Three tsconfigs exclude test files and CI typechecks none of them, so a type-level guard in any worker test is inert

[serge-ivo]

No CI gate typechecks a worker test, so every compile-time exhaustiveness guard in one is inert

Found while closing #588. RunHealth had a Record<RunHealth, true> arm intended to fail when a member was added. It could never fail: it is not compiled by anything.

workers/api/tsconfig.json   "exclude": ["src/**/*.test.ts", "src/lib/d1-sqlite.ts"]
workers/mcp/tsconfig.json   "exclude": ["src/**/*.test.ts"]
packages/sdk/tsconfig.json  "exclude": ["src/**/*.test.ts"]

ci.yml's four tsc --noEmit projects therefore never see a worker test, and vitest transpiles without typechecking. So a type-level assertion in a test file compiles nowhere and fails never — it is a comment that looks like a guard.

Population, measured: grep -rl 'Record<' workers/api/src workers/mcp/src --include='*.test.ts' → 145 files. Not every one is an exhaustiveness check, but that is the set in which such a check would be silently inert, and it includes at least one that was.

Why this outranks the individual guards it hides

This repo's whole verification discipline is ADR 0002 — a guard states what it measured — and its G4 practice is to break a guard deliberately and watch it go red. A type-level guard in a worker test cannot go red, so G4 silently passes it: the mutation is made, nothing fails, and the failure is indistinguishable from "the arm was already covered elsewhere".

Concretely, this defeated the exact mechanism #588 relied on. The fix there was to make RunHealth a runtime const array so an executed test could check it. That works — and it is a workaround for this issue, not a solution to it. Every other type-level assertion in those 145 files is still unchecked.

Acceptance criteria

1. Worker and SDK test files are typechecked by CI — a tsconfig.test.json, a lifted exclude, or vitest --typecheck. State the choice and its cost; the exclusions are presumably there for a reason (build output, speed) and that reason must be answered, not ignored.
2. Introducing a type error in a worker test fails CI. Demonstrated red.
3. The count of type-level assertions that were inert is reported, not estimated. 145 is the Record< population, not the answer — how many were actually exhaustiveness guards, and how many were already wrong when this landed?
4. Any that were wrong are fixed or removed. A guard that never worked and now fails is a finding, not a regression.
5. store/console is checked too — its tsconfig has no exclude, so it may already be fine; confirm rather than assume.

Verified vs inferred

• Verified: all three exclude lines verbatim; the four tsc --noEmit projects in ci.yml; the 145-file grep -rl count; that vitest does not typecheck by default; that Record<RunHealth, true> in workers/api was inert (the The server-side health verdict reports 'working' for all 89 finished runs — the enum has no member for a closed run #588 agent demonstrated it).
• Inferred: that most of the 145 are not exhaustiveness checks. Plausible — Record< has many uses — but not measured, which is exactly what AC3 asks for. Do not assume the number is small because the fix looks large.

[serge-ivo]

Shipped in 6d44ac7. CI green on that SHA (including the new gate), api + mcp deploys succeeded, both /health 200.

AC3 — the measurement, not an estimate

Record< matches 145 files. That is the population, not the answer. Of 568 Record< occurrences across workers/api + workers/mcp tests, 558 are Record<string, …> — ordinary typed fixtures. Only 10 use a named union key.

Real type-level assertions across all three trees: 10 constructs in 9 files.

Construct	Where	Verdict
Record<RunHealth, true>	run-health-readers.test.ts:203	correct
Record<RunWaitReason, true>	run-health-readers.test.ts:227	correct
Record<LoopRunStatus | "running", true>	work-report.test.ts:187	correct
Record<LoopStopReason, true>	work-report.test.ts:195	correct
Record<AttachmentState, …>	prompt-claims.test.ts:175	correct
Record<CodingFailureClass, …>	coding-resume.test.ts:39	correct
Partial<Record<Provider, KeyRow>>	routes/connectors.test.ts:36	fixture, not a guard
conditional-type, both directions	tool-listing-budget.test.ts:92	correct
satisfies BrowserAction[]	browser-task-loop.test.ts:98	correct
satisfies Partial<UserAiProviderError>	user-ai.test.ts:143	correct
const state: AgentState = {…}	agent-do.test.ts:75	ALREADY WRONG

The other 7 satisfies grep hits were the English word in a test name, not the operator.

Answers to the three questions:

1. 10 of the 145 are genuinely type-level assertions (9 if you exclude the Partial fixture).
2. 1 was already wrong: agent-do.test.ts:75 annotated a literal AgentState that had been missing the required guardrails, welcomeMessage and isPublished for as long as it existed.
3. Fixed, not removed — the three fields are supplied. The other nine were correct and are now enforced rather than decorative.

AC1 — the exclusions answered, not ignored

A separate tsconfig.test.json per project. All three exclusions were load-bearing and all three survive:

• workers/* — types: ["@cloudflare/workers-types"] withholds node globals from Worker code deliberately, and 86 test files import node:fs/node:sqlite/node:os. Admitting them via the production config would hand every production module globals the Worker has no runtime for.
• workers/api — src/lib/d1-sqlite.ts is excluded as a bundle barrier (its own tsconfig comment says so). Untouched.
• packages/sdk — that config emits the dist files: ["dist"] publishes to npm; compiling tests there would ship test JS + .d.ts. Verified dist still carries no test artifact.

Each test config is noEmit, so no reason is weakened. One consequence worth recording: @types/node went to those three packages only, not the root — store/console, store/admin and agents/coder/web leave types to auto-discovery, so a root-level add silently gives three browser builds node globals. For the same reason packages/sdk/tsconfig.json now pins types: ["react","react-dom"]: that barrier previously held only by accident. Probed both directions.

Incidental finding: workers/mcp had no tsc step in ci.yml at all — neither its tests nor its source were typechecked by CI.

Cost: 5.7s locally for all three (api 3.4s over 347 test files, mcp 1.5s, sdk 0.9s).

AC2 / G4 — demonstrated red

On the case whose own comment asserts it. tool-listing-budget.test.ts:92 holds ToolTier and the inline ToolDef["tier"] union to being the same set, commented "A fifth tier added to one and not the other fails tsc, not this assertion."

Adding "experimental" to ToolDef["tier"] alone:

• pnpm vitest run tool-listing-budget.test.ts → 6 passed
• biome check → clean
• new gate → tool-listing-budget.test.ts(92,128): error TS2322: Type 'true' is not assignable to type 'never'.

The comment's claim was false until this commit. (My first G4 attempt used Record<RunHealth, true> — but that one also fails vitest now, because #588's workaround added a runtime array. It was not a clean demonstration, so I built one.)

AC5 — store/console confirmed, not assumed

Its tsconfig has no exclude, and 50 test files are in its tsc program. An injected const x: number = "…" in tabs/BehaviourTab.test.ts fails with exit 2. Same for store/admin (4 test files) and agents/coder/web (24). Nothing needed.

AC4 and what else fell out

Turning the gate on surfaced 417 further errors in 69 of 347 api test files (mcp 13, sdk 2). These are fixture drift, not inert guards — all fixed, none by weakening an assertion. 9,039 tests still pass. The ones that were measuring something other than what they claimed:

• 9 sites called signSession({uid, email, roles}, SECRET) — not its signature (tools.test.ts ×3, coding-repos.test.ts ×5, instances-apply.test.ts ×1). Those tests minted sessions whose uid was an object and whose roles fell back to the default; email was never in the payload at all.
• keys.test.ts:331 asserted usage !== null && usage.count >= RATE_LIMIT on a usage const initialised to null — the second operand was unreachable.
• mcp-credentials.test.ts set unattended: "unattended", not an UnattendedClass value, held up by an as DiscoveryResult cast.
• mcp-consent.test.ts / mcp-tool-catalog.test.ts imported Env from "./types.js" — a path with no file behind it.
• gate.test.ts's FakeSR never modelled abort(), which gate.ts:362 calls; it no-opped in every test there and the one test that cares monkey-patched it on.
• work-stop.test.ts, subordinate-observation.test.ts, board-runs.test.ts factories omitted required fields (lastAliveAt, waitingReason, waitingUntil, interruptions), building runs in shapes their real mappers cannot emit.

Two production type defects — reported, NOT fixed here

Both are separable from #599 and want their own ticket:

1. workers/api/src/lib/usage.ts:319 — UsageSummary["totals"] omits cacheReadTokens / cacheWriteTokens, which aggregateUsage does compute and return (init usage.ts:417, accumulate :434-435, return :470). Returned via a variable, so no excess-property check fires and the fields are erased from the public type while surviving at runtime — the same drop-on-the-way-out shape The Usage chart shows 4.2M tokens for the day the 250M ceiling was tripped — the daily series drops the cache columns, which are 98.2% of what the ceiling counts #547 fixed for daily. The console works around it by declaring its own parallel shape with the fields optional (store/console/src/pages/Usage.tsx:35, read at :281, :361, :375). usage.test.ts now reads them through a narrowing helper that throws if either stops being a number, so coverage is unchanged; the helper is marked for deletion once the type is widened.
2. workers/api/src/lib/connectors/types.ts:111 — JsonSchema.properties[].type is declared string, but draft-07 allows string | string[] and behaviourToolSchema (agent-behaviour.ts:580-602) emits ["number","null"] etc. Nothing catches it because that builder's local is a Record<string, unknown>.

Verification

pnpm typecheck · pnpm vitest run (517 files / 9,039 tests) · biome check --error-on-warnings · design-tokens · agents-allowlist · qa-config · file-size · migrations --require-history · surface-lock --require-history · test-isolation · bare-catch · docs:drift · pnpm test:e2e (405 passed, chromium + webkit). All re-run after rebasing onto origin/main. CI green on 6d44ac7.