diff --git a/.github/workflows/javascript-ci.yml b/.github/workflows/javascript-ci.yml
index 49c515b01..73f252421 100644
--- a/.github/workflows/javascript-ci.yml
+++ b/.github/workflows/javascript-ci.yml
@@ -81,18 +81,30 @@ jobs:
         run: pnpm smoke:dist
         working-directory: javascript
 
-      - name: Lint
+      # Every workspace package except the root. Also asserts, before linting,
+      # that dist/ exists and that no package can escape the gate by omitting a
+      # lint script — both failures used to be silent (#565).
+      - name: Lint (workspace packages)
         run: pnpm lint:all
         working-directory: javascript
 
       # Lints the shipped library source (src/, excluding tests) with the root
       # package config, which the workspace-recursive lint:all does not cover.
       # Enforces no-non-null-assertion (#751) and the rest of the config on the
-      # library; extending the gate to tests/examples is tracked in #565.
+      # library.
       - name: Lint (library)
         run: pnpm lint:lib
         working-directory: javascript
 
+      # Everything the root package owns that lint:all does not reach: src/
+      # INCLUDING tests, root-level *.ts, and scripts/. The pre-existing
+      # no-explicit-any debt in test files is recorded per-file in
+      # eslint-suppressions.json rather than waived by severity, so a NEW one
+      # fails here while the known 106 stay green (#565).
+      - name: Lint (root package)
+        run: pnpm lint:root
+        working-directory: javascript
+
       - name: Type check
         run: pnpm typecheck:all
         working-directory: javascript
diff --git a/javascript/demo-sliding-deadline.ts b/javascript/demo-sliding-deadline.ts
index ddde05b8c..c63476ad6 100644
--- a/javascript/demo-sliding-deadline.ts
+++ b/javascript/demo-sliding-deadline.ts
@@ -11,9 +11,9 @@
  *
  * Run: node_modules/.bin/tsx demo-sliding-deadline.ts
  */
-import { ElevenLabsAgentAdapter } from "./src/voice/adapters/elevenlabs.js";
 import { Buffer } from "node:buffer";
 import type { RawData } from "ws";
+import { ElevenLabsAgentAdapter } from "./src/voice/adapters/elevenlabs.js";
 
 // ── timing constants ──────────────────────────────────────────────────────────
 const TIMEOUT_S = 0.5;         // 500ms raw idle deadline
diff --git a/javascript/eslint-suppressions.json b/javascript/eslint-suppressions.json
new file mode 100644
index 000000000..4637bb963
--- /dev/null
+++ b/javascript/eslint-suppressions.json
@@ -0,0 +1,17 @@
+{
+  "src/agents/__tests__/red-team.test.ts": {
+    "@typescript-eslint/no-explicit-any": {
+      "count": 102
+    }
+  },
+  "src/agents/judge/__tests__/judge-agent.test.ts": {
+    "@typescript-eslint/no-explicit-any": {
+      "count": 3
+    }
+  },
+  "src/tracing/__tests__/setup.test.ts": {
+    "@typescript-eslint/no-explicit-any": {
+      "count": 1
+    }
+  }
+}
\ No newline at end of file
diff --git a/javascript/eslint.config.mjs b/javascript/eslint.config.mjs
index 59757a17f..b987ca7b3 100644
--- a/javascript/eslint.config.mjs
+++ b/javascript/eslint.config.mjs
@@ -57,7 +57,14 @@ export default defineConfig([
     languageOptions: { globals: globals.browser },
   },
   {
-    files: ["**/*.config.{js,mjs,cjs,ts}", "eslint.config.mjs"],
+    // Build tooling and the maintenance scripts run under Node, not a browser.
+    // Without this, `scripts/**` is linted with browser globals and reports
+    // no-undef on Buffer/process (#565).
+    files: [
+      "**/*.config.{js,mjs,cjs,ts}",
+      "eslint.config.mjs",
+      "scripts/**/*.{js,mjs,cjs,ts}",
+    ],
     languageOptions: { globals: globals.node },
   },
   tseslint.configs.recommended,
@@ -78,8 +85,7 @@ export default defineConfig([
   {
     // Forbid non-null assertions (`!`) in shipped library source. Tests and
     // examples legitimately assert known-present fixtures, so the rule is
-    // scoped to non-test `src/` only; extending the lint gate to the rest of
-    // the package is tracked in #565.
+    // scoped to non-test `src/` only.
     files: ["src/**/*.ts"],
     ignores: ["src/**/*.test.ts", "src/**/__tests__/**"],
     rules: {
diff --git a/javascript/examples/custom-observability/package.json b/javascript/examples/custom-observability/package.json
index cd50ca95a..79287a3e7 100644
--- a/javascript/examples/custom-observability/package.json
+++ b/javascript/examples/custom-observability/package.json
@@ -3,6 +3,7 @@
   "private": true,
   "type": "module",
   "scripts": {
+    "lint": "eslint .",
     "test:no-auto-init": "tsx test-no-auto-init.ts",
     "test:scenario-only": "tsx test-scenario-only.ts",
     "test:custom-scopes": "tsx test-custom-scopes.ts",
diff --git a/javascript/examples/custom-observability/scope-name.ts b/javascript/examples/custom-observability/scope-name.ts
new file mode 100644
index 000000000..9caed3f2e
--- /dev/null
+++ b/javascript/examples/custom-observability/scope-name.ts
@@ -0,0 +1,22 @@
+import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
+
+/** The two shapes OTel has used for the instrumentation scope, across SDK majors. */
+type ScopedSpan = ReadableSpan & {
+  instrumentationScope?: { name?: string };
+  instrumentationLibrary?: { name?: string };
+};
+
+/**
+ * Returns the instrumentation scope name for a span, handling both
+ * OTel SDK v1 (instrumentationLibrary) and v2 (instrumentationScope).
+ *
+ * Shared rather than copied into each probe: this is a version-compatibility
+ * shim, and the copy nobody remembers to update is the one that breaks when
+ * OTel renames the field again.
+ */
+export function getScopeName(span: ReadableSpan): string {
+  const s = span as ScopedSpan;
+  return (
+    s.instrumentationScope?.name ?? s.instrumentationLibrary?.name ?? "unknown"
+  );
+}
diff --git a/javascript/examples/custom-observability/test-config-file.ts b/javascript/examples/custom-observability/test-config-file.ts
index a8693a53c..c80c64149 100644
--- a/javascript/examples/custom-observability/test-config-file.ts
+++ b/javascript/examples/custom-observability/test-config-file.ts
@@ -19,18 +19,18 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 process.chdir(path.join(__dirname, "with-config-file"));
 console.log(`Working directory: ${process.cwd()}`);
 
+import {
+  run,
+  AgentRole,
+  user,
+  agent,
+  succeed,
+  type AgentInput,
+} from "@langwatch/scenario";
 import { trace } from "@opentelemetry/api";
 import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
-import { run, AgentRole, user, agent, succeed } from "@langwatch/scenario";
-
-function getScopeName(span: ReadableSpan): string {
-  const s = span as any;
-  return (
-    s.instrumentationScope?.name ??
-    s.instrumentationLibrary?.name ??
-    "unknown"
-  );
-}
+import { getScopeName } from "./scope-name";
+
 
 // --- Step 1: Create agents (no LLM needed) ---
 const dummyUserAgent = {
@@ -40,7 +40,7 @@ const dummyUserAgent = {
 
 const echoAgent = {
   role: AgentRole.AGENT as const,
-  call: async (input: any) => {
+  call: async (input: AgentInput) => {
     const lastMessage = input.messages.at(-1);
     const content =
       typeof lastMessage?.content === "string"
diff --git a/javascript/examples/custom-observability/test-custom-scopes.ts b/javascript/examples/custom-observability/test-custom-scopes.ts
index 869f6acc0..4701e7f20 100644
--- a/javascript/examples/custom-observability/test-custom-scopes.ts
+++ b/javascript/examples/custom-observability/test-custom-scopes.ts
@@ -4,12 +4,6 @@
  * Demonstrates the advanced use case where a user wants to include their own
  * instrumented code (e.g., database calls) alongside scenario spans.
  */
-import { trace } from "@opentelemetry/api";
-import {
-  SimpleSpanProcessor,
-  InMemorySpanExporter,
-} from "@opentelemetry/sdk-trace-base";
-import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
 import {
   run,
   AgentRole,
@@ -19,19 +13,13 @@ import {
   setupScenarioTracing,
   withCustomScopes,
 } from "@langwatch/scenario";
+import { trace } from "@opentelemetry/api";
+import {
+  SimpleSpanProcessor,
+  InMemorySpanExporter,
+} from "@opentelemetry/sdk-trace-base";
+import { getScopeName } from "./scope-name";
 
-/**
- * Returns the instrumentation scope name for a span, handling both
- * OTel SDK v1 (instrumentationLibrary) and v2 (instrumentationScope).
- */
-function getScopeName(span: ReadableSpan): string {
-  const s = span as any;
-  return (
-    s.instrumentationScope?.name ??
-    s.instrumentationLibrary?.name ??
-    "unknown"
-  );
-}
 
 // --- Step 1: Set up span collection ---
 const memoryExporter = new InMemorySpanExporter();
@@ -40,7 +28,7 @@ const collectorProcessor = new SimpleSpanProcessor(memoryExporter);
 setupScenarioTracing({
   instrumentations: [],
   spanProcessors: [collectorProcessor],
-  langwatch: "disabled" as any,
+  langwatch: "disabled",
 });
 
 // --- Step 2: Create a "database" tracer under a custom scope ---
@@ -50,7 +38,7 @@ const httpTracer = trace.getTracer("http-server");
 // Simulate a database-backed agent
 const dbAgent = {
   role: AgentRole.AGENT as const,
-  call: async (input: any) => {
+  call: async () => {
     // Simulate a database query (tagged with custom scope)
     return dbTracer.startActiveSpan(
       "db.query SELECT users",
@@ -123,7 +111,8 @@ for (const [scope, scopeSpans] of byScope) {
 // --- Step 6: Show what withCustomScopes would filter ---
 const filters = withCustomScopes("my-app/database");
 console.log("\n--- Filter config for LangWatchTraceExporter ---");
-console.log('withCustomScopes("my-app/database") would include:');
+console.log('withCustomScopes("my-app/database") returns:', filters);
+console.log("which would include:");
 console.log(
   `  @langwatch/scenario spans (${byScope.get("@langwatch/scenario")?.length ?? 0})`
 );
diff --git a/javascript/examples/custom-observability/test-no-auto-init.ts b/javascript/examples/custom-observability/test-no-auto-init.ts
index ee19dd803..f85fc5859 100644
--- a/javascript/examples/custom-observability/test-no-auto-init.ts
+++ b/javascript/examples/custom-observability/test-no-auto-init.ts
@@ -10,8 +10,9 @@ import { trace } from "@opentelemetry/api";
 const providerBefore = trace.getTracerProvider();
 const providerNameBefore = providerBefore.constructor.name;
 
-// Dynamically import scenario to test the side-effect
-const scenario = await import("@langwatch/scenario");
+// Dynamically import scenario to test the side-effect. The module namespace is
+// deliberately discarded — the import itself is what this test exercises.
+await import("@langwatch/scenario");
 
 // Check the provider AFTER importing scenario
 const providerAfter = trace.getTracerProvider();
diff --git a/javascript/examples/custom-observability/test-scenario-only.ts b/javascript/examples/custom-observability/test-scenario-only.ts
index e10db1bb6..23360ed97 100644
--- a/javascript/examples/custom-observability/test-scenario-only.ts
+++ b/javascript/examples/custom-observability/test-scenario-only.ts
@@ -4,12 +4,6 @@
  * This simulates the production use case: a server process that imports scenario
  * and only wants scenario-scoped spans, not HTTP/middleware noise.
  */
-import { trace } from "@opentelemetry/api";
-import {
-  SimpleSpanProcessor,
-  InMemorySpanExporter,
-} from "@opentelemetry/sdk-trace-base";
-import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
 import {
   run,
   AgentRole,
@@ -17,21 +11,15 @@ import {
   agent,
   succeed,
   setupScenarioTracing,
-  scenarioOnly,
+  type AgentInput,
 } from "@langwatch/scenario";
+import { trace } from "@opentelemetry/api";
+import {
+  SimpleSpanProcessor,
+  InMemorySpanExporter,
+} from "@opentelemetry/sdk-trace-base";
+import { getScopeName } from "./scope-name";
 
-/**
- * Returns the instrumentation scope name for a span, handling both
- * OTel SDK v1 (instrumentationLibrary) and v2 (instrumentationScope).
- */
-function getScopeName(span: ReadableSpan): string {
-  const s = span as any;
-  return (
-    s.instrumentationScope?.name ??
-    s.instrumentationLibrary?.name ??
-    "unknown"
-  );
-}
 
 // --- Step 1: Set up a custom InMemorySpanExporter to capture what gets collected ---
 const memoryExporter = new InMemorySpanExporter();
@@ -41,7 +29,7 @@ const collectorProcessor = new SimpleSpanProcessor(memoryExporter);
 setupScenarioTracing({
   instrumentations: [], // disable auto-instrumentation
   spanProcessors: [collectorProcessor],
-  langwatch: "disabled" as any, // don't send to LangWatch for this test
+  langwatch: "disabled", // don't send to LangWatch for this test
 });
 
 // --- Step 3: Simulate "server noise" -- create spans that should be filtered out ---
@@ -61,7 +49,7 @@ const dummyUserAgent = {
 
 const echoAgent = {
   role: AgentRole.AGENT as const,
-  call: async (input: any) => {
+  call: async (input: AgentInput) => {
     const lastMessage = input.messages.at(-1);
     const content =
       typeof lastMessage?.content === "string"
diff --git a/javascript/examples/openai-realtime-demo/package.json b/javascript/examples/openai-realtime-demo/package.json
index c54c5075e..6d6d69d33 100644
--- a/javascript/examples/openai-realtime-demo/package.json
+++ b/javascript/examples/openai-realtime-demo/package.json
@@ -7,7 +7,7 @@
   "types": "index.ts",
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "lint": "eslint agents/ index.ts",
+    "lint": "eslint . --ignore-pattern 'realtime-client/**'",
     "format": "pnpm lint --fix"
   },
   "dependencies": {
diff --git a/javascript/package.json b/javascript/package.json
index a1ee75616..02f1ab275 100644
--- a/javascript/package.json
+++ b/javascript/package.json
@@ -20,6 +20,7 @@
     "typecheck": "tsc --noEmit",
     "lint": "eslint .",
     "lint:lib": "eslint 'src/**/*.ts' --ignore-pattern '**/*.test.ts' --ignore-pattern '**/__tests__/**'",
+    "lint:root": "eslint . --ignore-pattern 'examples/**'",
     "format": "eslint . --fix",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -29,7 +30,7 @@
     "clean:all": "pnpm -r --parallel exec rm -rf dist *.tgz .cache",
     "build:all": "pnpm run build",
     "typecheck:all": "pnpm -r --parallel run typecheck",
-    "lint:all": "pnpm -r --parallel run lint",
+    "lint:all": "node scripts/check-lint-preconditions.mjs && pnpm -r --parallel run lint",
     "format:all": "pnpm -r --parallel run format",
     "test:all": "pnpm -r --parallel run test",
     "vitest-examples": "pnpm -F vitest-examples",
diff --git a/javascript/scripts/check-lint-preconditions.mjs b/javascript/scripts/check-lint-preconditions.mjs
new file mode 100644
index 000000000..f4656c70e
--- /dev/null
+++ b/javascript/scripts/check-lint-preconditions.mjs
@@ -0,0 +1,156 @@
+/**
+ * Preconditions for the workspace lint gate (#565).
+ *
+ * Two failure modes made real lint debt invisible in CI, and neither surfaced
+ * as a red build — they surfaced as silence:
+ *
+ *   1. `pnpm -r run <script>` SKIPS a package that does not define that script,
+ *      without erroring. Verified: with `lint` removed from examples/vitest,
+ *      `pnpm -r --parallel run lint` exits 0 and prints nothing about the
+ *      skipped package. pnpm ships no built-in for this — `--if-present` does
+ *      the opposite (it suppresses a non-zero exit). examples/custom-observability
+ *      sat that way with 19 lint problems.
+ *   2. The examples import `@langwatch/scenario` through its published `exports`
+ *      map, which points at `dist/`. Lint before a build and every one of those
+ *      imports reports `import/no-unresolved` — 63 errors that say nothing about
+ *      code quality.
+ *
+ * This turns both into loud, actionable failures before `lint:all` runs.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+/**
+ * Scripts every non-root workspace package must define to be covered by a gate.
+ * `typecheck` belongs here too — examples/custom-observability defines none, so
+ * `typecheck:all` skips it by the same mechanism — but adding it surfaces three
+ * pre-existing OTel v1/v2 type errors that are out of scope here. Tracked in #867;
+ * add "typecheck" to this list in the same change that fixes them.
+ */
+const REQUIRED_SCRIPTS = ["lint"];
+
+/**
+ * True when `command` runs eslint over the whole package rather than an
+ * enumerated subset. An enumerated list (`eslint agents/ index.ts`) only covers
+ * what someone remembered on the day they wrote it, so a new sibling file is
+ * silently ungated — which is the same invisibility this script exists to stop.
+ *
+ * Checks the parsed positional arguments, not the spelling: flags may precede
+ * the target (`eslint --max-warnings=0 .` is fine), and a shell operator that
+ * could swallow the exit code (`eslint . || true`) is rejected outright.
+ */
+export function lintsWholePackage(command) {
+  if (/[;&|]/.test(command)) return false;
+
+  const tokens = command.trim().split(/\s+/);
+  const eslintAt = tokens.findIndex((t) => /(^|\/)eslint$/.test(t));
+  if (eslintAt === -1) return false;
+
+  const positionals = [];
+  for (let i = eslintAt + 1; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (token.startsWith("-")) {
+      // A value-taking flag written as two tokens consumes the next one.
+      if (!token.includes("=") && /^--(ignore-pattern|format|config|rulesdir|ext|resolve-plugins-relative-to|suppressions-location)$/.test(token)) i++;
+      continue;
+    }
+    positionals.push(token.replace(/^['"]|['"]$/g, ""));
+  }
+
+  return positionals.length === 1 && /^\.\/?$/.test(positionals[0] ?? "");
+}
+
+/** Workspace packages as pnpm itself resolves them, so the globs stay in one place. */
+function workspacePackages() {
+  let raw;
+  try {
+    raw = execFileSync("pnpm", ["list", "-r", "--depth", "-1", "--json"], {
+      cwd: packageRoot,
+      encoding: "utf8",
+    });
+  } catch (error) {
+    throw new Error(
+      `could not enumerate workspace packages (\`pnpm list -r\` failed): ${error.message}`
+    );
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(
+      "`pnpm list -r --depth -1 --json` did not return JSON — its output shape may have " +
+        `changed. First 200 chars: ${raw.slice(0, 200)}`
+    );
+  }
+}
+
+/** Pure decision half, so the rules are testable without spawning a process. */
+export function lintPreconditionFailures(packages, { root, distExists }) {
+  const failures = [];
+
+  if (!distExists) {
+    failures.push(
+      "javascript/dist/index.js is missing, so `@langwatch/scenario` cannot resolve from the\n" +
+        "    examples and lint would report import/no-unresolved on every import of it.\n" +
+        "    Run `pnpm build` first (CI does this in the Build step)."
+    );
+  }
+
+  // The enumeration silently passing is the exact failure class this file exists
+  // to remove, so an empty or root-less package list is a hard error, not a pass.
+  if (!packages.some((pkg) => resolve(pkg.path) === root)) {
+    failures.push(
+      `pnpm reported ${packages.length} workspace package(s) and none of them is the\n` +
+        "    root — the enumeration is broken, so this guard would otherwise pass\n" +
+        "    without having checked anything."
+    );
+    return failures;
+  }
+
+  for (const pkg of packages) {
+    // The root package is covered by `lint:root`, not by the recursive `lint:all`.
+    if (resolve(pkg.path) === root) continue;
+
+    const manifest = JSON.parse(
+      readFileSync(join(pkg.path, "package.json"), "utf8")
+    );
+    const where = relative(root, pkg.path);
+
+    for (const script of REQUIRED_SCRIPTS) {
+      const command = manifest.scripts?.[script];
+      if (!command) {
+        failures.push(
+          `workspace package "${pkg.name}" (${where}) has no \`${script}\` script, so\n` +
+            `    \`pnpm -r run ${script}\` skips it silently and it is not covered by any gate.`
+        );
+      } else if (script === "lint" && !lintsWholePackage(command)) {
+        failures.push(
+          `workspace package "${pkg.name}" (${where}) has a lint script that does not\n` +
+            `    cover the whole package (\`${command}\`). A file added beside those paths\n` +
+            "    would not be linted. Use `eslint .`, excluding nested workspace packages\n" +
+            "    with --ignore-pattern."
+        );
+      }
+    }
+  }
+
+  return failures;
+}
+
+const failures = lintPreconditionFailures(workspacePackages(), {
+  root: packageRoot,
+  distExists: existsSync(join(packageRoot, "dist", "index.js")),
+});
+
+if (failures.length > 0) {
+  console.error("\nLint gate preconditions failed:\n");
+  for (const failure of failures) console.error(`  - ${failure}\n`);
+  process.exit(1);
+}
+
+console.log(
+  `Lint gate preconditions OK: dist/ present, every workspace package defines ${REQUIRED_SCRIPTS.join(" + ")}.`
+);
diff --git a/javascript/src/agents/__tests__/realtime-adapter-frames.test.ts b/javascript/src/agents/__tests__/realtime-adapter-frames.test.ts
index 4065a0539..c348d1909 100644
--- a/javascript/src/agents/__tests__/realtime-adapter-frames.test.ts
+++ b/javascript/src/agents/__tests__/realtime-adapter-frames.test.ts
@@ -31,9 +31,9 @@
 import type { ModelMessage } from "ai";
 import { describe, it, expect } from "vitest";
 
-import { RealtimeAgentAdapter } from "../realtime/realtime-agent.adapter";
 import { AgentRole } from "../../domain";
 import type { AgentInput } from "../../domain";
+import { RealtimeAgentAdapter } from "../realtime/realtime-agent.adapter";
 
 const AGENT_TRANSCRIPT = "thanks for joining, tell me about your background";
 
diff --git a/javascript/src/agents/__tests__/realtime-adapter-key-resolution.test.ts b/javascript/src/agents/__tests__/realtime-adapter-key-resolution.test.ts
index b17b374d4..00cd7b1bb 100644
--- a/javascript/src/agents/__tests__/realtime-adapter-key-resolution.test.ts
+++ b/javascript/src/agents/__tests__/realtime-adapter-key-resolution.test.ts
@@ -10,8 +10,8 @@
  */
 
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { RealtimeAgentAdapter } from "../realtime/realtime-agent.adapter";
 import { AgentRole } from "../../domain";
+import { RealtimeAgentAdapter } from "../realtime/realtime-agent.adapter";
 
 type ConnectParams = { apiKey?: string };
 
diff --git a/javascript/src/agents/__tests__/realtime-echo-noleak.test.ts b/javascript/src/agents/__tests__/realtime-echo-noleak.test.ts
index c3a564c4e..0ae6dccaa 100644
--- a/javascript/src/agents/__tests__/realtime-echo-noleak.test.ts
+++ b/javascript/src/agents/__tests__/realtime-echo-noleak.test.ts
@@ -31,12 +31,12 @@
 import type { ModelMessage } from "ai";
 import { describe, it, expect, vi } from "vitest";
 
-import { userSimulatorAgent } from "../user-simulator-agent";
-import type { InvokeLLMParams, InvokeLLMResult } from "../types";
-import { ResponseFormatter } from "../realtime/response-formatter";
-import type { AudioResponseEvent } from "../realtime/realtime-event-handler";
 import { AgentRole } from "../../domain";
 import type { AgentInput } from "../../domain";
+import type { AudioResponseEvent } from "../realtime/realtime-event-handler";
+import { ResponseFormatter } from "../realtime/response-formatter";
+import type { InvokeLLMParams, InvokeLLMResult } from "../types";
+import { userSimulatorAgent } from "../user-simulator-agent";
 
 vi.mock("../../config", () => ({
   getProjectConfig: vi.fn().mockResolvedValue({
diff --git a/javascript/src/agents/__tests__/realtime-echo-safe.test.ts b/javascript/src/agents/__tests__/realtime-echo-safe.test.ts
index 06c5bb135..a5425623b 100644
--- a/javascript/src/agents/__tests__/realtime-echo-safe.test.ts
+++ b/javascript/src/agents/__tests__/realtime-echo-safe.test.ts
@@ -47,13 +47,13 @@
 import type { ModelMessage } from "ai";
 import { describe, it, expect, vi } from "vitest";
 
-import { userSimulatorAgent } from "../user-simulator-agent";
-import { messageRoleReversal } from "../utils";
-import type { InvokeLLMParams, InvokeLLMResult } from "../types";
-import { ResponseFormatter } from "../realtime/response-formatter";
-import type { AudioResponseEvent } from "../realtime/realtime-event-handler";
 import { AgentRole } from "../../domain";
 import type { AgentInput } from "../../domain";
+import type { AudioResponseEvent } from "../realtime/realtime-event-handler";
+import { ResponseFormatter } from "../realtime/response-formatter";
+import type { InvokeLLMParams, InvokeLLMResult } from "../types";
+import { userSimulatorAgent } from "../user-simulator-agent";
+import { messageRoleReversal } from "../utils";
 
 // Mock getProjectConfig so no real model config / filesystem is needed and the
 // stubbed invokeLLM is never bypassed (mirrors judge-agent.test.ts).
@@ -198,15 +198,10 @@ describe("realtime echo-safety (AC-JS1')", () => {
     expect(exchange.some((m) => m.role === "user")).toBe(true);
 
     // Diagnostics (visible on failure).
-    // eslint-disable-next-line no-console
     console.log(`[POST-FIX] Q=${JSON.stringify(QUESTION)}`);
-    // eslint-disable-next-line no-console
     console.log(`[POST-FIX] U=${JSON.stringify(postFixAnswer)}`);
-    // eslint-disable-next-line no-console
     console.log(`[POST-FIX] Jaccard=${jPostFix.toFixed(3)}`);
-    // eslint-disable-next-line no-console
     console.log(`[NAIVE]    U=${JSON.stringify(naiveAnswer)}`);
-    // eslint-disable-next-line no-console
     console.log(`[NAIVE]    Jaccard=${jNaive.toFixed(3)}`);
 
     // Naive control: the echo metric IS red-capable at the JS layer.
diff --git a/javascript/src/agents/__tests__/realtime-response-formatter.test.ts b/javascript/src/agents/__tests__/realtime-response-formatter.test.ts
index 2120746bd..a3d8c9c54 100644
--- a/javascript/src/agents/__tests__/realtime-response-formatter.test.ts
+++ b/javascript/src/agents/__tests__/realtime-response-formatter.test.ts
@@ -22,8 +22,8 @@
 
 import { describe, it, expect } from "vitest";
 
-import { ResponseFormatter } from "../realtime/response-formatter";
 import type { AudioResponseEvent } from "../realtime/realtime-event-handler";
+import { ResponseFormatter } from "../realtime/response-formatter";
 
 /** Minimal base64 PCM16 stand-in (bytes are irrelevant to these assertions). */
 const AUDIO_B64 = Buffer.from("\x00\x00".repeat(8), "binary").toString("base64");
diff --git a/javascript/src/agents/__tests__/realtime-response-guard.test.ts b/javascript/src/agents/__tests__/realtime-response-guard.test.ts
index 1d2a2c95c..3c885c052 100644
--- a/javascript/src/agents/__tests__/realtime-response-guard.test.ts
+++ b/javascript/src/agents/__tests__/realtime-response-guard.test.ts
@@ -9,11 +9,11 @@
  *   - AC-JS4/AC-JS5: response.create is sent unconditionally → count is 1, not 0
  */
 
+import type { RealtimeSession } from "@openai/agents/realtime";
 import { describe, it, expect, vi } from "vitest";
-import { RealtimeEventHandler } from "../realtime/realtime-event-handler";
-import { RealtimeAgentAdapter } from "../realtime/realtime-agent.adapter";
 import { AgentRole } from "../../domain";
-import type { RealtimeSession } from "@openai/agents/realtime";
+import { RealtimeAgentAdapter } from "../realtime/realtime-agent.adapter";
+import { RealtimeEventHandler } from "../realtime/realtime-event-handler";
 
 // ------- FakeTransport -------
 class FakeTransport {
diff --git a/javascript/src/agents/__tests__/red-team.test.ts b/javascript/src/agents/__tests__/red-team.test.ts
index c48ac13ee..3551123ed 100644
--- a/javascript/src/agents/__tests__/red-team.test.ts
+++ b/javascript/src/agents/__tests__/red-team.test.ts
@@ -1,12 +1,12 @@
 import { describe, it, expect, vi } from "vitest";
+import { AgentRole, AgentAdapter, JudgeAgentAdapter } from "../../domain";
+import type { AgentInput, AgentReturnTypes } from "../../domain";
+import { ScenarioExecutionState } from "../../execution/scenario-execution-state";
 import { CrescendoStrategy } from "../red-team/crescendo-strategy";
 import { GoatStrategy } from "../red-team/goat-strategy";
 import { renderMetapromptTemplate } from "../red-team/metaprompt-template";
 import { redTeamCrescendo, redTeamGoat, redTeamAgent } from "../red-team/red-team-agent";
 import { Base64Technique, DEFAULT_TECHNIQUES } from "../red-team/techniques";
-import { ScenarioExecutionState } from "../../execution/scenario-execution-state";
-import { AgentRole, AgentAdapter, JudgeAgentAdapter } from "../../domain";
-import type { AgentInput, AgentReturnTypes } from "../../domain";
 
 // Shared helper — minimal AgentInput-like object for unit tests
 const makeInput = (messages: any[], currentTurn = 1) => ({
diff --git a/javascript/src/agents/__tests__/user-simulator-tts.test.ts b/javascript/src/agents/__tests__/user-simulator-tts.test.ts
index dc6d2c4ad..bfa1e569c 100644
--- a/javascript/src/agents/__tests__/user-simulator-tts.test.ts
+++ b/javascript/src/agents/__tests__/user-simulator-tts.test.ts
@@ -13,6 +13,7 @@
 
 import { describe, it, expect, afterEach, vi } from "vitest";
 
+import type { AgentInput } from "../../domain";
 import { AudioChunk } from "../../voice/audio-chunk";
 import { extractAudio, messageHasAudio } from "../../voice/messages";
 import {
@@ -20,7 +21,6 @@ import {
   registerTtsProvider,
 } from "../../voice/tts";
 import { userSimulatorAgent, type UserSimulatorAgentConfig } from "../user-simulator-agent";
-import type { AgentInput } from "../../domain";
 
 vi.mock("../../config", () => ({
   getProjectConfig: vi.fn().mockResolvedValue({
diff --git a/javascript/src/agents/__tests__/user-simulator-voice.test.ts b/javascript/src/agents/__tests__/user-simulator-voice.test.ts
index e8ae6b6fe..e79b3ca48 100644
--- a/javascript/src/agents/__tests__/user-simulator-voice.test.ts
+++ b/javascript/src/agents/__tests__/user-simulator-voice.test.ts
@@ -23,11 +23,11 @@ import { fileURLToPath } from "node:url";
 import { loadFeature, describeFeature } from "@amiceli/vitest-cucumber";
 import { expect, vi } from "vitest";
 
-import { AudioChunk } from "../../voice/audio-chunk";
 import { makeChunk } from "./fixtures/make-chunk";
+import type { AgentInput } from "../../domain";
+import { AudioChunk } from "../../voice/audio-chunk";
 import { extractAudio, messageHasAudio } from "../../voice/messages";
 import { userSimulatorAgent, type UserSimulatorAgentConfig } from "../user-simulator-agent";
-import type { AgentInput } from "../../domain";
 
 // Mock getProjectConfig to avoid filesystem dependency in unit tests.
 vi.mock("../../config", () => ({
diff --git a/javascript/src/agents/__tests__/voice-assistant-role.test.ts b/javascript/src/agents/__tests__/voice-assistant-role.test.ts
index 0c7f5e4ce..7bdd2624b 100644
--- a/javascript/src/agents/__tests__/voice-assistant-role.test.ts
+++ b/javascript/src/agents/__tests__/voice-assistant-role.test.ts
@@ -23,8 +23,8 @@ import { fileURLToPath } from "node:url";
 import { loadFeature, describeFeature } from "@amiceli/vitest-cucumber";
 import { expect } from "vitest";
 
-import { AudioChunk } from "../../voice/audio-chunk";
 import { makeChunk } from "./fixtures/make-chunk";
+import { AudioChunk } from "../../voice/audio-chunk";
 import { createAudioMessage, extractAudio, messageHasAudio } from "../../voice/messages";
 import { JudgeAgent } from "../judge/judge-agent";
 
diff --git a/javascript/src/agents/judge/__tests__/judge-agent.test.ts b/javascript/src/agents/judge/__tests__/judge-agent.test.ts
index b9fb95d01..23d9e2eeb 100644
--- a/javascript/src/agents/judge/__tests__/judge-agent.test.ts
+++ b/javascript/src/agents/judge/__tests__/judge-agent.test.ts
@@ -1,10 +1,10 @@
 import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { judgeAgent, JudgeAgentConfig } from "../judge-agent";
-import { JudgeSpanCollector } from "../judge-span-collector";
 import { AgentInput, AgentRole } from "../../../domain";
-import { DEFAULT_TOKEN_THRESHOLD } from "../estimate-tokens";
 import { InvokeLLMParams, InvokeLLMResult } from "../../types";
+import { DEFAULT_TOKEN_THRESHOLD } from "../estimate-tokens";
+import { judgeAgent, JudgeAgentConfig } from "../judge-agent";
+import { JudgeSpanCollector } from "../judge-span-collector";
 import { createSpan } from "./helpers/create-span";
 
 function createSmallTrace(): ReadableSpan[] {
diff --git a/javascript/src/agents/judge/__tests__/judge-span-collector.test.ts b/javascript/src/agents/judge/__tests__/judge-span-collector.test.ts
index b45d7df66..89ac8ed10 100644
--- a/javascript/src/agents/judge/__tests__/judge-span-collector.test.ts
+++ b/javascript/src/agents/judge/__tests__/judge-span-collector.test.ts
@@ -1,6 +1,6 @@
+import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
 import { describe, it, expect, beforeEach } from "vitest";
 import { JudgeSpanCollector } from "../judge-span-collector";
-import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
 
 function createSpan({
   spanId,
diff --git a/javascript/src/agents/judge/__tests__/judge-span-digest-formatter.test.ts b/javascript/src/agents/judge/__tests__/judge-span-digest-formatter.test.ts
index 4c6d775aa..173e90542 100644
--- a/javascript/src/agents/judge/__tests__/judge-span-digest-formatter.test.ts
+++ b/javascript/src/agents/judge/__tests__/judge-span-digest-formatter.test.ts
@@ -1,5 +1,5 @@
-import { describe, it, expect } from "vitest";
 import { attributes } from "langwatch/observability";
+import { describe, it, expect } from "vitest";
 import { JudgeSpanDigestFormatter } from "../judge-span-digest-formatter";
 import { createSpan } from "./helpers/create-span";
 
diff --git a/javascript/src/agents/judge/__tests__/judge-utils.test.ts b/javascript/src/agents/judge/__tests__/judge-utils.test.ts
index 8d37e98f6..0a23fb2db 100644
--- a/javascript/src/agents/judge/__tests__/judge-utils.test.ts
+++ b/javascript/src/agents/judge/__tests__/judge-utils.test.ts
@@ -1,5 +1,5 @@
-import { describe, it, expect } from "vitest";
 import { ModelMessage } from "ai";
+import { describe, it, expect } from "vitest";
 import { JudgeUtils } from "../judge-utils";
 
 describe("JudgeUtils.buildTranscriptFromMessages", () => {
diff --git a/javascript/src/execution/__tests__/proceed-interruptions.test.ts b/javascript/src/execution/__tests__/proceed-interruptions.test.ts
index 338c15836..337a43142 100644
--- a/javascript/src/execution/__tests__/proceed-interruptions.test.ts
+++ b/javascript/src/execution/__tests__/proceed-interruptions.test.ts
@@ -18,8 +18,8 @@ import {
   type AgentReturnTypes,
   UserSimulatorAgentAdapter,
 } from "../../domain";
-import { ScenarioExecution } from "../scenario-execution";
 import { InterruptionConfig } from "../../voice/interruption";
+import { ScenarioExecution } from "../scenario-execution";
 
 class MockAgent extends AgentAdapter {
   role = AgentRole.AGENT;
diff --git a/javascript/src/execution/__tests__/realtime-user-proceed-guard.test.ts b/javascript/src/execution/__tests__/realtime-user-proceed-guard.test.ts
index 39650b661..ba175a48e 100644
--- a/javascript/src/execution/__tests__/realtime-user-proceed-guard.test.ts
+++ b/javascript/src/execution/__tests__/realtime-user-proceed-guard.test.ts
@@ -29,12 +29,12 @@ import {
   type AgentInput,
   type AgentReturnTypes,
 } from "../../domain";
-import { ScenarioExecution } from "../scenario-execution";
-import { user, agent, proceed } from "../../script";
 import { USER_TURN_NO_AUDIO_FOR_VOICE_AUT } from "../../domain/agents/agent-shapes";
+import { user, agent, proceed } from "../../script";
+import { FakeVoiceAdapter } from "../../voice/__tests__/fixtures/fake-adapter";
 import { AudioChunk } from "../../voice/audio-chunk";
 import { createAudioMessage, messageHasAudio } from "../../voice/messages";
-import { FakeVoiceAdapter } from "../../voice/__tests__/fixtures/fake-adapter";
+import { ScenarioExecution } from "../scenario-execution";
 
 /** Non-silent PCM16 audio user turn (200 bytes). */
 function audioUserTurn(transcript: string): AgentReturnTypes {
diff --git a/javascript/src/execution/__tests__/scenario-execution-inline-criteria.test.ts b/javascript/src/execution/__tests__/scenario-execution-inline-criteria.test.ts
index 1a08060db..64dc2330d 100644
--- a/javascript/src/execution/__tests__/scenario-execution-inline-criteria.test.ts
+++ b/javascript/src/execution/__tests__/scenario-execution-inline-criteria.test.ts
@@ -7,9 +7,9 @@ import {
   AgentInput,
   AgentReturnTypes,
 } from "../../domain";
+import { UserSimulatorAgentAdapter } from "../../domain/agents";
 import { user, agent, judge, succeed } from "../../script";
 import { ScenarioExecution } from "../scenario-execution";
-import { UserSimulatorAgentAdapter } from "../../domain/agents";
 
 class MockAgent extends AgentAdapter {
   role = AgentRole.AGENT;
diff --git a/javascript/src/execution/__tests__/scenario-role-attributes.test.ts b/javascript/src/execution/__tests__/scenario-role-attributes.test.ts
index 899348ee2..8afddc672 100644
--- a/javascript/src/execution/__tests__/scenario-role-attributes.test.ts
+++ b/javascript/src/execution/__tests__/scenario-role-attributes.test.ts
@@ -1,10 +1,10 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import { trace } from "@opentelemetry/api";
 import {
   InMemorySpanExporter,
   SimpleSpanProcessor,
 } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import {
   AgentRole,
   AgentAdapter,
@@ -12,9 +12,9 @@ import {
   AgentInput,
   AgentReturnTypes,
 } from "../../domain";
+import { UserSimulatorAgentAdapter } from "../../domain/agents";
 import { user, agent, judge } from "../../script";
 import { ScenarioExecution } from "../scenario-execution";
-import { UserSimulatorAgentAdapter } from "../../domain/agents";
 
 class MockAgent extends AgentAdapter {
   role = AgentRole.AGENT;
diff --git a/javascript/src/execution/__tests__/scenario-scope-attribute.test.ts b/javascript/src/execution/__tests__/scenario-scope-attribute.test.ts
index be22607e5..864d11193 100644
--- a/javascript/src/execution/__tests__/scenario-scope-attribute.test.ts
+++ b/javascript/src/execution/__tests__/scenario-scope-attribute.test.ts
@@ -1,10 +1,10 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import { trace } from "@opentelemetry/api";
 import {
   InMemorySpanExporter,
   SimpleSpanProcessor,
 } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import {
   AgentRole,
   AgentAdapter,
@@ -12,9 +12,9 @@ import {
   AgentInput,
   AgentReturnTypes,
 } from "../../domain";
+import { UserSimulatorAgentAdapter } from "../../domain/agents";
 import { user, agent, judge, proceed } from "../../script";
 import { ScenarioExecution } from "../scenario-execution";
-import { UserSimulatorAgentAdapter } from "../../domain/agents";
 
 class MockAgent extends AgentAdapter {
   role = AgentRole.AGENT;
diff --git a/javascript/src/execution/__tests__/user-explicit-content-voice.test.ts b/javascript/src/execution/__tests__/user-explicit-content-voice.test.ts
index 1ea9924c5..ea2327cd8 100644
--- a/javascript/src/execution/__tests__/user-explicit-content-voice.test.ts
+++ b/javascript/src/execution/__tests__/user-explicit-content-voice.test.ts
@@ -13,18 +13,18 @@
 
 import { describe, it, expect } from "vitest";
 
+import { userSimulatorAgent } from "../../agents/user-simulator-agent";
 import {
   AgentRole,
   AgentAdapter,
   type AgentInput,
   type AgentReturnTypes,
 } from "../../domain";
-import { ScenarioExecution } from "../scenario-execution";
 import { user, agent } from "../../script";
-import { userSimulatorAgent } from "../../agents/user-simulator-agent";
+import { FakeVoiceAdapter } from "../../voice/__tests__/fixtures/fake-adapter";
 import { AudioChunk } from "../../voice/audio-chunk";
 import { extractAudio } from "../../voice/messages";
-import { FakeVoiceAdapter } from "../../voice/__tests__/fixtures/fake-adapter";
+import { ScenarioExecution } from "../scenario-execution";
 
 /** Deterministic offline TTS stub: PCM16 bytes proportional to text length. */
 function stubSynthesize(text: string): Promise<AudioChunk> {
diff --git a/javascript/src/execution/__tests__/voice-agent-transcript.test.ts b/javascript/src/execution/__tests__/voice-agent-transcript.test.ts
index 1b64f4e33..2cef3cd53 100644
--- a/javascript/src/execution/__tests__/voice-agent-transcript.test.ts
+++ b/javascript/src/execution/__tests__/voice-agent-transcript.test.ts
@@ -23,11 +23,11 @@ import {
   type AgentInput,
   type AgentReturnTypes,
 } from "../../domain";
-import { ScenarioExecution } from "../scenario-execution";
 import { agent, proceed, user } from "../../script";
+import { FakeVoiceAdapter } from "../../voice/__tests__/fixtures/fake-adapter";
 import { AudioChunk } from "../../voice/audio-chunk";
 import { createAudioMessage, extractAudio } from "../../voice/messages";
-import { FakeVoiceAdapter } from "../../voice/__tests__/fixtures/fake-adapter";
+import { ScenarioExecution } from "../scenario-execution";
 
 /** EL-like AUT: audio-only frames on the wire (no per-chunk transcript). The
  *  turn's text lands on `lastAgentTranscript` DURING the drain — exactly the
diff --git a/javascript/src/runner/__tests__/run.test.ts b/javascript/src/runner/__tests__/run.test.ts
index 583cd07e8..596f32578 100644
--- a/javascript/src/runner/__tests__/run.test.ts
+++ b/javascript/src/runner/__tests__/run.test.ts
@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { run, type RunOptions } from "../run";
 import { AgentRole, type AgentAdapter, type AgentInput, type ScenarioConfig } from "../../domain";
 import type { ScenarioEvent } from "../../events/schema";
+import { run, type RunOptions } from "../run";
 
 // Mock the EventBus - must use function keyword for constructor
 vi.mock("../../events/event-bus", () => ({
diff --git a/javascript/src/script/__tests__/interrupt-after-and-user-overrides.test.ts b/javascript/src/script/__tests__/interrupt-after-and-user-overrides.test.ts
index 50581ef47..07f1e6c0b 100644
--- a/javascript/src/script/__tests__/interrupt-after-and-user-overrides.test.ts
+++ b/javascript/src/script/__tests__/interrupt-after-and-user-overrides.test.ts
@@ -10,9 +10,9 @@
 
 import { describe, it, expect } from "vitest";
 
-import { interrupt } from "../voice-steps";
-import { user } from "../index";
 import type { ScenarioExecutionLike } from "../../domain";
+import { user } from "../index";
+import { interrupt } from "../voice-steps";
 
 interface TraceEntry {
   kind: string;
diff --git a/javascript/src/voice/__tests__/adapter-lifecycle.test.ts b/javascript/src/voice/__tests__/adapter-lifecycle.test.ts
index d428bd5fd..3c26fa848 100644
--- a/javascript/src/voice/__tests__/adapter-lifecycle.test.ts
+++ b/javascript/src/voice/__tests__/adapter-lifecycle.test.ts
@@ -32,8 +32,8 @@ import {
   type AgentReturnTypes,
   UserSimulatorAgentAdapter,
 } from "../../domain";
-import { agent, fail, succeed, user } from "../../script";
 import { ScenarioExecution } from "../../execution/scenario-execution";
+import { agent, fail, succeed, user } from "../../script";
 import { FakeVoiceAdapter } from "./fixtures/fake-adapter";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
diff --git a/javascript/src/voice/__tests__/connected-state.test.ts b/javascript/src/voice/__tests__/connected-state.test.ts
index 7f573b149..6dd25a70c 100644
--- a/javascript/src/voice/__tests__/connected-state.test.ts
+++ b/javascript/src/voice/__tests__/connected-state.test.ts
@@ -13,12 +13,12 @@ import {
   AgentRole,
   type AgentInput,
 } from "../../domain";
-import { AudioChunk } from "../audio-chunk";
-import { AdapterCapabilities } from "../capabilities";
 import { VoiceAgentAdapter } from "../adapter";
 import { defaultVoiceCall } from "../adapter.runtime";
-import { PendingTransportError } from "../adapters/pending-transport-error";
 import { OpenAIRealtimeAgentAdapter } from "../adapters/openai-realtime";
+import { PendingTransportError } from "../adapters/pending-transport-error";
+import { AudioChunk } from "../audio-chunk";
+import { AdapterCapabilities } from "../capabilities";
 
 /** Adapter that flips isConnected() on connect()/disconnect(). */
 class GatedAdapter extends VoiceAgentAdapter {
diff --git a/javascript/src/voice/__tests__/duration-fidelity.test.ts b/javascript/src/voice/__tests__/duration-fidelity.test.ts
index 01c85fd9e..cd401d35a 100644
--- a/javascript/src/voice/__tests__/duration-fidelity.test.ts
+++ b/javascript/src/voice/__tests__/duration-fidelity.test.ts
@@ -35,8 +35,8 @@ import {
   type AgentReturnTypes,
   UserSimulatorAgentAdapter,
 } from "../../domain";
-import { agent, judge, user } from "../../script";
 import { ScenarioExecution } from "../../execution/scenario-execution";
+import { agent, judge, user } from "../../script";
 import { AudioChunk, PCM16_SAMPLE_RATE, PCM16_SAMPLE_WIDTH_BYTES } from "../audio-chunk";
 import { createAudioMessage } from "../messages";
 import { VoiceRecordingRuntime } from "../recording.runtime";
diff --git a/javascript/src/voice/__tests__/factories.test.ts b/javascript/src/voice/__tests__/factories.test.ts
index 0313b935a..849005d18 100644
--- a/javascript/src/voice/__tests__/factories.test.ts
+++ b/javascript/src/voice/__tests__/factories.test.ts
@@ -12,12 +12,12 @@ import type { LanguageModel } from "ai";
 import { describe, it, expect } from "vitest";
 
 import scenario, { voice } from "../../index";
-import { PipecatAgentAdapter } from "../adapters/pipecat";
-import { OpenAIRealtimeAgentAdapter } from "../adapters/openai-realtime";
+import { VoiceAgentAdapter } from "../adapter";
+import { ElevenLabsAgentAdapter, ComposableVoiceAgent } from "../adapters";
 import { GeminiLiveAgentAdapter } from "../adapters/gemini-live";
+import { OpenAIRealtimeAgentAdapter } from "../adapters/openai-realtime";
+import { PipecatAgentAdapter } from "../adapters/pipecat";
 import { TwilioAgentAdapter } from "../adapters/twilio";
-import { ElevenLabsAgentAdapter, ComposableVoiceAgent } from "../adapters";
-import { VoiceAgentAdapter } from "../adapter";
 import type { AudioChunk } from "../audio-chunk";
 import type { STTProvider } from "../stt";
 
diff --git a/javascript/src/voice/__tests__/fixtures/fake-adapter.ts b/javascript/src/voice/__tests__/fixtures/fake-adapter.ts
index fa2ff5c94..9b2bccf1e 100644
--- a/javascript/src/voice/__tests__/fixtures/fake-adapter.ts
+++ b/javascript/src/voice/__tests__/fixtures/fake-adapter.ts
@@ -16,12 +16,12 @@
  *   - `sentAudio` / `responses` — visible audio queues for assertions.
  */
 import { AgentRole } from "../../../domain/agents";
+import { VoiceAgentAdapter } from "../../adapter";
+import { AudioChunk, silentChunk } from "../../audio-chunk";
 import {
   AdapterCapabilities,
   type AdapterCapabilitiesInit,
 } from "../../capabilities";
-import { AudioChunk, silentChunk } from "../../audio-chunk";
-import { VoiceAgentAdapter } from "../../adapter";
 
 export interface FakeAdapterOptions {
   /** Override the default capability matrix (defaults to nativeVad=true). */
diff --git a/javascript/src/voice/__tests__/hooks.test.ts b/javascript/src/voice/__tests__/hooks.test.ts
index 57b004379..97b93b5ce 100644
--- a/javascript/src/voice/__tests__/hooks.test.ts
+++ b/javascript/src/voice/__tests__/hooks.test.ts
@@ -21,8 +21,8 @@ import { fileURLToPath } from "node:url";
 import { loadFeature, describeFeature } from "@amiceli/vitest-cucumber";
 import { expect, it } from "vitest";
 
-import { agent, succeed, user } from "../../script";
 import { ScenarioExecution } from "../../execution/scenario-execution";
+import { agent, succeed, user } from "../../script";
 import { AudioChunk, silentChunk } from "../audio-chunk";
 import type { VoiceEvent } from "../recording.types";
 import { AudioUserSimulator } from "./fixtures/audio-user-simulator";
diff --git a/javascript/src/voice/__tests__/judge-stt.test.ts b/javascript/src/voice/__tests__/judge-stt.test.ts
index 885c02c5d..c638772e8 100644
--- a/javascript/src/voice/__tests__/judge-stt.test.ts
+++ b/javascript/src/voice/__tests__/judge-stt.test.ts
@@ -11,16 +11,16 @@
 import type { ModelMessage } from "ai";
 import { describe, it, expect, vi } from "vitest";
 
-import { AudioChunk } from "../audio-chunk";
-import { createAudioMessage } from "../messages";
-import { prepareJudgeInput, transcribeAudioMessages } from "../judge-stt";
-import type { STTProvider } from "../stt";
 import { judgeAgent } from "../../agents/judge/judge-agent";
 import type { JudgeAgentConfig } from "../../agents/judge/judge-agent";
 import {
   AgentRole,
   type AgentInput,
 } from "../../domain";
+import { AudioChunk } from "../audio-chunk";
+import { prepareJudgeInput, transcribeAudioMessages } from "../judge-stt";
+import { createAudioMessage } from "../messages";
+import type { STTProvider } from "../stt";
 
 // JudgeAgent.call() reads project config from disk; mock it so the test is
 // hermetic (matches judge-agent.test.ts).
diff --git a/javascript/src/voice/__tests__/playback.test.ts b/javascript/src/voice/__tests__/playback.test.ts
index 6b84e4b59..b58e29c85 100644
--- a/javascript/src/voice/__tests__/playback.test.ts
+++ b/javascript/src/voice/__tests__/playback.test.ts
@@ -11,6 +11,7 @@
  *    when audioPlayback: false, sink is NOT constructed.
  */
 
+import { spawn } from "node:child_process";
 import { describe, it, expect, vi, beforeEach, type Mock } from "vitest";
 
 // ---------------------------------------------------------------------------
@@ -83,13 +84,19 @@ vi.mock("node:child_process", () => ({
   spawn: vi.fn().mockReturnValue(mockProc),
 }));
 
-// ---------------------------------------------------------------------------
-// Imports after mock declaration (vitest hoists vi.mock to module-scope).
-// ---------------------------------------------------------------------------
-
-import { spawn } from "node:child_process";
-import { AudioPlaybackSink } from "../playback";
+import { configure } from "../../config/configure";
+import {
+  AgentRole,
+  type AgentInput,
+  type AgentReturnTypes,
+  JudgeAgentAdapter,
+  UserSimulatorAgentAdapter,
+} from "../../domain";
+import { ScenarioExecution } from "../../execution/scenario-execution";
+import { VoiceAgentAdapter } from "../adapter";
 import { AudioChunk } from "../audio-chunk";
+import { AdapterCapabilities } from "../capabilities";
+import { AudioPlaybackSink } from "../playback";
 
 // Minimal real PCM16 chunk: 4 bytes = two int16 samples = valid PCM16.
 function makeChunk(): AudioChunk {
@@ -246,17 +253,6 @@ describe("AudioPlaybackSink", () => {
 // Suite 2: executor wiring (via ScenarioExecution)
 // ---------------------------------------------------------------------------
 
-import {
-  AgentRole,
-  type AgentInput,
-  type AgentReturnTypes,
-  JudgeAgentAdapter,
-  UserSimulatorAgentAdapter,
-} from "../../domain";
-import { ScenarioExecution } from "../../execution/scenario-execution";
-import { VoiceAgentAdapter } from "../adapter";
-import { AdapterCapabilities } from "../capabilities";
-import { configure } from "../../config/configure";
 
 // Minimal fake adapters for the executor wiring tests.
 class FakeVoiceAgent extends VoiceAgentAdapter {
diff --git a/javascript/src/voice/__tests__/proceed-interrupt-errors.test.ts b/javascript/src/voice/__tests__/proceed-interrupt-errors.test.ts
index 7a77c0d20..58886e69f 100644
--- a/javascript/src/voice/__tests__/proceed-interrupt-errors.test.ts
+++ b/javascript/src/voice/__tests__/proceed-interrupt-errors.test.ts
@@ -14,7 +14,6 @@
 
 import { describe, it, expect } from "vitest";
 
-import { sleep } from "../utils";
 
 import {
   AgentRole,
@@ -24,12 +23,13 @@ import {
   UserSimulatorAgentAdapter,
 } from "../../domain";
 import { ScenarioExecution } from "../../execution/scenario-execution";
-import { InterruptionConfig } from "../interruption";
 import { VoiceAgentAdapter } from "../adapter";
+import { AgentSpeakingEvent } from "../adapter.runtime";
 import { AudioChunk } from "../audio-chunk";
 import { AdapterCapabilities } from "../capabilities";
-import { AgentSpeakingEvent } from "../adapter.runtime";
+import { InterruptionConfig } from "../interruption";
 import { createAudioMessage } from "../messages";
+import { sleep } from "../utils";
 
 // ---------------------------------------------------------------------------
 // Helpers
diff --git a/javascript/src/voice/__tests__/proceed-interrupt.test.ts b/javascript/src/voice/__tests__/proceed-interrupt.test.ts
index 153a6c9df..3ab0de049 100644
--- a/javascript/src/voice/__tests__/proceed-interrupt.test.ts
+++ b/javascript/src/voice/__tests__/proceed-interrupt.test.ts
@@ -47,7 +47,6 @@
 
 import { describe, it, expect } from "vitest";
 
-import { sleep } from "../utils";
 
 import {
   AgentRole,
@@ -56,11 +55,12 @@ import {
   UserSimulatorAgentAdapter,
 } from "../../domain";
 import { ScenarioExecution } from "../../execution/scenario-execution";
-import { InterruptionConfig } from "../interruption";
 import { VoiceAgentAdapter } from "../adapter";
 import { AudioChunk } from "../audio-chunk";
 import { AdapterCapabilities } from "../capabilities";
+import { InterruptionConfig } from "../interruption";
 import { createAudioMessage, extractTranscript } from "../messages";
+import { sleep } from "../utils";
 import { PassingJudge } from "./fixtures/passing-judge";
 
 // ---------------------------------------------------------------------------
diff --git a/javascript/src/voice/__tests__/result-audio.test.ts b/javascript/src/voice/__tests__/result-audio.test.ts
index 6c6c9523a..dd2e18449 100644
--- a/javascript/src/voice/__tests__/result-audio.test.ts
+++ b/javascript/src/voice/__tests__/result-audio.test.ts
@@ -34,8 +34,8 @@ import {
   type AgentReturnTypes,
   UserSimulatorAgentAdapter,
 } from "../../domain";
-import { agent, judge, user } from "../../script";
 import { ScenarioExecution } from "../../execution/scenario-execution";
+import { agent, judge, user } from "../../script";
 import { AudioChunk } from "../audio-chunk";
 import { createAudioMessage } from "../messages";
 import { VoiceRecordingRuntime } from "../recording.runtime";
diff --git a/javascript/src/voice/__tests__/transcribe-stale-transcript.test.ts b/javascript/src/voice/__tests__/transcribe-stale-transcript.test.ts
index e0df939fe..047aaca7e 100644
--- a/javascript/src/voice/__tests__/transcribe-stale-transcript.test.ts
+++ b/javascript/src/voice/__tests__/transcribe-stale-transcript.test.ts
@@ -16,9 +16,9 @@
  */
 import { describe, expect, it } from "vitest";
 
+import type { AudioSegment, VoiceRecording } from "../recording.types";
 import { type STTProvider } from "../stt";
 import { transcribeSegments } from "../transcribe";
-import type { AudioSegment, VoiceRecording } from "../recording.types";
 
 const PCM_BYTES = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
 
diff --git a/javascript/src/voice/__tests__/transcribe.test.ts b/javascript/src/voice/__tests__/transcribe.test.ts
index e1c0ed131..41dd99f40 100644
--- a/javascript/src/voice/__tests__/transcribe.test.ts
+++ b/javascript/src/voice/__tests__/transcribe.test.ts
@@ -15,9 +15,9 @@ import { loadFeature, describeFeature } from "@amiceli/vitest-cucumber";
 import { expect, vi } from "vitest";
 
 import type { AudioChunk } from "../audio-chunk";
+import type { AudioSegment, VoiceRecording } from "../recording.types";
 import { type STTProvider } from "../stt";
 import { transcribeSegments } from "../transcribe";
-import type { AudioSegment, VoiceRecording } from "../recording.types";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const FEATURE_PATH = resolve(HERE, "..", "..", "..", "..", "specs", "voice-agents.feature");
diff --git a/javascript/src/voice/__tests__/vad-fallback.test.ts b/javascript/src/voice/__tests__/vad-fallback.test.ts
index f93410582..aa2f663de 100644
--- a/javascript/src/voice/__tests__/vad-fallback.test.ts
+++ b/javascript/src/voice/__tests__/vad-fallback.test.ts
@@ -19,8 +19,8 @@ import { fileURLToPath } from "node:url";
 import { loadFeature, describeFeature } from "@amiceli/vitest-cucumber";
 import { beforeEach, expect, vi, type MockInstance } from "vitest";
 
-import { agent, succeed, user } from "../../script";
 import { ScenarioExecution } from "../../execution/scenario-execution";
+import { agent, succeed, user } from "../../script";
 import { AudioChunk } from "../audio-chunk";
 import type { VoiceEvent } from "../recording.types";
 import { WebRTCVadFallback } from "../vad";
diff --git a/javascript/src/voice/adapters/__tests__/elevenlabs-agent-hangup.test.ts b/javascript/src/voice/adapters/__tests__/elevenlabs-agent-hangup.test.ts
index b3ca60ddb..4730a159e 100644
--- a/javascript/src/voice/adapters/__tests__/elevenlabs-agent-hangup.test.ts
+++ b/javascript/src/voice/adapters/__tests__/elevenlabs-agent-hangup.test.ts
@@ -26,8 +26,8 @@
 import { describe, it, expect } from "vitest";
 
 import type { AgentInput } from "../../../domain/agents";
-import { PendingTransportError } from "../pending-transport-error";
 import { ElevenLabsAgentAdapter } from "../index";
+import { PendingTransportError } from "../pending-transport-error";
 import { FakeWebSocket, makeFakeConv } from "./fixtures/fake-elevenlabs-conversation";
 
 /** Feed one inbound EL ConvAI frame to the SDK over the fake socket. */
diff --git a/javascript/src/voice/adapters/__tests__/elevenlabs.test.ts b/javascript/src/voice/adapters/__tests__/elevenlabs.test.ts
index 4babb4e81..a425b29b6 100644
--- a/javascript/src/voice/adapters/__tests__/elevenlabs.test.ts
+++ b/javascript/src/voice/adapters/__tests__/elevenlabs.test.ts
@@ -17,15 +17,15 @@
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import type { LanguageModel } from "ai";
 import { describeFeature, loadFeature } from "@amiceli/vitest-cucumber";
+import type { LanguageModel } from "ai";
 import { afterEach, describe, it, expect, vi } from "vitest";
 
 import { AgentRole } from "../../../domain/agents";
-import { AudioChunk, silentChunk } from "../../audio-chunk";
 import { VoiceAgentAdapter } from "../../adapter";
-import { ELEVENLABS_DEFAULT_VOICE_ID } from "../../voice-models";
+import { AudioChunk, silentChunk } from "../../audio-chunk";
 import { elevenLabsAgent } from "../../factories";
+import { ELEVENLABS_DEFAULT_VOICE_ID } from "../../voice-models";
 import {
   ComposableVoiceAgent,
   ElevenLabsAgentAdapter,
diff --git a/javascript/src/voice/adapters/__tests__/gemini-live-spans.test.ts b/javascript/src/voice/adapters/__tests__/gemini-live-spans.test.ts
index e72c2a25c..86ff04988 100644
--- a/javascript/src/voice/adapters/__tests__/gemini-live-spans.test.ts
+++ b/javascript/src/voice/adapters/__tests__/gemini-live-spans.test.ts
@@ -22,15 +22,15 @@
 
 import { Buffer } from "node:buffer";
 
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { context, trace, SpanStatusCode } from "@opentelemetry/api";
+import { AsyncLocalStorageContextManager } from "@opentelemetry/context-async-hooks";
 import {
   InMemorySpanExporter,
   SimpleSpanProcessor,
   type ReadableSpan,
 } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
-import { AsyncLocalStorageContextManager } from "@opentelemetry/context-async-hooks";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 
 // Register a context manager ONCE so context.with propagates across awaits — the
 // runtime + adapter read currentSpan() after awaits. Without it context.active()
@@ -88,11 +88,11 @@ vi.mock("@google/genai", () => {
   };
 });
 
-import { GeminiLiveAgentAdapter } from "../gemini-live";
+import type { AgentInput } from "../../../domain/agents";
 import { AudioChunk } from "../../audio-chunk";
 import { createAudioMessage } from "../../messages";
 import { voiceSpan } from "../../telemetry";
-import type { AgentInput } from "../../../domain/agents";
+import { GeminiLiveAgentAdapter } from "../gemini-live";
 
 // 2400 samples @24kHz → 1600 samples @16kHz → 3200 bytes after the wire resample.
 const USER_BYTES = 4800;
diff --git a/javascript/src/voice/adapters/__tests__/openai-realtime-response-guard.test.ts b/javascript/src/voice/adapters/__tests__/openai-realtime-response-guard.test.ts
index 93bc28d55..65672c2d1 100644
--- a/javascript/src/voice/adapters/__tests__/openai-realtime-response-guard.test.ts
+++ b/javascript/src/voice/adapters/__tests__/openai-realtime-response-guard.test.ts
@@ -15,8 +15,8 @@
  * AC-ERR1 is a control test — PASSES on pre-fix code (existing error path).
  */
 
-import { describe, it, expect } from "vitest";
 import { EventEmitter } from "node:events";
+import { describe, it, expect } from "vitest";
 import type WebSocket from "ws";
 import { OpenAIRealtimeAgentAdapter } from "../openai-realtime";
 
diff --git a/javascript/src/voice/adapters/__tests__/openai-realtime-user-call-guard.test.ts b/javascript/src/voice/adapters/__tests__/openai-realtime-user-call-guard.test.ts
index ffdbb4bb0..74383c52e 100644
--- a/javascript/src/voice/adapters/__tests__/openai-realtime-user-call-guard.test.ts
+++ b/javascript/src/voice/adapters/__tests__/openai-realtime-user-call-guard.test.ts
@@ -30,8 +30,8 @@ import { describe, expect, it } from "vitest";
 
 import { AgentRole, type AgentInput } from "../../../domain/agents";
 import { AudioChunk } from "../../audio-chunk";
-import { createAudioMessage, extractAudio } from "../../messages";
 import { OPENAI_REALTIME_MODEL, OpenAIRealtimeAgentAdapter } from "../../index";
+import { createAudioMessage, extractAudio } from "../../messages";
 import { setupMockRealtimeServer } from "./fixtures/mock-realtime-server";
 
 let observed: Array<{ type: string; data: Record<string, unknown> }> = [];
diff --git a/specs/typescript-lint-gate-coverage.feature b/specs/typescript-lint-gate-coverage.feature
new file mode 100644
index 000000000..2cd14d369
--- /dev/null
+++ b/specs/typescript-lint-gate-coverage.feature
@@ -0,0 +1,193 @@
+Feature: The TypeScript lint gate covers every file it claims to, and debt cannot grow silently
+  As a maintainer of the @langwatch/scenario TypeScript SDK
+  I want CI to lint every file the workspace owns, with no package or path able to
+  opt out by accident
+  So that lint debt is visible when it is introduced instead of accumulating
+  invisibly, and so a green lint run means what a reader assumes it means
+
+  Background:
+    Given the TypeScript SDK lives in javascript/ as a pnpm workspace
+    And pnpm-workspace.yaml lists "." plus examples/*, examples/openai-realtime-demo and examples/openai-realtime-demo/realtime-client
+    And `pnpm -r run <script>` excludes the workspace ROOT even though "." is listed in packages:
+    And `pnpm -r run <script>` SKIPS, without erroring, any package that has no such script
+    And the examples import @langwatch/scenario through its published exports map, which points at dist/
+    And PR #755 added a lint:lib CI step that already gates src/ excluding tests
+    And the measured baseline at 88aec40, post `pnpm install --frozen-lockfile` + `pnpm build` on eslint 9.39.4, is 0 problems in src/** non-test (already gated by lint:lib)
+    And 209 problems in src/** tests, ungated
+    And 2 problems in root-level files (demo-sliding-deadline.ts, scripts/), ungated
+    And 19 problems in examples/custom-observability, ungated because it defines no lint script
+    And 0 problems in the other examples/*, already gated by lint:all
+
+  # ============================================================
+  # Group: The gate reaches every root-owned file (AC1, AC7)
+  # ============================================================
+
+  @integration
+  Scenario: lint:root covers src tests, root-level files and scripts, and excludes examples
+    # AC1
+    Given the lint:root script is defined in javascript/package.json
+    When `pnpm lint:root --format json` is run from javascript/
+    Then the linted-file list includes at least one path under src/ that is not a test
+    And it includes at least one path under src/**/__tests__/
+    And it includes the repo-root file demo-sliding-deadline.ts
+    And it includes at least one path under scripts/
+    And it includes zero paths under examples/
+
+  @integration
+  Scenario Outline: each root-owned sub-scope actually fails the gate when defective
+    # AC1 — one injected defect per sub-scope, proving the scope is gated and not merely listed
+    Given the working tree is clean and `pnpm lint:root` exits 0
+    When <defect> is injected into <file>
+    Then `pnpm lint:root` exits non-zero
+    And reverting the injection returns `pnpm lint:root` to exit 0
+
+    Examples:
+      | file                                     | defect                            |
+      | src/agents/__tests__/red-team.test.ts    | an out-of-order import            |
+      | demo-sliding-deadline.ts                 | an unused top-level variable      |
+      | scripts/generate-noise-samples.mjs       | a reference to an undefined global |
+
+  @integration
+  Scenario: scripts/ is linted with Node globals rather than browser globals
+    # AC7
+    Given scripts/generate-noise-samples.mjs is a Node script that uses Buffer
+    And eslint.config.mjs previously applied globals.node only to *.config.* files
+    When `pnpm lint:root` is run
+    Then scripts/generate-noise-samples.mjs reports zero problems
+    And no inline eslint-disable comment was added to that file to achieve it
+
+  # ============================================================
+  # Group: The autofixable debt is cleared by fixing code, not by silencing rules (AC2, AC11)
+  # ============================================================
+
+  @integration
+  Scenario: import/order is clean across the newly gated surface
+    # AC2
+    Given the baseline carried 98 import/order problems in src/** tests and 1 in demo-sliding-deadline.ts
+    When `pnpm lint:root --format json` is run on the change
+    Then zero messages carry ruleId "import/order"
+    And the one violation that `--fix` could not resolve, in src/voice/__tests__/playback.test.ts,
+        was fixed by moving the import rather than by suppressing the rule
+
+  @unit
+  Scenario: the baseline was cleared by fixing code, not by disabling rules or widening ignores
+    # AC11 — the escape hatch every bare "reports 0 problems" criterion leaves open
+    When the diff of javascript/eslint.config.mjs against main is inspected
+    Then no rule severity moved from "error" to "warn" or "off"
+    And no new entry was added to the top-level ignores array
+    And no rule was disabled for a path via a new ignores entry or --ignore-pattern
+    But recording the 106 known violations in a committed eslint-suppressions.json is permitted, per AC3,
+        because it keeps the rule at "error" and names every suppressed site
+    And the count of files linted by lint:root is greater than or equal to the count on main
+    And no added line in the diff introduces eslint-disable, --quiet, continue-on-error or no-error-on-unmatched-pattern
+
+  # ============================================================
+  # Group: no-explicit-any is enforced where it ships and ratcheted where it does not (AC3)
+  # ============================================================
+
+  @integration
+  Scenario: a new any in shipped library source fails the gate
+    # AC3
+    Given src/** non-test currently reports zero no-explicit-any problems
+    When an `any` is added to a non-test file under src/
+    Then `pnpm lint:root` exits non-zero
+    And `pnpm lint:lib` exits non-zero
+
+  @integration
+  Scenario: the existing test-file any is recorded per file and cannot grow
+    # AC3 — the ratchet. A --max-warnings integer was rejected: it is a TOTAL budget
+    # over every warn-level rule, so an unrelated unused variable consumes the same
+    # allowance as an `any`, and the two are freely interchangeable.
+    Given the 106 pre-existing no-explicit-any violations are recorded in eslint-suppressions.json
+    And that file records them per file and per rule, not as a single number
+    And no-explicit-any remains severity "error" everywhere, including tests
+    When `pnpm lint:root` is run unmodified
+    Then it exits 0
+    But when a 107th `any` is added to src/agents/__tests__/red-team.test.ts
+    Then `pnpm lint:root` exits non-zero
+    And when an unrelated warn-level violation is added elsewhere instead
+    Then it does not consume the no-explicit-any allowance
+
+  @integration
+  Scenario: the suppression baseline ratchets down and cannot silently widen
+    # AC3 — a baseline that only ever grows is a waiver, not a ratchet
+    Given a suppressed `any` is removed from a test file
+    When `eslint . --ignore-pattern 'examples/**' --prune-suppressions` is run
+    Then eslint-suppressions.json records one fewer suppression for that file
+    And the file is committed, so any change to the baseline is visible in review
+
+  # ============================================================
+  # Group: no package can escape the gate (AC5, AC6)
+  # ============================================================
+
+  @integration
+  Scenario: a workspace package with no lint script fails the gate instead of being skipped
+    # AC5 — the silent-skip hole that hid 19 problems
+    Given the guard enumerates workspace packages at runtime via `pnpm list -r --depth -1 --json`
+    And it never reads a hardcoded package list
+    When the lint script is removed from an existing package's package.json
+    Then `pnpm lint:all` exits non-zero naming that package
+    And when a NEW workspace package containing no lint script is added instead
+    Then `pnpm lint:all` exits non-zero naming that package
+    And restoring both returns `pnpm lint:all` to exit 0
+
+  @integration
+  Scenario: an enumerated lint script fails the gate because it drifts
+    # AC5 — `eslint agents/ index.ts` lints only what someone remembered that day
+    Given a package's lint script is changed from `eslint .` to an enumerated file list
+    When `pnpm lint:all` is run
+    Then it exits non-zero naming that package and its enumerated command
+
+  @integration
+  Scenario: examples/custom-observability is gated and clean without gutting its probes
+    # AC6 — nothing in CI executes this package, so the cleanup must be proven by running it
+    Given the package previously had no lint script and 19 problems
+    When it gains `"lint": "eslint ."` and the problems are fixed
+    Then `pnpm -F custom-observability-example lint` exits 0 with zero messages
+    And `pnpm -F custom-observability-example test:all` exits 0
+    And test-no-auto-init.ts still performs `await import("@langwatch/scenario")` for its side effect
+    And that probe still prints "Importing @langwatch/scenario did NOT auto-initialize OpenTelemetry"
+
+  # ============================================================
+  # Group: the gate fails honestly, not confusingly (AC4)
+  # ============================================================
+
+  @integration
+  Scenario: linting without a build reports the real cause instead of 63 resolver errors
+    # AC4 — reframed: the dist/ dependency is legitimate (examples consume the published
+    # surface); what was broken is that its absence produced misleading output
+    Given javascript/dist has been removed
+    When `pnpm lint:all` is run
+    Then it exits non-zero
+    And the output names javascript/dist as missing and tells the reader to run `pnpm build`
+    And it does not emit 63 import/no-unresolved errors for '@langwatch/scenario'
+
+  # ============================================================
+  # Group: nothing that already worked regressed (AC8, AC9, AC10)
+  # ============================================================
+
+  @integration
+  Scenario: lint:lib and lint:all still cover at least what they covered before
+    # AC8 — exit 0 alone would also pass for a gutted script
+    When the linted-file sets of lint:lib and lint:all are compared against main
+    Then each after-set is a superset of its before-set
+    And both commands exit 0
+
+  @integration
+  Scenario: the import reorder changed no runtime behaviour
+    # AC10 — a differential, not merely "green"
+    Given the autofix reordered imports across 40+ files under src/
+    When `pnpm test` is run before and after the change
+    Then the two runs report identical passed, failed and skipped counts
+    And no test file present before the change is absent after it
+    And `pnpm typecheck:all` exits 0
+
+  @e2e
+  Scenario: the gate is green on a CI run that actually executed it
+    # AC9 — a draft PR yields a green javascript-ci with ci-checks SKIPPED, so the
+    # job's own conclusion is what counts, never the aggregate
+    Given the PR is not a draft
+    When javascript-ci runs on it
+    Then the ci-checks job's own conclusion is "success" and not "skipped"
+    And the "Lint (root package)", "Lint (library)" and "Lint (workspace packages)" steps all pass
+    And no --max-warnings, --quiet, continue-on-error or new eslint-disable was added