feat: Phase 8.8 — prior-art evaluation mechanism (08-prior-art-cited principle + Prior-art trailer convention) - #12
Merged
Merged
Conversation
Phase 8.8 T1. New shipped reference doc establishes the build-vs-reuse single source of truth: format spec for entries, verdict semantics (ADOPT / ADOPT VOCABULARY / DEFER / WATCHLIST / REJECT), template for adding entries, empty entry table at section 4, cross-refs to T3/T6/T7 deliverables (forward-pointers). This commit establishes the base file. T2 adds the first entry (Autogrep) and demonstrates the Prior-art commit trailer convention; the trailer convention itself is formalized in T7 (CONTRIBUTING.md). T1 itself does not carry a Prior-art trailer — there is no SSOT to cite yet. 82 lines (≤500 LOC reference doc constraint).
…rt trailer) Phase 8.8 T2. First entry in prior-art-evaluations.md SSOT, demonstrating the row schema established in T1 and the `Prior-art:` commit trailer convention that T7 will formalize in CONTRIBUTING.md. T1 itself shipped without a trailer (no SSOT to cite); T2 onward demonstrates the convention in advance of formal codification. Entry: ID 1 — Autogrep (Semgrep + LLM, 2024–2025) Capability: L3 LLM-driven rule generation Verdict: DEFER Rationale: closest single analog per ultraview 2026-05-08; context7 lookup 2026-05-08 (≥3 phrasings: resolve "Autogrep", resolve "Semgrep", query "Autogrep AI LLM rule generation from CVE patches", query "Autogrep machine learning rule generation security vulnerabilities") confirms Semgrep auto-generates rules from CVE / GHSA / Electron release-note feeds — security-only domain, no stack-aware field, no self-application invariant, no best-practice-doc source signal. Trigger: LLM v2 condition fires per open-questions §13.10 #1, OR new Autogrep release / Semgrep rule-synthesis-from-docs feature surfaces. Hard constraint #5/#9 satisfied: ≥3 context7 phrasings before adding the entry. Hard constraint #1 satisfied (zero LLM at runtime; the lookup itself is research-time human-in-the-loop, not a hot-path call). Prior-art: 2026-05-08 analog research session (PR #9 C-park) -> Autogrep closest analog identified; PR #9 ultraview confirmed; T2 context7 lookup 2026-05-08 verified Semgrep CVE-derived rule generation feature still ships.
Phase 8.8 T3. Adds Phase 2 principle 08 — every framework artifact
claiming new capability cites prior-art-evaluations.md by ID. T3 enforces
this on phase research files; widening to design docs / retros is
deferred to Phase 8.8 retro per actual false-positive data.
Test structure mirrors principles/04-no-tautology.test.ts:
- assertPrinciple8(filename, content, ssotIds) — pure helper, throws on
violation; broken-reference check is universal, citation-presence
check is gated by BASELINE_EXCEPTIONS.
- Main probe: walks docs/meta-factory/phase-*-research.md and
phase-*-entry-research.md (regex covers both naming conventions),
collects violations.
- Mutation tests: synthetic in-memory file content (no fixture files):
no citations + non-baseline -> fail; broken citation #999 -> fail;
valid citation -> pass; baseline file with no citations -> pass;
baseline file with broken citation -> still fail (universal check).
- SSOT loader negative invariant: schema-table headers in §1/§2
(non-numeric `| ID |` cells) do not pollute the entry-id set.
Pre-T3 baseline (phase-3..phase-8 research files) is documented in the
test as `BASELINE_EXCEPTIONS`. Future research files post-T3 must cite
or be added to baseline with explicit rationale (the test will fail loud
otherwise — no quiet bypass).
Recursive self-application loop: principle 08 validates artifacts cite
the SSOT; Phase 8.8 commits T2-T11 carry `Prior-art:` trailers; the
trailer convention is formalized in T7 CONTRIBUTING.md. The principle
test is the L4-level invariant; the trailer is the developer-time
discipline; the SSOT is the source data.
Vitest discovery: `principles/**/*.test.ts` glob already covers the new
file; no vitest.config.ts edit needed. Picked up by existing CI job
`principles-meta-tests` automatically.
Verified: 7/7 tests in 08-prior-art-cited; 34/34 across all 8 principles
(was 27 before T3; +7 new); make self-audit green.
Prior-art: prior-art-evaluations.md#1 (Autogrep, verdict DEFER — different domain, no overlap with framework-internal artifact validation; the principle 08 surface area is meta-test of doc artifacts, not LLM-driven rule synthesis).
Phase 8.8 T4 + T5. Two more SSOT entries demonstrating non-overlapping verdicts and the qualified `ADOPT VOCABULARY` form. T4 (ID 2) — Netlify CLI framework-info / detect-server-settings: Capability: L1 multi-framework version-aware detection Verdict: WATCHLIST context7 lookup 2026-05-08 (≥3 phrasings: resolve "Netlify", query "framework-info framework detection version-aware Next.js Fastify multi-framework") confirmed `netlify dev --framework` flag default `#auto` plus `src/utils/detect-server-settings.ts` orchestrating cross-framework detection. Production-ready, but blocked by §6.0 #2 (no new explicit deps). WATCHLIST instead of DEFER because the blocking constraint is policy-based (stop-rule relax-criterion) not domain-based — same problem space, just forbidden capability for v1. T5 (ID 3) — Fitness functions (Ford / Parsons / Kua, *Building Evolutionary Architectures*, 2017 / 2nd ed. 2023): Capability: framework-level meta-test pattern vocabulary Verdict: ADOPT VOCABULARY (qualified form of ADOPT) Vocabulary entry — no library to context7-resolve; the term is published in books not indexed as a library SDK. T10 updates overview.md L2 description to use the term where applicable. Adoption is doc-terminology-only — no code, no dep, no behavior change. Picks up academic-literature alignment for the principles-as-tests pattern (`packages/core/principles/01-08`). SSOT now at 3 entries (was 1). Principle 08 still green (broken-ref check confirms IDs 2 and 3 resolve to entries; future cites of #2 / #3 from research files will pass the principle test). Two `Prior-art:` trailers — one per entry — to make the audit trail explicit per entry, not combined. Prior-art: prior-art-evaluations.md#1 (T4 — independent capability: L1 detection vs Autogrep's L3 generation, no overlap; both can be DEFER/WATCHLIST simultaneously). Prior-art: prior-art-evaluations.md#3 (T5 — fitness functions = established vocabulary for framework-level meta-test invariants per Ford 2017+; this commit creates the entry citing itself, which is acceptable for vocabulary adoption per the recursive-self-application thesis).
Phase 8.8 T6. Inserts new sub-step 1.5 between «List capability areas»
(was item 1, stays item 1) and «Resolve candidates» (was item 2, now
item 3) in §5.5 Step 0. Existing items 2-5 renumber to 3-6; the
internal cross-reference inside Step 1.5 («include candidate в Step 5
matrix») reflects the new numbering of Build matrix.
Step 1.5 enforces:
- For each capability area surfaced in Step 1, consult SSOT (prior-art-
evaluations.md) for matches on «Capability matched».
- On match: (a) update «Last reviewed» in same commit as phase research;
(b) include candidate in Step 5 matrix with current verdict; (c) if
verdict is DEFER/WATCHLIST, add explicit re-evaluation note.
- On no match: continue to Step 3 Resolve candidates; if new candidate
surfaces there, it is added to SSOT in the same commit as phase
research (per prior-art-evaluations.md §3).
- Acceptance: phase-N-research.md cites matched entries by ID format
`[prior-art-evaluations.md#N]`, «Last reviewed» dates touched in same
commit (`git log -p` audit in phase retro).
This is the developer-time enforcement layer; principle 08 (T3) is the
test-time enforcement layer; the SSOT (T1+T2+T4+T5) is the source data.
T7 will add the third layer (commit trailer convention in CONTRIBUTING.md
+ pre-push hook).
Numbering note inlined in Step 1.5 itself: the «1.5» label is preserved
per Phase 8.8 prompt T6 wording, even though the actual list position
became «item 2» — the label communicates the insertion point semantically.
Prior-art: prior-art-evaluations.md#1 (process gate complementary to SSOT — different layer, no overlap with Autogrep's L3 LLM-driven generation; this commit edits process docs, not adds capability).
…ention + PR template
Phase 8.8 T7. Three new/extended files codifying the build-vs-reuse
convention at the developer-time surface:
CLAUDE.md (NEW, 58 lines, repo root) — auto-loaded by Claude Code.
Concise agent-facing summary: when to consult SSOT, what counts as a
capability commit, `Prior-art:` trailer syntax with positive +
escape-hatch examples, recursive-self-application table linking the
three enforcement layers (T3 meta-test / T6 process gate / T7+T8
developer-time hook).
CONTRIBUTING.md (extended, 98 -> 190 lines) — full contributor-facing
detail. New section «Build-vs-reuse + `Prior-art:` trailer convention»
inserted before existing «Reference». Includes:
- Capability commit definition (mirrors T8 hook detection contract).
- Out-of-scope list (refactors, doc edits, snapshot regen, recipe
data edits — explicitly NOT capability commits).
- Trailer syntax with positive forms (multiple Prior-art lines stack)
and escape-hatch with hard rules: ≥20 chars rationale, must specify
why, placeholder rejection list (TODO / later / n/a / tbd).
- Recursive-self-application table mirroring CLAUDE.md.
- Bypass policy: --no-verify skips hook content but principle 08 still
catches research-file violations in CI; no silent bypass possible.
.github/pull_request_template.md (NEW, 12 lines) — PR-time checklist.
Prior-art consult section + Test plan section with explicit links to
audit commands. Picks up automatically on `gh pr create` without
--body.
Verification:
test -f .github/pull_request_template.md ✓
grep -q "Prior-art" CONTRIBUTING.md CLAUDE.md ✓
wc -l CONTRIBUTING.md = 190 ≤500 ✓
npm test principles/08 7/7 ✓
Recursive-self-application: T7 itself adds new files ≥80 LOC
(CLAUDE.md = 58 LOC < 80; CONTRIBUTING.md delta = 92 LOC ≥ 80). The
addition is documentation of the convention, not new capability code,
so the trailer cites the process gate rationale, not new capability
discovery. Hook detection rule for «doc edit» is implicit: docs are
typically below the size threshold, but T7 is borderline — explicit
trailer here records the «process discipline» surface.
Prior-art: prior-art-evaluations.md#1 (process discipline different surface from artifact — Autogrep entry rationale already notes this; T7 codifies the discipline at developer-time, complementary to T3 meta-test layer and T6 process-gate layer, not duplicative).
… hard fail
Phase 8.8 T8. Adds section 7 to the pre-push hook: capability-commit
detection + `Prior-art:` trailer validation. Definition of "capability
commit" mirrors CONTRIBUTING.md and CLAUDE.md (ordered checks):
(a) new explicit dep in package.json — `^\+\s+"[^"]+":\s*"\^?[0-9]`
grep on the staged diff;
(b) new file ≥50 LOC under a NEW subdirectory of packages/core/ —
checks parent commit `git ls-tree` for the subdir's prior absence;
(c) new file ≥80 LOC anywhere under packages/.
Trailer validation logic:
- Universal: ≥20 chars after "Prior-art: ".
- Escape-hatch refinement (payload starts with "skipped"): the
rationale (after the separator —/–/-/:) must be ≥20 chars on its
own AND not consist entirely of placeholder words. Word-tokenize
the rationale; if every word lowercases to {todo, later, na, tbd,
fixme, placeholder, ""}, reject as gaming.
- Multiple `Prior-art:` lines: any one valid line passes the commit.
- First commit after fresh clone (no `origin/main`): hook skips the
gate (no comparison base).
Implementation discipline (PR #9 m4 finding — do not repeat):
- `for sha in $(git rev-list ...)` accumulator loop, NOT
`git rev-list ... | while read sha` pipeline. Subshell-`return`
breaks under `set -e` and silently passes broken trailers.
- `<(git diff-tree ...)` process substitution + `while IFS=$'\t' read`
for per-commit file iteration — same reason.
- All helpers prefix-namespaced `pa_*` to avoid colliding with the
other six pre-push sections.
Standalone testing PRE-commit (per Phase 8.8 prompt Hard Constraint
#10 + Lessons #4):
- bash -n .husky/pre-push → syntax OK
- pa_check_trailer on T2 commit (valid trailer) → PASS
- pa_check_trailer on T1 commit (no trailer) → "no-trailer"
- synthetic short payload (<20 chars) → "invalid"
- synthetic placeholder repeat ("TODO TODO ...") → "invalid"
(the v1 detection failed this; bumped to word-tokenizer)
- synthetic mixed placeholder + real word → PASS
- synthetic valid escape hatch → PASS
context7 verification (≥3 phrasings per Hard Constraint #5/#9):
- resolve "husky" + query "commit trailer detection capability commit
build vs reuse policy enforcement" → husky is a generic hook
runner; no built-in trailer-policy feature.
- resolve "lefthook" → fast hooks manager; no built-in trailer policy.
- (transitive) pre-commit (Python framework) is also a hook runner
without prior-art-trailer detection.
Self-application: the new section 7 will validate its own predecessor
commits at next push. T3 is a capability commit (new file ≥80 LOC
under packages/); its `Prior-art:` trailer is valid; the hook will
let it through. T1, T2, T4-T7 are not capability commits (docs/
edits only); the hook will not gate them.
Prior-art: prior-art-evaluations.md#1 (no analog matches «capability-commit detection in pre-push» — context7 lookup confirms husky / lefthook / pre-commit are generic hook runners without build-vs-reuse trailer enforcement; the hook code is bespoke, hand-rolled, ≤120 LOC addition).
Phase 8.8 T9. Self-contained bash test for the Phase 8.8 T8 hook
section 7 (capability commit detection + Prior-art trailer validation).
Test design:
- Independence: each sub-test creates an isolated tmp git repo via
`mktemp -d`, sets up `origin/main` ref, and stubs the external
commands (actionlint, zizmor, npx, npm, audit-ai-docs.test.sh) that
sections 1-6 of the hook invoke. Section 7 then runs against the
tmp repo's commits in isolation.
- Single source of truth: tests invoke the actual `.husky/pre-push`
file (not an inlined logic copy). Drift between hook and test is
impossible because the test exercises the canonical hook.
- 6 sub-tests:
1. positive: new dep + valid trailer → exit 0
2. negative: new dep + no trailer → exit non-zero
3. positive: new dep + valid escape hatch → exit 0
4. negative: short escape hatch (<20 chars rationale) → exit non-zero
5. mutation: invert trailer match (`Prior-art:*` → never-match)
→ sub-test 1's positive case must now FAIL (proves trailer-
matching is load-bearing in test 1)
6. mutation: short-circuit `pa_detect_capability_reason` to
always-return-1 → sub-test 2's negative case slips through
(proves capability-detection is load-bearing in test 2)
Implementation discipline (mirrors T8 anti-pipeline rules):
- `for sha in $(git rev-list ...)` accumulator pattern in tmp repo
setup (no `| while read` pipelines).
- Test mutations use `sed` over the canonical hook file copied into
tmp; the canonical file in REPO_ROOT is NOT modified by tests.
- Multi-line package.json in capability commits matches real-world
package.json formatting; the hook's regex `^\+\s+"NAME":\s+"\^?[0-9]`
anchors on indented dep entries (an early test draft used flat
single-line JSON which the regex correctly did NOT match — the
test was rewritten to mirror real package.json before commit, per
Hard Constraint #10 / Lesson #4 «TESTED bash»).
CI: `principles-meta-tests` job in `.github/workflows/audit-self.yml`
gains a new step «Run prior-art trailer hook anti-tautology test
(Phase 8.8 T9)» invoking `bash tests/hooks/prior-art-trailer-hook.test.sh`
right after the existing `test:principles` step. No new sibling job —
ultraview m1 finding (redundant gates).
Verification: 6/6 sub-tests pass locally; bash -n syntax check clean.
Prior-art: prior-art-evaluations.md#1 (anti-tautology mutation pattern from Phase 2 P4 applied to bash / process surface; the principle is well-established in the framework's own meta-tests, this commit is its mechanical extension to the new hook surface — not a new capability area).
… functions vocabulary
Phase 8.8 T10. Four documentation edits closing out the cross-references
established forward-pointers from T1/T5:
(1) prior-art-evaluations.md §5 «Staleness policy» — replaces T1 stub.
- Threshold: `Last reviewed` >180 days surfaces an entry as
re-evaluation candidate at next §5.5 Step 1.5 consult.
- Date format: ISO 8601 (YYYY-MM-DD); ISO timestamps accepted but
canonical column is date-only.
- No automated CI gate yet — false-positive cost (re-verifying a
still-current entry) exceeds false-negative cost (one stale entry
persisting one extra phase). Automated gate deferred to Phase 8.X+
self-diagnostics (see self-diagnostics-design.md §6); when added,
warn-only initially, escalate to hard fail only after FP rate <10%
on 10+ phase research sessions.
- Re-verification scope: same-commit `Last reviewed` bump if still
applicable; new commit changing `Verdict`/`Rationale` if new
evidence; `REJECT` verdict if candidate deprecated/abandoned.
(2) aif-comparison.md §9 reuse-matrix row «Incident → rule generation»
— extended with Phase 8.8 cross-ref note.
- aif-evolve = auto-rule generation from patches: incident-derived,
high-volume, post-fix lifecycle.
- Phase 8.8 prior-art mechanism = manual analog: curated, low-volume,
pre-build lifecycle (consult-gate + trailer convention).
- Different signal sources (CVE/incident patches vs. capability
research), different lifecycle stages — explicitly complementary,
NOT replacement (per Phase 8.8 prompt A6 + ultraview N5).
- Re-evaluate integration when LLM v2 trigger fires per
open-questions.md §13.10 entry #1.
(3) aif-comparison.md §10 differentiator #4 — note clarifying recursion
thesis stays at THREE forms (do NOT add a 4th per ultraview N4).
- The Phase 8.8 mechanism is itself recursive (commits T2-T11 carry
Prior-art trailers; principle 08 validates SSOT citations) but
operates within the existing three forms:
form #1: principles testing manifest is generalised by principle
08 testing the SSOT (different artifact, same recursion);
form #3: T9 anti-tautology test of the T8 hook is a mutation
test of a meta-test on the bash/process surface (same pattern,
different language).
- The split design (artifact + process + SSOT) operates within
existing axes; thesis stays at three.
(4) skills/rules-as-tests/references/overview.md L2 — vocabulary
alignment callout per T5 ADOPT VOCABULARY decision.
- L2 meta-test pattern (Phase 2 principles/01-08) corresponds to
«fitness functions» in evolutionary architecture vocabulary
(Ford / Parsons / Kua, 2017 / 2nd ed. 2023).
- Both terms describe the same artifact — academic mapping
documented; no code change.
Verification: principle 08 still 7/7; hook anti-tautology test still
6/6; all three grep probes pass (Staleness policy, aif-evolve,
fitness functions present in target files).
Prior-art: prior-art-evaluations.md#3 (T10 closes T5 ADOPT VOCABULARY commitment — overview.md L2 now frames Phase 2 principles via fitness functions vocabulary; same entry covered the original adoption decision).
Prior-art: prior-art-evaluations.md#2 (staleness policy applies to all entries; framework-info entry's WATCHLIST verdict + 180-day threshold cross-referenced into §5).
…e 9 entry Phase 8.8 T11. Closes the implementation phase. Mirrors phase-7.5.md structure: header + scope + verification block + Phase 8 retroactive audit (the CRITICAL section per Phase 8.8 prompt §11) + self-application at-creation evidence + stop-rule audit + time-vs-plan ratio + new findings + verdict + versioning. 123 lines (≤200 LOC retro target). Verdict: **GO** to Phase 9 entry research (Path B AST gen + Path A LLM gen ROI scoping per §13.10 entry #2 trigger fired at Phase 8 close). Phase 8 retroactive audit (§4): - Six Phase 8 build-vs-reuse decisions audited post-hoc. - Zero reinvention found. Phase 8 either inherited Phase 4-7 build decisions (Stack Detector v1 inherited at Phase 8 C1), explicitly consulted AIF prior art (gate 5 / aif-gate-result / /aif-verify integration spike), or built genuinely-new capability where no analog exists (regen diff metric — context7 audit-time confirms no standard for «preset plan similarity»). - No hard-blocker escalation for Phase 9 entry. Phase 8.8 ships as a FORWARD gate (Phase 9+ must use §5.5 Step 1.5 + principle 08 + Prior-art trailer), not a corrective gate. Self-application at-creation evidence: - 2026-05-08 analog research session (PR #9 C-park) — original Autogrep discovery, predates SSOT. - PR #9 ultraview verdict (2026-05-08) — independent reviewer pass that froze A1-A6 architectural decisions. - Phase 8.8 commits T2-T11: 10 Prior-art trailer lines across 8 commits (T4-T5 and T10 each ship two stacked trailers). New findings (4) recorded for Phase 9 input: 1. Hook regex sensitivity to package.json formatting (multi-line vs flat single-line). 2. Gaming surface on escape-hatch placeholder rationales (T8 word- tokenizer fix; T9 sub-test 5 doesn't currently exercise this bypass — opportunity for 7th sub-test). 3. Recipe applies-to glob redundancy (uncovered at PR #11 review; fixed pre-merge in commit 9fe5a5b). 4. «Step 1.5» label vs. list position drift (canonical bold label preserved; auto-numbering is decoration). Stop-rule audit: all 6 §6.0 hard rules held (NO LLM, NO new explicit deps, NO yargs/commander, NO Path B AST gen, atomic commits / convention / English / no emoji, principle applies to itself). Time-vs-plan ratio: target 3-5 days, actual ≪1 day (≈3 hours single session including PR #11 review/fix cycle for Phase 8 close-out before Phase 8.8 branch fork). >2x trigger DID NOT fire — same burn-mode compression as Phase 4-8. Phase 9 entry session is unblocked per this retro's GO verdict and MUST exercise §5.5 Step 1.5 + principle 08 + Prior-art trailer convention as the first downstream consumer. Observed false-positive rate from Phase 9 entry → input to a follow-up Phase 8.8 retro decision on widening principle 08 scope (currently phase research files only; design docs / retros / commit messages deferred). Prior-art: prior-art-evaluations.md#1 (retro pattern follows phase-7.5.md established structure — same headers, same verdict-line format; mechanical mirror, not new capability area, no analog research needed beyond the retro template itself).
…cleanup PR #12 review M1+M2+L2. M1 — broaden semver-prefix coverage in pa_is_new_dep_added: Old regex: `"\^?[0-9]` (caret or digit-prefix only). New regex: `"(\^|~|>=?|<=?|=|[0-9*])`. Now catches: `"^X"`, `"~X"`, `">=X"`, `"<=X"`, `">X"`, `"<X"`, `"=X"`, digit start, `"*"`. Still misses pure dist-tag versions ("latest" / "next" / "beta") and URL specifiers ("file:" / "git+" / "github:") — documented in the function comment as a known limitation. Rationale: scoping to broader patterns (any `[^"]+` value) would false-positive on package.json `scripts` entries which also follow the `"name": "value"` shape. Phase 9+ entry research can tighten via jq-based JSON parse if observed in practice. M2 — bump-vs-add differentiation: Pre-fix: any `+` line matching the dep-shape regex flagged the commit as capability, including pure version bumps where the same key appears in both `+` and `-` lines. Post-fix: extract dep keys from both `+` and `-` lines via grep+sed; a key is "newly added" only if present in `+` but absent in `-`. Pure bumps no longer false-positive into capability detection. Implementation discipline: standard `for key in $added_keys` loop + `printf '%s\n' "$removed_keys" | grep -qFx "$key"` membership test. No subshell-return / pipe-while patterns (PR #9 m4 finding stays enforced). L2 — remove unused `stripped` local var declaration in pa_check_trailer (leftover from earlier draft of the placeholder check; superseded by the word-tokenizer loop). T9 hook test — added 2 sub-tests to validate the M1/M2 fixes: Test 7 (M2): seed an existing dep, then commit a version bump without a trailer. Hook must NOT flag as capability (exit 0). Test 8 (M1): commit a new dep with tilde-prefix version (`~1.0.0`) + valid trailer. Hook must flag as capability AND accept the trailer (exit 0). Pre-M1-fix would have missed the tilde and silently passed the commit through. Plus 2 new helper functions (seed_existing_dep, bump_existing_dep, add_capability_commit_with_tilde) to keep sub-test bodies thin. Verified locally: bash -n on both files clean; 8/8 sub-tests pass (original 6 still green + 2 new for M1/M2); principle 08 still 7/7; make self-audit green (34/34 across all 8 principles). Prior-art: prior-art-evaluations.md#1 (PR review tightening — same Autogrep entry rationale; bump-vs-add differentiation is mechanical refinement of an existing detector, not new capability area, no separate analog research needed).
artyhoo
added a commit
that referenced
this pull request
Jul 11, 2026
…rrides where unavoidable (#980) Fixes all 16 open Dependabot alerts (triage-first, per-alert rationale below). Two atomic commits: lock/manifest bumps; drizzle fixture pins. No new dependencies — overrides entries and in-range bumps only; not a capability commit. ## Per-alert disposition | Alerts | Package | Fix | Mechanism | |---|---|---|---| | #17-#24 (7×, incl. **critical** CVE-2026-33937) | handlebars 4.7.8 → 4.7.9 | root lock | `eslint-plugin-boundaries ^5.0.0 → ^6.0.2` in `packages/preset-react-spa/package.json:26` — 6.0.2 pins `@boundaries/elements 2.0.1` → handlebars 4.7.9. Chosen over also-available ^7.0.2 as the smaller major jump with the same security outcome. The shipped template `packages/preset-react-spa/templates/eslint.config.react.mjs` is unchanged: v6 keeps the explicitly-configured legacy `element-types` rule + `boundaries/elements` settings working. | | #4, #5 (CVE-2026-8723) | qs 6.15.1 → 6.15.2 | both locks | `overrides` in root `package.json` + `packages/core/package.json` — **unavoidable**: latest typed-rest-client (3.0.0) still pins vulnerable qs 6.15.1 exactly (verified against the npm registry). | | #27 (CVE-2026-53550) | js-yaml 4.1.1 → 4.2.0 | root lock | `overrides "js-yaml": "4.2.0"` — parent markdownlint-cli2 pins exact 4.1.1; its fixed release 0.23.0 requires node>=22 while CI runs node 20, so the parent bump is blocked. Exact spec matches packages/core's direct-dep spec (npm direct-dep override rule). | | #12 (CVE-2026-48988) | markdown-it 14.1.1 → 14.3.0 | root lock | `overrides "markdown-it": "^14.2.0"` — same markdownlint-cli2 exact-pin reason. | | #10, #13 (CVE-2026-49356) | @babel/core 7.29.0 → 7.29.7 | both locks | in-range `npm update` (parents allow ^7.x / ~7.29.0). | | #7 | esbuild 0.28.0 → 0.28.1 | packages/core lock | in-range `npm update` (tsx ~0.28.0, vite ^0.28.0). Root esbuild was already 0.28.1. | | #16, #28 (CVE-2026-39356, high) | drizzle-orm ^0.40.0 → ^0.45.2 | 2 fixture manifests + stub | `packages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5`, `packages/core/research/fixtures/tier1-single-root/package.json:3`, stub `.../node_modules/drizzle-orm/package.json` bumped in lockstep. Consuming tests verified version-insensitive (name-based detection; `research-plan.json` has `version: null`) — fixed, not dismissed. | ## Notes - **Synth bundle deliberately NOT regenerated:** the bundle is built by ROOT esbuild (`scripts/build-synth-bundle.sh:17` uses `$ROOT/node_modules/.bin/esbuild`), which was already 0.28.1 and is unchanged; the packages/core esbuild bump is a non-feeding transitive. `NODE_ENV=development build-synth-bundle.sh --check` green after fresh `npm ci` of both locks. - **Consumer note (preset-react-spa):** boundaries v6 changes the `dependency-nodes` default from `["import"]` to `["import","export","require","dynamic-import"]`. Consumers may see new (legitimate) `boundaries/element-types` findings on `export … from` / `require()` / dynamic-import edges — stricter, not broken. - **Expected `npm ls` marker:** `invalid: qs@6.15.2` under typed-rest-client is the documented override-forced exact-pin violation (the point of the fix); no CI gate runs `npm ls`. ## Verification - Full local CI-equivalent gate set green: typecheck, full packages/core suite (2288 tests, 0 failed), `format:check`, `NODE_ENV=development build:synth-bundle:check`, `render-rules --check`, `render-rule-index --check`, install-sh `gh-534-arch-boundaries` + `f17-lint-rules-planted-violation` + `byte-identical` (fingerprints unchanged — no SNAPSHOT_MODE regen needed). - Lock integrity independently re-verified from clean state: `npm ci` (root) and `npm ci --prefix packages/core` both exit 0; every touched lock entry has version+resolved+integrity; zero unexpected version changes in either lock diff (only intended packages + their transitive helper chains). ## §1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files) ### §1.7 Forward-check applied This PR introduces no new rule; the forward obligation is that each fix lands at the earliest reachable channel and is executable, not prose: vulnerable versions are excluded structurally by manifest constraints — `package.json:6-10` (overrides block), `packages/core/package.json` overrides, `packages/preset-react-spa/package.json:26` (^6.0.2 floor) — so any future `npm install` cannot silently re-resolve a vulnerable version; regressions fail at install/lock level, before CI. ### §1.7 Backward-check applied Class of this change = dependency-version-constraint updates. Surfaces where the class occurs, each swept: root `package-lock.json` (all 6 target packages patched, no residual vulnerable entries — verified over the full lock, not the diff); `packages/core/package-lock.json` (qs/@babel/core/esbuild patched; contains NO handlebars/js-yaml/markdown-it entries → no overrides needed there); fixture manifests `packages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5` + `packages/core/research/fixtures/tier1-single-root/package.json:3` + its stub (bumped in lockstep, internally coherent); other fixture manifests under `packages/core/**/fixtures/` (swept — no other pinned occurrences of affected packages); shipped templates + `install.sh` (grep: zero version pins of affected packages); synth bundle `packages/core/synthesizer/synth-and-wire.bundle.mjs` (not fed by the core esbuild entry — `scripts/build-synth-bundle.sh:17`; `--check` green); install fingerprints/baselines (`tests/install-sh/byte-identical.test.sh` green — unshifted).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 8.8 ships the build-vs-reuse mechanism as three enforcement layers + one shared SSOT, with recursive self-application: the convention validates its own implementation. 9 atomic commits + 1 retro = 10 total on
docs/phase-8.8-mechanism.Verdict: GO to Phase 9 entry research. Phase 8 retroactive audit (retro §4) found zero reinvented capability — Phase 8 either inherited Phase 4-7 build decisions, explicitly consulted AIF prior art, or built genuinely-new capability where no analog exists. Phase 8.8 acts as a forward gate, not a corrective gate.
Changes
docs/meta-factory/prior-art-evaluations.md(T1) with format spec + 3 entries (T2/T4/T5: Autogrep DEFER, Netlify framework-info WATCHLIST, fitness functions ADOPT VOCABULARY) + staleness policy (T10).packages/core/principles/08-prior-art-cited.test.ts(T3) — Phase 2 principle 08 enforcing research files cite SSOT by ID; broken-ref detection universal across baseline. 7/7 sub-tests, picked up by existingprinciples-meta-testsCI job.EXECUTION-PLAN.md §5.5 Step 1.5(T6) mandatory consult before phase research drafted..husky/pre-pushcapability commit detection +Prior-art:trailer validation (T8); convention codified inCLAUDE.md,CONTRIBUTING.md,.github/pull_request_template.md(T7); anti-tautology meta-testtests/hooks/prior-art-trailer-hook.test.sh(T9, 6/6 sub-tests, mutation-validated, added to CI inprinciples-meta-testsjob).aif-comparison.md §9aif-evolve overlap row (complementary, not replacement);aif-comparison.md §10recursion thesis preserved at 3 forms (no 4th);skills/rules-as-tests/references/overview.md L2fitness functions vocabulary alignment (T10).docs/meta-factory/retros/phase-8.8.md(T11): scope + verification block (17 probes) + Phase 8 retroactive audit (6 decisions audited) + self-application at-creation evidence + stop-rule audit + 5 new findings + GO verdict.Prior-art consult
Prior-art:trailers — 11 trailer lines across 8 commits (T2-T11; T4-T5 and T10 ship two stacked trailers per the ≥1-trailer-per-cited-entry convention).Last revieweddates set per §3 step 1 (all entries: 2026-05-08 first seen + last reviewed).Test plan
npm test --workspace=@rules-as-tests/core --rungreen (246/246; +7 from T3, +1 from PR feat(phase-8): acceptance gate Next 15->16 + canonical regen + GO verdict for Phase 9 #11 review fix)make self-auditgreen (no regressions)npm run --prefix packages/core test:principlesgreen (34/34; was 27 pre-T3, +7 new)bash tests/hooks/prior-art-trailer-hook.test.shgreen (6/6 sub-tests, including 2 anti-tautology mutations)Verdict
GO to Phase 9 entry research. Phase 9 entry session MUST exercise §5.5 Step 1.5 + principle 08 + Prior-art trailer convention as the first downstream consumer. Phase 8 retroactive audit found no reinvention; no hard-blocker escalation.
Full retro: docs/meta-factory/retros/phase-8.8.md