…ncies (#505)

* docs(ci-scope): revise spec — namedInputs over implicitDependencies

PR #503 surfaced that Nx 22.5.1 rejects file-path syntax in
implicitDependencies entries (validates strictly as project names;
errored: "implicitDependencies point to non-existent project(s)"
on //path). The Nx-native mechanism for file-level affecting-deps is
per-project namedInputs referenced by target inputs.

Spec updates:
- Header revision note documenting the discovery.
- Replace "implicitDependencies — fallback paths become first-class"
  section with "namedInputs — fallback paths become first-class".
- Concrete project.json example uses namedInputs.deploymentConfig
  with {workspaceRoot}/... paths, bound to target inputs.
- Migration sequencing updated: PR 1 retroactively documented as
  "tags only (shipped)"; PR 2 includes the namedInputs migration.
- Risk surface revised: namedInputs target-binding fragility (must
  reference in target inputs to take effect).
- Acceptance criteria updated.

The shim still targets ~50 LOC; the migration goal is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(ci-scope): revise plan to match namedInputs spec

PR 1's Task 1 collapsed to a SHIPPED stub with archived tag-categorization
rules in a <details> block. Adds Task 2.5 to PR 2: add namedInputs.
deploymentConfig to apps/cockpit and apps/website project.json,
reference in build target inputs, smoke-test that nx affected picks
up vercel.cockpit.json changes correctly.

Keeps Tasks 3-8 unchanged (shim rewrite, test migration, smoke, commit,
drift guard) — those don't depend on the implicitDependencies vs
namedInputs distinction beyond the smoke-test expectations.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(ci-scope): replace classifier with thin shim over nx affected

PR 2 of 3 for the ci-scope thin-shim migration. PR 1 (#503) added
scope:* tags to 87 project.json files; this PR makes ci-scope.mjs
actually read them via `nx show projects --affected`.

apps/cockpit + apps/website: namedInputs.deploymentConfig
- Per-project namedInputs declare which non-project files affect each
  project: vercel.*.json, scripts/deploy-smoke.ts, capability-registry.ts,
  etc. on apps/cockpit; vercel.json on apps/website.
- Referenced from each project's build target inputs so nx considers
  them when computing affected.
- Replaces ~50 LOC of applyFallbackPathScope rules with Nx-native data.
- Smoke-verified: `nx show projects --affected` correctly marks
  `cockpit` as affected when vercel.cockpit.json changes.

scripts/ci-scope.mjs: 340 LOC → 120 LOC.
- applyProjectScope (~80 LOC of project-walking rules) → replaced by
  ~10-LOC tag-driven classifyFromAffected reading from
  `nx show projects --affected --json`.
- applyFallbackPathScope (~50 LOC of file-path rules) → replaced by
  the namedInputs above.
- discoverProjects walk (~30 LOC of filesystem traversal) → gone.
- GLOBAL_CI_FILES short-circuit (.github/workflows/ci.yml etc.) kept.
- Backward-compatible CLI: --base/--head/--output/--event=push.

scripts/ci-scope.spec.mjs: full rewrite.
- Tests inject synthetic affectedProjects arrays with tag arrays directly
  (no more synthetic workspace+ownsPath fixtures).
- 13 tests across 5 describe blocks: short-circuit, publishable lib
  broadcast, cockpit cap angular/python, fallback paths via namedInputs,
  tag isolation (non-scope tags + unknown scope keys ignored).

Backward-compatible workflow gating: same scope booleans emit for the
same file changes. Jobs still truly skip (no per-job fast-pass cost).

This PR's own CI run is the integration test. DO NOT admin-merge — if
the new shim misclassifies, its own gates fire wrong. Verify scope
output in the CI scope job's logs before merging.

See docs/superpowers/specs/2026-05-21-ci-scope-thin-shim-design.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci-scope): use node:test (not vitest) in ci-scope.spec.mjs

CI runs `node --test scripts/ci-scope.spec.mjs` directly (no vitest
installed at the ci-scope job's pre-npm-ci stage). My PR 2 rewrite
imported `describe, it, expect` from 'vitest' and used Chai-style
matchers; CI errored with ERR_MODULE_NOT_FOUND on 'vitest'.

Rewrite spec to use Node's built-in test runner:
- import { describe, it } from 'node:test'
- import assert from 'node:assert/strict'
- expect(x).toBe(y) → assert.equal(x, y)
- expect(x).toEqual(y) → assert.deepEqual(x, y)

All 13 tests pass via `node --test`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci(ci-scope): add setup-node + npm ci so the new shim can call nx affected

PR 2's ci-scope.mjs rewrite delegates project ownership to `nx show
projects --affected --json`. The CI scope job previously had no node
setup or npm install (just `actions/checkout` + `node --test`), so
the new shim errored with "Could not find Nx modules" at runtime.

Add setup-node@v6 (node 22, cache: npm) + `npm ci` before the
classifier test and the scope-detection step. Tax: ~15-30s warm cache,
~60s cold cache, on every CI run. This is the one-time-per-PR cost of
using nx's project graph as the source of truth instead of a hand-
maintained classifier walk.

Comment block in the ci.yml explains the rationale so reviewers
understand why setup got more elaborate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

#509)

PR 3 of 3 for the ci-scope thin-shim migration. PR 1 (#503) added
scope:* tags to every CI-participating project; PR 2 (#507) rewrote
ci-scope.mjs to read them via `nx show projects --affected --json`.
This drift-guard asserts every cockpit cap project (angular + python
under cockpit/<product>/<topic>/) declares the expected tags:

- scope:cockpit-e2e + scope:cockpit-examples on every cap project.
- scope:cockpit-smoke on python caps that have a smoke target.

Closes the silent-failure mode: future contributors adding a new cap
can't forget the tags — the test names which project + which tag is
missing.

Excludes cockpit/ag-ui/* (no python sibling; different tag rules).

See spec: docs/superpowers/specs/2026-05-21-ci-scope-thin-shim-design.md.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>