WP-065: Make workspace quality surfaces blocking

[simple-agent-manager]

Summary

WP-065 turns SAM's previously optional or silently omitted workspace quality surfaces into one fail-closed contract. It changes developer tooling, tests, package scripts, and CI only; runtime UI/API/CLI behavior is unchanged.

Changed contracts

• Every pnpm workspace with tests must expose runnable test and test:coverage scripts. The guard rejects missing packages, workspace membership, exact package-name drift, missing scripts, and representative placeholder commands.
• Root coverage now executes real tasks for apps/tail-worker, apps/www, packages/cloud-init, packages/ui, and infra; tools/og-image remains outside the contract because it has no tests.
• packages/terminal now includes .test.tsx in lint and a dedicated no-emit test TypeScript project.
• packages/ui now has an installable Storybook 10 production build, Vite/Tailwind token pipeline, dynamic built-story browser discovery, computed semantic-token checks, axe assertions, and screenshots for two themes and two viewports.
• apps/www now exposes build-backed unit/coverage/browser checks. Its browser build uses a loopback analytics domain and blocks/fails any attempted production analytics request.
• CI directly runs Storybook, public docs links, and www browser checks. The new job installs from the frozen lockfile with dependency lifecycle scripts disabled, invokes the pinned workspace Playwright binary, and requires every expected Storybook/public-site screenshot before artifact upload.

Regression evidence

Before this change:

• pnpm --filter @simple-agent-manager/ui build-storybook exited 0 while reporting that the selected package had no build-storybook script.
• pnpm turbo run test:coverage --dry=json reported NONEXISTENT for five tested workspaces: cloud-init, infra, tail-worker, UI, and www.

After this change:

• Checked-in mutation fixtures fail for an omitted tested coverage script, placeholder commands, a missing specialized package, removal from pnpm-workspace.yaml, exact package-name drift, missing Storybook/www scripts, incomplete CI wiring, and any missing browser evidence.
• Full root coverage reports 20/20 successful Turbo tasks instead of silently omitting the five packages.

Validation

• Frozen install: pnpm install --frozen-lockfile
• Affected coverage: tail-worker 30 tests; cloud-init 190; infra 56; UI 87; terminal 99; www 2 emitted/source tracker tests
• www source coverage: 85.13% statements / 91.04% lines
• pnpm --filter @simple-agent-manager/ui build-storybook
• Storybook browser audit: 32/32 desktop/mobile/theme cases
• www docs: 0 broken links across 26 pages
• www browser audit: 14/14 desktop/mobile cases
• pnpm quality:browser-evidence
• pnpm quality:scripts:test: 20 files / 224 tests
• Post-Sonar guard/evidence checks: direct ESLint plus 14/14 focused tests; security/test/completion re-reviews PASS
• pnpm lint
• pnpm typecheck
• pnpm test:coverage: 20/20 Turbo tasks
• pnpm build
• Final GitHub suite: 25/25 applicable checks green, including SonarCloud and Workspace Quality Surfaces

Staging Verification

N/A by direct user release contract: this individual source PR must not mutate shared staging; the final mega integration owns staging. No staging deployment or verification was performed.

UI Compliance Checklist

• Storybook rendered at desktop and mobile widths in both SAM themes
• Axe runs on every built story; public /self-host/ also has blocking axe/overflow assertions
• Computed semantic foreground/background assertions prevent transparent false-green rendering
• Screenshots visually inspected; UI/UX reviewer independently rebuilt and reran 32/32 audits

End-to-End Verification

• Package graph invariant traced from pnpm-workspace.yaml and manifests through the root guard into blocking CI
• Browser evidence traced from production Storybook/www builds through Playwright into the required screenshot manifest and artifact upload
• No runtime source was changed; no threshold was lowered and no test was deleted or skipped
• Exact implementation/review record: tasks/active/2026-08-08-blocking-workspace-quality-surfaces.md

Post-Mortem

Class of bug: silent aggregate-gate omission. Turbo and filtered pnpm commands can return green when an intended workspace/package/script is absent. CI previously asserted only aggregate exit status, so quality surfaces could disappear without a failure. The new package-graph, specialized identity, CI wiring, and evidence-manifest fixtures make participation explicit and fail closed.

Specialist Review Evidence

Reviewer	Status	Outcome
test-engineer	ADDRESSED	Placeholder-script acceptance, hardcoded story inventory, and emitted/source tracker coverage findings fixed; post-Sonar direct ESLint and 14/14 fixture re-review PASS
ui-ux-specialist	ADDRESSED	Semantic Tailwind mapping, token assertions, and fail-on-missing screenshots fixed; independently passed 32/32 audits
doc-sync-validator	ADDRESSED	Required post-mortem timeline added; no public docs or CLAUDE.md sync required
constitution-validator	PASS	No runtime hardcoded values or constitution violations
security-auditor	ADDRESSED	Production analytics egress isolated to loopback and blocked fail-closed; post-Sonar CI install/local-binary boundary re-review found no material findings
defensive regression reviewer	ADDRESSED	Specialized filters bound to workspace/path/name/script identity and complete screenshot manifest added; final PASS
task-completion-validator	PASS	Every research finding, checklist item, and criterion maps to substantive evidence; post-Sonar re-review passed and the final 25/25 GitHub suite is green

Exceptions

• Existing dark-theme primary/danger button contrast debt is recorded as two exact expected axe findings by theme/story/rule/node target. It is not skipped: the test warns/annotates it and fails if either finding disappears or changes, or if any new serious/critical violation appears. Runtime token changes are outside this non-breaking packet.
• Shared staging, merge, and task archive are intentionally excluded by the direct user release contract. This PR must remain open and unmerged.

Agent Preflight

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

Official documentation consulted before implementation: Storybook's React/Vite framework guide (https://storybook.js.org/docs/get-started/frameworks/react-vite), Storybook accessibility testing guide (https://storybook.js.org/docs/writing-tests/accessibility-testing), and Playwright web-server configuration reference (https://playwright.dev/docs/test-webserver).

Codebase Impact Analysis

• package.json, workspace manifests, pnpm-lock.yaml: runnable coverage and browser/Storybook command contracts.
• scripts/quality/: fail-closed workspace identity, CI wiring, and browser evidence validators with mutation fixtures.
• packages/ui/: Storybook production/test harness only; no shared component runtime source changes.
• packages/terminal/: test-only lint/typecheck inputs and minimal static-test corrections.
• apps/www/ and apps/tail-worker/: package test commands and deterministic test harnesses only; no runtime source behavior changes.
• .github/workflows/ci.yml: one blocking workspace-quality job with read-only permissions and pinned actions.

Documentation & Specs

The exact developer/CI contracts, baseline proof, validation, exception, post-mortem, and reviewer outcomes are recorded in tasks/active/2026-08-08-blocking-workspace-quality-surfaces.md. No public docs-site content or CLAUDE.md update is required because runtime/product behavior and public setup instructions did not change.

Constitution & Risk Check

Principle XI was reviewed: loopback ports, browser viewports/timeouts, story IDs, and action SHAs are bounded test-harness or immutable supply-chain constants, not runtime deployment configuration. Risk is limited to CI duration and test determinism; package identity, browser egress, missing scripts, empty story inventories, and missing screenshot evidence all fail closed. No runtime trust boundary, infrastructure, migration, credential, or secret handling changed.

Generated with Codex.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/wp-065-every-workspace-36845j (0e19f7b) with main (8c689a6)}

[simple-agent-manager]

Integration in progress — owned by task 01KZMFQJ4VKXEFB9K9Q64QKDDF. PR Shepherd: hands off until this completes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud