Make each tm- workflow's meta a literal first statement

[sv-tmueller]

Part of batch #423

What to build

The Workflow runtime refuses all three tm- workflows (tm-review-changes, tm-review-codebase, tm-map-codebase), by name and by path. Each file builds export const meta from SPEC and TIER_MODELS, and const SPEC comes before it. The runtime needs meta to be a plain literal and the first statement in the script. #405 hit this first, and #406's live run (PR #419) hit it again; both worked around it with a hand-modified copy. The installed 2.9.0 plugin ships the same code, so the slash commands likely fail to load as shipped.

Make meta a plain literal and the first statement in each of the three files. It carries the same content as today: name, description, and each phase's title, detail and model. Nothing outside the runtime reads meta.

Add a test that reads each workflow file and checks three things:

• meta is the first statement.
• meta evaluates in an empty node:vm context, which proves it has no outside references.
• meta deep-equals the value SPEC produces today (name, description, and each phase's title, detail and model), so a SPEC edit without a matching meta edit fails CI.

The architect picks whether the literal copies SPEC or SPEC reads its phases from meta. The sync test is required either way.

Live run (lead step, after the tester passes). The lead runs the branch's tm-review-changes.js once, by path and unmodified, on this PR's own diff, and records in the PR body that it loaded, plus cost and wall-clock time. The owner approved this run (about $2, about 3.5 minutes last time) at batch sign-off on 2026-10-01.

Acceptance criteria

• In all three tm- workflow files, export const meta is the first statement and a plain literal, with no identifiers, calls or interpolation.
• A new test fails on today's main and passes after the fix. It checks position and evaluates the literal in an empty vm context.
• The test checks that each meta deep-equals the value SPEC produces (name, description, and each phase's title, detail and model).
• The lead's live run of the unmodified branch file loads. The PR body records that it loaded, plus cost and wall-clock time.
• npm test passes, and the version in .claude/.claude-plugin/plugin.json is bumped.

Non-goals

• Changing any stage, prompt or SPEC content.
• Live runs of tm-review-codebase and tm-map-codebase. Each fans out over the whole repo and costs much more. The refusal happens when the file loads, so the static test covers both.
• Porting the verify stage to tm-review-codebase (review agent orchestration #344 P2, next batch).

[sv-tmueller]

Sub-plan (architect, batch #423)

SUB_PLAN

Delta against the plan (the batch #423 signed-off contract, package 1, carried verbatim in #424's body). Size check: fits size:S. The work is three small meta moves of about 15 lines each, one new test file of about 60 lines, and a one-line version bump.

Decision the plan left to the architect: meta is a literal copy, and SPEC stays exactly as it is. The other option (SPEC reads its phases from meta) does not work, for three reasons:

• Three tests evaluate const SPEC = {...} alone in an empty vm context. A SPEC that refers to meta would throw a ReferenceError in all of them:
  • parseSpecFromJs in specs.test.mjs
  • parseSpec in render-path.test.mjs
  • parseSpec in effort-policy.test.mjs
• meta holds model and SPEC holds tier. You can't work back from model to tier, because judgment and lead both map to opus.
• The non-goals rule out any change to SPEC content.

Leading-comment risk: avoided, not tested. Each file starts at byte 0 with export const meta = {.

• The 6-line "Workflow spec (embedded...)" header moves down, unchanged, to sit directly above const SPEC.
• The literal has no comments inside it. The one in tm-review-changes.js ("meta.phases carries the model for display purposes") moves into a comment after the literal.
• Add one short comment after meta: it is a literal first statement because the runtime requires it, it repeats SPEC's name, description and phases with each tier resolved through TIER_MODELS, and the new test fails if the two drift. The comment must not contain the word "fable" (the raw-source guard in effort-policy.test.mjs scans whole files).
• The test enforces byte 0, so no file can drift to a shape the live run did not check. That is also why one live run of tm-review-changes covers the other two files.
• Whether the runtime accepts a header comment above meta stays an open question. Relaxing the check later needs its own live check.

Test additions: new file .claude/workflows/__tests__/workflow-meta.test.mjs.

• Which files: list the workflow .js files with readdirSync, not a fixed list, so a fourth workflow can't skip the check. Every workflow script has to load.
• Position: src.startsWith('export const meta = {').
• Empty-vm evaluation: brace-match the literal and run '(' + literal + ')' in createContext({}).
• Plain-literal check (the one real addition): evaluating in an empty context does not prove "no calls". [...].map(...), Object.freeze({...}) and template literals with no ${} all run fine there, because the builtins are always present. So after evaluating:
  • remove the quoted strings from the literal,
  • remove identifier: keys,
  • assert what remains matches /^[\s{}\[\],]*$/.
    This catches identifiers used as values, calls, arrows, spreads, template literals and comments. It is how acceptance criterion 1 gets a test.
• Sync check:
  • Build the expected value from the same file: SPEC and TIER_MODELS sliced the way the existing tests do. Expected is { name, description, phases: SPEC.phases.map(p => ({ title, detail, model: TIER_MODELS[p.tier] })) }.
  • Pass both sides through a JSON round-trip before assert.deepStrictEqual. Objects built by vm come from another realm, so deepStrictEqual fails on them otherwise (specs.test.mjs notes the same problem).
  • Together with the existing checks (SPEC against the JSON spec in specs.test.mjs, TIER_MODELS against the adapter table in effort-policy.test.mjs), this links meta all the way to the adapter table.
• Brace matching and string removal are safe today. I evaluated the current meta values, and none of their strings contain braces, quotes or backticks.

File order:

1. Commit 1 (test:) adds only the new test, and it fails on the current files. Keeping it a separate commit lets the tester show "fails on today's main" by running that commit in a scratch worktree.
2. Commit 2 (fix:) changes the three workflow files:
   • .claude/workflows/tm-review-changes.js
   • .claude/workflows/tm-review-codebase.js
   • .claude/workflows/tm-map-codebase.js
     It also bumps .claude/.claude-plugin/plugin.json from 2.9.0 to 2.9.1 (patch, since this is a fix). Copy the literal values from what the current meta evaluates to; don't retype them. Keys keep today's order: name, description, phases; then title, detail, model.
3. npm test passes, then a draft PR. The developer stops there; the live run is the lead's step.

What constrains the change (checked, no edits needed):

• criticWithFallback, safeRef and parseArgs stay byte-identical (helpers.test.mjs slices them by name, so their position doesn't matter). Don't touch them.
• render-path.test.mjs and review-changes-verify.test.mjs turn export const into const and wrap the whole file in a function, so they still work with meta first.
• The PROMPTS slicing in prompts-sync.test.mjs, and the TIER_MODELS/TIER_EFFORTS slicing in effort-policy.test.mjs, are not affected.
• TIER_MODELS stays in use: each file still uses it in 4 or 5 agent() calls.
• Nothing outside the runtime reads meta. The .meta.json references in token-report.mjs are sidecar files, a different thing.

Live run: if the lead's run of the unchanged branch file is still refused, the refusal text goes back to the developer as a fix round. The position and literal checks are then tightened to match whatever the runtime rejected.

Conflicts with docs/architecture/: none. adapter-interface.md ("Spec format") covers only the JSON spec and SPEC, and both stay as they are, so no doc edit is needed. One side effect to know about: changing a tier's model now also means editing the three meta literals. The new test names the file that drifted.

Merge note: this should merge first among the three packages, so it takes 2.9.1. Package 3 (#407) edits PROMPTS in the same two review workflows. That is a different region of the files, so it only needs a rebase.

[sv-tmueller]

Package summary (batch #423): PR #426 ready for review

• Pipeline: architect sub-plan (delta: meta is a literal copy, SPEC stays as it is; byte-0 position enforced); developer DONE, no deviations; tester PASS at 1afc284 with 16 mutations caught and named by file; lead live run; reviewer APPROVE (both passes clean). No fix rounds.
• Checks at 1afc284: npm test 477 pass, 0 fail; node scripts/check-version-bump.mjs origin/main HEAD exit 0 (2.9.0 -> 2.9.1); CI green (unit tests, version bump guard). The new test fails on main (9 of 10).
• Live run (acceptance criterion 4): the runtime loaded the branch's tm-review-changes.js unmodified, by path, on the first try (run wf_170be40a-a33). Approve, 0 must-fix, 3 nits dismissed, $1.23 list price (undercount, output estimated), 136,708 ms measured. Details in the PR body and batch Batch: follow-ons-from-417 #423 Decision 3.
• Should-fix: none.
• Nits for the human review: (1) the "display purposes" comment now sits after meta in all three files with an added "only", which nobody checked, and the original's first sentence ("The adapter table resolves the tier to a concrete model for the Claude Code host.") was dropped; the reviewer suggests the original wording without "only". (2) Commit 1afc284's body says a computed meta "is not read reliably", but the runtime refuses to load the file; fix it in the squash message.
• Untested: whether the runtime accepts a header comment above meta. The test requires byte 0 by design, so that question stays open.
• Merge note: merge this first among the batch's PRs (2.9.1). PR feat: add severity floor to review prompts #428 (Auto-must-fix severity floor in review prompts #407) and PR fix: token report prices Sonnet 5.5 and uses the lead's real output tokens #427 (Token report: price Sonnet 5.5 and use the lead's real output tokens #425) then rebase their plugin.json line. The Auto-must-fix severity floor in review prompts #407 tester's scratch merge with this branch conflicted only on that line.