docs(docs): add initiative 0011 — foundation adoption + process discipline (post-launch sweep, subordinate to 0010 freeze)#1686
Merged
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughA new pre-launch hardening initiative (0010) is documented with four phases: CI guards for process discipline, foundation adoption via migrations and deprecations, hardening verification through security and integration tests, and Storybook coverage hand-off. The initiative is indexed in the README with P0 priority and Sprint 2 ETA. ChangesPre-Launch Hardening Initiative Documentation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/initiatives/0010-foundation-adoption-and-process-discipline.md (1)
158-163: 💤 Low valueConsider router introspection complexity vs manual allowlist.
PR 3.2 proposes using "Express router-introspection або via OpenAPI-spec" to programmatically verify session protection. This approach has trade-offs:
Pros: Automated, catches future regressions
Cons: Complex to implement reliably (line 163 acknowledges false-negative risk from dynamic mounts)The mitigation is an explicit
EXEMPT_ROUTESallowlist, but this creates maintenance burden and somewhat defeats the purpose of automatic discovery.Consider whether a simpler approach might be more maintainable:
- Option A (current plan): Router introspection + manual allowlist
- Option B: Explicit test suite covering all sensitive routes (more manual but clearer)
- Option C: Schema-driven approach using OpenAPI tags (routes tagged
requiresAuth: true)The current plan is acceptable, but if implementation proves complex, fallback to Option B.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/initiatives/0010-foundation-adoption-and-process-discipline.md` around lines 158 - 163, The comment flags that router-introspection plus an EXEMPT_ROUTES allowlist (and requireSession() as the middleware being asserted) may be overly complex and high-maintenance; update the document to require a clear fallback plan: implement the automated router-introspection/OpenAPI-spec approach as the primary method but add explicit acceptance criteria (what counts as "covered") and a trigger to fall back to Option B (manual explicit test suite) if dynamic mounts or false-negatives are detected during implementation; also add guidance to minimize EXEMPT_ROUTES maintenance (single canonical EXEMPT_ROUTES constant and review checklist) and optional longer-term migration to Option C (OpenAPI tag requiresAuth:true) so maintainers know to prefer schema-driven tagging when available.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@docs/initiatives/0010-foundation-adoption-and-process-discipline.md`:
- Around line 158-163: The comment flags that router-introspection plus an
EXEMPT_ROUTES allowlist (and requireSession() as the middleware being asserted)
may be overly complex and high-maintenance; update the document to require a
clear fallback plan: implement the automated router-introspection/OpenAPI-spec
approach as the primary method but add explicit acceptance criteria (what counts
as "covered") and a trigger to fall back to Option B (manual explicit test
suite) if dynamic mounts or false-negatives are detected during implementation;
also add guidance to minimize EXEMPT_ROUTES maintenance (single canonical
EXEMPT_ROUTES constant and review checklist) and optional longer-term migration
to Option C (OpenAPI tag requiresAuth:true) so maintainers know to prefer
schema-driven tagging when available.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: cdaba324-d066-4480-9bae-8c77a9b9455a
📒 Files selected for processing (2)
docs/initiatives/0010-foundation-adoption-and-process-discipline.mddocs/initiatives/README.md
Co-Authored-By: Сон Хер <dmytro.s.stakhov@gmail.com>
Skords-01
force-pushed
the
devin/1777900501-init-0010-foundation-adoption
branch
from
4764e4e to
87061ef
Compare
Skords-01
changed the title
⏱️ CI Pipeline Duration ReportBased on the last 50 successful runs on the default branch. Overall Pipeline
Trend (last 20 runs): Per-Job Breakdown
|
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Додає нову ініціативу 0011 — Foundation adoption + process discipline (post-launch sweep) у
docs/initiatives/і реєструє її в таблиці активних уdocs/initiatives/README.md. Ініціатива підпорядкована0010-revenue-first-launch— поважає її 4-тижневий scope-freeze для shipping білінгу.Ініціатива об'єднує 18 PR-ів у 4 фазах у двох вікнах:
useFormValidation→useApiForm(feat(web): додати useApiForm — уніфікований form-engine на RHF + zod #1614), ad-hocisLoading/isError→<DataState>(feat(web): add <DataState> wrapper for RQ loading/empty/error/stale #1588). Реальний baseline (2026-05-04): 2 active form consumers, 6useApiFormconsumers, 0<DataState>real consumers, 15 manual-loading sites, 0 rawfetch()у modules.ETA загальна — 7 тижнів від старту, з 11-тижневим буфером до Q3-launch deadline 2026-09-30.
Цей PR — тільки документ-план. Жодних змін до коду / CI / runtime тут немає; кожна фаза породить окремі PR-и.
Governing Skill
sergeant-start-here(planning / governance, не feature)Playbook
docs/playbooks/deploy-config-change.md,docs/playbooks/security-pen-test-checklist.md) як частину PR 1.3 / 3.1.docs/initiatives/NNNN-slug.md+ оновленняdocs/initiatives/README.md— стандарт.Verification
Future-file refs у Phase 1/2/3/4 загорнуті у
<placeholder>синтаксис (наприклад,scripts/<check-pr-body>.mjs), щоб не triggerитиcheck-governance-sync.mjsяк dangling refs (file-template convention зscripts/check-governance-sync.mjs:185).Pre-existing CI failures (
Test coverage (vitest),check) не пов'язані з цим doc-only PR — підтверджено: PR #1685 (інший docs-only PR, який було змерджено) мав ті ж failures наmain.Additional checks:
README.mdоновлена; 0010 row preserved with new 0011 row appended)Docs and Governance
AGENTS.mdneeded an update. — Ні, ця ініціатива не змінює hard-rules; вона лише планує їх посилення (PR 1.1 — PR-template-guard) як майбутнє правило.docs/initiatives/README.mdupdated.Updated docs:
docs/initiatives/0011-foundation-adoption-and-process-discipline.md(новий, 158 рядків)docs/initiatives/README.md(рядок 0011 у таблиці активних ініціатив)Risk and Rollout
git revertцього PR-а; вилучити 0011-рядок зdocs/initiatives/README.md. Жодних follow-up cleanup не потрібно — нічого in-flight.Hard Rule #15
AGENTS.mdbefore coding.--no-verify.Reviewer Notes
scripts/<check-pr-body>.mjs) за convention зscripts/check-governance-sync.mjs:185— інакше governance-sync лінтер падав з 8 dangling refs. Реальні файли створяться у відповідних PR-ах.@Skords-01. Sub-tasks Phase 2 можуть делегуватися через child-Devin-сесії (1-2 одночасно, рішення user 2026-05-04).docs/governance/pr-template-required.jsonregistry — об'єднати enforcement.