STO-399: build TypeScript graph before unit lane

[stone16]

Originating Multica issue: STO-399
Original author: @ryan

Summary

The documented Python unit lane now provisions the local TypeScript build artifacts it executes: make test builds the existing SDK → ActionPlane → BotDelivery dependency graph before pytest (Makefile:20). A clean checkout no longer requires undocumented manual builds.

Why

make install intentionally installs TypeScript dependencies with --ignore-scripts (Makefile:4-7), but the embedded BotDelivery contract test builds BotDelivery directly (tests/unit/test_bot_delivery_model_egress_contract.py:46-60). BotDelivery resolves local peer packages through their dist exports, so the documented clean-checkout unit command failed when ActionPlane had not already been built. Closes STO-399.

Approach

Accepted choice: Declare the existing bot-build target as the prerequisite of test; bot-build already expresses SDK + ActionPlane → BotDelivery (Makefile:20, Makefile:82-83).

Rejected alternatives:

• Add lifecycle scripts to npm ci: rejected because the repository intentionally installs with --ignore-scripts (Makefile:5-7).
• Duplicate three npm build commands inside the Python test: rejected because it would create a second dependency-order contract beside bot-build.
• Skip or weaken the embedded BotDelivery test: rejected because that hides the clean-checkout failure instead of provisioning its required local peers.

Constraint: The fix must preserve package versions, runtime behavior, public APIs, and the existing isolated package gates while making the documented make install + make test path deterministic.

The regression test compares exact Make target lines, preventing substring false positives and locking both the unit-lane prerequisite and the existing local dependency graph (tests/unit/test_bot_delivery_application_contract.py:84-89). No dependency or product code changed.

How I Tested

End-to-end test cases

Case	Test file:line	What it asserts
Unit target provisions clean local TypeScript peers	tests/unit/test_bot_delivery_application_contract.py:84	Exact test: bot-build and bot-build: sdk-build action-build target contracts exist.
Embedded BotDelivery build/runtime proof	tests/unit/test_bot_delivery_model_egress_contract.py:46	SDK and BotDelivery build, and the 17-test BotDelivery runtime suite passes from the Python unit lane.

Verbatim test output

Red on baseline Makefile with the new regression test:

$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" gtimeout 60 uv run pytest -q tests/unit/test_bot_delivery_application_contract.py::test_unit_lane_builds_the_local_typescript_dependency_graph
F                                                                        [100%]
=================================== FAILURES ===================================
_________ test_unit_lane_builds_the_local_typescript_dependency_graph __________
>       assert "test: bot-build" in target_lines
E       AssertionError: assert 'test: bot-build' in {...}
tests/unit/test_bot_delivery_application_contract.py:88: AssertionError
=========================== short test summary info ============================
FAILED tests/unit/test_bot_delivery_application_contract.py::test_unit_lane_builds_the_local_typescript_dependency_graph
1 failed in 0.13s

Green clean dependency reproduction and full unit lane:

$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" node --version
v22.12.0
$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" npm --version
10.9.0
$ gtimeout 300 make install
uv sync --frozen
Audited 37 packages in 0.91ms
npm --prefix sdk/typescript ci --ignore-scripts
added 58 packages in 510ms
npm --prefix action_plane/typescript ci --ignore-scripts
added 19 packages in 458ms
npm --prefix bot_delivery/typescript ci --ignore-scripts
added 21 packages in 411ms
$ find sdk/typescript action_plane/typescript bot_delivery/typescript -maxdepth 1 -type d -name dist | wc -l
0
$ gtimeout 600 make test
npm --prefix sdk/typescript run build
npm --prefix action_plane/typescript run build
npm --prefix bot_delivery/typescript run build
uv run pytest -q tests/unit
1300 passed in 23.36s

Existing tests

Command (all finite-timeout)	Result
gtimeout 300 make build	Successfully built dist/context_engine-0.1.0.tar.gz and wheel
gtimeout 600 make test	1300 passed in 23.36s
gtimeout 600 make catalog	132 passed in 15.50s; security catalog valid: 15 invariants, 12 fixtures
gtimeout 300 make openapi-check	exit 0, no diff
gtimeout 300 make openapi-breaking-check	9 passed in 0.60s
gtimeout 600 make sdk-test	3 runtime tests passed; packed SDK consumer passed
gtimeout 300 make sdk-pack	context-engine-resolve-sdk-0.0.0-v0.tgz produced in ignored build output
gtimeout 600 make action-test	13 runtime tests passed; packed ActionPlane consumer passed
gtimeout 600 make bot-test	17 runtime tests passed; packed BotDelivery consumer passed
gtimeout 1200 make integration	445 passed, 4 deselected, 2 warnings in 302.06s (0:05:02)
gtimeout 600 make smoke	6 passed in 3.48s
gtimeout 1200 make security-gate	157 passed in 106.58s; M0 SECURITY PASS

Integration emitted two existing PytestUnraisableExceptionWarning warnings from SQLAlchemy event-registry weakref cleanup; there were no test failures.

Cleanup proof:

$ make db-down
Container context-engine-a3f47f5af674d8ba-postgres-1 Removed
Network context-engine-a3f47f5af674d8ba_default Removed
$ docker volume rm context-engine-a3f47f5af674d8ba_postgres-data
context-engine-a3f47f5af674d8ba_postgres-data
$ <resource audit>
containers=0
networks=0
volumes=0
processes=0

New tests added

• tests/unit/test_bot_delivery_application_contract.py:84 — proves the documented unit lane owns the complete local TypeScript dependency build order.

Lint / typecheck

$ gtimeout 300 make lint
uv run ruff check .
All checks passed!
$ gtimeout 600 make typecheck
Success: no issues found in 230 source files
> @context-engine/action-plane@0.0.0-m2-perform typecheck
> tsc --project tsconfig.json --noEmit
> @context-engine/bot-delivery@0.0.0-m2-private-flow typecheck
> tsc --project tsconfig.json --noEmit
$ gtimeout 300 make sdk-check
generated SDK clean: 35590359d1d1a46094f09ba239dabefba91e0ff7ef7c513cfcc56669b8156625
$ gtimeout 300 make action-typecheck
> tsc --project tsconfig.json --noEmit
$ gtimeout 300 make bot-typecheck
> tsc --project tsconfig.json --noEmit

Definition of Done

• Dedicated branch from baseline origin/main 29b4a6b3828b484aea9b5cc8f31dcef290e47caf.
• Regression proof fails on the baseline target contract and passes after the fix.
• Clean make install leaves zero dist trees; make test provisions SDK → ActionPlane → BotDelivery deterministically under Node 22.12.0/npm 10.9.0.
• Direct SDK, ActionPlane, and BotDelivery typecheck/build/runtime/package gates pass.
• Full unit, Ruff, Mypy, catalog, OpenAPI, DB integration, process, and M0 security gates pass with finite timeouts.
• DB/process resources cleaned: zero containers, networks, volumes, or processes remain.
• Diff is limited to Makefile and one unit contract test; git diff --check passes; no untracked files, generated artifacts, credentials, environment files, or unrelated changes are included.
• Branch committed and pushed; this PR is ready for independent review and will not be self-approved or merged by the author.

Rollback Plan

Revert commit cab629171e15378db091388a5b74e40d2dfc3c0d. Maximum blast radius is the local/CI verification command graph only; no production runtime or data is touched. Time to rollback is under five minutes plus CI validation.

Residual risk: make test now performs three deterministic TypeScript builds, increasing unit-lane duration by several seconds. This is bounded to developer/CI verification and uses existing build targets; no runtime residual risk remains.

Out of Scope

• Product runtime, authorization, RLS, database schema, and public APIs.
• Node/npm pins, package versions, lockfiles, dependencies, and lifecycle scripts.
• Refactoring embedded TypeScript contract tests or changing the complete make check graph.
• The two pre-existing non-failing SQLAlchemy weakref cleanup warnings observed in integration tests.

[coderabbitai]

Warning

Review limit reached

@stone16, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 11 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e7239167-971f-493c-9940-45b2ebbc4157

📥 Commits

Reviewing files that changed from the base of the PR and between 29b4a6b and cab6291.

📒 Files selected for processing (2)

• Makefile
• tests/unit/test_bot_delivery_application_contract.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sto-399-clean-unit-typescript-dependencies

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[stone16]

Verdict: approve

stometa, no findings at cab629171e15378db091388a5b74e40d2dfc3c0d.

What I checked:

• PASS — immutable scope: the head is still cab629171e15378db091388a5b74e40d2dfc3c0d; the diff is one prerequisite edge at Makefile:20 and one exact-line contract test at tests/unit/test_bot_delivery_application_contract.py:84-89.
• PASS — root cause: after the documented install at baseline 29b4a6b3828b484aea9b5cc8f31dcef290e47caf, the embedded unit test's BotDelivery build at tests/unit/test_bot_delivery_model_egress_contract.py:47-60 failed with TS2307 because the linked ActionPlane peer exports dist (action_plane/typescript/package.json:13-19) and had not been built.
• PASS — structural repair: test now depends on the existing bot-build graph (Makefile:20), which orders SDK and ActionPlane before BotDelivery (Makefile:60-83). This is the smallest repair because it reuses the repository's existing dependency edge without changing install scripts or package lifecycle behavior (Makefile:3-7).
• PASS — repeated-build behavior: make -n check schedules SDK, ActionPlane, and BotDelivery build recipes exactly once each. GNU Make deduplicates the shared targets reached through typecheck, package tests, bot-build, and test in the single check invocation (Makefile:15-20, Makefile:60-89). The embedded Python proof intentionally rebuilds SDK and BotDelivery inside pytest (tests/unit/test_bot_delivery_model_egress_contract.py:47-60); that pre-existing repetition is bounded and unchanged.
• PASS — regression-test strength: the set membership checks require the exact dependency declarations rather than substring matches (tests/unit/test_bot_delivery_application_contract.py:84-89), so the missing-edge regression cannot false-green. A no-op or broken recipe could still satisfy this structural test, but the clean execution check below exercises the real recipes; that is appropriate separation of contract and behavior.
• PASS — pin handling: the independent run used Node v22.12.0 and npm 10.9.0, matching every package pin (sdk/typescript/package.json:13-17, action_plane/typescript/package.json:8-12, bot_delivery/typescript/package.json:8-12). The SDK build also enforces both versions at execution time (sdk/typescript/scripts/verify-runtime.mjs:4-23).
• PASS — scope/security/hygiene: git diff --check passed; only Makefile and the unit contract test changed. No lockfile, dependency, generated artifact, credential, environment, production runtime, API, schema, authorization, or RLS file is in the diff. The ready PR body includes the required root cause, DoD, red/green evidence, rollback, residual risk, and out-of-scope sections.
• PENDING — current GitHub CI: the checks job is still IN_PROGRESS for this exact head; CodeRabbit status is SUCCESS, though its comment says its automated review was rate-limited. I did not wait because the assigned deliverable is an immutable-head review, not the eventual CI result.
• SKIPPED — independent DB integration/security reruns: no runtime, DB, security, workflow, or dependency code changed, and the focused clean-checkout plus full unit lane directly cover this Make/test-graph repair. The author supplied those broader results and GitHub CI is running the repository's make check caller at .github/workflows/ci.yml:30-49.

Verification re-run locally under Node 22.12.0/npm 10.9.0 with finite timeouts:

baseline clean install + focused embedded unit test:
FAILED tests/unit/test_bot_delivery_model_egress_contract.py::test_typescript_model_egress_is_closed_pinned_and_zero_byte_on_denial
1 failed in 4.22s
TS2307: Cannot find module '@context-engine/action-plane'

patched clean install + focused graph/embedded tests:
2 passed in 4.15s

patched full documented unit lane:
1300 passed in 20.81s

make -n check build counts:
sdk_build_commands=1
action_build_commands=1
bot_build_commands=1

git diff --check origin/main...HEAD:
[exit 0]

Accepted choice: Approve the exact head because test: bot-build reuses the existing dependency graph and independently fixes the clean-checkout failure.

Rejected alternatives:

• Request changes for a dynamic-only regression test: rejected because the exact-line test structurally locks the intended Make edges, while the independent clean execution proves their behavior.
• Request changes to eliminate the embedded SDK/BotDelivery rebuild: rejected because that repetition predates this two-file repair and does not duplicate targets within make check's Make graph.
• Block on pending CI: rejected because local focused and full unit evidence is green, while branch protection remains the merge gate for the running external workflow.

Constraint: The issue requires the smallest deterministic repair to the documented clean-install/unit path without changing dependencies, lifecycle scripts, or product behavior.

[stone16]

Verdict: pass

stometa, no findings at immutable head cab629171e15378db091388a5b74e40d2dfc3c0d.

Accepted choice: Pass this exact head because the documented clean install/unit path now provisions the existing SDK → ActionPlane → BotDelivery graph and every required independent gate passed.

Rejected alternatives:

• Fail for a structural-only regression test: rejected because the exact-line contract at tests/unit/test_bot_delivery_application_contract.py:84-89 is paired with clean-state execution of the real recipes and full unit suite.
• Fail for repeated or parallel target execution: rejected because repeated goals, make -j8 multi-goal execution, and two simultaneous make test processes all completed successfully; make -n check scheduled each TypeScript build and pytest once.
• Block on external verification: rejected because GitHub CI completed SUCCESS at this exact head and the PR remains open, ready, and unmerged.

Constraint: STO-399 requires the smallest deterministic repair to the documented make install + make test contract without product-runtime, API, schema, authorization, dependency, lifecycle-script, or version changes.

Security findings: none.

Performance findings: none. Measured clean-state make test completed in 27.99s including builds (1300 passed in 21.85s); a repeated real invocation completed in 21.26s and ran each goal once. No estimate is substituted for measurement.

Evidence checks:

1. PASS — immutable SHA and scope: local HEAD and GitHub headRefOid both equal cab629171e15378db091388a5b74e40d2dfc3c0d; merge base is 29b4a6b3828b484aea9b5cc8f31dcef290e47caf. git diff --check passed and only Makefile plus tests/unit/test_bot_delivery_application_contract.py changed.
2. PASS — regression proof: baseline Makefile:20 is exactly test: and an exact test: bot-build predicate returned status 1; the focused current-head contract test at tests/unit/test_bot_delivery_application_contract.py:84-89 passed (1 passed in 0.09s).
3. PASS — clean happy path under Node v22.12.0 / npm 10.9.0: make install exited 0 and left zero package dist trees; make test then executed SDK, ActionPlane, and BotDelivery builds in the order declared at Makefile:20, Makefile:60-83, followed by 1300 passed in 21.85s.
4. PASS — expected failure: with host Node v25.8.0, make test stopped in 0.25s at sdk/typescript/scripts/verify-runtime.mjs:4-23 with exact text Error: SDK requires exact Node 22.12.0; observed 25.8.0; pytest did not run.
5. PASS — absent/stale build output: zero-dist state built successfully; after backdating representative SDK, ActionPlane, and BotDelivery artifacts to epoch 946656000, make test recreated all three with current timestamps and returned 1300 passed in 16.42s. Each build cleans its output at sdk/typescript/scripts/clean.mjs:1-7, action_plane/typescript/scripts/clean.mjs:1-5, and bot_delivery/typescript/scripts/clean.mjs:1-5.
6. PASS — repeated/concurrent weird paths: make test test ran builds and pytest once, then printed Nothing to be done for 'test'; make -j8 test bot-build sdk-build action-build built shared prerequisites once and returned 1300 passed in 17.03s; two simultaneous make test processes both returned 0 with 1300 passed each.
7. PASS — Make aggregation: make -n check counted sdk-build:1, action-build:1, bot-build:1, unit:1 for the graph at Makefile:89.
8. PASS — independent non-database gates: build produced sdist/wheel; Ruff All checks passed!; Mypy reported Success: no issues found in 230 source files; catalog 132 passed plus 15 invariants, 12 fixtures; OpenAPI check exited 0 and breaking check reported 9 passed.
9. PASS — direct package gates under the pinned runtime: SDK 3 passed plus packed consumer and generated checksum; ActionPlane 13 passed plus packed consumer; BotDelivery 17 passed plus packed consumer; ActionPlane and BotDelivery typechecks exited 0. Package manifests pin the runtime at sdk/typescript/package.json:13-17, action_plane/typescript/package.json:8-12, and bot_delivery/typescript/package.json:8-12.
10. PASS — database/process/security: integration 445 passed, 4 deselected, 2 warnings in 282.75s; process 6 passed in 3.56s; M0 security 157 passed, 1 warning in 109.73s and M0 SECURITY PASS. The warnings were the disclosed SQLAlchemy event-registry weakref cleanup warnings, not failures.
11. PASS — cleanup: exact checkout-scoped audit returned containers:0, networks:0, volumes:0, processes:0; generated database env mode was 600; git status was clean and git ls-files --others --exclude-standard returned zero.
12. PASS — security/dependency/credential review: the new Make edge at Makefile:20 invokes only fixed existing targets; no authentication, authorization, external input, injection, secret, side-channel, database, API, or external-call surface changed. No manifest, lockfile, dependency, generated artifact, credential, or environment file is in the diff; ignored sensitive/build paths are declared at .gitignore:10-40.
13. PASS — PR/CI: the PR body contains the required traceability preamble, root cause, change/DoD evidence, rollback, residual risk, and out-of-scope sections. GitHub checks completed SUCCESS at this SHA; PR state is open, ready (isDraft=false), clean, and unmerged.

Skipped checks: none.

[stone16]

Verdict: approve

stometa, no blocking findings at immutable PR head cab629171e15378db091388a5b74e40d2dfc3c0d.

What I checked:

• PASS — exact checkout and scope: git rev-parse HEAD returned cab629171e15378db091388a5b74e40d2dfc3c0d, the requested base resolved to 29b4a6b3828b484aea9b5cc8f31dcef290e47caf, and the checkout was clean before verification. The diff is exactly Makefile:20 plus tests/unit/test_bot_delivery_application_contract.py:84-89 (9 additions, 1 deletion across two files).
• PASS — root cause and structural repair: the documented install deliberately suppresses lifecycle scripts (Makefile:3-7), while local SDK and ActionPlane packages expose generated dist entries (sdk/typescript/package.json:18-25, action_plane/typescript/package.json:13-19) consumed when the embedded unit proof builds BotDelivery (tests/unit/test_bot_delivery_model_egress_contract.py:47-60). test: bot-build now makes that build graph a prerequisite of pytest (Makefile:20-21), and bot-build completes SDK plus ActionPlane before its BotDelivery recipe (Makefile:60-83).
• PASS — regression strength: the test parses whole Makefile lines into a set and requires the exact test: bot-build and bot-build: sdk-build action-build declarations (tests/unit/test_bot_delivery_application_contract.py:84-89), so substring matches or a missing dependency edge cannot false-green.
• PASS — runtime pins: the independent run used Node v22.12.0 and npm 10.9.0, matching the manifests (sdk/typescript/package.json:13-17, action_plane/typescript/package.json:8-12, bot_delivery/typescript/package.json:8-12). The SDK build enforces both pins (sdk/typescript/scripts/verify-runtime.mjs:4-23).
• PASS — product/API/security scope: the only production-adjacent line changes the local verification graph (Makefile:20); the other change is a unit contract test (tests/unit/test_bot_delivery_application_contract.py:84-89). No runtime, API, schema, authorization, RLS, manifest, lockfile, dependency, or workflow file changed.
• PASS — secret/generated-artifact audit: a credential-pattern scan of the exact diff returned no matches; git diff --check exited 0; the changed-path list contained only the two expected files; final tracked status was empty and non-ignored untracked count was 0. Generated TypeScript/Python outputs are ignored by repository policy (.gitignore:17-41) and none entered the diff.
• PASS — terminal GitHub CI: checks is COMPLETED/SUCCESS at this exact head. The CodeRabbit status context is SUCCESS, but gh pr checks says Review rate limited and the bot comment confirms no automated review ran; I treat CodeRabbit review as skipped/rate-limited, not as code-review evidence.

Verification re-run locally with finite timeouts:

$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" node --version
v22.12.0
$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" npm --version
10.9.0

$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" gtimeout 300 make install
uv sync --frozen
Audited 37 packages in 5ms
npm --prefix sdk/typescript ci --ignore-scripts
added 58 packages in 461ms
npm --prefix action_plane/typescript ci --ignore-scripts
added 19 packages in 332ms
npm --prefix bot_delivery/typescript ci --ignore-scripts
added 21 packages in 382ms
EXIT_STATUS=0

$ find sdk/typescript action_plane/typescript bot_delivery/typescript -maxdepth 1 -type d -name dist
DIST_COUNT_AFTER_INSTALL=0
EXIT_STATUS=0

$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" gtimeout 600 make test
npm --prefix sdk/typescript run build
npm --prefix action_plane/typescript run build
npm --prefix bot_delivery/typescript run build
uv run pytest -q tests/unit
1300 passed in 25.97s
EXIT_STATUS=0

$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" gtimeout 60 uv run pytest -q tests/unit/test_bot_delivery_application_contract.py::test_unit_lane_builds_the_local_typescript_dependency_graph
1 passed in 0.07s
EXIT_STATUS=0

$ git show 29b4a6b3828b484aea9b5cc8f31dcef290e47caf:Makefile | grep -Fx 'test: bot-build'
EXPECTED_BASELINE_ABSENCE_EXIT_STATUS=1
[wrapper exit 0: absence was expected]

$ PATH="$HOME/.nvm/versions/node/v22.12.0/bin:$PATH" gtimeout 60 make -n check
DRY_RUN_EXIT_STATUS=0
npm --prefix sdk/typescript run build => 1
npm --prefix action_plane/typescript run build => 1
npm --prefix bot_delivery/typescript run build => 1
uv run pytest -q tests/unit => 1

$ git diff --check 29b4a6b3828b484aea9b5cc8f31dcef290e47caf...cab629171e15378db091388a5b74e40d2dfc3c0d
DIFF_CHECK_EXIT_STATUS=0
CHANGED_PATHS
M Makefile
M tests/unit/test_bot_delivery_application_contract.py
TRACKED_STATUS=[empty]
UNTRACKED_NONIGNORED_COUNT=0

$ gh pr checks 96 --repo stone16/context-engine
CodeRabbit pass 0 Review rate limited
checks     pass 10m43s

One preliminary install wrapper used zsh's reserved read-only variable status and failed after the install steps; it is not credited above. The corrected bounded rerun is the recorded exit-0 result.

SKIPPED locally — make lint, make typecheck, make smoke, make integration, and make security-gate: this two-file diff changes only the verification dependency graph and its unit contract. GitHub's terminal-success checks job ran the repository's full make check caller at .github/workflows/ci.yml:30-49; I did not misreport those broader lanes as independently rerun.

Blocking findings: none.

Accepted choice: Approve PR #96 at the exact reviewed head because the smallest Make prerequisite repair structurally and behaviorally fixes the clean-checkout unit lane without changing product behavior.

Rejected alternatives:

• Request changes for a dynamic-only regression test — the exact-line contract locks the intended graph, while the clean full unit execution proves the recipes behave correctly.
• Request changes to modify install lifecycle scripts — the existing bot-build graph already expresses the required ordering, so lifecycle changes would expand scope unnecessarily.
• Block on CodeRabbit's skipped automated review — the required non-author peer review is this review, and terminal CI plus independent local evidence cover the changed surface.

Constraint: STO-399 requires the documented make install plus make test path to be deterministic while preserving dependencies, package lifecycles, public APIs, runtime, and security behavior.