fix(ufs): parity derives its runtimes instead of naming directories

[indykish]

Follow-up to #19, which found this while fixing the scope hole and deliberately left it out.

The bug

The cross-runtime ERR_* parity check globbed three fixed directories. One of them stopped existing:

  zig_err   src/*.zig                          → 172 codes
  js_err    agentsfleet/src/*.{js,jsx,ts,tsx}  →   0 files scanned  ◄──
  ui_err    ui/packages/*/src/*.ts{,x}         → 168 files scanned

So "every client ERR_* must have a Zig twin" passed by scanning nothing. Three real codes in cli/src/ — ERR_UNAUTHORIZED, ERR_WORKSPACE_NAME_EXISTS, ERR_CLI_CREDENTIAL_EXCHANGE_FAILED — went uncompared for as long as it took someone to read the glob.

That is this audit's own failure mode, and one repository's directory names sitting inside a gate every repository receives.

Swapping the path would move the landmine, not remove it

agentsfleet/src/ → cli/src/ is the same bug waiting for the next reorg. The scan now reads *.zig as the source of truth and every other in-scope runtime file as the client side, anywhere in the tree. A runtime-derived glob has no directory left to go stale.

Two things fall out of doing it properly:

No Zig means skipped, with a reason. Without that branch, fixing the globs would turn every error code in a single-runtime repository into an orphan on the next orly update — a worse bug than the one being fixed.

Test exclusion is directory-shaped (test/, tests/, __tests__/, fixtures/), not .test. infix alone. cli/test/acceptance/fixtures/install-negatives-ops.ts declares two codes that are inputs to a negative test; an infix filter walked past it and would have graded both as production orphans.

The eval asserts what was FOUND, not the exit code

A vacuous pass and a real pass are the same status — precisely why nobody noticed. evals/dispatch/parity.sh checks the output text of five cases. Against the previous implementation:

  FAIL  orphan outside the old hardcoded globs is caught
        expected: cross-runtime-orphan ERR_NEVER_MIRRORED absent-in-zig
        got:      OK:   audit-ufs: no violations across 2 files    ◄── the bug
  PASS  code present in Zig is not reported
  PASS  codes in a fixtures/ tree are excluded
  FAIL  no Zig means skipped with a reason, not a vacuous pass
  PASS  ui/ orphan still caught after the rewrite

  3 passed, 2 failed

Against this branch: 5 passed, 0 failed. Wired into make audit and available as make dispatch-parity-evals.

Measured — no behaviour change for anyone

tree	result
agentsfleet (Zig + TS + Rust)	byte-identical output; its 3 real codes now actually compared, all present
cache-kit.rs	identical + the new skip line
extended-ceph-exporter	identical + the new skip line

string-dup counts unchanged from #19: 30 / 16 / 0.

Also

• The UFS card's parity clause said "more than one runtime (Zig, TS, JS)" — a fixed triad. It is now the runtimes the repository ships.
• Version 0.6.7.

Verification

make audit green (69 PASS, exit 0) · dispatch-evals 17/17 · parity-evals 5/5 · install-evals 23/23 · coverage check (h) green.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!