---
name: ci-clippy-preflight-workspace
description: "pre-flight the EXACT CI clippy invocation — `--workspace --all-targets -- -D warnings`, standalone, exit code read directly; without -D warnings clippy exits 0 on warnings and your gate measures a weaker property than CI enforces"
metadata: 
  node_type: memory
  type: feedback
  originSessionId: d99414a7-2b9c-498e-9890-4cd8b10c8b6a
  modified: 2026-08-04T16:18:56.022Z
---

CI `test` job runs `cargo clippy --workspace --all-targets -- -D warnings` (ci.yml:181). Two ways a local pre-flight silently measures something weaker:

**1. Scope.** `cargo clippy -p spt …` does NOT compile sibling crates, so their lints are invisible. Hit on M11-W1: a `clippy::useless_vec` in `spt-daemon` (linkhost.rs:702) was latent under a `-p spt` pre-flight and surfaced only at CI's `--workspace` step. Fixed @06cf6f1.

**2. Denial level (found 2026-07-19, TEARDOWN-AUTHORITY W1 — the more dangerous one).** Without `-- -D warnings`, **clippy EXITS 0 ON WARNINGS.** A local run that omits it proves only "no hard errors", never "CI-clean" — a warning-only regression passes every local round and fails CI at the denial step. doyle and todlando BOTH omitted it all day, independently, across three gate rounds.

**3. Exit-code capture.** `cargo clippy … | tail -N` then `$?` captures **tail's** status, not clippy's; `cmd | filter && next` chains on the filter too. Both agents hit this the same day (doyle piped to `tail`, todlando to `grep`). Use PIPESTATUS or — better — don't pipe: run each gate leg as its own command with its own captured status. A combined one-line report is worth less than a trustworthy one.

**4. A TEST-ONLY lane feels exempt, and is not (hertz, 2026-08-04).** My er-seams lane shipped no product code — one new integration test. I verified it the way a test lane invites: nextest green on the named test, plus a narrow `cargo check -p spt-store`. Both passed, and a passing test reads as a finished lane, so no compile gate ever ran. The test target carried a dead `let mut … = None;`; `unused_assignments` fired only under `--all-targets`, which is where a TEST's own lints are first read at all. doyle caught it at golden assembly, where it would have redded the whole USHER batch under `-D warnings`. **The trap is that the nextest green is a real, relevant, passing measurement of the thing the lane exists to deliver — it just isn't the lint gate, and its relevance is what stops you looking further.** Scope (point 1) is usually described as "sibling crates"; the sharper statement is that *your own test target is also out of scope* until `--all-targets` pulls it in.

**Why 2 survived undetected:** it never produced a false RED. Every other defect that week announced itself with a red; **an instrument that fails only silently gives nobody a reason to inspect it, so it can only be found by someone auditing a GREEN.** We have no routine for that category — that insight is worth more than the fix.

**How to apply:** before pushing any branch, run the EXACT CI invocation — `cargo clippy --workspace --all-targets -- -D warnings` — standalone, unpiped, and quote the numeric exit code in your verdict rather than summarising it as "clippy 0", so the claim and the evidence are the same object. Same discipline for the nextest sweep across crates. CI only fires on `pull_request`, so a feature branch needs a PR to get CI at all. Relates to [[traceable-per-wave-activation]], [[gate-int-tests-with-nextest-not-bare-cargo-test]].