CI-001B4 — Make frontend lint non-mutating and fail closed #186

Outcome

Complete through PR #189. Main commit: bec7d5e365eacb418563a172029f241f660d9768.

The frontend CI job no longer rewrites source or ignores lint failure. It runs a direct, blocking checker over 102 JS/JSX/TS/TSX files before application tests, then proves tracked and non-ignored untracked paths stayed clean.

Child of #105 (CI-001). Depends on #124 (closed).

Released claim

CLAIMED by /root at 2026-07-13T22:10:25Z on codex/issue-186-frontend-lint-gate. The isolated branch refreshed onto 28681ef74a8aaa1addb2c01d533442dd952e65c1, exact source commit 0bb164904fb6a8352c6141fc44ff7cd30425e750 was reviewed, and PR #189 squash-merged as bec7d5e365eacb418563a172029f241f660d9768.

The nine-path claim is released.

Verified invariant

• The lint process disables the repository-wide eslint-plugin-only-warn effect so configured severity remains visible.
• The reviewable baseline contains all 102 scanned files and every individual finding: 125 configured errors and 7 warnings.
• Any added, removed, moved, or changed record rejects.
• Fatal parser/configuration/process failures reject through one fixed message; hostile exception getters/Proxies cannot leak their text through the CLI or test harness.
• The exact job prefix pins the GitHub-hosted runner, read-only permission, credential-free checkout, Node 20, dependency install with lifecycle scripts disabled, direct lint, and immediately adjacent clean proof.
• Structural tests reject duplicate YAML keys, self-hosted runners, global/job/step overrides, inserted environment steps, reordered wiring, mutation, incomplete scope, and swallowed failures.
• Ignored dependency/build paths and an operating-system sandbox remain explicitly outside this proof.

Acceptance

• Add one explicit non-mutating lint:ci script covering frontend JS, JSX, TS, and TSX.
• Preserve configured severities by disabling only the process-local effect of eslint-plugin-only-warn.
• Store all 102 scanned files and all 125 configured errors plus 7 warnings as deterministic, reviewable individual records.
• Accept only the exact reviewed records and reject fatal/malformed/missing/failed input.
• Share one safe verification wrapper between CLI and test harness and emit only one fixed bounded rejection.
• Replace the fail-open workflow line with direct Node lint followed immediately by the clean check.
• Pin the runner/job/setup trust context and reject overrides or prefix changes.
• Keep the opt-in lint:fix utility out of CI.
• Add hostile workflow, finding, parser, exception, and dirty-checkout tests.
• Prove exact lint success, deliberate fatal failure, hostile-exception redaction, and probe removal.
• Run frontend, SPA, workflow, Functions, Rules, commerce emulator, build, and diff checks.
• Update exact engineering status without claiming clean lint, branch protection, or deployment.
• Record exact pull-request and post-merge hosted evidence.

Evidence

• Three independent reviews: approved.
• PR run 29291402007: all five GitHub jobs passed; exact install, lint, clean, tests, and build steps passed; Netlify disposable preview passed.
• Post-merge run 29291515653: all five jobs passed on exact main bec7d5e365eacb418563a172029f241f660d9768, including the named lint and clean steps.

Officer impact: None — this changes an engineering quality gate and no officer task or public behavior.

Officer documentation: None — no officer procedure changes.

Deployment evidence: Source, tests, merge, hosted PR CI, disposable preview, and post-merge CI are proven. No production website publication, Firebase deployment, Stripe/provider change, branch-protection change, or production behavior occurred.