ci(deploy-site): build with npm run build, the predicate the apex publisher answers to

[gHashTag]

Two jobs write to t27.ai, and only one of them ran the spec generators.

• gHashTag/ghashtag.github.io publish-website.yml builds with npm run build, so npm fires the prebuild hook. That hook runs the spec generators, including onboarding-from-spec. On 2026-10-01 at 16:38Z this hook refused t27 worlds: refresh the catalog (14 repositories, 1737 specs) #1176's stale corpus counts.
• This repo's deploy-site.yml built with npx vite build. npx does not fire npm lifecycle hooks, so this second writer would have published the same stale counts. At 19:00Z it was the job that last wrote the apex (42072ef2f, blog: the seed moved Fmax 1.22x, the pins moved it 2.6x #1204's post). The only reason that deploy was correct is that main had already been fixed by feat(queen): IGLA board on WARS; black field; tables stack on phones #1212 and fix(website): the catalog refresh runs the checks its counts must pass #1217.

The fix is one line: npm run build. Both writers now answer to the same predicate. Running the generators also means deploy-site ships freshly generated catalogs, as the publisher does. On main the committed ones differ only in generatedAt and two source hashes.

{
  "version": 1,
  "head_sha": "be9b499fbc9aafd7c2393eabae3f5acaa2e468d0",
  "summary": "deploy-site.yml, the second job that writes t27.ai, built with npx vite build. That skips npm's prebuild hook and with it the spec generators the apex publisher runs, so a stale-spec main that the publisher refused (2026-10-01 16:38Z) would have deployed through this door. It now builds with npm run build, the same predicate.",
  "changes": [
    ".github/workflows/deploy-site.yml: Build step runs npm run build instead of npx vite build, with a comment saying why the two writers must share one predicate"
  ],
  "tests": [
    {
      "command": "cd apps/website && npm ci && npm run check:queen-evidence && npm run build",
      "status": "passed",
      "result": "exit 0 in 141 s; the prebuild hook ran every generator: onboarding-from-spec wrote llms.txt and agents.t27 (22843 bytes each), spec tests 10, asserts 54, all hold; vite built in 1m 56s",
      "evidence": "local run on the branch head, tree = main 082196ffc plus this workflow edit"
    },
    {
      "command": "git diff after npm run build (generated catalogs vs committed)",
      "status": "passed",
      "result": "7 regenerated files differ only in generatedAt, one docs source sha256 and the shared-core indexer sha256 -- no content drift; not committed",
      "evidence": "per-key JSON diff of public/{agents,crons,docs,functions,skills,tools,t27} catalogs"
    }
  ],
  "limitations": [
    "The workflow itself is workflow_dispatch only and is not exercised by this PR's checks; the next manual deploy is the first real run.",
    "A deploy now takes about two minutes longer, the price of running the generators."
  ],
  "tags": [
    "Engineering",
    "Verification"
  ],
  "blog": {
    "title": "Two doors to one site, and only one of them had the lock",
    "summary": "The publisher's build refused a stale spec; a second deploy job reached the same domain through npx, which never fires the hook that held the check.",
    "outline": [
      "The apex publisher failed on stale onboarding counts, and that failure was the check working.",
      "A second job wrote the same domain an hour later and would have shipped the stale counts: npx vite build skips npm's prebuild hook.",
      "One line, npm run build in place of npx vite build, makes both writers answer to the same predicate, so neither can publish what the other refuses."
    ]
  }
}

🤖 Generated with Claude Code