Skip to content

docs: Phase 8.8 session prompt (replaces C-parked PR #9) - #10

Closed
artyhoo wants to merge 1 commit into
mainfrom
docs/phase-8.8-session-prompt
Closed

docs: Phase 8.8 session prompt (replaces C-parked PR #9)#10
artyhoo wants to merge 1 commit into
mainfrom
docs/phase-8.8-session-prompt

Conversation

@artyhoo

@artyhoo artyhoo commented May 8, 2026

Copy link
Copy Markdown
Owner

Summary

Self-contained orchestrator prompt for Phase 8.8 — prior-art evaluation mechanism. Replaces C-parked PR #9 (closed 2026-05-08 per multi-agent ultraview verdict). 1 file, 430 lines (transient artifact, ≤500-line invariant satisfied).

Phase 8.8 itself does NOT execute in this PR. This PR ships the prompt that drives Phase 8.8 session post-Phase-8-close.

What changed vs PR #9 (architectural)

# PR #9 (C-parked) This prompt
A1 IR7 entry в factory/rules-manifest.json NO manifest entry — Phase 2 principle pattern packages/core/principles/08-*.test.ts
A2 «equal footing с every rule has executable check» (manifest principle language) «every framework artifact claiming new capability cites prior-art evaluation» (broader, universal)
A3 Process rule promoted to manifest with check.type=manual Process discipline lives в CLAUDE/CONTRIBUTING/.husky — NOT manifest
A4 Soft warn pre-push hook Hard fail с structured escape hatch (Prior-art: skipped — ≥20 chars rationale)
A5 aif-evolve overlap missed Explicit cross-ref в aif-comparison.md §9 reuse matrix (T10)
A6 Time estimate 1-2 days docs-only 3-5 days implementation (validation script + husky hook + tests + docs)
A7 HARD BLOCKER for Phase 9 entry STRONGLY RECOMMENDED + Phase 8 retro escalation trigger
A8 Path: tests/principles/ (ghost — doesn't exist) Path: tests/hooks/ (exists)
A9 bash heuristic with broken subshell-return pattern Pseudocode + explicit prohibition on pipeline-return; «test before commit» mandate

Verified findings from ultraview (2026-05-08, multi-agent review of PR #9)

MAJOR (architectural):

  • M1: IR-namespace mismatch — IR1-IR6 = Integration Rules для distributed systems, не «invariant»
  • M2: Manifest scope = consumer code (stack values: ts-server / react-next / microservices), not framework's own artifacts
  • M3: packages/core/principles/ is right home (mirrors Phase 2 P1-P7 pattern, runs through existing CI)

Confirmed minor (m1-m9): redundant CI gate, broken bash, ghost test path, missing PR template, time estimate, framing inconsistencies, etc.

New findings (10): «Mirror Phase 7.5» false claim, ghost path, aif-evolve overlap missed, §10 differentiator drift, gating principles directory growth, Уровень sub-numbering, CI job count inconsistency, Phase 8 sequencing fragility, §13.10 trigger possibility, stop-rules clean.

Prompt structure

10 sections, 430 lines:

  1. Identity & Context
  2. Reading list (9 items, ordered)
  3. Architectural decisions A1-A6 (locked, do NOT revisit)
  4. Hard constraints (10 items)
  5. Task list T1-T11 (8 atomic commits + retro)
  6. Acceptance criteria (overall script)
  7. What NOT to do (10 hard-won lessons)
  8. Risk register (6 rows + mitigations)
  9. PR plan
  10. Post-merge actions

Acceptance for THIS PR

Test plan

  • Fresh-session reader test: open new Claude session, paste/read PHASE-8.8-PROMPT.md, ask «can you execute Phase 8.8 as described без re-debating architecture?». Should be self-contained.
  • Cross-ref check: every link в prompt resolves to existing file.
  • Future Phase 8.8 session uses this as input (acceptance comes when Phase 8.8 actually executes).

Related

Context

Art = first real consumer (per EXECUTION-PLAN.md §1 «No-consumers caveat — UPDATED 2026-05-08 (CLOSED)»). Production-grade discipline applies — no «good enough for solo» compromises.

…traview findings

PR #9 C-parked 2026-05-08 per multi-agent ultraview verdict. Replaces 5
iterative architectural pivot commits с clean implementation prompt
based на verified findings.

Architectural decisions locked (do NOT revisit during execution):
- A1: NO IR-namespace в manifest (manifest = consumer code; IR1-IR6 =
  Integration Rules для distributed systems)
- A2: Phase 2 principle pattern packages/core/principles/08-*.test.ts
  (mirror existing 01-07; runs through existing principles-meta-tests
  CI job)
- A3: Tighter framing «every framework artifact claiming new capability
  cites prior-art evaluation» (broad, universal)
- A4: Process discipline lives в CLAUDE/CONTRIBUTING/.husky/pre-push,
  NOT in manifest (different surface, different enforcement)
- A5: Hard fail с structured escape hatch (Prior-art: skipped — ≥20
  chars rationale)
- A6: aif-evolve overlap explicit cross-ref в aif-comparison.md §9
  (complementary, manual prior-art consult vs auto-mining from patches)

8 task implementation phase (T1-T11) + retro:
- T1: SSOT skeleton + format spec
- T2: Autogrep first entry (demonstrates Prior-art trailer convention)
- T3: 08-prior-art-cited Phase 2 principle (Vitest)
- T4-T5: Netlify framework-info + fitness functions entries
- T6: §5.5 Step 1.5 mandatory consult gate
- T7: CLAUDE.md + CONTRIBUTING.md + .github/pull_request_template.md
- T8: pre-push hook (TESTED bash; PR #9 m4 lesson — no subshell-return)
- T9: tests/hooks/prior-art-trailer-hook.test.sh (anti-tautology guard)
- T10: staleness policy + aif-evolve cross-ref + fitness functions
  vocabulary
- T11: Phase 8 retroactive audit + Phase 8.8 retro

Honest framing:
- Implementation phase, NOT mirror Phase 7.5 (which was docs-only ≈30
  min) — Phase 8.8 = 3-5 дней wall-clock
- Phase 9 entry: STRONGLY RECOMMENDED, NOT HARD BLOCKER (Phase 8 retro
  decides escalation)
- Path: tests/hooks/ (exists), NOT tests/principles/ (ghost path from
  PR #9 N3 finding)

Includes 6-section reading list, 10-item «What NOT to do» (hard-won
from ultraview), 6-row risk register, per-task verification commands,
overall acceptance script. 430 lines total (transient artifact, well
under 500-line invariant).

Triggered by: Phase 8 close (acceptance GO verdict). Branch: create
docs/phase-8.8-mechanism from main post-Phase-8-merge. Self-contained
execution — fresh session reads prompt, executes 8 commits + retro.
@artyhoo

artyhoo commented May 8, 2026

Copy link
Copy Markdown
Owner Author

Closing without merge — Phase 8.8 implementation merged in PR #12 (commit a971728).

The prompt file (docs/meta-factory/PHASE-8.8-PROMPT.md) was a transient input artifact for the implementation session. The actual outcomes, verification block, and 5 new findings are captured in the retro docs/meta-factory/retros/phase-8.8.md, which IS on main.

Convention from Phase 7.5: prompts are transient, retros are kept. Closing this PR keeps that convention.

The branch remains in the repo for historical reference (not auto-deleted on close).

@artyhoo artyhoo closed this May 8, 2026
artyhoo added a commit that referenced this pull request May 8, 2026
Closes 2 MAJOR + 1 MINOR review findings on PR #13:

- M1 — A3 SSOT entry #5 was added with 1 phrasing; PROMPT Hard
  Constraint #10 strictly requires ≥3 phrasings BEFORE adding SSOT
  entry. Added 2 more context7 query-docs phrasings against
  /anthropics/anthropic-sdk-typescript covering cache_control TTL
  options, max_uses budget, server_tool_use.web_search_requests
  counter, Usage interface token-counter independence. Updated
  §4.A3 with 3-phrasing log + production-tracking surface details
  (strengthens SSOT #5 ADOPT-WHEN-TRIGGERED claim).

- M2 — A1 ROI rigor: PROMPT §6 T3 explicitly named Cody and Aider
  as candidates; T3.2 covered only Cursor + Continue.dev + Factory.
  Added Cody (Sourcegraph) + Aider lookups. Both confirm: Cody's
  cody.contextFilters / *.rule.md and Aider's .aider.conf.yml are
  AGENT-side configuration (model selection, repo filters, prompt
  guidance), NOT ESLint rule pick-from-menu. 5-candidate coverage
  reinforces «no LLM-pick-of-ESLint-rules analog in production»
  negative-existence claim — A1 DEFER verdict strengthened, not
  weakened.

- m1 — retro Verification block #4 said «10 trailer lines» but
  actual count is 11 (T5 skipped + T6 retro trailers were missing
  from enumeration). Corrected to 11 = 3+1×8 across 9 commits.

No verdict change in §5 matrix; ROI thesis still closes negative.
SSOT entries #4, #5 unchanged. Phase 9 implementation scope
(A6/A7/A8/A9 BUILD; A1-A5 DEFER) unchanged.

File sizes after T7: phase-9-entry-research.md 182 LOC (≤200);
retro 115 LOC (≤200); SSOT 96 LOC (≤500). Principle 08 7/7,
246/246 core tests, 9/9 verdict rows match acceptance regex.

Prior-art: prior-art-evaluations.md#5 (web_search_20250305 — 2 additional context7 phrasings close M1 violation of Hard Constraint #10; ≥3 phrasings discipline now satisfied for SSOT entry add).
Prior-art: prior-art-evaluations.md#4 (Factory ESLint Plugin — Cody + Aider lookups close M2 coverage gap; 5-candidate base reinforces negative-existence claim driving A1 DEFER).
artyhoo added a commit that referenced this pull request May 10, 2026
…r reviewer REVISE

Closes 1 BLOCKER + 2 MAJOR + 1 MINOR from reviewer pass on 98ef3ba.

P1 (B1) — §10 SSOT schema fixed to 8 columns matching prior-art-evaluations.md §4 precedent (entries #1-#15):
ID | Candidate | Capability matched | First seen | Last reviewed | Verdict | Rationale | Trigger to revisit
Velocity moved from 9th-pseudo-column into Rationale field opener per #6-#10. First seen / Last reviewed = 2026-05-10 for all #16-#21.

P2 (M1) — context7 phrasings backfill:
- §1 (O1): +2 new queries (`/modelcontextprotocol/servers`, `/vercel/platforms` resolve). Material correction: SECURITY.md states reference servers «not production-ready»; §1 maturity column downgraded from «Mature/Official» to «Reference».
- §3 (O3): +1 new query (`/websites/windsurf`); other 7 documented as «derived from O0 sweep».
- §4-§8: each section gets one-line motivation explaining why no new query was needed (analytical / cognitive-probe / pattern-comparison objectives).

P3 (M2) — rule-5 counter-prompt added to §0 as item 3:
2 phrasings against `/renovatebot/renovate` + `/sverweij/dependency-cruiser` + `/tj-actions/changed-files`. NULL result. Confirms «incrementality is gap in every surveyed framework» negative-existence claim. §13.3 `#negative-existence-claim` raised LOW → MEDIUM with explicit residual-risk acknowledgement.

P4 (m1) — Windsurf gap closed AND classification raised:
- §3 row revised: Windsurf Cascade detect-and-install + MCP Marketplace one-click deeplink + `pre_mcp_tool_use` hook surfaced. Second partial-end-to-end candidate alongside AIF.
- §3 conclusion updated: «AIF and Windsurf Cascade» (not just AIF) carry the discover-env-→-propose/install shape.
- §13.3 `#category-sweep-missed` LOW → MEDIUM. `#prompt-list-anchoring` description revised to acknowledge floor-as-ceiling failure caught at reviewer pass.
- §13.4 self-reflexive checklist updated: 3 counter-prompts (was 2); §1.5 line acknowledges reviewer-driven gap closure.

File: 486 lines (under 500 cap). 14 sections intact. Principle 09 doc-authority test green.

Prior-art: skipped — follow-up edit closes reviewer findings on existing research-patch; no new capability per CLAUDE.md hook definition; SSOT proposals (§10) still land in orchestrator session per prior-art-evaluations.md §3 step 1.
artyhoo added a commit that referenced this pull request May 24, 2026
…205)

Closes Sub-wave F.3 from `.claude/orchestrator-prompts/meta-orchestrator-followup-audit/kickoff.md §1` per the binding scope in `docs/meta-factory/research-patches/2026-05-24-meta-orchestrator-refactor-f3-scope.md §1.5` (12 items, all addressed in this commit).

### G §1.5 items closed

- **Item 1 (M1)** — §5 dispatch table row «R-phase, single» routed to Mode A inline (was Queue mode); aligns with `queue-mode.md §1 Triggers` («single kickoff → Mode A»).
- **Item 2 (D3-MAJOR)** — §0 `disable-model-invocation: true` misattribution fixed: the flag suppresses CC's default auto-load into subagent contexts, NOT a recursive-invocation guard (subagent depth is hard-capped at 2 by CC's harness per `code.claude.com/docs/en/sub-agents.md`).
- **Item 3 (M2)** — `references/plain-language-tail.md:8` «injects» wording replaced with «enforces presence via Stop hook `decision:block` mechanism». Mirror synced.
- **Item 4 (m1)** — §5 added missing «R-phase, multiple sequential → Queue mode» row.
- **Item 5 (m2)** — §6 stage-gate `created:>=2026-05-23` hardcoded date filter removed; `head:<branch> base:staging` is specific enough; T-MOB-B notes the corner-case discipline.
- **Item 6 (m3)** — blank line added before `## See also` (Markdown convention + principle 09 header format).
- **Item 7 (F3-S1)** — §5 antipatterns added: `#worker-dispatch-via-subagent` + `#commit-on-behalf-of-worker`, each with falsifier.
- **Item 8 (F3-S2)** — §10 «Inline session report» expanded to specify the 3-layer structure (`## Dependency graph` ASCII tree + `## Action queue` 5-column table + `### Stage N` 1-liner blocks). SKILL.md stays under the 500-line gate by pointing the full grammar at `references/output-format.md` (kickoff §4 #10 split option).
- **Item 9 (F3-S3)** — NEW `references/output-format.md` (299 lines) with grammar + 4 worked examples (Mode A single / Mode SDD / Mode B × N parallel worktrees / Mode Queue) + ASCII templates + 1-liner anti-patterns. Mirror synced (consumer-relative paths in §A see-also block).
- **Item 10 (Gap-1)** — `launch-table-generator.sh detect_subwaves()` keyword filter added (`R-phase|execution|wiring|Mode [AB]|Direct Edit|SDD|Queue mode|I-phase|implementer|reviewer|sub-wave`) to avoid §1/§2 hook+dispatch tables being matched as sub-waves. Mirror synced + smoke-tested on this kickoff (8/8 sub-waves correctly detected).
- **Item 11 (§1 Step 2 REPORT reconciliation)** — added clause: when maintainer-passed REPORT contradicts `gh pr list`, emit reconciliation note and trust mechanical state (REPORT is supplementary, not load-bearing; per 3-layer responsibility model + memory `feedback_no_human_verification_ai_self_verifies`).
- **Item 12 (mirror sync)** — every edit propagated to consumer mirror (`skills/meta-orchestrator/`); helpers/launch-table-generator.sh byte-identical; SKILL.md mirror gains a condensed §10 carrying the same 6 required substrings; output-format.md mirror is identical content with consumer-relative §A links (markdown links replaced by plain text for project-internal refs so `check-skill-drift.sh` stays green).

### Principle 18 — new (`packages/core/principles/18-meta-orchestrator-output-format.test.ts`)

Mechanical structural check: for each of the 4 surfaces (authoring SKILL.md §10, mirror SKILL.md §10, authoring output-format.md, mirror output-format.md), asserts the 6 required substrings are present (`## Dependency graph`, `↓`, `## Action queue`, `Paste в новый CC tab`, `Можно параллельно с`, `### Stage`). Includes companion paired-negative tests proving the check fails on synthetic broken §10 content (per principle 02 discipline).

Slot 18 verified free (slots 01-17 occupied).

### Acceptance criteria

- ✅ SKILL.md §10 expanded with 3-layer output spec (compact pointer + substring spec); SKILL.md stays under 500-line gate (499 lines).
- ✅ `references/output-format.md` shipped with grammar + 4 worked examples (Mode A / SDD / Mode B × N / Queue).
- ✅ Consumer mirror synced; `check-skill-drift.sh` green; principle 14 green.
- ✅ Principle 12 still green (kickoff §5 AI-traps citations unaffected).
- ✅ Principle 18 green (new).
- ✅ Own cold-QA pre-handoff (T19): G §1.5 12 items + kickoff §4 #10 + §1.7 forward/backward verified.

§1.7: forward+backward-check applied. Forward — principle 18 = REFERENCE from principle 12 precedent at packages/core/principles/12-ai-laziness-traps.test.ts:24; Argo `├── / └──` ADAPT vocabulary cited from F.1 prior-art PR #203 at docs/meta-factory/research-patches/2026-05-24-meta-orchestrator-ux-research.md:30; deterministic TypeScript substring grep with no paid LLM (no-paid-llm-in-ci.md §1); references/output-format.md carries Authoritative-for header per doc-authority-hierarchy.md §2 at .claude/skills/meta-orchestrator/references/output-format.md:3; SKILL ↔ references spec-of pointer at .claude/skills/meta-orchestrator/SKILL.md:421 per dual-implementation-discipline.md §5. Backward — principle 18 scope = SKILL.md §10 of meta-orchestrator skill only (covers both authoring + mirror copies via SURFACES array at packages/core/principles/18-meta-orchestrator-output-format.test.ts:54-77); does NOT introduce retroactive sweep across other skills; paired-negative tests at packages/core/principles/18-meta-orchestrator-output-format.test.ts:152-185 prove the check is non-tautological per principle 02.

### See also

- Parent kickoff: `.claude/orchestrator-prompts/meta-orchestrator-followup-audit/kickoff.md §1` Sub-wave F.3
- G research-patch §1.5: `docs/meta-factory/research-patches/2026-05-24-meta-orchestrator-refactor-f3-scope.md`
- F.1 prior-art: `docs/meta-factory/research-patches/2026-05-24-meta-orchestrator-ux-research.md`

Prior-art: prior-art-evaluations.md#64 (subagent-driven-development KEEP-NARROW + REFERENCE — F.3 introduces no new capability beyond extending the existing meta-orchestrator skill per the G binding scope; no new SSOT row needed).
artyhoo added a commit that referenced this pull request May 26, 2026
Maintainer correction 2026-05-26 caught 4 invariant-level violations in
first draft of B3 sub-mechanism:

1. CI cast as primary evaluator (violates README CI=last-resort invariant)
2. Literal "halt-on-first-CI-red" despite REVISE=3 in same kickoff row
3. False claim "companion-projects only in memory" (§1.13 codified 2026-05-22)
4. "Oracle via subagent = expensive/complex" while session was using it for
   cold-review (91k tokens / 3 min / caught 2 MAJOR)

All four are nested T-traps on self (T3 + T16 + T11/T13 + recursive-self-
application gap). Cold-review subagent missed all four because its prompt
was structural-check, not invariant-check.

Patch changes:
- §0: add T-BA-E #ci-as-primary-evaluator trap (specialisation of T3+T16);
  enumerate it alongside existing T-BA-D #bundle-name-match
- §3 B3 table: add 4 new candidates with corrected scoring —
  oh-my-openagent (#8, ADOPT three-attempt+Oracle protocol, ~95% match,
  EXACT problem class), Aider --auto-test (#9, ADOPT success-path,
  ~85%), OpenHands AgentController (#10, ADOPT VOCABULARY + REFERENCE,
  ~80%), Claude Task Master autopilot (#11, ADOPT pause-not-halt
  semantics, ~80%); re-score Anthropic evaluator-optimizer ~40%→~90%
  with reframe (Oracle subagent IS our evaluator-LLM, not CI)
- §5 B3 verdict: rewrite from "ADOPT SDD + vocab from Argo/Anthropic" to
  ADOPT composition of 4 production patterns (oh-my-openagent +
  Aider + Task Master + Anthropic evaluator-optimizer + Superpowers SDD
  reviewer-loop); BUILD-delta ≤130 LOC (per-item-in-bundle wrapper +
  Oracle prompt template + bash glue), only what no upstream provides
- §7 forward-check: explicit T-BA-E listing + meta-insight section
  acknowledging this R-phase demonstrated the Oracle layer is missing in
  our own workflow (not just for B3); the very pattern this patch
  recommends building for B3 is the pattern this patch itself needed
  for its own discipline check

Companion memory codified:
- feedback_oracle_via_subagent_reuse_existing.md (4-checker before BUILD)
- feedback_cold_review_must_check_core_invariants.md (invariant-check
  template for future cold-review subagent prompts)
- feedback_b3_revise_not_halt_on_ci_red.md (REVISE semantics correction)
- feedback_ai_doc_research_priority_pool.md broadened scope (added
  runtime side; corrected oh-my-openagent canonical URL)

Research-only: zero SSOT row mutations, no helpers shipped. Per-sub-mech
verdict unchanged for B1/B2; B3 verdict substantially strengthened by
prior-art composition. Stage 2 maintainer GO/DEFER/DROP decision unblocks
Stage 3 I-phase.

Prior-art: skipped — research-patch only, no capability commit
artyhoo added a commit that referenced this pull request May 31, 2026
…#99 multi-device (#324)

DeepWiki re-survey (maintainer runs CC through Superset). Corrects the
WebSearch-only false-negative in survey row #10 (Apache Superset != superset.sh):
Slack-agent is real. Adds the operator-vs-shipped two-axis frame to #86 so REJECT
is not misread as "operator may not use Superset". #99 = multi-device deviceId
dispatch (REFERENCE, not built today). Survey patch §9 correction appended.

Prior-art: skipped — append-only SSOT correction + research-patch correction note; no new capability, no dependency, no code.
artyhoo added a commit that referenced this pull request Jul 11, 2026
…rrides where unavoidable (#980)

Fixes all 16 open Dependabot alerts (triage-first, per-alert rationale below). Two atomic commits: lock/manifest bumps; drizzle fixture pins. No new dependencies — overrides entries and in-range bumps only; not a capability commit.

## Per-alert disposition

| Alerts | Package | Fix | Mechanism |
|---|---|---|---|
| #17-#24 (7×, incl. **critical** CVE-2026-33937) | handlebars 4.7.8 → 4.7.9 | root lock | `eslint-plugin-boundaries ^5.0.0 → ^6.0.2` in `packages/preset-react-spa/package.json:26` — 6.0.2 pins `@boundaries/elements 2.0.1` → handlebars 4.7.9. Chosen over also-available ^7.0.2 as the smaller major jump with the same security outcome. The shipped template `packages/preset-react-spa/templates/eslint.config.react.mjs` is unchanged: v6 keeps the explicitly-configured legacy `element-types` rule + `boundaries/elements` settings working. |
| #4, #5 (CVE-2026-8723) | qs 6.15.1 → 6.15.2 | both locks | `overrides` in root `package.json` + `packages/core/package.json` — **unavoidable**: latest typed-rest-client (3.0.0) still pins vulnerable qs 6.15.1 exactly (verified against the npm registry). |
| #27 (CVE-2026-53550) | js-yaml 4.1.1 → 4.2.0 | root lock | `overrides "js-yaml": "4.2.0"` — parent markdownlint-cli2 pins exact 4.1.1; its fixed release 0.23.0 requires node>=22 while CI runs node 20, so the parent bump is blocked. Exact spec matches packages/core's direct-dep spec (npm direct-dep override rule). |
| #12 (CVE-2026-48988) | markdown-it 14.1.1 → 14.3.0 | root lock | `overrides "markdown-it": "^14.2.0"` — same markdownlint-cli2 exact-pin reason. |
| #10, #13 (CVE-2026-49356) | @babel/core 7.29.0 → 7.29.7 | both locks | in-range `npm update` (parents allow ^7.x / ~7.29.0). |
| #7 | esbuild 0.28.0 → 0.28.1 | packages/core lock | in-range `npm update` (tsx ~0.28.0, vite ^0.28.0). Root esbuild was already 0.28.1. |
| #16, #28 (CVE-2026-39356, high) | drizzle-orm ^0.40.0 → ^0.45.2 | 2 fixture manifests + stub | `packages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5`, `packages/core/research/fixtures/tier1-single-root/package.json:3`, stub `.../node_modules/drizzle-orm/package.json` bumped in lockstep. Consuming tests verified version-insensitive (name-based detection; `research-plan.json` has `version: null`) — fixed, not dismissed. |

## Notes

- **Synth bundle deliberately NOT regenerated:** the bundle is built by ROOT esbuild (`scripts/build-synth-bundle.sh:17` uses `$ROOT/node_modules/.bin/esbuild`), which was already 0.28.1 and is unchanged; the packages/core esbuild bump is a non-feeding transitive. `NODE_ENV=development build-synth-bundle.sh --check` green after fresh `npm ci` of both locks.
- **Consumer note (preset-react-spa):** boundaries v6 changes the `dependency-nodes` default from `["import"]` to `["import","export","require","dynamic-import"]`. Consumers may see new (legitimate) `boundaries/element-types` findings on `export … from` / `require()` / dynamic-import edges — stricter, not broken.
- **Expected `npm ls` marker:** `invalid: qs@6.15.2` under typed-rest-client is the documented override-forced exact-pin violation (the point of the fix); no CI gate runs `npm ls`.

## Verification

- Full local CI-equivalent gate set green: typecheck, full packages/core suite (2288 tests, 0 failed), `format:check`, `NODE_ENV=development build:synth-bundle:check`, `render-rules --check`, `render-rule-index --check`, install-sh `gh-534-arch-boundaries` + `f17-lint-rules-planted-violation` + `byte-identical` (fingerprints unchanged — no SNAPSHOT_MODE regen needed).
- Lock integrity independently re-verified from clean state: `npm ci` (root) and `npm ci --prefix packages/core` both exit 0; every touched lock entry has version+resolved+integrity; zero unexpected version changes in either lock diff (only intended packages + their transitive helper chains).

## §1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files)

### §1.7 Forward-check applied
This PR introduces no new rule; the forward obligation is that each fix lands at the earliest reachable channel and is executable, not prose: vulnerable versions are excluded structurally by manifest constraints — `package.json:6-10` (overrides block), `packages/core/package.json` overrides, `packages/preset-react-spa/package.json:26` (^6.0.2 floor) — so any future `npm install` cannot silently re-resolve a vulnerable version; regressions fail at install/lock level, before CI.

### §1.7 Backward-check applied
Class of this change = dependency-version-constraint updates. Surfaces where the class occurs, each swept: root `package-lock.json` (all 6 target packages patched, no residual vulnerable entries — verified over the full lock, not the diff); `packages/core/package-lock.json` (qs/@babel/core/esbuild patched; contains NO handlebars/js-yaml/markdown-it entries → no overrides needed there); fixture manifests `packages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5` + `packages/core/research/fixtures/tier1-single-root/package.json:3` + its stub (bumped in lockstep, internally coherent); other fixture manifests under `packages/core/**/fixtures/` (swept — no other pinned occurrences of affected packages); shipped templates + `install.sh` (grep: zero version pins of affected packages); synth bundle `packages/core/synthesizer/synth-and-wire.bundle.mjs` (not fed by the core esbuild entry — `scripts/build-synth-bundle.sh:17`; `--check` green); install fingerprints/baselines (`tests/install-sh/byte-identical.test.sh` green — unshifted).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant