ci(gates): refuse a bare -- between pnpm and vitest in committed commands

`pnpm --filter <pkg> test` with its arguments after a bare separator runs the
WHOLE package suite. pnpm forwards the separator verbatim into the child argv
and vitest's cac parser then discards everything after it, options and
positionals alike, in silence — the file pattern and `--maxWorkers` die
together, the suite passes, and it reads exactly like the narrow run that was
asked for.

#11425 landed the corrected spelling in the instruction files. That is
discipline; this is the mechanical half. Both mechanism layers were re-measured
on this tree rather than recalled, each with a control: pnpm and npx forward the
separator, npm and turbo strip it, and vitest 4.1.10 turns `CACError: Unknown
option` (exit 1) into no output at all (exit 0) when the same flag moves behind
the separator.

The violating population is EMPTY today, so the gate is built to say that out
loud rather than print a bare "0 violations": it reports how many separators it
JUDGED (6 on this tree), refuses a tree whose roots, corpus or workspace
derivation went blind, and carries its non-vacuity in `--self-test`, which
drives this same sweep RED over a temp tree on disk.

Five of those six judged separators are forms a naive bare-`--` selector would
have RED and every one is correct as written — this workflow's own turbo dogfood
shard and the three documented `pnpm dev -- --fresh` spellings — so the rule is
vitest-BOUND, with the vitest-backed script names derived from the workspace
instead of typed in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Author: os-steve

.github/workflows/lint.yml

@@ -2411,6 +2411,48 @@ jobs:
       - name: Every committed pnpm --filter names a real package
         run: pnpm check:pnpm-filter-targets
 
+      # The sibling of the gate above, and the OTHER half of the family its
+      # comment names (#10166). There the `--filter` selector matched nothing;
+      # here the filter matched, the script ran, and the ARGUMENTS were lost.
+      #
+      # ⛔ Hand a vitest-backed script its arguments after a bare separator and
+      # the WHOLE package suite runs. pnpm forwards the separator verbatim into
+      # the child argv (npm and turbo both strip it — pnpm is the odd one out),
+      # and vitest's cac parser then discards EVERYTHING after it, options and
+      # positionals alike, in silence. The file pattern and `--maxWorkers` die
+      # together, so the concurrency discipline is inert in the same breath.
+      # Measured on the card: 415 files / 11045 tests / 358s under the shared
+      # verify lock, where the intended run was one file in 655ms — green, exit
+      # 0, reading exactly like the narrow run that was asked for.
+      #
+      # ⚠️ The broken spelling is written out in the GATE'S header, not here.
+      # The first draft of this comment spelled it, and the gate red on this
+      # file at its own wiring commit — which is the objection a corpus gate was
+      # rejected on once before ("it would fire on the counter-example the
+      # corrected instruction MUST contain"). That objection is real; the answer
+      # is `COUNTER_EXAMPLE_FILES` in the gate, and the reason this file is not
+      # in it is that a whole workflow is too coarse a thing to exempt — a
+      # broken spelling here would EXECUTE.
+      #
+      # ⚠️ The violating population is EMPTY today (#11425 landed the corrected
+      # spelling), so this step's job is to keep it empty — and the gate says so
+      # in its own verdict line rather than printing a bare "0 violations". It
+      # reports how many separators it JUDGED, not just how many it failed: 5 on
+      # the tree it landed against, four of which a naive bare-`--` selector
+      # would have RED (this workflow's own turbo dogfood shard, and the three
+      # documented `pnpm dev -- --fresh` spellings in AGENTS.md). Its rule is
+      # vitest-BOUND, and the vitest-backed script names are derived from the
+      # workspace rather than typed here.
+      #
+      # Reads text under `.claude/**`, `skills/**`, `scripts/**`,
+      # `.github/workflows/**` and every tracked AGENTS.md / CLAUDE.md, plus the
+      # workspace manifests for the derivation. No build, no network,
+      # sub-second. The `check:` key runs `--self-test` first: it drives this
+      # same sweep RED over a temp tree on disk, which is what carries
+      # non-vacuity while the real population is zero.
+      - name: No committed command forwards args to vitest through a bare --
+        run: pnpm check:agent-test-spelling
+
   # Lane 1 of 4 behind the required `TypeScript Type Check` context. The
   # aggregator job at the bottom of this file explains the split, holds the
   # contract, and is the thing the merge queue actually requires — read it

package.json

@@ -52,6 +52,7 @@
     "check:skill-frame-freshness": "node scripts/check-skill-frame-freshness.mjs --self-test && node scripts/check-skill-frame-freshness.mjs",
     "check:skill-compatibility": "node scripts/check-skill-compatibility-version.mjs --self-test && node scripts/check-skill-compatibility-version.mjs",
     "check:agent-model-declared": "node scripts/check-agent-model-declared.mjs --self-test && node scripts/check-agent-model-declared.mjs",
+    "check:agent-test-spelling": "node scripts/check-agent-test-spelling.mjs --self-test && node scripts/check-agent-test-spelling.mjs",
     "check:ratchet-remedy-authority": "node scripts/check-ratchet-remedy-authority.mjs --self-test && node scripts/check-ratchet-remedy-authority.mjs",
     "check:pm-skill-ratchet": "node scripts/pm/check-skill-line-ratchet.mjs --self-test && node scripts/pm/check-skill-line-ratchet.mjs",
     "check:pm-skill-id-lint": "node scripts/pm/check-skill-id-lint.mjs --self-test && node scripts/pm/check-skill-id-lint.mjs",