refactor(autoflow): shrink policy registry to OE-specific invariants (#1229 B2.7) (#1295)

Co-authored-by: DevBot <devbot@openelement.dev>

Author: SisyphusZheng

.githooks/pre-commit

@@ -1,13 +1,15 @@
 #!/bin/sh
 #
-# openElement pre-commit hook.
-# AutoFlow3 is the single local gate controller; this tier stays fast and
-# delegates gate policy to tools/autoflow/policy.ts.
+# openElement pre-commit hook. Format/lint are owned by the Deno toolchain
+# directly (ADR-0144, #1229); AutoFlow3 keeps only OE-specific dev-tier gates.
 #
 # Install: deno task hooks:install
 
 set -e
 
+deno fmt --check
+deno lint
+
 echo "[autoflow:dev] pre-commit"
 deno task autoflow:dev || {
   echo ""

.githooks/pre-push

@@ -1,13 +1,20 @@
 #!/bin/sh
 #
-# openElement pre-push hook.
-# AutoFlow3 owns the push tier gate selection.
+# openElement pre-push hook. Format/lint/type-graph/Markdown are owned by the
+# pinned OSS tools directly (ADR-0144, #1229); AutoFlow3 owns only the
+# OE-specific push-tier gate selection.
 #
 # Install: deno task hooks:install
 
 set -e
 
 BRANCH=$(git rev-parse --abbrev-ref HEAD)
+
+deno fmt --check
+deno lint
+deno task lint:markdown
+deno task typecheck
+
 echo "=== pre-push: autoflow:push for '$BRANCH' ==="
 
 deno task autoflow:push || {

.github/workflows/autoflow-ci.yml

@@ -68,6 +68,11 @@ jobs:
           tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
           /tmp/gitleaks git --redact --verbose .
       - uses: ./.github/actions/setup-deno-workspace
+      # ADR-0144 / #1229 (B2.7): generic toolchain gates are pinned OSS tool steps, not AutoFlow gates.
+      - run: deno fmt --check
+      - run: deno lint
+      - run: deno task lint:markdown
+      - run: deno task typecheck
       - name: Install Playwright browsers
         # All three engines up front: the gate's fixture:request-time:gate
         # runs the request-time fixture suite on Chromium, Firefox and WebKit.

deno.json

@@ -70,7 +70,6 @@
     "fullstack:boundary-check": "deno run --allow-read --allow-run tools/check-fullstack-boundary.ts",
     "fullstack:migrations-check": "deno run --allow-read tools/check-supabase-migrations.ts",
     "fullstack:workspace-qualification": "deno task --cwd examples/supabase-cloudflare-starter build && deno task --cwd examples/supabase-cloudflare-starter nitro:build && deno run --allow-read --allow-write --allow-env --allow-sys --allow-net=127.0.0.1,localhost --allow-run=node,deno tools/qualify-workspace-runtime.ts",
-    "fullstack:notes-qualification": "deno task fullstack:workspace-qualification",
     "fullstack:evidence-freshness": "deno run --allow-env --allow-net=api.github.com tools/check-evidence-freshness.ts",
     "fullstack:cloudflare-config-check": "deno test --allow-read tools/render-cloudflare-async-config.test.ts && deno task --cwd examples/supabase-cloudflare-starter build && deno task --cwd examples/supabase-cloudflare-starter nitro:build && deno run --allow-read --allow-write tools/render-cloudflare-async-config.ts examples/supabase-cloudflare-starter/wrangler.jsonc examples/supabase-cloudflare-starter/.wrangler-async.generated.json && deno run --allow-run=deno tools/run-wrangler-dry-run.ts examples/supabase-cloudflare-starter/.wrangler-async.generated.json && rm examples/supabase-cloudflare-starter/.wrangler-async.generated.json",
     "arch:check": "deno run --allow-read --allow-run tools/check-architecture-contract.ts",

tools/autoflow/__tests__/policy.test.ts

@@ -50,9 +50,16 @@ Deno.test('policy: minor release with approved plan can execute', () => {
   assert(decision.requiredEvidence.includes('approval:ADR-0101/docs-current-v040'));
 });
 
-Deno.test('policy: dev tier remains fast', () => {
-  const gates = selectGates('dev', ['packages/core/src/index.ts']).map((gate) => gate.name);
-  assertEquals(gates, ['fmt:check', 'lint']);
+Deno.test('policy: generic toolchain concerns are not AutoFlow gates (ADR-0144, #1229)', () => {
+  // Deno fmt/lint/check and markdownlint-cli2 own these as CI steps and hook calls.
+  for (const tier of ['dev', 'push', 'ci', 'release'] as const) {
+    const names = selectGates(tier, ['packages/element/src/index.ts']).map((gate) => gate.name);
+    for (const generic of ['fmt:check', 'lint', 'typecheck', 'lint:markdown']) {
+      assertFalse(names.includes(generic), `${generic} must not be an AutoFlow ${tier} gate`);
+    }
+  }
+  // The dev tier carries no gates at all for a package-source-only change.
+  assertEquals(selectGates('dev', ['packages/core/src/index.ts']).map((gate) => gate.name), []);
 });
 
 Deno.test('policy: push tier stays fast for package source changes', () => {

tools/autoflow/policy.ts

@@ -25,22 +25,9 @@ export function isCI(): boolean {
   return Deno.env.get('CI') === 'true';
 }
 
+// ADR-0144 / #1229: fmt/lint/type-graph/Markdown are owned by Deno fmt, deno
+// lint, deno check and markdownlint-cli2 as autoflow-ci.yml steps and .githooks calls.
 const GATES: readonly GateDefinition[] = [
-  {
-    name: 'fmt:check',
-    command: ['deno', 'task', 'fmt:check'],
-    tiers: ['dev', 'push', 'ci', 'release'],
-  },
-  {
-    name: 'lint',
-    command: ['deno', 'task', 'lint'],
-    tiers: ['dev', 'push', 'ci', 'release'],
-  },
-  {
-    name: 'typecheck',
-    command: ['deno', 'task', 'typecheck'],
-    tiers: ['push', 'ci', 'release'],
-  },
   {
     name: 'graph:check',
     command: ['deno', 'task', 'graph:check'],
@@ -326,14 +313,6 @@ const GATES: readonly GateDefinition[] = [
     tiers: ['ci', 'release'],
     triggers: [/^packages\/(element|ui|app)\/src\//],
   },
-  {
-    // #1156 (B2.6): markdownlint-cli2 owns Markdown structure per ADR-0144
-    // (thin .markdownlint-cli2.jsonc config; no bespoke checker).
-    name: 'lint:markdown',
-    command: ['deno', 'task', 'lint:markdown'],
-    tiers: ['push', 'ci', 'release'],
-    triggers: [/\.md$/, /^\.markdownlint-cli2\.jsonc$/, /^deno\.json$/],
-  },
   {
     name: 'text-integrity:check',
     command: ['deno', 'task', 'text-integrity:check'],