feat(oxc): dogfood the assembled quality stack (sc-1681)

[norvalbv]

Summary

Dogfood the assembled Oxc quality stack inside Devkit itself after the capability and anti-slop baseline work in #401.

• make self-host init/upgrade/doctor own Oxc and anti-slop as recorded capabilities
• run anti-slop against the exact staged Git index in pre-commit, including staged config, managed plugin, and baseline bytes
• enforce base-to-candidate baseline monotonicity in CI, with only a one-time bootstrap exception and durable same-commit handling for Git renames
• commit Devkit's generated managed Oxc/anti-slop state and deterministic 1,677-finding / 1,543-fingerprint baseline
• recommend the official Oxc editor extension while keeping CLI/CI authoritative
• save the reproducible assembled-stack benchmark, raw samples, diagnostic ownership table, and migration rationale

Why this is a mixed stack

The preceding parity studies found responsibilities that should not move merely to reduce process count:

• Oxfmt owns formatting.
• Biome owns JS/TS/JSON/CSS lint and assist diagnostics.
• Oxlint owns the 15 vendored anti-slop rules.
• ESLint owns filesystem topology, Electron topology, empty-directory checks, and import walls.
• tsc owns TypeScript 6 diagnostics and JavaScript build emission.

This PR adds no duplicate lint responsibility: the managed Oxlint base enables only anti-slop, Biome formatting is disabled, and ESLint is topology-only.

Exact staged and baseline semantics

anti-slop check --staged materializes git write-tree into a temporary mirror. It therefore evaluates staged source postimages—not working-tree bytes—and also sees the staged root config, managed config/plugin, package metadata, lockfile, and baseline. Config or baseline changes force a full scan; unrelated staged files no-op.

CI uses anti-slop check --base "$ANTI_SLOP_BASE". Candidate baseline counts may only shrink relative to the merge base. A repository with no base baseline gets the sole bootstrap exception. A debt-bearing Git rename must persist the regenerated baseline in the same commit; checks reject a stale old-path fingerprint, then verify the new-path count did not grow. Adding a violation and enlarging the baseline still fails.

Benchmark

Saved at docs/benchmarks/experiments/2026-08-16-oxc-devkit-dogfood/ with the harness, raw 10-sample results, host/runtime provenance, exact measurement tree, and interpretation.

Supported Node 24.19 / Apple M4 results:

Lane	Metric	Control median	Candidate median	Delta
local deterministic quality segment	CPU	10.500 s	10.190 s	-3.0%
local deterministic quality segment	wall	5.344 s	5.436 s	+1.7%
local deterministic quality segment	process-tree RSS	218.4 MiB	212.5 MiB	-2.7%
full repository static-quality segment	CPU	8.335 s	11.620 s	+39.4%
full repository static-quality segment	wall	2.236 s	3.737 s	+67.1%
full repository static-quality segment	process-tree RSS	469.4 MiB	500.1 MiB	+6.5%

The hot agent loop is effectively CPU-neutral/slightly better while adding all 15 anti-slop rules. The full CI lane is intentionally heavier because it adds a second full-tree policy family, a separate format check, and typechecks the vendored source. That is a costed compatibility boundary, not evidence for removing Biome, ESLint, or tsc. Frink must repeat the assembled benchmark on its own staged and full scopes before adoption.

Validation

• bun run format:check — 573 files, green
• bun run lint — 575 files, green
• bun run lint:structure — green
• bun run typecheck — green
• bun run benchmarks:check -- --mode staged — green
• node cli/index.mts anti-slop check --staged — 1,677 current findings, 0 ready to prune
• focused unit/integration tests — 71/71 pre-review plus 14/14 reviewer-fix regressions green
• packed anti-slop E2E — 7/7 green, including partial staging, baseline laundering, CI base comparison, durable rename persistence, and a post-merge check
• pre-review full suite — 221 files passed / 1 skipped; 3,847 tests passed / 5 skipped
• post-review full rerun — 220 files and 3,850 tests passed; one unrelated husky-block-exec parallel-load assertion failed, then passed 1/1 isolated
• GitHub CI — every static gate, including the new merge-base anti-slop step, passed; the test step hit active SC-1711 (ship receipt ref timing) and its exact test passed 1/1 isolated locally
• manual self-host doctor — managed Oxc/anti-slop, baseline, hook, and runner checks green
• final GitNexus staged analysis — 72 files, 36 indexed symbols, 9 affected processes, HIGH as expected for self-host init/doctor paths; all affected direct paths are covered above

Merge order

This PR targets codex/sc-1676-anti-slop-baselines (#401), which targets the Oxfmt adoption in #400. The evidence-only responsibility studies are #397, #398, and #399. Merge/retarget in epic order.

Shortcut: SC-1681

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 72db3d65-b43f-46f1-9aac-67a77e29df4d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}