Source: 2026-09-11 self-audit of v0.19.5 (commit f6f8484), finding D-M16 in the reconciled review; raw finding mech 6.8.
Severity: medium · Disposition: port differently · Evidence: observed fact
Location
.codecarto/.gitignore:1-13.
Defect
In a checkout, every findings output is ignored, so status.yaml says a phase is complete while a fresh clone has no report. In npm installs (D-H7) there is no ignore file at all. Two clones of the same project can disagree.
Proposed fix
Pick one policy (findings committed by default, documented opt-out) and apply it on both install paths.
The reimplementation spec carries this as a normative rule with a named acceptance scenario.
Source: 2026-09-11 self-audit of v0.19.5 (commit
f6f8484), finding D-M16 in the reconciled review; raw finding mech 6.8.Severity: medium · Disposition: port differently · Evidence: observed fact
Location
.codecarto/.gitignore:1-13.Defect
In a checkout, every findings output is ignored, so
status.yamlsays a phase is complete while a fresh clone has no report. In npm installs (D-H7) there is no ignore file at all. Two clones of the same project can disagree.Proposed fix
Pick one policy (findings committed by default, documented opt-out) and apply it on both install paths.
The reimplementation spec carries this as a normative rule with a named acceptance scenario.