Gate the workspace manifest dependency graph against cycles

.github/workflows/lint.yml

@@ -3628,6 +3628,39 @@ jobs:
       - name: turbo.json package tasks name real packages and real scripts
         run: pnpm check:turbo-task-graph
 
+      # The workspace manifest graph, over every `workspace:` edge in
+      # `dependencies`, `devDependencies`, `peerDependencies` and
+      # `optionalDependencies` across all workspace packages, has NO cycle
+      # (#13513, filed as #14195).
+      #
+      # #13513 cost seven independent dev seats a wasted build cycle each, on
+      # trees they did not touch, because one `devDependencies` edge made the
+      # graph cyclic. A cyclic edge does not fail where it is added -- the
+      # author's own package builds fine -- it fails later, in SOMEONE ELSE's
+      # closure build, in a package they did not touch, non-deterministically
+      # (which member loses the DTS race is a scheduling outcome). Before this
+      # gate the only signal was `pnpm install` printing `WARN There are
+      # cyclic workspace dependencies: …` on stderr with EXIT 0, and it had
+      # been printing that warning for the entire life of the #13513 defect
+      # before anyone read it.
+      #
+      # All FOUR declaration classes are walked, `peerDependencies` included:
+      # a scan over the other three alone reports 0 cycles on the pre-fix
+      # #13513 tree, honestly and wrongly -- the loop's first edge was a
+      # `peerDependencies` edge (#13513 comment `5473800149`, resolved in
+      # `5479206575`). Every cycle is named with the declaration class of each
+      # edge that closes it (`A --devDependencies--> B`), because "there is a
+      # cycle" does not tell an author which edge to cut.
+      #
+      # Reads the workspace manifests only (via the shared enumerator). No
+      # build, no pnpm invocation, no network, sub-second. The `check:` key
+      # runs `--self-test` first: this gate's defect class is its matching
+      # rule, which a clean tree cannot distinguish from a rule that stopped
+      # matching, and the peer-only / optional-only cases are the #13513
+      # false-zero control -- a walker that drops either class fails them.
+      - name: workspace manifest dependency graph has no cycle
+        run: pnpm check:workspace-manifest-cycles
+
       # A relationship carrier is spelled as the target object's NAME (#13103).
       # `FieldSchema.reference` is `z.string()`, and #13053 measured what a
       # non-string one costs: a fixture spelling `reference: { object: '...' }`

package.json

@@ -80,6 +80,7 @@
     "check:single-claim-paths": "node scripts/check-single-claim-paths.mjs --self-test",
     "check:pnpm-filter-targets": "node scripts/pnpm-filter-targets.mjs --self-test && node scripts/check-pnpm-filter-targets.mjs --self-test && node scripts/check-pnpm-filter-targets.mjs",
     "check:turbo-task-graph": "node scripts/check-turbo-task-graph.mjs --self-test && node scripts/check-turbo-task-graph.mjs",
+    "check:workspace-manifest-cycles": "node scripts/check-workspace-manifest-cycles.mjs --self-test && node scripts/check-workspace-manifest-cycles.mjs",
     "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",