fix(devx): route missing GITHUB_REPOSITORY/GITHUB_TOKEN to EXIT_NOT_WIRED - #17362

Fixes #16329

What changed

check:single-claim-paths's readPrContext only guarded PR_NUMBER via Object.hasOwn. With PR_NUMBER set and GITHUB_REPOSITORY unset, ctx.repo resolved to '', the request was built anyway (/repos//pulls/…), and the run died on an unhandled rejection — exiting 1, this gate's FINDING code, instead of the exit-2 NOT WIRED path its own header already reserves for exactly this.

readPrContext now returns a three-way result: null (nothing wired at all), { wired: false, missing, number } (PR_NUMBER present but GITHUB_REPOSITORY or GITHUB_TOKEN missing), or the full context. judge() routes both null and wired: false through the same EXIT_NOT_WIRED (2) verdict text — still saying "judged nothing", never printing a ✓.

GITHUB_REPOSITORY and GITHUB_TOKEN are checked by truthiness (trimmed, non-empty), not PR_NUMBER's Object.hasOwn presence check. This is a deliberate, documented departure from the PR_NUMBER convention, not a silent swap — see the docblock above readPrContext: PR_NUMBER's value is never read to build a request, it only witnesses that the workflow ran, so presence is the right test. GITHUB_REPOSITORY/GITHUB_TOKEN are consumed directly to build the request (URL slug, Authorization header), so an empty string is the same failure as an absent variable — the exact /repos//pulls/… bug is reproduced by a GITHUB_REPOSITORY that a presence check would call "wired" the moment it is merely set to ''. The token is guarded unconditionally too: every real invocation reads a PR's file list over the network, and the wiring workflow always supplies one (pinned by the existing self-test: "the wiring passes a token, without which no file list can be read").

Why out of scope stays out of scope

The NODE_USE_ENV_PROXY=1 / 403-vs-404 proxy question named at the end of the issue is not touched here — the issue itself calls it "a separate question," and the claim comment repeats the same boundary. No self-re-exec was added to this gate.

Measurements

Before (original readPrContext, PR_NUMBER set, GITHUB_REPOSITORY unset):

$ PR_NUMBER=16326 node scripts/check-single-claim-paths.mjs
EXIT=1

file:///.../scripts/check-single-claim-paths.mjs:481
  if (!response.ok) throw new Error(`GitHub API ${response.status} for ${path}`);
                          ^

Error: GitHub API 404 for /repos//pulls/16326/files?per_page=100&page=1
    at .../scripts/check-single-claim-paths.mjs:481:27
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async listPrPaths (.../scripts/check-single-claim-paths.mjs:431:19)
    at async collect (.../scripts/check-single-claim-paths.mjs:440:16)
    at async .../scripts/check-single-claim-paths.mjs:696:44

Node.js v22.22.2

After (this PR, same command, same env):

$ PR_NUMBER=16326 node scripts/check-single-claim-paths.mjs
EXIT=2

check:single-claim-paths: NOT WIRED — GITHUB_REPOSITORY is not set (or set to an empty string), so this run was handed no usable pull
request context and judged nothing. This is a wiring or usage failure, NOT a verdict: it says
nothing about whether any PR claims a single-claim path, and no author caused it.

Fix:  run it from the workflow that supplies the context (.github/workflows/single-claim-path-guard.yml), or locally with
      PR_NUMBER=123 GITHUB_REPOSITORY=owner/repo GITHUB_TOKEN=... node scripts/check-single-claim-paths.mjs

Reverse control (all three variables supplied — behaviour UNCHANGED, a real verdict is still returned):

$ NODE_USE_ENV_PROXY=1 GITHUB_REPOSITORY=objectstack-ai/objectstack PR_NUMBER=16326 GITHUB_TOKEN=x node scripts/check-single-claim-paths.mjs
EXIT=0
✓ check:single-claim-paths: PR #16326 modifies none of the 1 declared at-most-one-writer path(s), so there is nothing to serialise.

--self-test (raised battery floor, 'Wiring absent: never clean, never an accusation.' 5 → 16, including the new missing-slug and missing-token cases and one assertion pinning the exit code as the literal number 2):

$ node scripts/check-single-claim-paths.mjs --self-test
...
  ✓ no PR context at all exits NOT WIRED
  ✓ NOT WIRED says it judged nothing
  ✓ NOT WIRED does not read as a clean board
  ✓ a fully wired environment (all three variables) is wired
  ✓ an unset environment is not wired
  ✓ PR_NUMBER with no GITHUB_REPOSITORY is not fully wired
  ✓ ...and it is attributed to the right missing variable
  ✓ a missing GITHUB_REPOSITORY exits NOT WIRED, never the FINDING code
  ✓ ...and that exit code really is the number 2 (#16329, not just the named constant)
  ✓ the missing-repo verdict says it judged nothing
  ✓ the missing-repo verdict does not read as a clean board
  ✓ the missing-repo verdict names the missing variable
  ✓ PR_NUMBER + repo but no GITHUB_TOKEN is not fully wired
  ✓ ...and it is attributed to GITHUB_TOKEN
  ✓ a missing GITHUB_TOKEN exits NOT WIRED too
  ✓ all three variables present is fully wired (reverse control)
...
✓ check-single-claim-paths self-test: 65 cases pass.

Gates run

node scripts/pm/dispatch-gates.mjs --commands derived 32 commands for this diff; all 32 ran green, including pnpm check:pm-dispatch-gates (1674 cases pass) and pnpm check:single-claim-paths (the self-test above). node scripts/check-nul-bytes.mjs also passes.

Changeset

skip-changeset — measured, not assumed: every package's package.json files[] publishes only dist, README.md, CHANGELOG.md (checked across all workspace packages with a files field). scripts/check-single-claim-paths.mjs is a repo-root CI gate script under scripts/, not scripts/pm/**, and is not built into any package's dist — nothing published moves.

Clause-②: no

Generated by Claude Code