ci: wire coco-dev-versions and import-specifier checks into the workflow

[bitfathers94]

ci: wire coco-dev-versions and import-specifier checks into the workflow

Both checks live in test:ci but no GitHub Actions job ran either, so
each could silently diverge with zero CI signal -- the same
local-only-until-now gap the surrounding drift steps close.

Add a named coco-dev-versions:check step gated on a new cocoDev
path filter (k8s/coco-dev/**, scripts/check-coco-dev-versions*.ts) plus
the push clause, and a named import-specifiers:check step gated on
backend or any packages/* workspace filter (mcp/engine/miner/
discoveryIndex), mirroring the checker's BUNDLER_ROOTS/NODENEXT_ROOTS.

Also add a real-tree regression assertion to the import-specifier test
so the guard is enforced by vitest, not the workflow step alone -- the
gap that let two specifier drifts reach main after the guard shipped.

Closes #9649

[loopover-orb]

Caution

🛑 LoopOver review result - reject/close recommended

_{Review updated: 2026-07-29 19:46:24 UTC}

2 files · 1 AI reviewer · 1 blocker · CI green · clean

🛑 Suggested Action - Reject/Close

Review summary
This PR wires two previously CI-invisible checks (import-specifier drift and coco-dev version drift) into ci.yml and adds a real-tree regression test for the import-specifier checker so vitest itself enforces the guard. The import-specifier step is correctly gated (backend/mcp/engine/miner/discoveryIndex are all already part of validate-code's job-level `if`), and the new regression test passed in this run's CI. However, the new `cocoDev` output is never added to `validate-code`'s own job-level `if:` condition, so the new 'Coco-dev versions drift check' step — despite its correct step-level gate — will never execute on a PR that touches only k8s/coco-dev/** files, which is precisely the scenario this PR set out to fix.

Blockers

• validate-code's job-level `if:` was not updated to include `needs.changes.outputs.cocoDev`, so a PR touching only k8s/coco-dev/** skips the entire job and the new 'Coco-dev versions drift check' step never runs on that PR despite its own step-level gate.

Nits — 4 non-blocking

• The new real-tree regression test (test/unit/check-import-specifiers-script.test.ts) has no injected fixtures, so it's coupled to whatever the repo tree looks like at any given time -- intentional per the stated mirroring of existing tests, but worth a one-line note that an unrelated future file addition could trip it.
• The import-specifier step's gate list (backend/mcp/engine/miner/discoveryIndex) omits `ui`/`uiContract` -- worth confirming packages/loopover-ui-kit truly has no NodeNext-resolved relative imports the checker would ever need to scan.
• Add `needs.changes.outputs.cocoDev == 'true'` to validate-code's job-level `if:` (.github/workflows/ci.yml, the `validate-code:` job definition) so a coco-dev-only PR still triggers the job and its new step.
• Consider a follow-up comment near the job-level `if:` noting that any new step-level filter output added below it must also be added here, since this is exactly the class of gap this PR itself fixed for the two `test:ci` checks.

Why this is blocked

• validate-code's job-level `if:` was not updated to include `needs.changes.outputs.cocoDev`, so a PR touching only k8s/coco-dev/** skips the entire job and the new 'Coco-dev versions drift check' step never runs on that PR despite its own step-level gate.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. validate-code's job-level \`if:\` was not updated to include \`needs.changes.outputs.cocoDev\`, so a PR touching only k8s/coco-dev/\*\* skips the entire job and the new 'Coco-dev versions drift check' step never runs on that PR despite its own step-level gate.

Decision drivers

• ❌ Code review — 1 blocker (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9649
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 94 registered-repo PR(s), 65 merged, 1 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bitfathers94; Gittensor profile; 94 PR(s), 1 issue(s).
Improvement	ℹ️ Insufficient signal	risk: clean · value: insufficient-signal · LLM: moderate

Linked issue satisfaction

Addressed
The diff adds the cocoDev path filter and gated coco-dev-versions:check step, adds a similarly gated import-specifiers:check step covering backend/mcp/engine/miner/discoveryIndex, and adds a real-tree regression test in check-import-specifiers-script.test.ts asserting findImportSpecifierViolations() returns [] with a comment citing #9240/#9249, matching all stated deliverables and required pattern

Review context

• Author: bitfathers94
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 94 PR(s), 1 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.76%. Comparing base (38e37ec) to head (3384ae8).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9894   +/-   ##
=======================================
  Coverage   91.76%   91.76%           
=======================================
  Files         921      921           
  Lines      113175   113175           
  Branches    27245    27245           
=======================================
  Hits       103856   103856           
  Misses       8034     8034           
  Partials     1285     1285           

Flag	Coverage Δ
backend	95.68% <ø> (ø)
control-plane	100.00% <ø> (ø)
rees	89.62% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[loopover-orb]

LoopOver is closing this pull request on the maintainer's behalf (AI review flagged a likely critical defect: validate-code's job-level `if:` was not updated to include `needs.changes.outputs.cocoDev`, so a PR touching only k8s/coco-dev/** skips the entire job and the new 'Coco-dev versions drift check' step never runs on that PR despite its own step-level gate.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.