epic #470 C13: core-decoupling ratchet reads 0, pinned permanently

[Weegy]

Epic #470 C13. Stacked on #807 (C12). Ratchet 0.

Core carries no Dev Platform reference at all — no code path, config key, i18n key, fixture string or comment. All 14 zones CLEAN, and the floor is now enforced as an absolute rather than as a baseline.

3,300  epic start
  214  after C10 (the tree deleted)
  209  after C12 (the publicPaths exemptions)
    0  this PR

Per-zone

Zone	Was	Now	What was there
middleware/src	19	0	Comments. Some pointed at paths C10 deleted (devplatform/routes/devWebhooks.ts, src/devplatform/devJobTypes.ts) — stale links, now corrected
middleware/test	62	0	Fixture route prefixes, nav ids, channel types → a neutral example plugin; one test renamed and re-scoped (below)
middleware/packages	17	0	A tombstone comment in pluginContext.ts + one shared-pool comment; CHANGELOG.md allowlisted
middleware/migrations	69	0	Allowlisted — see below
middleware/env-example	1	0	Operator pointer now names the Hub (the actual install path) instead of the plugin's source repo
web-ui/app	19	0	Nav/route fixtures, plus a genuinely stale comment claiming the entry shows "while DEV_PLATFORM_ENABLED" — an env var C10 deleted
scripts	27	0	The ratchet was counting its own PATTERNS array
middleware/scripts, sidecars, package.json, web-ui/messages, web-ui/config, ci-workflows, compose	0	0	Already clean after C10 — the CI matrix, id-token: write and compose residue named in the C13 brief were handled there

The floor is absolute, not a baseline

A ratchet parked at zero still reads its floor out of a JSON file, and a JSON file is editable. One hand-edit and core could legally re-acquire a reference — the outcome the whole epic exists to prevent.

So EXTRACTION_COMPLETE in scripts/check-core-decoupling.mjs makes the check assert 0 outright and ignore the baseline for pass/fail. --update refuses to write a non-zero baseline. The CI job (core decoupling ratchet (#470), unchanged name, still required) additionally greps the report for TOTAL 0, so even a refactor that made the script exit 0 while still counting hits fails the job.

Mutation-checked — one probe comment added to src/services/ssrfGuard.ts:

$ node scripts/check-core-decoupling.mjs
Core re-acquired Dev Platform references: 1 found, 0 allowed.
  middleware/src: 1
exit 1

$ node scripts/check-core-decoupling.mjs --update
refusing to record a non-zero baseline: 1 reference(s) found.
exit 1

Reversing the extraction is now an architectural decision to argue in review — flip the constant, restore a baseline — not a number to edit.

What is allowlisted, and why it is not a dodge

Two entries, each anchored on an exact path so the exemption cannot widen. Both are historical record rather than coupling — a record you are allowed to edit is not a record.

Allowlisted	Why it cannot be reworded
middleware/migrations/00{22..30}_*	Every deployment that ran them has those filenames in its schema_migrations ledger, and C11's plugin-side migrator seeds its own ledger from exactly those donor rows. Rename one and the handoff stops matching on the installations that need it most. The DDL body names the real tables and columns living in those databases right now.
middleware/packages/plugin-api/CHANGELOG.md	A published entry for a released version, written to be found: it spells out the removed exports so a consumer grepping their own source lands on the entry explaining where the type went. Rewording it breaks its one job and misreports what shipped.

The script also excludes itself. PATTERNS has to spell out the 21 identifiers it hunts for, so an unfiltered scan counted 27 hits against the detector and made the target 27 instead of 0. Self-exclusion is safe precisely because it is the detector — no runtime, ships in no image, and adding a pattern there can only make the check stricter. The narrower alternative (skipping the array by line range) breaks the moment the array moves.

services/githubAppJwt.ts stays in core and needed no allowlist — it is generic GitHub App auth and carries no matching identifier. Its comment now says explicitly that moving it into the plugin repo would recreate the reverse dependency across a repo boundary.

Zero counts identifiers, not the English name

Worth being explicit, because it is the difference between a sweep and a whitewash. The patterns are identifier-shaped (devPlatform, dev-runner, DEV_JOB, djr_, …). A comment may still say "the dev platform plugin", and several deliberately do. What cannot survive is an import, a route, a config key, an i18n key or a fixture string. Prose describes history; identifiers create coupling. Where the old comment pointed at a real code artifact that no longer exists, it was corrected rather than reworded.

One test re-scoped, not just renamed

manifestDevJobsLegacyKey.test.ts → manifestRetiredPermissionKey.test.ts. It pinned one historical permission key, but the guarantee it protects — unknown permission keys are ignored, not rejected — is key-agnostic. Pinned to one name it would go stale-but-green the next time a different capability is retired. It now exercises the shapes a retired key arrives in (bare true, a block of options, alongside live keys). Which names were retired stays in the changelog, which is a changelog's job.

A trap this sweep walked into

Renaming the nav fixture's de label left never leaks the per-locale label map to the browser asserting res.text.includes('Dev-Plattform') === false — a string that no longer existed anywhere, so the guard was permanently green. Repointed at the real de label (Beispiel-Plugin), which the sibling locale test proves is present in the de response. Flagging it because it is the exact failure mode a mass-rename invites.

Verification

Check	Result
middleware full suite	6,948 tests — 6,936 pass, 0 fail, 12 skipped
web-ui vitest	717 tests, 85 files — all pass
middleware tsc --noEmit + eslint	clean
middleware typecheck:test ratchet	371, no regressions (caught one error I introduced; fixed, not re-baselined)
web-ui typecheck, eslint	clean (0 errors)
i18n:check	OK — 3,560 keys, en + de
i18n:literals	exit 0
check-core-decoupling.mjs	TOTAL 0 / baseline 0, all 14 zones CLEAN
Zero-enforcement mutation	check and --update both fail on one reintroduced reference

Nothing was left above zero.

Do not merge yet; stacked on #807.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Cross-family review (Forge)

Reviewed against code, not against the description. GPT-5.4 (reasoning=high) via codex exec — a different model family from the author, deliberately.

Verdict: MERGE after 04fc1053. The zero floor is real and the mutation evidence reproduces. One genuine hole was found in the allowlisting, plus two gaps; all three are fixed on this branch.

The enforcement itself reproduces

Re-ran the author's mutation independently (one // probe: devplatform in src/services/ssrfGuard.ts):

Layer	Result
node scripts/check-core-decoupling.mjs	exit 1, names the zone
--update	exit 1, refuses a non-zero baseline
CI's grep -qE '^ TOTAL 0'	exit 1

All three fail independently. EXTRACTION_COMPLETE is not decorative.

DEFECT (fixed) — the self-exclusion was a basename wildcard, not a path

'!**/check-core-decoupling.mjs' excludes every file of that name anywhere in a scanned zone, not just the detector. Proven:

$ printf '// devplatform devRunner dev_job\n' > middleware/src/__probe/check-core-decoupling.mjs
$ node scripts/check-core-decoupling.mjs
Core is free of Dev Platform references.
exit 0

Three real identifiers inside middleware/src, counted as zero. That is precisely the "reference hiding inside an allowlisted region" the floor exists to prevent, and it needed no edit to the script or the baseline — just a filename.

Anchored to the exact repo-relative path. The scripts zone still reports CLEAN (self-exclusion intact) and the probe now exits 1.

The mutation test is now committed rather than performed — scripts/check-core-decoupling.test.mjs plants the probe and asserts the checker goes red. It builds its own pattern tokens at runtime (['dev','platform'].join('')) so the test file cannot trip the detector it tests. Mutation-checked in both directions: reverting the glob turns it red, restoring it turns it green.

GAP (fixed) — the regression test would never have run

scripts/ has no package.json, and no CI job globs *.test.mjs. A test file left there is green because nothing executes it — the same failure family this job's own timeout comment already names. Wired into the decoupling job as a step after the zero assertion.

GAP (fixed) — the rename stopped at identifiers, not at the name

PATTERNS is identifier-shaped, so Dev Platform and Dev-Plattform match nothing. Four fixtures still carried the plugin's display name while this PR states "what cannot survive is … a fixture string":

middleware/test/uiRouteCatalogNav.test.ts · middleware/test/toolPluginRuntimeRouteDisposal.test.ts · web-ui/app/_lib/__tests__/navParse.test.ts · web-ui/app/_lib/__tests__/navMerge.test.ts

Renamed to Example Plugin / Beispiel-Plugin together with their assertions, preserving the en / de / de-AT / fr fallback each test exercises. Invisible to the ratchet by construction, so this one only closes by reading.

The identifiers-not-prose argument is otherwise correct and was not disturbed — deliberate prose in the detector, .env.example, package.json _dependencyNote and chat/page.tsx is untouched. Adding the English name to PATTERNS would make the detector's own prose unfixable.

Mass-rename trap — swept, one more angle

Extracted every string literal the C13 diff removed-and-did-not-re-add, then grepped each against the tree at HEAD. Besides the Dev-Plattform leak the author already caught, no assertion compares against a string that no longer exists. The four fixtures above were self-consistent (fixture and assertion moved together), so they were a naming gap, not permanently-green tests.

No behaviour hidden in the sweep

Classified every changed line in all 11 non-test source files (pluginContext.ts, githubAppJwt.ts, manifestLoader.ts, awaitStore.ts, publicPaths.ts, ssrfGuard.ts, gateReevaluation.ts, adminEmbeddingProvider.ts, conductorWebhooksInbound.ts, 0007_webhooks.sql, .env.example) plus both web-ui files: comment-only, every one. The sole executable change in the whole residue sweep is the ratchet script itself. Claim (4) holds exactly.

Allowlist judgement

Migrations 0022–0030 and the plugin-api CHANGELOG are anchored on exact paths and are genuinely historical record — rewording either breaks the artifact's one job. Left as-is. Worth knowing about the residual shape: a new line added inside those two regions would be allowlisted too. The migrations are frozen released DDL (editing one is already a violation with its own consequences) and the CHANGELOG is append-only per release, so the exposure is narrow and visible in review — unlike the basename hole, which was invisible.

Gates (on the merged branch)

middleware 6,948 tests — 6,936 pass, 0 fail, 12 skipped · web-ui vitest 717 pass · typecheck:test ratchet 371, no regressions · middleware eslint clean · web-ui typecheck clean, eslint 0 errors · i18n:check OK — 3,560 keys, en + de · i18n:literals exit 0 · check-core-decoupling.mjs TOTAL 0 / baseline 0 · detector regression test 2/2 · ci.yml parses, decoupling job has 5 steps.

Note: C12's review fix (f7acf93f) is merged forward into this branch, so the Fixed changelog entry here covers the whole C12+C13 review.