feat(scripts): farm-wide detector for the #8435 ratchet-remedy authority convention

.github/workflows/lint.yml

@@ -1327,6 +1327,27 @@ jobs:
       - name: Check every agent definition declares a model
         run: pnpm check:agent-model-declared
 
+      # The #8435 ratchet-remedy authority convention, enforced farm-wide instead of
+      # gate by gate. A gate whose second remedy is editing a shrink-only ratchet must
+      # either mark that path `⛔ MAINTAINER-ONLY` or turn it down outright; six gates
+      # do (PR #8517, #8539, #8549) and nothing stopped the seventh from not.
+      #
+      # A shared helper module was the obvious route and is the wrong one: a module is
+      # reachable only from gates that import it, so it standardises the gates that
+      # already agreed and is blind to the next one. #8538 is the proof — the sixth
+      # instance was found by sweeping source text, and that file imports nothing to be
+      # found by. So this sweeps `scripts/*.{mjs,mts}` — never `*.mjs`, which is the
+      # blind spot that made #8538 necessary in the first place.
+      #
+      # Runs its own --self-test first, and the self-test carries a corpus-scale
+      # positive control: a detector that quietly stopped matching would otherwise
+      # report a clean farm while reading nothing, which is the exact failure the
+      # convention it enforces is about. Static text only — no build, so it belongs in
+      # this pre-build group. No paths filter, for the standard reason: a filter on
+      # scripts/** would go dormant on the PR that reworded the convention elsewhere.
+      - name: Ratchet-remedy authority convention (#8435) across the gate farm
+        run: pnpm check:ratchet-remedy-authority
+
       - name: Check the react-blocks contract is in sync with the spec
         run: pnpm --filter @objectstack/spec check:react-blocks
 

package.json

@@ -44,6 +44,7 @@
     "check:skill-frame-freshness": "node scripts/check-skill-frame-freshness.mjs --self-test && node scripts/check-skill-frame-freshness.mjs",
     "check:skill-compatibility": "node scripts/check-skill-compatibility-version.mjs --self-test && node scripts/check-skill-compatibility-version.mjs",
     "check:agent-model-declared": "node scripts/check-agent-model-declared.mjs --self-test && node scripts/check-agent-model-declared.mjs",
+    "check:ratchet-remedy-authority": "node scripts/check-ratchet-remedy-authority.mjs --self-test && node scripts/check-ratchet-remedy-authority.mjs",
     "check:pm-skill-ratchet": "node scripts/pm/check-skill-line-ratchet.mjs --self-test && node scripts/pm/check-skill-line-ratchet.mjs",
     "check:pm-skill-id-lint": "node scripts/pm/check-skill-id-lint.mjs --self-test && node scripts/pm/check-skill-id-lint.mjs",
     "check:pm-dispatch-gates": "node scripts/pm/check-dispatch-gates.mjs",