[kyle-sexton]

Refs: #8839

Summary

Closes the test-selection audit gaps found by the scheduled audit: 85 gaps in 8 suites (run 39587509730) and 25 gaps in 10 suites (run 39766052329), 18 suites in all. A suite read a file that scripts/affected-tests.sh does not select it for. More shards are still to come, so #8839 stays open.

Fix

• # test-scope: declarations (R8) in 17 suites' headers, each the narrowest glob that covers the read files (one glob per directory only where the suite reads every file in it). No selector rule changes, per the fix(ci): select suites for the files they read (#8410) #8411 decision.
• scripts/selection-audit.sh no longer reports a read of a file recorded in scripts/affected-tests-no-suite.txt (a non-shell lane covers it). This drops the package-lock.json row of visual-compare.test.sh instead of declaring it; scripts/selection-audit.test.sh gains a recorded no-suite read that must not be a gap.
• A bump: none changelog fragment for each of the 11 plugins touched.

Verification

All 109 (suite, file) pairs from both gaps.tsv files were gaps before the change and select their suite now (scripts/affected-tests.sh --explain -- <file>, as the audit runs it). One pair per suite:

• .claude/settings.json -> .claude/hooks/check-affected-pre-push.test.sh (test-scope .claude/settings.json) [1 pair(s)]
• plugins/animation/.claude-plugin/plugin.json -> plugins/animation/scripts/animation.test.sh (test-scope plugins/animation/.claude-plugin/plugin.json) [1 pair(s)]
• plugins/biome-format/lib/git-hooks/install.mjs -> plugins/biome-format/hooks/biome-format.test.sh (test-scope plugins/biome-format/lib/git-hooks/install.mjs) [2 pair(s)]
• plugins/code-metrics/scripts/yaml_subset.py -> plugins/code-metrics/skills/audit-coverage/scripts/audit-coverage.test.sh (test-scope plugins/code-metrics/scripts/yaml_subset.py) [1 pair(s)]
• plugins/code-metrics/scripts/yaml_subset.py -> plugins/code-metrics/skills/audit-type-debt/scripts/audit-type-debt.test.sh (test-scope plugins/code-metrics/scripts/yaml_subset.py) [1 pair(s)]
• plugins/guardrails/.claude-plugin/plugin.json -> plugins/guardrails/git-hooks/reference-verify.test.sh (test-scope plugins/guardrails/.claude-plugin/plugin.json) [3 pair(s)]
• plugins/guardrails/hooks/abort-boundary.test.sh -> plugins/guardrails/hooks/block-convention-violation.test.sh (test-scope plugins/guardrails/hooks/*.test.sh) [25 pair(s)]
• plugins/guardrails/.claude-plugin/plugin.json -> plugins/guardrails/hooks/block-fix-request-post.test.sh (test-scope plugins/guardrails/.claude-plugin/plugin.json) [1 pair(s)]
• plugins/planning/.claude-plugin/plugin.json -> plugins/planning/shared/tests/align.test.sh (test-scope plugins/planning/.claude-plugin/plugin.json) [31 pair(s)]
• plugins/planning/shared/schema/question-shape.schema.json -> plugins/planning/shared/tests/test_people_proposals.py (test-scope plugins/planning/shared/schema/question-shape.schema.json) [7 pair(s)]
• plugins/planning/.claude-plugin/plugin.json -> plugins/planning/shared/tests/tracer.test.sh (test-scope plugins/planning/.claude-plugin/plugin.json) [7 pair(s)]
• plugins/review/lib/parse-concern-value.sh -> plugins/review/skills/setup/scripts/setup-apply.test.sh (test-scope plugins/review/lib/parse-concern-value.sh) [2 pair(s)]
• plugins/ruff-format/hooks/exec-bash.mjs -> plugins/ruff-format/hooks/ruff-format-end-of-turn.test.sh (test-scope plugins/ruff-format/hooks/exec-bash.mjs) [1 pair(s)]
• plugins/session-flow/.claude-plugin/plugin.json -> plugins/session-flow/skills/running-retro/scripts/test_observer.py (test-scope plugins/session-flow/.claude-plugin/plugin.json) [1 pair(s)]
• plugins/source-control/skills/babysit-prs/scripts/tests/repo_config_fake.py -> plugins/source-control/skills/babysit-prs/scripts/tests/test_babysit_merge_prefilter.py (test-scope plugins/source-control/skills/babysit-prs/scripts/tests/repo_config_fake.py) [1 pair(s)]
• plugins/user-interface/tests/fixtures/browserslistrc-project/src/Widget.svelte -> plugins/user-interface/tests/detect.test.sh (test-scope plugins/user-interface/tests/fixtures//src/.svelte) [3 pair(s)]
• plugins/work-items/tools/work-item-tracker/adapters/linear/add-sub-item.sh -> plugins/work-items/tools/work-item-tracker/adapters/linear/list-items.test.sh (test-scope plugins/work-items/tools/work-item-tracker/adapters/linear/*.sh) [21 pair(s)]

bash scripts/selection-audit.test.sh: PASS=19 FAIL=0. bash scripts/check-changelog-fragments.sh --check: 11 fragments valid. Headers changed only; the setup-apply, ruff-format-end-of-turn and block-fix-request-post suites pass (385 checks, 9 passed, PASS=296). The browser and Python suites were not run.

Related

• Audit run 39766052329
• Audit run 39587509730
• test: declare test scopes the selector missed #8617 (the same fix for the earlier gaps)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T13:09:21.355827Z	8851b2d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 8851b2d6c6389b6172ed729f48320422d11d2ee5: 0 finding(s), 0 as inline comments.

No security findings on head 8851b2d.

I read the full diff, which covers 29 files:

• 11 .changes fragments, each bump: none.

• # test-scope: comment headers added or extended in 15 test suites.

• A one-pattern change in scripts/selection-audit.sh and the matching test changes in scripts/selection-audit.test.sh.

• scripts/selection-audit.sh: The awk filter that builds gaps.tsv now also skips verdicts starting with no-suite:. These are files the selector records as covered by a non-shell lane, so the audit no longer reports them as gaps. This is a reporting-only audit script. It processes repository-controlled paths and verdicts and has no new input, execution, or secret-handling surface. A change that is recorded as having no suite, or that selects none, is not a trust-boundary change.

• Test headers and test fixtures: Test-scope headers are comments that widen which suites run for a file change, so they make the test selection stricter, not looser. The test edits only alter local fixtures and the stub selector.

• Manifests: No plugin.json or marketplace.json was changed. Several headers only list a plugin.json path in a comment, so there are no manifest <field> lines to report.

• Instruction surfaces: The diff deletes or softens no standing instruction (CLAUDE.md, AGENTS.md, rules, skill or agent bodies, hook block lists). The instruction-surface lens found nothing, so I did not read the exception register.

• Actions: No workflow files changed.

[github-actions]

claude-review reviewed 8851b2d6c6389b6172ed729f48320422d11d2ee5: 0 finding(s), 0 as inline comments.

No findings.

I read the full diff and PR context and checked the changes statically. I did not run scripts/selection-audit.test.sh (the sandbox needed approval to run it), so the PR's PASS=19 result is author-claimed and not confirmed by me.

• Header placement: I read the selector's header parser in scripts/affected-tests.sh (scope_declarations, scripts/affected-tests.sh:587). It reads # test-scope: lines from the leading comment block, where blank lines are skipped and the scan stops at the first non-comment line. Every new header is in that block, including the Python files that put it on line 1 or after the shebang, and the shell suites that put it after a # shellcheck disable line and before set.
• Stale globs: The selector exits 2 when a declared glob matches no tracked file. I listed the new literal paths (for example plugins/planning/shared/schema/wire.schema.json, plugins/review/lib/resolve-convention-home.sh, plugins/guardrails/hooks/workflow-resilience-check.sh) and the directories behind the wildcard globs; all match at least one existing file. I did not run the selector's own stale-glob check.
• Audit filter: The scripts/selection-audit.sh change drops verdicts that begin no-suite:. The selector emits that exact prefix (scripts/affected-tests.sh:1452) and the audit keeps it via grep -m1 -E "^(no-suite|deleted)", so the awk pattern ^(not checked|no-suite:) matches. deleted verdicts are still reported as gaps.
• Audit test stub: The stub now records only data/recorded.txt as no-suite. data/hidden.txt therefore falls through with no stderr and gets the selects no suite verdict, which matches the new expected gap row.
• Changelog fragments: There are 11 bump: none fragments, one for each plugin whose files changed. The .claude/hooks suite is not a plugin and has none.
• Manifests: The diff changes no plugin.json or marketplace.json, so no manifest lines apply.
• Closing issue: The PR uses Refs: #8839 and closes nothing, so there are no closing-issue criteria to check.