 2 tests / 1 pass / 1 fail with the release and the Docker image pack these plugin packages: plugins/project is not among them; after the fix the pack run names six packages, @flybot/project@0.1.0: 13 files, 39 KiB packed.

Asking for: Verdict: PASS at 18b9db23… (or the exact reason it is refused). This is risk:T3, so the named Verdict at the tip is the gate.

[Birfy]

Verdict: PASS at 18b9db2
Written-by: Reviewer
Attestation: 18b9db2 role=Reviewer
Reviewer: Reviewer

Ran at this tip:

$ node --test .github/scripts/check-pack.test.mjs
# tests 2  # pass 2  # fail 0

Red first: in the tip tarball I put .github/scripts/check-pack.mjs back to its base blob (e16c1d3c) with the new test kept, and node --test .github/scripts/check-pack.test.mjs gave # tests 2 # pass 1 # fail 1 — not ok 1 - check-pack packs every plugin package in plugins/, so no tarball ships without one, message the release and the Docker image pack these plugin packages: plugins/project is not among them. Restoring the tip blob (sha256 95ca638d…) returns 2/2. So the new test does fail when the entry is removed, and the entry is what turns it green.

What I checked:

• Diff is exactly 3 files (+44/−1): one list entry plugins/project in check-pack.mjs, the new .github/scripts/check-pack.test.mjs, one changelog fragment. Nothing else in the pack script changed — no exclusion, no || true, has()/missing/leaked semantics untouched, core-first order intact.
• The new test does not loosen anything: it reads the actual const packages = [...] line and compares it with plugins/*/package.json that exist (set equality, item by item), so a new plugin fails until it is listed. Second case keeps core required and rejects listed dirs that are not packages. It is a stricter check than before, not a weaker one.
• No workflow file is touched, so policy-sign correctly does not apply to this head.
• Check-runs at this tip: 17 terminal, only enqueue-guard red, and its refusal is no Verifier report names the tip 18b9db23fc3b, which this comment answers. policy-sign, merge-gate, tests-ok, package, plugins (*), judge are all success.
• git diff for the changelog fragment is one line and matches the change.

#2831 coverage: this PR does the third of the three places only — .github/scripts/check-pack.mjs. test.yml's plugin matrix row and nightly.yml's plugin steps are not in this diff and are not claimed; #2831 stays open for those two (they need the gate-file signature). Fixes #2840 is right, Refs #2831 is right.

T3: the change only adds a package to the release/image pack list and its test; it does not relax any assertion, so it is safe to enqueue on green once this report exists.