Skip to content

Wave 10.5 — bash-fallback + declarative check-registry + install.sh feature detection - #129

Merged
artyhoo merged 1 commit into
mainfrom
feat/wave-10.5-bash-fallback
May 21, 2026
Merged

Wave 10.5 — bash-fallback + declarative check-registry + install.sh feature detection#129
artyhoo merged 1 commit into
mainfrom
feat/wave-10.5-bash-fallback

Conversation

@artyhoo

@artyhoo artyhoo commented May 21, 2026

Copy link
Copy Markdown
Owner

What was done

  • packages/core/hooks/checks/registry.ts (114 LOC) — declarative check-registry { id, criticalForFallback, runner }[] decoupling check-set selection from execution (ADAPT from Aider, SSOT docs(execution-plan): align §1 Goal pointer with multi-channel framing (post-PR58 follow-up) #59). Two critical entries: prior-art-presence + s17-presence, both runner: 'bash' (per D2).
  • registry.test.ts — asserts the bash-expressible invariant (every criticalForFallback → runner: 'bash') AND the ≥2 critical-count.
  • packages/core/hooks/pre-push.fallback.sh (67 LOC) — critical-only bash gate for consumers without Node ≥20. Presence-only §7 Prior-art + §1.7 trailer checks over origin/main..HEAD; exit 1 if either required trailer missing, exit 0 otherwise. Mirrors s17.ts discipline glob + ALLOWLIST_RE bypass.
  • packages/core/templates/shared/husky-pre-push.sh — rewritten from the old consumer pre-push to a runtime dispatcher (Node ≥20 + pre-push.ts present → TS-core; else → fallback). Capability-check, not brand-name.
  • install.sh — copies both the dispatcher template and pre-push.fallback.sh to the consumer (chmod +x).
  • prior-art-evaluations.md — SSOT docs(execution-plan): align §1 Goal pointer with multi-channel framing (post-PR58 follow-up) #59 (Aider check-registry, verdict ADAPT) added in-commit.

§1.7 Forward-check applied

This ships the portable bash channel of the §7/§1.7 pre-push checks, so channel parity is the live forward risk (dual-implementation-discipline.md §5). Forward sweep: the fallback's discipline-file glob and allow-list must mirror the TS SSOT — packages/core/hooks/pre-push.fallback.sh:13 defines S17_ALLOWLIST_RE in exact parity with packages/core/hooks/checks/s17.ts:21, and the critical set is self-tested at packages/core/hooks/checks/registry.ts:51. The @dual-pair: pre-push-critical-checks anchor binds the two channels for future drift detection.

§1.7 Backward-check applied

The fallback reproduces, in bash, the presence arms of the already-shipped TS checks (packages/core/hooks/checks/prior-art.ts for §7, packages/core/hooks/checks/s17.ts:21 for the §1.7 discipline glob) — no new semantics, only a no-Node delivery channel. SSOT entry #59 is the next-free ID, added at docs/meta-factory/prior-art-evaluations.md:127. Node ≥20 threshold matches the shipped Wave 10.1 dispatcher (not the stale ≥18 in the research patch).

How to verify

  • Registry tests green (bash-expressible invariant + ≥2 critical count) — verified: npx vitest run packages/core/hooks/checks/registry.test.ts 6/6 (worker VERIFY + independent QA)
  • Fallback exits 1 on §7-missing, exits 1 on §1.7-missing (discipline commit), exits 0 when both present — verified: independent QA ran 3 live fabricated-repo scenarios; orchestrator re-verified D3-bypass + regression after the parity edit
  • D3 allow-list bypass mirrors s17.ts (allow-listed subject + discipline file + no §1.7 → exit 0) — verified: orchestrator fabricated-repo test, exit 0
  • Dispatcher uses runtime detection, Node ≥20, zero brand-name strings — verified: QA read of husky-pre-push.sh
  • install.sh copies dispatcher + fallback with chmod; does not bake install-moment node presence — verified: QA, lines 291/294-296
  • SSOT docs(execution-plan): align §1 Goal pointer with multi-channel framing (post-PR58 follow-up) #59 is next-free, well-formed, trailer matches — verified: QA, docs(goal): BROAD multi-channel framing + BFR-default rule (post-1A Commits 1-2) #58 was last
  • pre-push.ts NOT touched (parallel-overlap with 10.6 avoided) — verified: QA, absent from diff
  • registry.ts/registry.test.ts introduce zero typecheck errors — verified: QA grep of tsc output empty

Notes

Scope-out

  • Pre-existing audit-ai-docs.* typecheck errors on main (Wave 10.4 remark dep) — not touched here.

@artyhoo
feat(hooks): Wave 10.5 — bash-fallback + install.sh feature detection
31bb71a 
Ships the critical-only bash fallback for the pre-push hook and updates
the consumer-facing dispatcher template to runtime feature detection.

Artifacts:
- packages/core/hooks/checks/registry.ts (~114 LOC): declarative
  check-registry ({ id, criticalForFallback, runner }[]) decoupling
  check-set selection from execution (ADAPT from Aider §4.8.X.2).
  Critical entries: prior-art-presence + s17-presence (both runner: 'bash'),
  per D2 + research patch §7.2.
- packages/core/hooks/checks/registry.test.ts: unit tests asserting
  bash-expressible invariant (every criticalForFallback entry → runner: 'bash')
  AND presence of both required critical entries.
- packages/core/hooks/pre-push.fallback.sh (~63 LOC): critical-only bash gate.
  Runs §7 Prior-art presence + §1.7 presence checks on origin/main..HEAD commits.
  Historical cutoff (2026-05-12) respected. bash 3.2-compatible. exit 1 if either
  required trailer is absent; exit 0 when both present or no discipline files touched.
- packages/core/templates/shared/husky-pre-push.sh: updated from OLD consumer
  pre-push to runtime dispatcher (per research patch §7.4). Node ≥20 + pre-push.ts
  present → TS-core; otherwise → bash fallback. Capability-check, NOT brand-name.
- install.sh: also copies pre-push.fallback.sh to consumer project so the
  runtime dispatcher can find it at $REPO_ROOT/packages/core/hooks/pre-push.fallback.sh.
- docs/meta-factory/prior-art-evaluations.md: SSOT entry #59 added in-commit
  (registry.ts ≥80 LOC under packages/ → capability commit gate fires).

T15 self-application: the registry invariant (every criticalForFallback check is
bash-expressible) is itself unit-tested in registry.test.ts — the rule applies to
itself. Zero edits to pre-push.ts (parallel-overlap avoidance; 10.6 owns that file).

Prior-art: prior-art-evaluations.md#59 (Aider parse_lint_cmds / self.languages, verdict ADAPT — structural pattern of decoupling selection-table from execution-runner transfers; semantic axis differs: file-language vs project-stack. Wave 10.5 registry.ts is 114 LOC ≥80 threshold, capability commit gate fires, SSOT entry added in same commit per CLAUDE.md discipline).
@artyhoo
artyhoo merged commit a69fa35 into main May 21, 2026
22 checks passed
@artyhoo
artyhoo deleted the feat/wave-10.5-bash-fallback branch May 21, 2026 23:33
artyhoo added a commit that referenced this pull request May 22, 2026
@artyhoo
feat(principles): principle 17 — no paid LLM in CI (DN-6) [→staging l…
cd89d2f 
…ive-test] (#132)

* docs(research): memory coverage audit (memory → docs → tests) 2026-05-22 (#126)

R-phase report: triages all 51 project-memory files against the project
goal (rule = executable test), builds a 30-row coverage matrix by pipeline
stage (0 memory-only / 1 prose / 2 executable), and proposes a forward-going
memory-codification discipline (write-time + local-audit + periodic re-audit).
No implementation — gap-closure + new rule are a separate PR after maintainer GO.

Successor to 2026-05-13 memory-to-docs codification audit (extends memory→docs
for 6 entries to memory→docs→tests over all 51 files). Surfaces T16 stale-header
finding (principle tests 11/12/13 shipped but rule headers say "pending").

Prior-art: skipped — research-patch doc only, no new capability/dependency; reuses 2026-05-13 §7 REUSE verdict (Cline Memory Bank + CC scope hierarchy).

* feat(principles): Wave 10.6 — port hook-stub-completeness audit to principle 16 (#127)

- Add packages/core/principles/16-hook-stub-completeness.test.ts (7 tests):
  (a) real-tree vacuous pass: empty hard-fail set post-migration → passes, not dies
  (b) paired-negative: make_test_repo() test file missing stub → ❌ violation detected + message text asserted
  (c) non-empty happy path: stub present → no violation
  + scope gate, multi-script, dedup, T15 self-application arms
- Delete packages/core/audit-self/hook-stub-completeness.test.sh (bash predecessor)
- Remove requireSelfTest('…hook-stub-completeness.test.sh') invocation from pre-push.ts §3a
- Remove requireSelfTest() helper (zero call sites remaining → genuinely dead)
- Leave phantom stub in tests/hooks/prior-art-trailer-hook.test.sh (harmless; out of scope)

Prior-art: skipped — bash→TS port of existing hook-stub-completeness audit (Wave 10.6), no new capability

* docs(automerge): codify branch-from-main staging flow + resync discipline (#128)

* docs(automerge): codify branch-from-main→staging flow + resync discipline; sync doc to LIVE state

main's copy was stale (still called ci-success a placeholder). Updates: status LIVE (settings applied 2026-05-22); new §2.1 branching flow — always branch FROM main, auto-merge INTO staging, with the load-bearing RESYNC discipline (ff staging→main after each promotion) that keeps staging a disposable buffer not a divergent develop; §5 recipe marked APPLIED with the real ci-success+actionlint+zizmor contexts + main owner-only protection; §6 #2 RESOLVED (#125).

Prior-art: skipped — doc codification of an already-decided flow, no new capability/dependency/subdir.

* docs(§2.1): drop trunk-based exception — everything routine → staging (0 clicks)

Maintainer's point: direct-to-main is owner-only → forces a manual merge
click per PR, the exact toil being removed. staging auto-merges (0 clicks).
So all routine work → staging; direct-to-main only for owner hotfixes.

Added dependency note: for true zero-click walk-away the agent must set
auto-merge on staging-targeted PRs, currently blocked by the git-safety
hook (allows only feat→epic). Relaxing it (permit auto-merge --base staging)
is the actual zero-click lever, and is a maintainer-side hook edit.

Prior-art: skipped — doc refinement of the codified flow, no new capability.

* feat(hooks): Wave 10.5 — bash-fallback + install.sh feature detection (#129)

Ships the critical-only bash fallback for the pre-push hook and updates
the consumer-facing dispatcher template to runtime feature detection.

Artifacts:
- packages/core/hooks/checks/registry.ts (~114 LOC): declarative
  check-registry ({ id, criticalForFallback, runner }[]) decoupling
  check-set selection from execution (ADAPT from Aider §4.8.X.2).
  Critical entries: prior-art-presence + s17-presence (both runner: 'bash'),
  per D2 + research patch §7.2.
- packages/core/hooks/checks/registry.test.ts: unit tests asserting
  bash-expressible invariant (every criticalForFallback entry → runner: 'bash')
  AND presence of both required critical entries.
- packages/core/hooks/pre-push.fallback.sh (~63 LOC): critical-only bash gate.
  Runs §7 Prior-art presence + §1.7 presence checks on origin/main..HEAD commits.
  Historical cutoff (2026-05-12) respected. bash 3.2-compatible. exit 1 if either
  required trailer is absent; exit 0 when both present or no discipline files touched.
- packages/core/templates/shared/husky-pre-push.sh: updated from OLD consumer
  pre-push to runtime dispatcher (per research patch §7.4). Node ≥20 + pre-push.ts
  present → TS-core; otherwise → bash fallback. Capability-check, NOT brand-name.
- install.sh: also copies pre-push.fallback.sh to consumer project so the
  runtime dispatcher can find it at $REPO_ROOT/packages/core/hooks/pre-push.fallback.sh.
- docs/meta-factory/prior-art-evaluations.md: SSOT entry #59 added in-commit
  (registry.ts ≥80 LOC under packages/ → capability commit gate fires).

T15 self-application: the registry invariant (every criticalForFallback check is
bash-expressible) is itself unit-tested in registry.test.ts — the rule applies to
itself. Zero edits to pre-push.ts (parallel-overlap avoidance; 10.6 owns that file).

Prior-art: prior-art-evaluations.md#59 (Aider parse_lint_cmds / self.languages, verdict ADAPT — structural pattern of decoupling selection-table from execution-runner transfers; semantic axis differs: file-language vs project-stack. Wave 10.5 registry.ts is 114 LOC ≥80 threshold, capability commit gate fires, SSOT entry added in same commit per CLAUDE.md discipline).

* fix(ci): make ci-success the sole required gate; fold actionlint+zizmor under it (#130)

Branch protection on main/staging required ci-success + actionlint + zizmor, but
actionlint/zizmor lived in workflow-integrity.yml path-filtered to
.github/workflows/** — so PRs not touching workflows (docs, packages) never
triggered them, their required contexts never reported, and the PR deadlocked
(auto-merge could never fire). PR #126 hit this exact wall.

Fix: cross-workflow `needs:` is impossible, so move actionlint + zizmor into
audit-self.yml (no path filter → runs every PR) and add them to ci-success's
`needs:`. ci-success now transitively gates the linters and always reports, so
branch protection can require ONLY ci-success. workflow-integrity.yml keeps just
the R11 branch-protection-assertion. Checks are stricter, not weaker: a broken
workflow YAML on a docs PR is now caught (previously it wasn't).

Synced: rules-manifest R11 check.command + re-rendered RULES.md table + snapshot;
RULES.md R11 prose; ci-success-gate.sh comment; automerge-staging-plan.md §5
recipe (was telling the maintainer to re-add the deadlocking contexts).

Maintainer-side follow-up: re-run the branch-protection PUT with single-context
payload {"contexts":["ci-success"]} per automerge-staging-plan.md §5.

Prior-art: skipped — moves existing CI jobs between workflow files + doc sync; no new capability, dependency, or ≥80-LOC file.

* feat(principles): principle 17 — no paid LLM in CI (DN-6 stage-1→2 promotion)

Promotes .claude/rules/no-paid-llm-in-ci.md from "Class A, grep mechanism
ready, test pending" to a real executable gate (memory-coverage-audit §10
DN-6 — the one clean stage-1→2 win in-repo). Scans .github/workflows/*.yml
for paid-LLM *usage* (ANTHROPIC/OPENAI api-key assignment or secret ref,
api.{anthropic,openai}.com hostnames, paid SDK imports) and fails CI if any
is present.

Usage-precise, not mention-counting: full-line comments are stripped first,
so the project's own negation mention (framework-self-template-render.yml:
"NO ANTHROPIC_API_KEY reference") does NOT false-positive. Negative-controls
in the test prove that, plus session/MCP tooling (claude CLI, context7) is
out of scope per rule §2.

Slot 17 (01-16 occupied). Runs in CI via principles-meta-tests → gated by
ci-success. 7/7 local; full suite 17 files / 106 tests green.

§1.7: forward-check applied — principle 17 IS the executable artifact for an existing prose rule (no-paid-llm-in-ci.md §1/§6 "pre-merge grep" counter); paired-negatives at packages/core/principles/17-no-paid-llm-in-ci.test.ts:91 (api-key assignment), :96 (hostname), :101 (SDK) prove detection, negative-controls at :107/:112 prevent false-positives. Backward-check sweep — reviewed principle slots 01-16 (17 next free) + prior-art-evaluations.md; no overlap (secret-scanners detect leaked creds, this bans a paid-LLM dependency surface — inverse problem class).
Prior-art: skipped — principle test for the existing no-paid-llm-in-ci.md rule (DN-6 promotion); no new capability/dependency/subdir, mirrors principle 15/16 precedent.
@artyhoo artyhoo mentioned this pull request May 22, 2026
Merged
artyhoo added a commit that referenced this pull request May 22, 2026
@artyhoo
feat(principles): principle 17 — no paid LLM in CI (DN-6) [→staging l…
ec889c5 
…ive-test] (#132) (#133)

* docs(research): memory coverage audit (memory → docs → tests) 2026-05-22 (#126)

R-phase report: triages all 51 project-memory files against the project
goal (rule = executable test), builds a 30-row coverage matrix by pipeline
stage (0 memory-only / 1 prose / 2 executable), and proposes a forward-going
memory-codification discipline (write-time + local-audit + periodic re-audit).
No implementation — gap-closure + new rule are a separate PR after maintainer GO.

Successor to 2026-05-13 memory-to-docs codification audit (extends memory→docs
for 6 entries to memory→docs→tests over all 51 files). Surfaces T16 stale-header
finding (principle tests 11/12/13 shipped but rule headers say "pending").

Prior-art: skipped — research-patch doc only, no new capability/dependency; reuses 2026-05-13 §7 REUSE verdict (Cline Memory Bank + CC scope hierarchy).

* feat(principles): Wave 10.6 — port hook-stub-completeness audit to principle 16 (#127)

- Add packages/core/principles/16-hook-stub-completeness.test.ts (7 tests):
  (a) real-tree vacuous pass: empty hard-fail set post-migration → passes, not dies
  (b) paired-negative: make_test_repo() test file missing stub → ❌ violation detected + message text asserted
  (c) non-empty happy path: stub present → no violation
  + scope gate, multi-script, dedup, T15 self-application arms
- Delete packages/core/audit-self/hook-stub-completeness.test.sh (bash predecessor)
- Remove requireSelfTest('…hook-stub-completeness.test.sh') invocation from pre-push.ts §3a
- Remove requireSelfTest() helper (zero call sites remaining → genuinely dead)
- Leave phantom stub in tests/hooks/prior-art-trailer-hook.test.sh (harmless; out of scope)

Prior-art: skipped — bash→TS port of existing hook-stub-completeness audit (Wave 10.6), no new capability

* docs(automerge): codify branch-from-main staging flow + resync discipline (#128)

* docs(automerge): codify branch-from-main→staging flow + resync discipline; sync doc to LIVE state

main's copy was stale (still called ci-success a placeholder). Updates: status LIVE (settings applied 2026-05-22); new §2.1 branching flow — always branch FROM main, auto-merge INTO staging, with the load-bearing RESYNC discipline (ff staging→main after each promotion) that keeps staging a disposable buffer not a divergent develop; §5 recipe marked APPLIED with the real ci-success+actionlint+zizmor contexts + main owner-only protection; §6 #2 RESOLVED (#125).

Prior-art: skipped — doc codification of an already-decided flow, no new capability/dependency/subdir.

* docs(§2.1): drop trunk-based exception — everything routine → staging (0 clicks)

Maintainer's point: direct-to-main is owner-only → forces a manual merge
click per PR, the exact toil being removed. staging auto-merges (0 clicks).
So all routine work → staging; direct-to-main only for owner hotfixes.

Added dependency note: for true zero-click walk-away the agent must set
auto-merge on staging-targeted PRs, currently blocked by the git-safety
hook (allows only feat→epic). Relaxing it (permit auto-merge --base staging)
is the actual zero-click lever, and is a maintainer-side hook edit.

Prior-art: skipped — doc refinement of the codified flow, no new capability.

* feat(hooks): Wave 10.5 — bash-fallback + install.sh feature detection (#129)

Ships the critical-only bash fallback for the pre-push hook and updates
the consumer-facing dispatcher template to runtime feature detection.

Artifacts:
- packages/core/hooks/checks/registry.ts (~114 LOC): declarative
  check-registry ({ id, criticalForFallback, runner }[]) decoupling
  check-set selection from execution (ADAPT from Aider §4.8.X.2).
  Critical entries: prior-art-presence + s17-presence (both runner: 'bash'),
  per D2 + research patch §7.2.
- packages/core/hooks/checks/registry.test.ts: unit tests asserting
  bash-expressible invariant (every criticalForFallback entry → runner: 'bash')
  AND presence of both required critical entries.
- packages/core/hooks/pre-push.fallback.sh (~63 LOC): critical-only bash gate.
  Runs §7 Prior-art presence + §1.7 presence checks on origin/main..HEAD commits.
  Historical cutoff (2026-05-12) respected. bash 3.2-compatible. exit 1 if either
  required trailer is absent; exit 0 when both present or no discipline files touched.
- packages/core/templates/shared/husky-pre-push.sh: updated from OLD consumer
  pre-push to runtime dispatcher (per research patch §7.4). Node ≥20 + pre-push.ts
  present → TS-core; otherwise → bash fallback. Capability-check, NOT brand-name.
- install.sh: also copies pre-push.fallback.sh to consumer project so the
  runtime dispatcher can find it at $REPO_ROOT/packages/core/hooks/pre-push.fallback.sh.
- docs/meta-factory/prior-art-evaluations.md: SSOT entry #59 added in-commit
  (registry.ts ≥80 LOC under packages/ → capability commit gate fires).

T15 self-application: the registry invariant (every criticalForFallback check is
bash-expressible) is itself unit-tested in registry.test.ts — the rule applies to
itself. Zero edits to pre-push.ts (parallel-overlap avoidance; 10.6 owns that file).

Prior-art: prior-art-evaluations.md#59 (Aider parse_lint_cmds / self.languages, verdict ADAPT — structural pattern of decoupling selection-table from execution-runner transfers; semantic axis differs: file-language vs project-stack. Wave 10.5 registry.ts is 114 LOC ≥80 threshold, capability commit gate fires, SSOT entry added in same commit per CLAUDE.md discipline).

* fix(ci): make ci-success the sole required gate; fold actionlint+zizmor under it (#130)

Branch protection on main/staging required ci-success + actionlint + zizmor, but
actionlint/zizmor lived in workflow-integrity.yml path-filtered to
.github/workflows/** — so PRs not touching workflows (docs, packages) never
triggered them, their required contexts never reported, and the PR deadlocked
(auto-merge could never fire). PR #126 hit this exact wall.

Fix: cross-workflow `needs:` is impossible, so move actionlint + zizmor into
audit-self.yml (no path filter → runs every PR) and add them to ci-success's
`needs:`. ci-success now transitively gates the linters and always reports, so
branch protection can require ONLY ci-success. workflow-integrity.yml keeps just
the R11 branch-protection-assertion. Checks are stricter, not weaker: a broken
workflow YAML on a docs PR is now caught (previously it wasn't).

Synced: rules-manifest R11 check.command + re-rendered RULES.md table + snapshot;
RULES.md R11 prose; ci-success-gate.sh comment; automerge-staging-plan.md §5
recipe (was telling the maintainer to re-add the deadlocking contexts).

Maintainer-side follow-up: re-run the branch-protection PUT with single-context
payload {"contexts":["ci-success"]} per automerge-staging-plan.md §5.

Prior-art: skipped — moves existing CI jobs between workflow files + doc sync; no new capability, dependency, or ≥80-LOC file.

* feat(principles): principle 17 — no paid LLM in CI (DN-6 stage-1→2 promotion)

Promotes .claude/rules/no-paid-llm-in-ci.md from "Class A, grep mechanism
ready, test pending" to a real executable gate (memory-coverage-audit §10
DN-6 — the one clean stage-1→2 win in-repo). Scans .github/workflows/*.yml
for paid-LLM *usage* (ANTHROPIC/OPENAI api-key assignment or secret ref,
api.{anthropic,openai}.com hostnames, paid SDK imports) and fails CI if any
is present.

Usage-precise, not mention-counting: full-line comments are stripped first,
so the project's own negation mention (framework-self-template-render.yml:
"NO ANTHROPIC_API_KEY reference") does NOT false-positive. Negative-controls
in the test prove that, plus session/MCP tooling (claude CLI, context7) is
out of scope per rule §2.

Slot 17 (01-16 occupied). Runs in CI via principles-meta-tests → gated by
ci-success. 7/7 local; full suite 17 files / 106 tests green.

§1.7: forward-check applied — principle 17 IS the executable artifact for an existing prose rule (no-paid-llm-in-ci.md §1/§6 "pre-merge grep" counter); paired-negatives at packages/core/principles/17-no-paid-llm-in-ci.test.ts:91 (api-key assignment), :96 (hostname), :101 (SDK) prove detection, negative-controls at :107/:112 prevent false-positives. Backward-check sweep — reviewed principle slots 01-16 (17 next free) + prior-art-evaluations.md; no overlap (secret-scanners detect leaked creds, this bans a paid-LLM dependency surface — inverse problem class).
Prior-art: skipped — principle test for the existing no-paid-llm-in-ci.md rule (DN-6 promotion); no new capability/dependency/subdir, mirrors principle 15/16 precedent.
artyhoo added a commit that referenced this pull request May 22, 2026
@artyhoo
docs(research-patches): N7 dogfood-companions process-layer adoption …
0a201e2 
…plan (DECISION=C) (#135)

* feat(principles): principle 17 — no paid LLM in CI (DN-6) [→staging live-test] (#132) (#133)

* docs(research): memory coverage audit (memory → docs → tests) 2026-05-22 (#126)

R-phase report: triages all 51 project-memory files against the project
goal (rule = executable test), builds a 30-row coverage matrix by pipeline
stage (0 memory-only / 1 prose / 2 executable), and proposes a forward-going
memory-codification discipline (write-time + local-audit + periodic re-audit).
No implementation — gap-closure + new rule are a separate PR after maintainer GO.

Successor to 2026-05-13 memory-to-docs codification audit (extends memory→docs
for 6 entries to memory→docs→tests over all 51 files). Surfaces T16 stale-header
finding (principle tests 11/12/13 shipped but rule headers say "pending").

Prior-art: skipped — research-patch doc only, no new capability/dependency; reuses 2026-05-13 §7 REUSE verdict (Cline Memory Bank + CC scope hierarchy).

* feat(principles): Wave 10.6 — port hook-stub-completeness audit to principle 16 (#127)

- Add packages/core/principles/16-hook-stub-completeness.test.ts (7 tests):
  (a) real-tree vacuous pass: empty hard-fail set post-migration → passes, not dies
  (b) paired-negative: make_test_repo() test file missing stub → ❌ violation detected + message text asserted
  (c) non-empty happy path: stub present → no violation
  + scope gate, multi-script, dedup, T15 self-application arms
- Delete packages/core/audit-self/hook-stub-completeness.test.sh (bash predecessor)
- Remove requireSelfTest('…hook-stub-completeness.test.sh') invocation from pre-push.ts §3a
- Remove requireSelfTest() helper (zero call sites remaining → genuinely dead)
- Leave phantom stub in tests/hooks/prior-art-trailer-hook.test.sh (harmless; out of scope)

Prior-art: skipped — bash→TS port of existing hook-stub-completeness audit (Wave 10.6), no new capability

* docs(automerge): codify branch-from-main staging flow + resync discipline (#128)

* docs(automerge): codify branch-from-main→staging flow + resync discipline; sync doc to LIVE state

main's copy was stale (still called ci-success a placeholder). Updates: status LIVE (settings applied 2026-05-22); new §2.1 branching flow — always branch FROM main, auto-merge INTO staging, with the load-bearing RESYNC discipline (ff staging→main after each promotion) that keeps staging a disposable buffer not a divergent develop; §5 recipe marked APPLIED with the real ci-success+actionlint+zizmor contexts + main owner-only protection; §6 #2 RESOLVED (#125).

Prior-art: skipped — doc codification of an already-decided flow, no new capability/dependency/subdir.

* docs(§2.1): drop trunk-based exception — everything routine → staging (0 clicks)

Maintainer's point: direct-to-main is owner-only → forces a manual merge
click per PR, the exact toil being removed. staging auto-merges (0 clicks).
So all routine work → staging; direct-to-main only for owner hotfixes.

Added dependency note: for true zero-click walk-away the agent must set
auto-merge on staging-targeted PRs, currently blocked by the git-safety
hook (allows only feat→epic). Relaxing it (permit auto-merge --base staging)
is the actual zero-click lever, and is a maintainer-side hook edit.

Prior-art: skipped — doc refinement of the codified flow, no new capability.

* feat(hooks): Wave 10.5 — bash-fallback + install.sh feature detection (#129)

Ships the critical-only bash fallback for the pre-push hook and updates
the consumer-facing dispatcher template to runtime feature detection.

Artifacts:
- packages/core/hooks/checks/registry.ts (~114 LOC): declarative
  check-registry ({ id, criticalForFallback, runner }[]) decoupling
  check-set selection from execution (ADAPT from Aider §4.8.X.2).
  Critical entries: prior-art-presence + s17-presence (both runner: 'bash'),
  per D2 + research patch §7.2.
- packages/core/hooks/checks/registry.test.ts: unit tests asserting
  bash-expressible invariant (every criticalForFallback entry → runner: 'bash')
  AND presence of both required critical entries.
- packages/core/hooks/pre-push.fallback.sh (~63 LOC): critical-only bash gate.
  Runs §7 Prior-art presence + §1.7 presence checks on origin/main..HEAD commits.
  Historical cutoff (2026-05-12) respected. bash 3.2-compatible. exit 1 if either
  required trailer is absent; exit 0 when both present or no discipline files touched.
- packages/core/templates/shared/husky-pre-push.sh: updated from OLD consumer
  pre-push to runtime dispatcher (per research patch §7.4). Node ≥20 + pre-push.ts
  present → TS-core; otherwise → bash fallback. Capability-check, NOT brand-name.
- install.sh: also copies pre-push.fallback.sh to consumer project so the
  runtime dispatcher can find it at $REPO_ROOT/packages/core/hooks/pre-push.fallback.sh.
- docs/meta-factory/prior-art-evaluations.md: SSOT entry #59 added in-commit
  (registry.ts ≥80 LOC under packages/ → capability commit gate fires).

T15 self-application: the registry invariant (every criticalForFallback check is
bash-expressible) is itself unit-tested in registry.test.ts — the rule applies to
itself. Zero edits to pre-push.ts (parallel-overlap avoidance; 10.6 owns that file).

Prior-art: prior-art-evaluations.md#59 (Aider parse_lint_cmds / self.languages, verdict ADAPT — structural pattern of decoupling selection-table from execution-runner transfers; semantic axis differs: file-language vs project-stack. Wave 10.5 registry.ts is 114 LOC ≥80 threshold, capability commit gate fires, SSOT entry added in same commit per CLAUDE.md discipline).

* fix(ci): make ci-success the sole required gate; fold actionlint+zizmor under it (#130)

Branch protection on main/staging required ci-success + actionlint + zizmor, but
actionlint/zizmor lived in workflow-integrity.yml path-filtered to
.github/workflows/** — so PRs not touching workflows (docs, packages) never
triggered them, their required contexts never reported, and the PR deadlocked
(auto-merge could never fire). PR #126 hit this exact wall.

Fix: cross-workflow `needs:` is impossible, so move actionlint + zizmor into
audit-self.yml (no path filter → runs every PR) and add them to ci-success's
`needs:`. ci-success now transitively gates the linters and always reports, so
branch protection can require ONLY ci-success. workflow-integrity.yml keeps just
the R11 branch-protection-assertion. Checks are stricter, not weaker: a broken
workflow YAML on a docs PR is now caught (previously it wasn't).

Synced: rules-manifest R11 check.command + re-rendered RULES.md table + snapshot;
RULES.md R11 prose; ci-success-gate.sh comment; automerge-staging-plan.md §5
recipe (was telling the maintainer to re-add the deadlocking contexts).

Maintainer-side follow-up: re-run the branch-protection PUT with single-context
payload {"contexts":["ci-success"]} per automerge-staging-plan.md §5.

Prior-art: skipped — moves existing CI jobs between workflow files + doc sync; no new capability, dependency, or ≥80-LOC file.

* feat(principles): principle 17 — no paid LLM in CI (DN-6 stage-1→2 promotion)

Promotes .claude/rules/no-paid-llm-in-ci.md from "Class A, grep mechanism
ready, test pending" to a real executable gate (memory-coverage-audit §10
DN-6 — the one clean stage-1→2 win in-repo). Scans .github/workflows/*.yml
for paid-LLM *usage* (ANTHROPIC/OPENAI api-key assignment or secret ref,
api.{anthropic,openai}.com hostnames, paid SDK imports) and fails CI if any
is present.

Usage-precise, not mention-counting: full-line comments are stripped first,
so the project's own negation mention (framework-self-template-render.yml:
"NO ANTHROPIC_API_KEY reference") does NOT false-positive. Negative-controls
in the test prove that, plus session/MCP tooling (claude CLI, context7) is
out of scope per rule §2.

Slot 17 (01-16 occupied). Runs in CI via principles-meta-tests → gated by
ci-success. 7/7 local; full suite 17 files / 106 tests green.

§1.7: forward-check applied — principle 17 IS the executable artifact for an existing prose rule (no-paid-llm-in-ci.md §1/§6 "pre-merge grep" counter); paired-negatives at packages/core/principles/17-no-paid-llm-in-ci.test.ts:91 (api-key assignment), :96 (hostname), :101 (SDK) prove detection, negative-controls at :107/:112 prevent false-positives. Backward-check sweep — reviewed principle slots 01-16 (17 next free) + prior-art-evaluations.md; no overlap (secret-scanners detect leaked creds, this bans a paid-LLM dependency surface — inverse problem class).
Prior-art: skipped — principle test for the existing no-paid-llm-in-ci.md rule (DN-6 promotion); no new capability/dependency/subdir, mirrors principle 15/16 precedent.

* docs(research-patches): N7 dogfood-companions process-layer adoption plan (DECISION=C, axis B)

Read-only research deliverable for roadmap Wave N7. Inventories Superpowers process-layer
artefacts (SDD skill, using-git-worktrees) dogfoodable in our own dev under DECISION=C;
ADOPT both at process layer with explicit substrate-purity boundary (axis A never coupled).
Verifies isolation:"worktree" compatibility (DeepWiki, not name-assumed). Proposes SSOT
#60/#61 in-text (not written — surfaced for maintainer application after the §4-step-5
empirical trial). N0-storm overlap noted. §7 carries the §1.7 forward/backward self-review.

Prior-art: skipped — research-patch doc only, no capability artefact (DeepWiki ×3 + WebSearch ×3 evidence in §2; SSOT rows proposed not written).
artyhoo added a commit that referenced this pull request May 22, 2026
@artyhoo
docs(research-patches): N4b recommendation-moment gate design consoli…
3cbb5f4 
…dation (#136)

* feat(principles): principle 17 — no paid LLM in CI (DN-6) [→staging live-test] (#132) (#133)

* docs(research): memory coverage audit (memory → docs → tests) 2026-05-22 (#126)

R-phase report: triages all 51 project-memory files against the project
goal (rule = executable test), builds a 30-row coverage matrix by pipeline
stage (0 memory-only / 1 prose / 2 executable), and proposes a forward-going
memory-codification discipline (write-time + local-audit + periodic re-audit).
No implementation — gap-closure + new rule are a separate PR after maintainer GO.

Successor to 2026-05-13 memory-to-docs codification audit (extends memory→docs
for 6 entries to memory→docs→tests over all 51 files). Surfaces T16 stale-header
finding (principle tests 11/12/13 shipped but rule headers say "pending").

Prior-art: skipped — research-patch doc only, no new capability/dependency; reuses 2026-05-13 §7 REUSE verdict (Cline Memory Bank + CC scope hierarchy).

* feat(principles): Wave 10.6 — port hook-stub-completeness audit to principle 16 (#127)

- Add packages/core/principles/16-hook-stub-completeness.test.ts (7 tests):
  (a) real-tree vacuous pass: empty hard-fail set post-migration → passes, not dies
  (b) paired-negative: make_test_repo() test file missing stub → ❌ violation detected + message text asserted
  (c) non-empty happy path: stub present → no violation
  + scope gate, multi-script, dedup, T15 self-application arms
- Delete packages/core/audit-self/hook-stub-completeness.test.sh (bash predecessor)
- Remove requireSelfTest('…hook-stub-completeness.test.sh') invocation from pre-push.ts §3a
- Remove requireSelfTest() helper (zero call sites remaining → genuinely dead)
- Leave phantom stub in tests/hooks/prior-art-trailer-hook.test.sh (harmless; out of scope)

Prior-art: skipped — bash→TS port of existing hook-stub-completeness audit (Wave 10.6), no new capability

* docs(automerge): codify branch-from-main staging flow + resync discipline (#128)

* docs(automerge): codify branch-from-main→staging flow + resync discipline; sync doc to LIVE state

main's copy was stale (still called ci-success a placeholder). Updates: status LIVE (settings applied 2026-05-22); new §2.1 branching flow — always branch FROM main, auto-merge INTO staging, with the load-bearing RESYNC discipline (ff staging→main after each promotion) that keeps staging a disposable buffer not a divergent develop; §5 recipe marked APPLIED with the real ci-success+actionlint+zizmor contexts + main owner-only protection; §6 #2 RESOLVED (#125).

Prior-art: skipped — doc codification of an already-decided flow, no new capability/dependency/subdir.

* docs(§2.1): drop trunk-based exception — everything routine → staging (0 clicks)

Maintainer's point: direct-to-main is owner-only → forces a manual merge
click per PR, the exact toil being removed. staging auto-merges (0 clicks).
So all routine work → staging; direct-to-main only for owner hotfixes.

Added dependency note: for true zero-click walk-away the agent must set
auto-merge on staging-targeted PRs, currently blocked by the git-safety
hook (allows only feat→epic). Relaxing it (permit auto-merge --base staging)
is the actual zero-click lever, and is a maintainer-side hook edit.

Prior-art: skipped — doc refinement of the codified flow, no new capability.

* feat(hooks): Wave 10.5 — bash-fallback + install.sh feature detection (#129)

Ships the critical-only bash fallback for the pre-push hook and updates
the consumer-facing dispatcher template to runtime feature detection.

Artifacts:
- packages/core/hooks/checks/registry.ts (~114 LOC): declarative
  check-registry ({ id, criticalForFallback, runner }[]) decoupling
  check-set selection from execution (ADAPT from Aider §4.8.X.2).
  Critical entries: prior-art-presence + s17-presence (both runner: 'bash'),
  per D2 + research patch §7.2.
- packages/core/hooks/checks/registry.test.ts: unit tests asserting
  bash-expressible invariant (every criticalForFallback entry → runner: 'bash')
  AND presence of both required critical entries.
- packages/core/hooks/pre-push.fallback.sh (~63 LOC): critical-only bash gate.
  Runs §7 Prior-art presence + §1.7 presence checks on origin/main..HEAD commits.
  Historical cutoff (2026-05-12) respected. bash 3.2-compatible. exit 1 if either
  required trailer is absent; exit 0 when both present or no discipline files touched.
- packages/core/templates/shared/husky-pre-push.sh: updated from OLD consumer
  pre-push to runtime dispatcher (per research patch §7.4). Node ≥20 + pre-push.ts
  present → TS-core; otherwise → bash fallback. Capability-check, NOT brand-name.
- install.sh: also copies pre-push.fallback.sh to consumer project so the
  runtime dispatcher can find it at $REPO_ROOT/packages/core/hooks/pre-push.fallback.sh.
- docs/meta-factory/prior-art-evaluations.md: SSOT entry #59 added in-commit
  (registry.ts ≥80 LOC under packages/ → capability commit gate fires).

T15 self-application: the registry invariant (every criticalForFallback check is
bash-expressible) is itself unit-tested in registry.test.ts — the rule applies to
itself. Zero edits to pre-push.ts (parallel-overlap avoidance; 10.6 owns that file).

Prior-art: prior-art-evaluations.md#59 (Aider parse_lint_cmds / self.languages, verdict ADAPT — structural pattern of decoupling selection-table from execution-runner transfers; semantic axis differs: file-language vs project-stack. Wave 10.5 registry.ts is 114 LOC ≥80 threshold, capability commit gate fires, SSOT entry added in same commit per CLAUDE.md discipline).

* fix(ci): make ci-success the sole required gate; fold actionlint+zizmor under it (#130)

Branch protection on main/staging required ci-success + actionlint + zizmor, but
actionlint/zizmor lived in workflow-integrity.yml path-filtered to
.github/workflows/** — so PRs not touching workflows (docs, packages) never
triggered them, their required contexts never reported, and the PR deadlocked
(auto-merge could never fire). PR #126 hit this exact wall.

Fix: cross-workflow `needs:` is impossible, so move actionlint + zizmor into
audit-self.yml (no path filter → runs every PR) and add them to ci-success's
`needs:`. ci-success now transitively gates the linters and always reports, so
branch protection can require ONLY ci-success. workflow-integrity.yml keeps just
the R11 branch-protection-assertion. Checks are stricter, not weaker: a broken
workflow YAML on a docs PR is now caught (previously it wasn't).

Synced: rules-manifest R11 check.command + re-rendered RULES.md table + snapshot;
RULES.md R11 prose; ci-success-gate.sh comment; automerge-staging-plan.md §5
recipe (was telling the maintainer to re-add the deadlocking contexts).

Maintainer-side follow-up: re-run the branch-protection PUT with single-context
payload {"contexts":["ci-success"]} per automerge-staging-plan.md §5.

Prior-art: skipped — moves existing CI jobs between workflow files + doc sync; no new capability, dependency, or ≥80-LOC file.

* feat(principles): principle 17 — no paid LLM in CI (DN-6 stage-1→2 promotion)

Promotes .claude/rules/no-paid-llm-in-ci.md from "Class A, grep mechanism
ready, test pending" to a real executable gate (memory-coverage-audit §10
DN-6 — the one clean stage-1→2 win in-repo). Scans .github/workflows/*.yml
for paid-LLM *usage* (ANTHROPIC/OPENAI api-key assignment or secret ref,
api.{anthropic,openai}.com hostnames, paid SDK imports) and fails CI if any
is present.

Usage-precise, not mention-counting: full-line comments are stripped first,
so the project's own negation mention (framework-self-template-render.yml:
"NO ANTHROPIC_API_KEY reference") does NOT false-positive. Negative-controls
in the test prove that, plus session/MCP tooling (claude CLI, context7) is
out of scope per rule §2.

Slot 17 (01-16 occupied). Runs in CI via principles-meta-tests → gated by
ci-success. 7/7 local; full suite 17 files / 106 tests green.

§1.7: forward-check applied — principle 17 IS the executable artifact for an existing prose rule (no-paid-llm-in-ci.md §1/§6 "pre-merge grep" counter); paired-negatives at packages/core/principles/17-no-paid-llm-in-ci.test.ts:91 (api-key assignment), :96 (hostname), :101 (SDK) prove detection, negative-controls at :107/:112 prevent false-positives. Backward-check sweep — reviewed principle slots 01-16 (17 next free) + prior-art-evaluations.md; no overlap (secret-scanners detect leaked creds, this bans a paid-LLM dependency surface — inverse problem class).
Prior-art: skipped — principle test for the existing no-paid-llm-in-ci.md rule (DN-6 promotion); no new capability/dependency/subdir, mirrors principle 15/16 precedent.

* docs(research-patches): N4b recommendation-moment gate design consolidation

Read-only research deliverable for roadmap Wave N4b. Consolidates iterative rounds 1–5 +
a fresh prior-art re-verification (DeepWiki ×4 + WebSearch ×3, 2026-05-22) sustaining the
BUILD verdict for H10; ADOPT-VOCABULARY for AgentSpec trigger→check→enforce. Does NOT
re-open D6 (H1 shipped / H2 rejected / H10 trigger-gated, §13.39). Advances within D6 by
surfacing two not-yet-shipped low-cost mechanisms (W1 §1.7-allowlist tightening; Option B
compliance-verifier extension) as recommended follow-up — surfaced, not applied (both touch
maintainer-owned enforcement/agent files). §8 carries the §1.7 forward/backward self-review.

Prior-art: skipped — research-patch doc only, no capability artefact (DeepWiki ×4 + WebSearch ×3 evidence in §2; SSOT #62 proposed not written, to ship only with H10).
artyhoo added a commit that referenced this pull request May 22, 2026
@artyhoo
feat(rules): rule-enforcement channel-selection — survey + Class-C ru…
fa7cce6 
…le (#139)

* feat(principles): principle 17 — no paid LLM in CI (DN-6) [→staging live-test] (#132) (#133)

* docs(research): memory coverage audit (memory → docs → tests) 2026-05-22 (#126)

R-phase report: triages all 51 project-memory files against the project
goal (rule = executable test), builds a 30-row coverage matrix by pipeline
stage (0 memory-only / 1 prose / 2 executable), and proposes a forward-going
memory-codification discipline (write-time + local-audit + periodic re-audit).
No implementation — gap-closure + new rule are a separate PR after maintainer GO.

Successor to 2026-05-13 memory-to-docs codification audit (extends memory→docs
for 6 entries to memory→docs→tests over all 51 files). Surfaces T16 stale-header
finding (principle tests 11/12/13 shipped but rule headers say "pending").

Prior-art: skipped — research-patch doc only, no new capability/dependency; reuses 2026-05-13 §7 REUSE verdict (Cline Memory Bank + CC scope hierarchy).

* feat(principles): Wave 10.6 — port hook-stub-completeness audit to principle 16 (#127)

- Add packages/core/principles/16-hook-stub-completeness.test.ts (7 tests):
  (a) real-tree vacuous pass: empty hard-fail set post-migration → passes, not dies
  (b) paired-negative: make_test_repo() test file missing stub → ❌ violation detected + message text asserted
  (c) non-empty happy path: stub present → no violation
  + scope gate, multi-script, dedup, T15 self-application arms
- Delete packages/core/audit-self/hook-stub-completeness.test.sh (bash predecessor)
- Remove requireSelfTest('…hook-stub-completeness.test.sh') invocation from pre-push.ts §3a
- Remove requireSelfTest() helper (zero call sites remaining → genuinely dead)
- Leave phantom stub in tests/hooks/prior-art-trailer-hook.test.sh (harmless; out of scope)

Prior-art: skipped — bash→TS port of existing hook-stub-completeness audit (Wave 10.6), no new capability

* docs(automerge): codify branch-from-main staging flow + resync discipline (#128)

* docs(automerge): codify branch-from-main→staging flow + resync discipline; sync doc to LIVE state

main's copy was stale (still called ci-success a placeholder). Updates: status LIVE (settings applied 2026-05-22); new §2.1 branching flow — always branch FROM main, auto-merge INTO staging, with the load-bearing RESYNC discipline (ff staging→main after each promotion) that keeps staging a disposable buffer not a divergent develop; §5 recipe marked APPLIED with the real ci-success+actionlint+zizmor contexts + main owner-only protection; §6 #2 RESOLVED (#125).

Prior-art: skipped — doc codification of an already-decided flow, no new capability/dependency/subdir.

* docs(§2.1): drop trunk-based exception — everything routine → staging (0 clicks)

Maintainer's point: direct-to-main is owner-only → forces a manual merge
click per PR, the exact toil being removed. staging auto-merges (0 clicks).
So all routine work → staging; direct-to-main only for owner hotfixes.

Added dependency note: for true zero-click walk-away the agent must set
auto-merge on staging-targeted PRs, currently blocked by the git-safety
hook (allows only feat→epic). Relaxing it (permit auto-merge --base staging)
is the actual zero-click lever, and is a maintainer-side hook edit.

Prior-art: skipped — doc refinement of the codified flow, no new capability.

* feat(hooks): Wave 10.5 — bash-fallback + install.sh feature detection (#129)

Ships the critical-only bash fallback for the pre-push hook and updates
the consumer-facing dispatcher template to runtime feature detection.

Artifacts:
- packages/core/hooks/checks/registry.ts (~114 LOC): declarative
  check-registry ({ id, criticalForFallback, runner }[]) decoupling
  check-set selection from execution (ADAPT from Aider §4.8.X.2).
  Critical entries: prior-art-presence + s17-presence (both runner: 'bash'),
  per D2 + research patch §7.2.
- packages/core/hooks/checks/registry.test.ts: unit tests asserting
  bash-expressible invariant (every criticalForFallback entry → runner: 'bash')
  AND presence of both required critical entries.
- packages/core/hooks/pre-push.fallback.sh (~63 LOC): critical-only bash gate.
  Runs §7 Prior-art presence + §1.7 presence checks on origin/main..HEAD commits.
  Historical cutoff (2026-05-12) respected. bash 3.2-compatible. exit 1 if either
  required trailer is absent; exit 0 when both present or no discipline files touched.
- packages/core/templates/shared/husky-pre-push.sh: updated from OLD consumer
  pre-push to runtime dispatcher (per research patch §7.4). Node ≥20 + pre-push.ts
  present → TS-core; otherwise → bash fallback. Capability-check, NOT brand-name.
- install.sh: also copies pre-push.fallback.sh to consumer project so the
  runtime dispatcher can find it at $REPO_ROOT/packages/core/hooks/pre-push.fallback.sh.
- docs/meta-factory/prior-art-evaluations.md: SSOT entry #59 added in-commit
  (registry.ts ≥80 LOC under packages/ → capability commit gate fires).

T15 self-application: the registry invariant (every criticalForFallback check is
bash-expressible) is itself unit-tested in registry.test.ts — the rule applies to
itself. Zero edits to pre-push.ts (parallel-overlap avoidance; 10.6 owns that file).

Prior-art: prior-art-evaluations.md#59 (Aider parse_lint_cmds / self.languages, verdict ADAPT — structural pattern of decoupling selection-table from execution-runner transfers; semantic axis differs: file-language vs project-stack. Wave 10.5 registry.ts is 114 LOC ≥80 threshold, capability commit gate fires, SSOT entry added in same commit per CLAUDE.md discipline).

* fix(ci): make ci-success the sole required gate; fold actionlint+zizmor under it (#130)

Branch protection on main/staging required ci-success + actionlint + zizmor, but
actionlint/zizmor lived in workflow-integrity.yml path-filtered to
.github/workflows/** — so PRs not touching workflows (docs, packages) never
triggered them, their required contexts never reported, and the PR deadlocked
(auto-merge could never fire). PR #126 hit this exact wall.

Fix: cross-workflow `needs:` is impossible, so move actionlint + zizmor into
audit-self.yml (no path filter → runs every PR) and add them to ci-success's
`needs:`. ci-success now transitively gates the linters and always reports, so
branch protection can require ONLY ci-success. workflow-integrity.yml keeps just
the R11 branch-protection-assertion. Checks are stricter, not weaker: a broken
workflow YAML on a docs PR is now caught (previously it wasn't).

Synced: rules-manifest R11 check.command + re-rendered RULES.md table + snapshot;
RULES.md R11 prose; ci-success-gate.sh comment; automerge-staging-plan.md §5
recipe (was telling the maintainer to re-add the deadlocking contexts).

Maintainer-side follow-up: re-run the branch-protection PUT with single-context
payload {"contexts":["ci-success"]} per automerge-staging-plan.md §5.

Prior-art: skipped — moves existing CI jobs between workflow files + doc sync; no new capability, dependency, or ≥80-LOC file.

* feat(principles): principle 17 — no paid LLM in CI (DN-6 stage-1→2 promotion)

Promotes .claude/rules/no-paid-llm-in-ci.md from "Class A, grep mechanism
ready, test pending" to a real executable gate (memory-coverage-audit §10
DN-6 — the one clean stage-1→2 win in-repo). Scans .github/workflows/*.yml
for paid-LLM *usage* (ANTHROPIC/OPENAI api-key assignment or secret ref,
api.{anthropic,openai}.com hostnames, paid SDK imports) and fails CI if any
is present.

Usage-precise, not mention-counting: full-line comments are stripped first,
so the project's own negation mention (framework-self-template-render.yml:
"NO ANTHROPIC_API_KEY reference") does NOT false-positive. Negative-controls
in the test prove that, plus session/MCP tooling (claude CLI, context7) is
out of scope per rule §2.

Slot 17 (01-16 occupied). Runs in CI via principles-meta-tests → gated by
ci-success. 7/7 local; full suite 17 files / 106 tests green.

§1.7: forward-check applied — principle 17 IS the executable artifact for an existing prose rule (no-paid-llm-in-ci.md §1/§6 "pre-merge grep" counter); paired-negatives at packages/core/principles/17-no-paid-llm-in-ci.test.ts:91 (api-key assignment), :96 (hostname), :101 (SDK) prove detection, negative-controls at :107/:112 prevent false-positives. Backward-check sweep — reviewed principle slots 01-16 (17 next free) + prior-art-evaluations.md; no overlap (secret-scanners detect leaked creds, this bans a paid-LLM dependency surface — inverse problem class).
Prior-art: skipped — principle test for the existing no-paid-llm-in-ci.md rule (DN-6 promotion); no new capability/dependency/subdir, mirrors principle 15/16 precedent.

* docs(research): rule-enforcement channel-selection prior-art survey

Survey of just-in-time rule delivery to AI agents (companion-first:
Superpowers/aif-handoff/AIF/OhMyOpencode -> CC-native -> ecosystem).
Validates+refines the narrowest-reachable-channel principle into a
two-axis model (detectability->gate/inject; relevance->breadth).
Proposes SSOT rows #60-#63; codification home deferred to maintainer (Option A).

* feat(rules): rule-enforcement channel-selection (Class C)

Codify the narrowest-reachable-channel principle from the 2026-05-22
prior-art survey: deliver each rule by two axes (detectability->gate/inject;
relevance->breadth), reliability-ordered (deterministic matcher >= always-on
> semantic > memory). Reserve always-on for 3-4 invariants; never memory for
load-bearing rules. Register the rule in principle 09 REQUIRED_HEADER_DOCS so
its authority header is enforced. Class C (mechanism deferred: ADAPT
rule-injector hook per patch section 4).

Prior-art: research-patches/2026-05-22-rule-enforcement-channel-selection.md — prior-art survey (Superpowers / aif-handoff / AIF / OhMyOpencode / Cursor / Agent RuleZ). Verdict: the meta-discipline (which-channel selection) is BUILD — no upstream rule-selection discipline to adopt verbatim; delivery mechanisms are REFERENCE (CC hooks native, SSOT #20). Proposed SSOT rows #60-#63 surfaced for maintainer, not written.

§1.7: forward-check applied — rule complies with no-paid-llm-in-ci (deferred ADAPT hook is deterministic bash, not an LLM call), doc-authority-hierarchy (Class + Authoritative-for header present; registered at packages/core/principles/09-doc-authority-hierarchy.ts:43 so principle 09 enforces its header — verified test 17/17), and README earliest-reachable-channel (delivery-scope companion on a separate axis, not a conflicting goal claim); backward-check sweep — the channel-declaration obligation (rule §3 step 5) is forward-going per the §6 'Existing rules' note, parallel to dual-implementation-discipline §9; no retroactive sweep of the existing .claude/rules/*.md required, no CI gate checks channel declaration (Class C).
artyhoo added a commit that referenced this pull request May 22, 2026
@artyhoo
docs(meta-factory): DN-4 — memory-codification gap tracker (15 stage-…
072b09b 
…0) (#140)

* feat(principles): principle 17 — no paid LLM in CI (DN-6) [→staging live-test] (#132) (#133)

* docs(research): memory coverage audit (memory → docs → tests) 2026-05-22 (#126)

R-phase report: triages all 51 project-memory files against the project
goal (rule = executable test), builds a 30-row coverage matrix by pipeline
stage (0 memory-only / 1 prose / 2 executable), and proposes a forward-going
memory-codification discipline (write-time + local-audit + periodic re-audit).
No implementation — gap-closure + new rule are a separate PR after maintainer GO.

Successor to 2026-05-13 memory-to-docs codification audit (extends memory→docs
for 6 entries to memory→docs→tests over all 51 files). Surfaces T16 stale-header
finding (principle tests 11/12/13 shipped but rule headers say "pending").

Prior-art: skipped — research-patch doc only, no new capability/dependency; reuses 2026-05-13 §7 REUSE verdict (Cline Memory Bank + CC scope hierarchy).

* feat(principles): Wave 10.6 — port hook-stub-completeness audit to principle 16 (#127)

- Add packages/core/principles/16-hook-stub-completeness.test.ts (7 tests):
  (a) real-tree vacuous pass: empty hard-fail set post-migration → passes, not dies
  (b) paired-negative: make_test_repo() test file missing stub → ❌ violation detected + message text asserted
  (c) non-empty happy path: stub present → no violation
  + scope gate, multi-script, dedup, T15 self-application arms
- Delete packages/core/audit-self/hook-stub-completeness.test.sh (bash predecessor)
- Remove requireSelfTest('…hook-stub-completeness.test.sh') invocation from pre-push.ts §3a
- Remove requireSelfTest() helper (zero call sites remaining → genuinely dead)
- Leave phantom stub in tests/hooks/prior-art-trailer-hook.test.sh (harmless; out of scope)

Prior-art: skipped — bash→TS port of existing hook-stub-completeness audit (Wave 10.6), no new capability

* docs(automerge): codify branch-from-main staging flow + resync discipline (#128)

* docs(automerge): codify branch-from-main→staging flow + resync discipline; sync doc to LIVE state

main's copy was stale (still called ci-success a placeholder). Updates: status LIVE (settings applied 2026-05-22); new §2.1 branching flow — always branch FROM main, auto-merge INTO staging, with the load-bearing RESYNC discipline (ff staging→main after each promotion) that keeps staging a disposable buffer not a divergent develop; §5 recipe marked APPLIED with the real ci-success+actionlint+zizmor contexts + main owner-only protection; §6 #2 RESOLVED (#125).

Prior-art: skipped — doc codification of an already-decided flow, no new capability/dependency/subdir.

* docs(§2.1): drop trunk-based exception — everything routine → staging (0 clicks)

Maintainer's point: direct-to-main is owner-only → forces a manual merge
click per PR, the exact toil being removed. staging auto-merges (0 clicks).
So all routine work → staging; direct-to-main only for owner hotfixes.

Added dependency note: for true zero-click walk-away the agent must set
auto-merge on staging-targeted PRs, currently blocked by the git-safety
hook (allows only feat→epic). Relaxing it (permit auto-merge --base staging)
is the actual zero-click lever, and is a maintainer-side hook edit.

Prior-art: skipped — doc refinement of the codified flow, no new capability.

* feat(hooks): Wave 10.5 — bash-fallback + install.sh feature detection (#129)

Ships the critical-only bash fallback for the pre-push hook and updates
the consumer-facing dispatcher template to runtime feature detection.

Artifacts:
- packages/core/hooks/checks/registry.ts (~114 LOC): declarative
  check-registry ({ id, criticalForFallback, runner }[]) decoupling
  check-set selection from execution (ADAPT from Aider §4.8.X.2).
  Critical entries: prior-art-presence + s17-presence (both runner: 'bash'),
  per D2 + research patch §7.2.
- packages/core/hooks/checks/registry.test.ts: unit tests asserting
  bash-expressible invariant (every criticalForFallback entry → runner: 'bash')
  AND presence of both required critical entries.
- packages/core/hooks/pre-push.fallback.sh (~63 LOC): critical-only bash gate.
  Runs §7 Prior-art presence + §1.7 presence checks on origin/main..HEAD commits.
  Historical cutoff (2026-05-12) respected. bash 3.2-compatible. exit 1 if either
  required trailer is absent; exit 0 when both present or no discipline files touched.
- packages/core/templates/shared/husky-pre-push.sh: updated from OLD consumer
  pre-push to runtime dispatcher (per research patch §7.4). Node ≥20 + pre-push.ts
  present → TS-core; otherwise → bash fallback. Capability-check, NOT brand-name.
- install.sh: also copies pre-push.fallback.sh to consumer project so the
  runtime dispatcher can find it at $REPO_ROOT/packages/core/hooks/pre-push.fallback.sh.
- docs/meta-factory/prior-art-evaluations.md: SSOT entry #59 added in-commit
  (registry.ts ≥80 LOC under packages/ → capability commit gate fires).

T15 self-application: the registry invariant (every criticalForFallback check is
bash-expressible) is itself unit-tested in registry.test.ts — the rule applies to
itself. Zero edits to pre-push.ts (parallel-overlap avoidance; 10.6 owns that file).

Prior-art: prior-art-evaluations.md#59 (Aider parse_lint_cmds / self.languages, verdict ADAPT — structural pattern of decoupling selection-table from execution-runner transfers; semantic axis differs: file-language vs project-stack. Wave 10.5 registry.ts is 114 LOC ≥80 threshold, capability commit gate fires, SSOT entry added in same commit per CLAUDE.md discipline).

* fix(ci): make ci-success the sole required gate; fold actionlint+zizmor under it (#130)

Branch protection on main/staging required ci-success + actionlint + zizmor, but
actionlint/zizmor lived in workflow-integrity.yml path-filtered to
.github/workflows/** — so PRs not touching workflows (docs, packages) never
triggered them, their required contexts never reported, and the PR deadlocked
(auto-merge could never fire). PR #126 hit this exact wall.

Fix: cross-workflow `needs:` is impossible, so move actionlint + zizmor into
audit-self.yml (no path filter → runs every PR) and add them to ci-success's
`needs:`. ci-success now transitively gates the linters and always reports, so
branch protection can require ONLY ci-success. workflow-integrity.yml keeps just
the R11 branch-protection-assertion. Checks are stricter, not weaker: a broken
workflow YAML on a docs PR is now caught (previously it wasn't).

Synced: rules-manifest R11 check.command + re-rendered RULES.md table + snapshot;
RULES.md R11 prose; ci-success-gate.sh comment; automerge-staging-plan.md §5
recipe (was telling the maintainer to re-add the deadlocking contexts).

Maintainer-side follow-up: re-run the branch-protection PUT with single-context
payload {"contexts":["ci-success"]} per automerge-staging-plan.md §5.

Prior-art: skipped — moves existing CI jobs between workflow files + doc sync; no new capability, dependency, or ≥80-LOC file.

* feat(principles): principle 17 — no paid LLM in CI (DN-6 stage-1→2 promotion)

Promotes .claude/rules/no-paid-llm-in-ci.md from "Class A, grep mechanism
ready, test pending" to a real executable gate (memory-coverage-audit §10
DN-6 — the one clean stage-1→2 win in-repo). Scans .github/workflows/*.yml
for paid-LLM *usage* (ANTHROPIC/OPENAI api-key assignment or secret ref,
api.{anthropic,openai}.com hostnames, paid SDK imports) and fails CI if any
is present.

Usage-precise, not mention-counting: full-line comments are stripped first,
so the project's own negation mention (framework-self-template-render.yml:
"NO ANTHROPIC_API_KEY reference") does NOT false-positive. Negative-controls
in the test prove that, plus session/MCP tooling (claude CLI, context7) is
out of scope per rule §2.

Slot 17 (01-16 occupied). Runs in CI via principles-meta-tests → gated by
ci-success. 7/7 local; full suite 17 files / 106 tests green.

§1.7: forward-check applied — principle 17 IS the executable artifact for an existing prose rule (no-paid-llm-in-ci.md §1/§6 "pre-merge grep" counter); paired-negatives at packages/core/principles/17-no-paid-llm-in-ci.test.ts:91 (api-key assignment), :96 (hostname), :101 (SDK) prove detection, negative-controls at :107/:112 prevent false-positives. Backward-check sweep — reviewed principle slots 01-16 (17 next free) + prior-art-evaluations.md; no overlap (secret-scanners detect leaked creds, this bans a paid-LLM dependency surface — inverse problem class).
Prior-art: skipped — principle test for the existing no-paid-llm-in-ci.md rule (DN-6 promotion); no new capability/dependency/subdir, mirrors principle 15/16 precedent.

* docs(meta-factory): DN-4 — memory-codification gap tracker (15 stage-0)

Dedicated tracker for the 15 stage-0 (memory-only) conventions from the
2026-05-22 memory coverage audit; close incrementally as-touched per
memory-codification.md §3 (not big-bang — open-questions was at the 500-line cap).

§1.7: Forward — complies with memory-codification.md:1 (operationalises its §3 codify-then-pointer at corpus level) + doc-authority-hierarchy.md:1 (carries Authoritative-for header). Backward — implements DN-4 from docs/meta-factory/research-patches/2026-05-22-memory-coverage-audit.md:168; rows sourced from §4 matrix rows 16-30; no existing doc superseded.
Prior-art: skipped — in-repo tracker doc, no new capability/dependency/packages ≥80 LOC.
@artyhoo artyhoo mentioned this pull request Jul 3, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@artyhoo