T2: [Tooling] CI hardening — npm cache, drop lockfile fallback, pin node, type-checked eslint, noImplicitOverride

[curtyo18]

Summary

Five small improvements to the CI workflow and TypeScript/ESLint configuration. Bundled because they're all one-line PR-sized changes in the build infrastructure.

A. actions/setup-node@v4 without cache: 'npm' (.github/workflows/ci.yml:13-16)

Every CI run re-downloads the full dep tree. Minor cost, big speedup.

B. Lockfile fallback hides real failures (.github/workflows/ci.yml:17-23)

if [ -f package-lock.json ]; then npm ci; else npm install; fi

The lockfile IS checked in. If it goes missing in a PR, CI silently runs npm install (which can resolve different transitive versions than ci would). Drop the branch and just run npm ci so a missing lockfile fails loudly.

C. Node version pinning (.github/workflows/ci.yml:14-15)

node-version: '22' resolves to the latest 22.x at run time. Pinning to 22.x or to a specific minor (22.11.0) makes the build reproducible. Either is fine; the current form means a Node 22.x point release can break CI without a commit.

D. ESLint type-checked rules disabled (eslint.config.js:1-26)

The TypeScript-ESLint integration uses the plugin/parser but enables no type-checked rules (no projectService, no recommendedTypeChecked). Critical rules like no-floating-promises, no-misused-promises, await-thenable, no-unsafe-* are off. For an async-heavy engine that spawns workers and orchestrates filesystem batches, no-floating-promises alone catches a real class of bugs.

E. tsconfig missing noImplicitOverride (tsconfig.base.json:7-19)

errors.ts:3 already uses override and the codebase has class inheritance. Without noImplicitOverride: true, a future override omission on a subclass method silently shadows instead of overriding.

Background

From the 2026-05-17 multi-agent full-repo review.

Acceptance criteria

A. npm cache

• .github/workflows/ci.yml: add cache: 'npm' to the actions/setup-node@v4 with: block.
• CI run times measurably reduced (capture before/after in PR description).

B. Drop lockfile fallback

• Replace the if-block with just npm ci.
• A missing lockfile is a fail-loudly condition; if dependabot or a PR drops the lockfile by mistake, CI catches it.

C. Pin node version

• Pick: '22.x' (allow latest 22) OR '22.11.0' (exact pin; bumped manually via dependabot or maintainer). Document the choice.

D. Type-checked ESLint rules

• Enable projectService: true in the parser options (TypeScript-ESLint 8+ pattern).
• Enable tseslint.configs.recommendedTypeChecked (or its rule equivalents).
• Address any new lint failures: most likely no-floating-promises in tests using void casts. Apply minimal fixes per finding rather than mass-disabling.
• CI fails loudly if a new floating-promise is introduced.

E. noImplicitOverride

• tsconfig.base.json: add "noImplicitOverride": true.
• Address any compile errors (likely zero; the only inheritance is in errors.ts which already uses override).

Files affected (likely)

• .github/workflows/ci.yml
• eslint.config.js
• tsconfig.base.json
• Possibly multiple .ts files if D surfaces floating-promise / misused-promise issues

Suggested approach

Order: E, A, C, B (each one-line) → D last (may surface lint issues across the codebase that need triage). Split D into its own PR if the lint cleanup is non-trivial.

Out of scope

• Matrix CI (Node 22 + 24 simultaneously) — could be a follow-up; not required.
• Adding Windows/macOS CI runners — README's primary-target argument; deferred.
• Caching node_modules directly (the cache: 'npm' pattern is the canonical solution).

References

• Code: .github/workflows/ci.yml, eslint.config.js, tsconfig.base.json
• Standards: standards/coding-standards.md, standards/dependency-discipline.md