1.4 — Gate VSIX contents in CI (packaging.test.ts is currently inert)

[jack-champagne]

Problem

packages/extension/test/packaging.test.ts is describe.skipIf(!existsSync(VSIX)), and ci.yml never builds a .vsix (the package script is the only thing that produces amicode.vsix, and no CI job runs it). So the packaging-manifest suite skips on every push and PR — it is the source of the perennial "2 skip" in the green run.

That means the REQUIRED-ships manifest list guards nothing automatically. After #44 the list includes extension/media/inspector.{html,css}, but those entries — like every other entry — only assert anything if a human remembers to run pnpm --filter amicode-v2 package locally and then vitest by hand.

This is a deliberate deferral, not a regression

• The inert-without-vsix pattern is intentional, present since a4713d5 ("packaging-manifest assertion … verified, 39MB, 16 files"), whose comment states the intent: "Inert without a built .vsix so CI stays green."
• The last CI change in this area (26d9018, "extension unit suite in fast job … .vscodeignore ships vendor/") added vendor-shipping + boot-smoke but consciously left out a package step.
• The phased build plan lists "mechanical CI gates" under "explicitly NOT in β", landing in Phase 1.4 ("Reference-prompt smoke corpus + traceability/CI gates"). So this is parked by convention — it just had no tracking issue. This issue is that ticket.

Residual exposure

The repo-level presence of media/ is now caught in the fast tier — inspector_view_contract.test.ts readFileSyncs the source media/inspector.{html,css}, so a deleted file reds CI. The unguarded layer is strictly VSIX inclusion: a .vscodeignore mistake (or a vsce default-include change) that ships the repo file but drops it from the package. Today nothing in .vscodeignore names media/, so it ships only by default-inclusion with no backstop. If that breaks, the published extension renders a blank/unstyled Run Inspector while CI stays fully green.

Proposed approach

Two tiers (decide one or both):

1. Fast tier (cheap, no opencode vendoring): add a step that runs vsce ls (lists the files that would ship — no 39MB build, no fetch:opencode) and asserts the REQUIRED entries minus the vendored-opencode line. This makes the asset-manifest check a real per-PR gate at near-zero cost.
2. Slow/boot-smoke lane (full fidelity): run pnpm --filter amicode-v2 package (the boot-smoke job already does fetch:opencode, so it's the natural home) and run packaging.test.ts against the real amicode.vsix — this is the only path that can keep asserting the vendored-opencode entry.

Acceptance criteria

• The packaging-manifest assertion executes in CI on every PR (not skipped) and reds when a REQUIRED asset is excluded from the package.
• Adding media/** (or **/*.html) to .vscodeignore fails CI.
• The "2 skip" no longer silently hides the packaging suite (either it runs, or the remaining skip is explicitly justified in a comment).
• Realizes the Phase 1.4 DoD intent (requirement→test matrix; S35 "vendored opencode + bundled script must ship").

Out of scope

Marketplace publishing / signing (Phase 4, #2). This issue is only about making the existing manifest assertion a real CI gate.

Links

• Surfaced by refactor(extension): extract Run Inspector view to media files #44 (added the media/ entries and leaned on the guard in its description).
• a4713d5 introduced the inert assertion; 26d9018 last touched CI packaging.
• Plan: Phase 1.4 "smoke corpus + traceability/CI gates"; "explicitly NOT in β: … mechanical CI gates."

Dependencies

Blocked-by: #58