fix: enforce consolestderr on wasm and guard native/wasm CI parity

[pelikhan]

Summary

Fixes #67609.

• Mirror the dedicated consolestderr -test=false CI step on WebAssembly, using the existing wasm package scope.
• Parse the custom-linter job's YAML and compare native and wasm analyzer sets, including both bulk and dedicated steps. Keep the registry guard without its brittle hard-coded step count.
• Explicitly track the pre-existing native-only contextcancelnotdeferred exception from contextcancelnotdeferred still enforced on native CI only - wasm LINTER_FLAGS omission unfixed (issue 55932 auto-expired, 2nd oc #65753, rejecting stale exceptions once parity is restored.
• Ignore full-line shell comments in block-scalar commands before scanning target assignments and analyzer flags. Retain the production parity guard and a small standalone parser regression without exact workflow-format preconditions. Update the linter design notes.

Validation

• go test ./pkg/linters -count=1
• consolestderr -test=false against the native production package set and the existing wasm package set
• go run github.com/rhysd/actionlint/cmd/actionlint -shellcheck= -pyflakes= .github/workflows/cgo.yml
• PATH="/opt/homebrew/bin:$PATH" make agent-report-progress (initial publication: build, changed-package lint, impacted tests, and workflow drift guard all passed; 337 workflows compiled successfully)

Full make fmt completed Go formatting but encountered an unrelated existing JavaScript formatter error in testdata/copilot_sdk_web_fetch_contract.json (convertToJson is not defined). Incidental formatting changes outside this issue were removed.

[github-actions]

🔎 PR Code Quality Reviewer is reviewing code quality for this pull request...

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Generated by Ponytail Reviewer for #67634

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

One opportunity to make this smaller.

net: -95 lines possible.

Generated by ✂️ Ponytail Reviewer for #67634 · codex · gpt56 · 6.71 AIC · ⌖ 5.22 AIC · ⊞ 13.5K
_{Comment /ponytail to run again}

[Copilot]

🟡 Changes recommended

Block-scalar shell comments can still be misclassified as active linter enforcement.

1 open finding

• Commented-out shell assignments are treated as active enforcement · New

What changed in this PR

Adds WebAssembly enforcement for consolestderr and guards native/WASM linter parity.

Changes:

• Adds the dedicated WASM lint step.
• Parses CI YAML to compare analyzer sets.
• Adds parity regression tests and documentation.

File	Description
.github/​workflows/​cgo.yml	Adds WASM consolestderr enforcement.
pkg/​linters/​doc_sync_test.go	Implements target-parity validation.
pkg/​linters/​ci_sync_test.go	Adds regression scenarios.
pkg/​linters/​README.md	Documents parity policy and exception.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (>100 new lines in pkg/) but does not have a linked Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/67634-enforce-native-wasm-linter-parity-in-ci.md — review and complete it before merging.

🔒 This PR cannot merge until an ADR is linked in the PR body.

📋 What to do next

1. Review the draft ADR committed to your branch — it was generated from the PR diff (.github/workflows/cgo.yml, pkg/linters/ci_sync_test.go, pkg/linters/doc_sync_test.go, pkg/linters/README.md)
2. Complete the missing sections — add context the AI couldn't infer, refine the decision rationale, and list real alternatives you considered
3. Commit the finalized ADR to docs/adr/ on your branch
4. Reference the ADR in this PR body by adding a line such as:

   ADR: ADR-67634: Enforce Native/WebAssembly Custom-Linter Parity via YAML-Parsing CI Sync Tests

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

🔍 Decision inferred from the diff

• Decision: Enforce native/wasm analyzer parity by parsing the custom-linter job in cgo.yml and comparing combined bulk + dedicated analyzer sets per target, replacing the hard-coded step-count guard; mirror consolestderr -test=false onto wasm.
• Driver: consolestderr was native-only, so wasm-only regressions escaped CI (consolestderr (78th linter) CI-enforced on native only - omitted from the wasm custom-linters run (ci_target_asymmetry recurrenc #67609); the step-count guard was brittle and blind to analyzer drift.
• Alternatives visible from the diff: (a) add the missing wasm step and bump the step count, (b) generate CI linter flags from the analyzer registry, (c) collapse to a single cross-target invocation.
• Consequences: catches per-target enforcement gaps early and removes a flaky guard, at the cost of coupling tests to workflow YAML formatting and a manually maintained native-only exception list (contextcancelnotdeferred still enforced on native CI only - wasm LINTER_FLAGS omission unfixed (issue 55932 auto-expired, 2nd oc #65753).

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

• Context — What is the problem? What forces are at play?
• Decision — What did you decide? Why?
• Alternatives Considered — What else could have been done?
• Consequences — What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · opus50 · 38.2 AIC · ⌖ 45 AIC · ⊞ 1.8K · ◷
_{Comment /review to run again}

[github-actions]

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 36.2 AIC · ⌖ 5.57 AIC · ⊞ 21.2K
_{Comment /review to run again}

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd to this CI-parity fix. The change is well-scoped and well-tested — no actionable issues found.

📋 Verification performed

• Ran go test ./pkg/linters -run 'TestCIEnforcedLinter' -v -count=1: all three tests pass (TestCIEnforcedLinterTargetDrift, TestCIEnforcedLintersMatchTargets, TestCIEnforcedLintersMatchRegistry).
• Ran go test ./pkg/linters -count=1: full package passes.
• gofmt -l and go vet ./pkg/linters/... are clean on the new/modified test files.
• actionlint on .github/workflows/cgo.yml reports no errors.
• Verified the new consolestderr (wasm) step uses the same LINTER_PACKAGES scope as the existing wasm bulk step, so parity is scoped correctly.

Why this is a solid fix (per /diagnosing-bugs)

• Root cause addressed, not just symptom: rather than only adding the missing wasm step (the proximate bug from #67609), the PR adds a generic TestCIEnforcedLintersMatchTargets regression test that structurally parses cgo.yml's lint-go-custom job and diffs native vs. wasm analyzer sets — this prevents the class of bug (native/wasm drift), not just this one instance.
• The notYetEnforced/nativeOnly exception maps require non-empty reasons and are asserted to go stale once parity is restored ("restored parity makes native exception stale" test case), which avoids exceptions silently living forever.

Strong test coverage (per /tdd)

• ci_sync_test.go's table-driven TestCIEnforcedLinterTargetDrift covers meaningful edge cases: missing dedicated step on each target, bulk-flag drift on each target, restored parity, GOOS/GOARCH expressed via step env: instead of inline, single- vs double-quoted LINTER_FLAGS, and commented-out steps not counting as enforcement. These are exactly the cases that would have silently reintroduced the original drift.
• The regex widening (LINTER_FLAGS=["']([^"']+)["']) and the YAML-based step/env parser in parseCIEnforcedLinterSets are more robust than the previous brittle string-count assertion it replaces.

No blocking concerns. Nit (non-blocking): ci_sync_test.go and doc_sync_test.go both locally reimplement similar YAML-based CI workflow parsing — if more CI-sync tests are added later, consider consolidating parseCIEnforcedLinterSets and its workflow struct into a small shared test helper file to keep the two files from drifting apart in how they interpret cgo.yml.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 69.6 AIC · ⌖ 14.5 AIC · ⊞ 10.3K
_{Comment /matt to run again}