v0.8.66: Fail check-facts on unmapped ApiProvider variants

[Hmbown]

Why this matters

The website facts gate should prevent provider inventory drift. Today, a new ApiProvider variant can be omitted from the website provider map, facts-lib will print an error, and check:facts can still pass if the committed facts also lack that provider. That means the public provider map can silently fall behind the Rust provider enum.

Current behavior

web/scripts/facts-lib.mjs detects unmapped ApiProvider variants:

• web/scripts/facts-lib.mjs:104-109

But then deliberately returns only the mapped providers:

• web/scripts/facts-lib.mjs:110-114

// In check mode we don't want to crash the entire gate just because
// a new provider variant hasn't been mapped yet — but we do want to
// surface it loudly. Return what we can map.
return variants.map((v) => PROVIDER_LABEL_MAP[v]).filter(Boolean);

web/scripts/check-facts.mjs compares committed facts against freshly derived facts and exits success when there are no diffs:

• web/scripts/check-facts.mjs:105-109

Current local evidence:

> codewhale-web@0.1.0 check:facts
> node scripts/check-facts.mjs

[facts-lib] ApiProvider variants missing from PROVIDER_LABEL_MAP: Openmodel, Sakana. Add them to PROVIDER_LABEL_MAP here AND in web/lib/facts-drift.ts (or to EXCLUDED_PROVIDERS if intentionally hidden).
[check-facts] OK — committed facts.generated.ts matches workspace

So the gate reports missing provider mappings and still passes.

Desired behavior

1. npm run check:facts should fail when Rust ApiProvider variants are neither mapped nor intentionally excluded.
2. The runtime/website facts-drift surface may continue warning if that is useful, but the release/CI gate should be hard-fail.
3. The committed website facts should not be considered current when provider mappings are incomplete.

Repro or evidence

Run:

cd web && npm run check:facts
nl -ba web/scripts/facts-lib.mjs | sed -n '104,114p'
nl -ba web/scripts/check-facts.mjs | sed -n '105,109p'

Current output logs unmapped providers (Openmodel, Sakana) and still prints OK — committed facts.generated.ts matches workspace.

Acceptance criteria

• cd web && npm run check:facts exits non-zero when deriveProviders() finds unmapped non-excluded ApiProvider variants.
• The failure message names the unmapped provider variants and explains whether to add them to PROVIDER_LABEL_MAP or EXCLUDED_PROVIDERS.
• Openmodel and Sakana are either mapped for the website provider list or intentionally excluded with code comments.
• cd web && npm run check:facts passes only after provider mapping/exclusion is complete.
• The runtime facts-drift warning behavior remains separate if the app still wants a non-fatal runtime signal.

Related

• Related: v0.8.69: Add a website fact-drift gate for version, providers, and tool inventory #3415, the original website fact-drift gate issue.
• Related: feat(web): add fact-drift CI gate #3481, the merged fact-drift CI gate implementation.