chore: run the orphaned migration-safety test, and stop publishing real-looking ids

One of the eight script tests was reachable from no entrypoint, so it had
never run in CI — it passes, it was simply never invoked. This is the second
time that hand-maintained list has drifted from the files beside it; the
audit runner's own header records the first. The guard against a third is a
`check:*` script rather than a test, because the runner derives its list
from that namespace and so picks the guard up by name — a test would have
had to be hand-added to the very list it guards.

A published spec sat outside the generator's manifest and so outside its
drift check, and carried six example ids with the texture of real generated
ones rather than the pandigital placeholders the rest of the repo uses. The
new check globs the directory instead of reading the manifest, since the
manifest is what omitted the file. The one pre-existing borderline id is
allowlisted with a reason: loosening the threshold to admit it would have
hidden one of the six.

Author: waleedlatif1

apps/docs/openapi-core.json

@@ -211,7 +211,7 @@
             "description": "Comma-separated block-output selectors. A bare `blockId` returns that block's full output; a dot-path like `blockId.field` or `blockId.nested.path` returns just that value. Results are returned in the `blockOutputs` map keyed by the selector string.",
             "schema": {
               "type": "string",
-              "example": "c1b90bce-8a82-42a5-b6a5-5762846c2eaf,c1b90bce-8a82-42a5-b6a5-5762846c2eaf.waitDuration"
+              "example": "a6f0c8d2-3e57-4b19-8d4a-1c9e2f6b0a35,a6f0c8d2-3e57-4b19-8d4a-1c9e2f6b0a35.waitDuration"
             }
           }
         ],
@@ -227,8 +227,8 @@
                   "completed": {
                     "summary": "Completed run",
                     "value": {
-                      "executionId": "9254f1c9-5a11-4a12-91e3-8065293f3609",
-                      "workflowId": "81f661e1-d704-4861-b5c1-5bb3cf57e6a7",
+                      "executionId": "e4f8d2b6-9a1c-4e3d-8b7f-5c0a2d9e6f13",
+                      "workflowId": "3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36",
                       "status": "completed",
                       "trigger": "api",
                       "level": "info",
@@ -247,8 +247,8 @@
                   "paused": {
                     "summary": "Currently paused run",
                     "value": {
-                      "executionId": "772749f6-ee81-414c-a2c3-671549dd62b8",
-                      "workflowId": "81f661e1-d704-4861-b5c1-5bb3cf57e6a7",
+                      "executionId": "d5e1a3c7-8f60-4b29-9c4d-2a6e0f8b3d17",
+                      "workflowId": "3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36",
                       "status": "paused",
                       "trigger": "manual",
                       "level": "info",
@@ -259,8 +259,8 @@
                         "pausedAt": "2026-05-15T22:25:57.216Z",
                         "resumeAt": "2026-05-16T18:25:57.200Z",
                         "pauseKind": "time",
-                        "blockedOnBlockId": "c1b90bce-8a82-42a5-b6a5-5762846c2eaf",
-                        "pausedExecutionId": "438bf05b-bd3c-4011-b78e-b19c112eeb66",
+                        "blockedOnBlockId": "a6f0c8d2-3e57-4b19-8d4a-1c9e2f6b0a35",
+                        "pausedExecutionId": "9d3b7f10-2c8e-4a56-b0f4-6e1a8c5d2b97",
                         "pausePointCount": 1,
                         "resumedCount": 0
                       },
@@ -275,8 +275,8 @@
                   "failed": {
                     "summary": "Failed run",
                     "value": {
-                      "executionId": "3ccfdeed-a63c-4e86-98e2-8bec723bca52",
-                      "workflowId": "81f661e1-d704-4861-b5c1-5bb3cf57e6a7",
+                      "executionId": "b8c2e60f-1a47-4d35-9e8b-3f0d5a7c2e19",
+                      "workflowId": "3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36",
                       "status": "failed",
                       "trigger": "api",
                       "level": "error",
@@ -1537,12 +1537,12 @@
           "executionId": {
             "type": "string",
             "description": "The unique identifier of the execution.",
-            "example": "9254f1c9-5a11-4a12-91e3-8065293f3609"
+            "example": "e4f8d2b6-9a1c-4e3d-8b7f-5c0a2d9e6f13"
           },
           "workflowId": {
             "type": "string",
             "description": "The unique identifier of the workflow.",
-            "example": "81f661e1-d704-4861-b5c1-5bb3cf57e6a7"
+            "example": "3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36"
           },
           "status": {
             "type": "string",
@@ -1610,12 +1610,12 @@
                 "type": "string",
                 "nullable": true,
                 "description": "The block currently blocking resume.",
-                "example": "c1b90bce-8a82-42a5-b6a5-5762846c2eaf"
+                "example": "a6f0c8d2-3e57-4b19-8d4a-1c9e2f6b0a35"
               },
               "pausedExecutionId": {
                 "type": "string",
                 "description": "ID of the paused-execution row, useful for cross-referencing with the human-in-the-loop endpoints.",
-                "example": "438bf05b-bd3c-4011-b78e-b19c112eeb66"
+                "example": "9d3b7f10-2c8e-4a56-b0f4-6e1a8c5d2b97"
               },
               "pausePointCount": {
                 "type": "integer",
@@ -1659,8 +1659,8 @@
             "description": "Per-block outputs keyed by the selector string. Returned only when `?selectedOutputs` is set.",
             "additionalProperties": true,
             "example": {
-              "c1b90bce-8a82-42a5-b6a5-5762846c2eaf.waitDuration": 60000,
-              "c1b90bce-8a82-42a5-b6a5-5762846c2eaf.status": "completed"
+              "a6f0c8d2-3e57-4b19-8d4a-1c9e2f6b0a35.waitDuration": 60000,
+              "a6f0c8d2-3e57-4b19-8d4a-1c9e2f6b0a35.status": "completed"
             }
           }
         }

package.json

@@ -14,12 +14,13 @@
     "dev:sockets": "cd apps/realtime && bun run dev",
     "dev:full": "bunx concurrently -n \"App,Realtime\" -c \"cyan,magenta\" \"cd apps/sim && bun run dev\" \"cd apps/realtime && bun run dev\"",
     "dev:full:capped": "bunx concurrently -n \"App,Realtime\" -c \"cyan,magenta\" \"cd apps/sim && bun run dev:capped\" \"cd apps/realtime && bun run dev\"",
-    "test": "bun run test:setup && bun run test:npm-package-versions && bun run test:icon-path-precision && bun run test:tool-registry-boundary && bun run test:tool-request-boundary && bun run test:generators && turbo run test",
+    "test": "bun run test:setup && bun run test:npm-package-versions && bun run test:icon-path-precision && bun run test:tool-registry-boundary && bun run test:tool-request-boundary && bun run test:migrations-safety && bun run test:generators && turbo run test",
     "test:setup": "bun run --cwd packages/sim-setup test",
     "test:npm-package-versions": "bunx vitest run scripts/bump-npm-package-versions.test.ts",
     "test:icon-path-precision": "bunx vitest run scripts/check-icon-path-precision.test.ts",
     "test:tool-registry-boundary": "bunx vitest run scripts/check-tool-registry-boundary.test.ts",
     "test:tool-request-boundary": "bunx vitest run scripts/check-tool-request-boundary.test.ts",
+    "test:migrations-safety": "bunx vitest run scripts/check-migrations-safety.test.ts",
     "test:generators": "bunx vitest run scripts/generate-v2-cli-api.test.ts scripts/generate-cli-docs.test.ts scripts/generate-docs.test.ts",
     "format": "turbo run format",
     "format:check": "turbo run format:check",
@@ -57,6 +58,8 @@
     "check:migrations": "bun run scripts/check-migrations-safety.ts",
     "check:native-typecheck": "bun run scripts/check-native-typecheck.ts",
     "check:source-text": "bun run scripts/check-source-text.ts",
+    "check:spec-example-ids": "bun run scripts/check-spec-example-ids.ts",
+    "check:script-tests": "bun run scripts/check-script-test-coverage.ts",
     "check:audits": "bun run scripts/run-audits.ts",
     "check:skills": "bun run scripts/sync-skills.ts --check",
     "check:desktop-bridge": "bun run scripts/check-desktop-bridge-contract.ts --check",

scripts/check-script-test-coverage.ts

@@ -0,0 +1,71 @@
+#!/usr/bin/env bun
+/**
+ * Asserts every `scripts/*.test.ts` file is reachable from the root `test` script.
+ *
+ * The root `test` script chains a hand-maintained list of `test:*` entries, and a hand-maintained
+ * list silently drifts from the files on disk: a test added without a matching entry never runs,
+ * in CI or locally, and nothing reports it. `scripts/check-migrations-safety.test.ts` sat
+ * unreferenced and green for exactly that reason.
+ *
+ * `run-audits.ts` derives its own list from the `check:*` namespace precisely so a new audit is
+ * picked up by default, so this guard registers itself simply by being named `check:*` — it cannot
+ * drift out of the runner it belongs to.
+ */
+import { readdirSync } from 'node:fs'
+import path from 'node:path'
+
+const ROOT = path.resolve(import.meta.dir, '..')
+const TEST_FILE_PATTERN = /scripts\/[\w.-]+\.test\.ts/g
+const SUB_SCRIPT_PATTERN = /bun run ([\w:-]+)/g
+
+const manifest = await Bun.file(path.join(ROOT, 'package.json')).json()
+const commands = manifest.scripts as Record<string, string>
+
+/** Walks the `test` script and every `test:*` entry it chains, collecting referenced test files. */
+function reachableTestFiles(entry: string): Set<string> {
+  const referenced = new Set<string>()
+  const seen = new Set<string>()
+  const queue = [entry]
+
+  while (queue.length > 0) {
+    const name = queue.pop() as string
+    if (seen.has(name)) continue
+    seen.add(name)
+
+    const command = commands[name]
+    if (command === undefined) continue
+
+    for (const match of command.matchAll(TEST_FILE_PATTERN)) referenced.add(match[0])
+    for (const match of command.matchAll(SUB_SCRIPT_PATTERN)) queue.push(match[1])
+  }
+
+  return referenced
+}
+
+const onDisk = readdirSync(path.join(ROOT, 'scripts'))
+  .filter((file) => file.endsWith('.test.ts'))
+  .map((file) => `scripts/${file}`)
+  .sort()
+
+const reachable = reachableTestFiles('test')
+const orphaned = onDisk.filter((file) => !reachable.has(file))
+const missing = [...reachable].filter((file) => !onDisk.includes(file)).sort()
+
+if (orphaned.length > 0 || missing.length > 0) {
+  if (orphaned.length > 0) {
+    console.error(
+      `Script tests never run by \`bun run test\`:\n${orphaned.map((file) => `  - ${file}`).join('\n')}\n` +
+        'Add a `test:*` entry for each and chain it into the root `test` script.'
+    )
+  }
+  if (missing.length > 0) {
+    console.error(
+      `Root \`test\` script references script tests that do not exist:\n${missing.map((file) => `  - ${file}`).join('\n')}`
+    )
+  }
+  process.exit(1)
+}
+
+console.log(
+  `Script test coverage passed: ${onDisk.length} script tests reachable from \`bun run test\`.`
+)

scripts/check-spec-example-ids.ts

@@ -0,0 +1,66 @@
+#!/usr/bin/env bun
+/**
+ * Flags example UUIDs in the published OpenAPI specs that do not look deliberately synthetic.
+ *
+ * The specs in `apps/docs/` ship in a public repository, so an example id copied from a real run
+ * publishes an opaque workspace, workflow, or execution identifier. The repo's hand-crafted
+ * placeholders are pandigital — every hex digit appears, none more than three times
+ * (`3b1f7c92-8d4e-4a6b-9c0d-5e2f8a714b36`) — a texture a real v4 UUID essentially never has.
+ * That gives a mechanical signature for "this was generated, not authored".
+ *
+ * The directory is globbed rather than read from `OPENAPI_SPEC_FILES`, because the gap this closes
+ * is precisely that `openapi-core.json` is absent from that manifest and from every other check.
+ */
+import { readdirSync } from 'node:fs'
+import path from 'node:path'
+
+const ROOT = path.resolve(import.meta.dir, '..')
+const SPEC_DIR = path.join(ROOT, 'apps/docs')
+const UUID_PATTERN = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g
+
+/** Ids that are obviously synthetic to a reader but do not match the pandigital texture. */
+const ALLOWED: Record<string, string> = {
+  '7c9e6679-7425-40de-944b-e07fc1f90ae7': "Wikipedia's canonical example UUID",
+  'a3f1c0b2-7a44-4c1d-9d3a-2b8e5f0a1c77':
+    'pre-existing hand-authored block id shared with the v2 workflow operations tests',
+}
+
+/** All-zero and all-f sentinels read as synthetic on sight. */
+function isSentinel(uuid: string): boolean {
+  return new Set(uuid.replace(/-/g, '')).size <= 2
+}
+
+/** Hand-authored placeholders in this repo use every hex digit, none more than three times. */
+function isHouseStyle(uuid: string): boolean {
+  const hex = uuid.replace(/-/g, '')
+  const digits = new Set(hex)
+  if (digits.size < 16) return false
+  return [...digits].every((digit) => hex.split(digit).length - 1 <= 3)
+}
+
+const specFiles = readdirSync(SPEC_DIR)
+  .filter((file) => file.startsWith('openapi') && file.endsWith('.json'))
+  .sort()
+
+const findings: string[] = []
+
+for (const file of specFiles) {
+  const contents = await Bun.file(path.join(SPEC_DIR, file)).text()
+  const seen = new Set(contents.match(UUID_PATTERN) ?? [])
+  for (const uuid of [...seen].sort()) {
+    if (uuid in ALLOWED || isSentinel(uuid) || isHouseStyle(uuid)) continue
+    findings.push(`  - ${file}: ${uuid}`)
+  }
+}
+
+if (findings.length > 0) {
+  console.error(
+    `Published OpenAPI specs contain example UUIDs that look real rather than hand-authored:\n${findings.join('\n')}\n` +
+      'Replace each with a placeholder using every hex digit at most three times, or add it to ALLOWED with a reason.'
+  )
+  process.exit(1)
+}
+
+console.log(
+  `Spec example ids passed: ${specFiles.length} published specs contain no real-looking UUIDs.`
+)