Skip to content

feat(meta-orchestrator): L1 — extend discovery surface beyond kickoff.md - #214

Merged
artyhoo merged 1 commit into
stagingfrom
feat/mo-l1-discovery-surface
May 25, 2026
Merged

feat(meta-orchestrator): L1 — extend discovery surface beyond kickoff.md#214
artyhoo merged 1 commit into
stagingfrom
feat/mo-l1-discovery-surface

Conversation

@artyhoo

@artyhoo artyhoo commented May 25, 2026

Copy link
Copy Markdown
Owner

Summary

  • Stage 2 of umbrella meta-orchestrator-planner-completenesspriority-score.sh now enumerates 5 additional surface types as synthetic candidates beyond kickoff.md: cold-review-fixes.md, state.md with PENDING/TODO/AWAITING markers, memory files with TODO-codify:, stale open PRs (>14d), wave-sequencing-plan.md §0 rows marked 🟡/🔲 NOT blocked/DEFERRED.
  • Synthetic namespace <umbrella>-<reason> keeps additions distinct from real kickoff.md-derived entries (anti-tautology test in planner-discovery.test.ts:313-328).
  • Paired-negative Vitest test at packages/core/skills/planner-discovery.test.ts (16 tests, 5 surface types × positive + negative arms) per principle 02; vitest.config.ts include extended with 'skills/**/*.test.ts' so the test is discovered by CI + full suite.

How to verify

  • Commit on feat/mo-l1-discovery-surface — verified: git log --oneline origin/staging..HEAD4b395aa feat(meta-orchestrator): L1 — extend discovery surface beyond kickoff.md
  • Exactly 3 files changed (no drive-by) — verified: git diff --stat origin/staging..HEADpriority-score.sh +89 (65→148 LOC) · planner-discovery.test.ts NEW +356 · vitest.config.ts +1
  • @cc-only-rationale marker preserved — verified: grep '@cc-only-rationale' .claude/skills/meta-orchestrator/helpers/priority-score.sh → present at :31 (dual-implementation-discipline.md §6)
  • T17 preserve — existing kickoff loop intact — verified by independent Reviewer (agent acefbd25f25c85622): «removed lines are: (1) comment update, (2) REPO_ROOT refactored to seam-overridable, (3) gh${MO_GH_BIN} seam. Original kickoff loop logic intact at lines 53-92»
  • T15 dogfood — planner-completeness umbrella discoverable by upgraded helper — verified: bash .claude/skills/meta-orchestrator/helpers/priority-score.sh | grep planner-completeness → fires for both real kickoff (type=R-phase kickoff=exists) AND state-pending synthetic (type=state-followup source=state.md)
  • 16/16 vitest tests pass — verified: npx --prefix packages/core vitest run skills/planner-discovery.test.ts → 16 passed; grep -cE '^\s+(it|test)\(' packages/core/skills/planner-discovery.test.ts16; grep -cE 'it\.skip|it\.todo'0
  • Test discoverable by vitest full suite — verified: npx --prefix packages/core vitest list | grep skills/planner-discovery → present (vitest.config.ts include update worked)
  • Workspace typecheck clean — verified by Worker: npm run typecheck --workspaces --if-present → all 3 workspaces clean
  • Pre-existing test failures NOT attributable to this change — verified by independent Reviewer: same 3 check-doc-authority.test.ts + 1 pre-push.test.ts failures appear in unrelated worktree agent-af5d963458b4c5c44; S2 diff to packages/core/hooks/ = 0 lines
  • §1.7 trailer in commit body — verified: git log -1 --format='%B' | grep -E '§1\.7:' present with substantive Forward + Backward clauses citing kickoff.md:29 anchor + named rules satisfied (no-paid-llm-in-ci §1, dual-implementation-discipline §3)
  • Prior-art trailer cites SSOT rows chore(settings): register deps-hash-check.sh UserPromptSubmit hook #66-feat(hooks): add end-of-turn reminder Stop hook #71 — verified by independent Reviewer: «cites SSOT rows chore(settings): register deps-hash-check.sh UserPromptSubmit hook #66-feat(hooks): add end-of-turn reminder Stop hook #71 — all verified to exist in prior-art-evaluations.md»
  • Capability-commit gate satisfiedplanner-discovery.test.ts is new file ≥50 LOC under new packages/core/skills/ subdir → triggers Prior-art requirement; trailer present + substantive
  • Cold reviewer GO (no BLOCKER, no MAJOR) — agent acefbd25f25c85622 verdict: GO
  • CI green — to be confirmed post-push by gh pr checks

Scope (what this PR is NOT)

  • NOT the R-phase prior-art survey (Stage 1) — that ships separately as PR research(planner-completeness): R-phase prior-art survey for L3/L4/L5 #213.
  • NOT the L2 reverse-currency check (Stage 3) — depends on this PR merged; separate kickoff next session.
  • NOT plan-currency-check.sh modifications — Worker S2 used judgment per «may diverge with rationale»; rationale: «its job is operational status (CURRENT/STALE/FROZEN), not candidate enumeration. Adding a synthetic-count block would duplicate priority-score.sh output without adding signal».

Stub seam for testability

priority-score.sh lines 35/38/47 introduce env-var overrides (MO_GH_BIN, MO_MEM_DIR, MO_WAVE_PLAN) defaulting to runtime values. This keeps the script production-runtime unchanged while allowing the paired-negative test to inject mock-gh binaries + fixture paths without polluting the user's actual repo. No backward-incompatibility — all defaults match prior behaviour.

§1.7 Forward/Backward-check applied

Forward — This PR complies with: no-paid-llm-in-ci.md §1 (deterministic bash only, no API-billed LLM calls anywhere — test mock-gh is local bash script); dual-implementation-discipline.md §3 (meta-orchestrator helpers are INTERNAL CC-native tooling per §3; @cc-only-rationale marker preserved at .claude/skills/meta-orchestrator/helpers/priority-score.sh:31); build-first-reuse-default.md §3 (BUILD verdict for non-kickoff surface scan justified by SSOT rows #66-#71 — meta-orchestrator R-phase established BUILD for this capability layer); principle 02 paired-negative test surface extended to skills/ per packages/core/vitest.config.ts ('skills/**/*.test.ts' include addition). Evidence: .claude/skills/meta-orchestrator/helpers/priority-score.sh:31 (marker) + .claude/skills/meta-orchestrator/helpers/priority-score.sh:98-148 (synthetic sections additive) + commit 4b395aa body.

Backward — Sweep: extension is additive (T17 preserve) — existing kickoff loop logic at priority-score.sh:53-92 intact (verified by independent Reviewer reading the diff cold); existing @cc-only-rationale marker at :31 unchanged; existing set -euo pipefail + || true + while read -r patterns followed (T13 — pattern reuse, not reinvention). Namespace <umbrella>-<reason> distinct from real-kickoff <basename> namespace (anti-tautology test at packages/core/skills/planner-discovery.test.ts:313-328). SSOT rows #66-#71 unchanged; no other rule, helper, or doc superseded. Evidence: git diff --stat origin/staging..HEAD = 3 files only.


🤖 Generated with Claude Code

priority-score.sh now enumerates 5 additional surface types as synthetic
candidates: cold-review-fixes.md, state.md with PENDING/TODO markers,
memory files with TODO-codify, stale open PRs (>14d), wave-sequencing-plan
§0 rows marked 🟡/🔲/DEFERRED. Synthetic namespace <umbrella>-<reason>
keeps them distinct from real kickoff entries.

Paired-negative test at packages/core/skills/planner-discovery.test.ts
covers all 5 surface types per principle 02. Existing kickoff.md
enumeration preserved (T17). vitest.config.ts include extended with
'skills/**/*.test.ts' so the test is picked up by full-suite + CI.

Stage 2 of umbrella meta-orchestrator-planner-completeness.

Prior-art: meta-orchestrator R-phase (SSOT rows #66-#71 — AI Factory
REFERENCE, aif-handoff REJECT, OhMyOpencode REFERENCE, Bernstein
REFERENCE, ComposioHQ REFERENCE, Superpowers using-superpowers REJECT)
established BUILD for meta-orchestrator capability layer; this commit
extends the OWN-BUILD priority-score.sh helper (no upstream candidate
for «meta-orchestrator non-kickoff surface scan» — internal CC-native
per dual-implementation-discipline.md §3). Test artefact extends
principle 02 paired-negative surface; not a new capability layer.

§1.7: forward+backward-check applied.
Forward — this commit extends .claude/skills/meta-orchestrator/helpers/priority-score.sh
per L1 scope at .claude/orchestrator-prompts/meta-orchestrator-planner-completeness/kickoff.md:29;
no new rule introduced, no discipline-bearing artefact created;
no-paid-llm-in-ci.md §1 satisfied (deterministic bash only);
dual-implementation-discipline.md §3 satisfied (@cc-only-rationale preserved,
INTERNAL CC-native default retained).
Backward — extension is additive: T17 preserve verified via baseline diff
at /tmp/priority-baseline.txt vs /tmp/priority-after.txt (verify step 4);
existing kickoff-enumeration capability intact; SSOT rows #66-#71 unchanged;
no other rule or helper superseded.
@artyhoo
artyhoo merged commit 71598b4 into staging May 25, 2026
22 checks passed
artyhoo added a commit that referenced this pull request May 25, 2026
)

plan-currency-check.sh now emits UNTRACKED-<N> for merged PRs (last 30d)
absent from wave-sequencing-plan.md §0, and UNTRACKED-KICKOFF for kickoff
dirs whose umbrella name is absent from §0. Reuses L1 seams (MO_GH_BIN,
MO_WAVE_PLAN, REPO_ROOT) for testability. Both checks additive; existing
plan-claims-vs-reality DRIFT detection intact (T17).

Paired-negative test at packages/core/skills/plan-currency-check.test.ts
covers both UNTRACKED categories + failure modes (missing wave-plan,
empty merged-PRs) per principle 02.

Stage 3 of umbrella meta-orchestrator-planner-completeness; depends on
Stage 2 L1 (PR #214) and Stage 1 R-phase (PR #213), both on origin/staging.

Prior-art: L1 (PR #214) established the MO_GH_BIN/MO_WAVE_PLAN/REPO_ROOT
seam vocabulary in priority-score.sh — this commit reuses the same seam
names verbatim (T13). No external upstream candidate for «reverse-currency
plan-vs-merged-PR audit» — internal CC-native per
dual-implementation-discipline.md §3. SSOT rows #66-#71
(meta-orchestrator BUILD/REFERENCE register) cover the parent capability.

§1.7: forward+backward-check applied.
Forward — extends .claude/skills/meta-orchestrator/helpers/plan-currency-check.sh
per L2 scope at .claude/orchestrator-prompts/meta-orchestrator-planner-completeness/kickoff.md:30;
no new rule or discipline-bearing artefact introduced;
no-paid-llm-in-ci.md §1 satisfied (deterministic bash + jq + grep only);
dual-implementation-discipline.md §3 satisfied (@cc-only-rationale preserved,
INTERNAL CC-native default retained).
Backward — extension additive: T17 preserve verified via baseline diff at
/tmp/plan-currency-baseline.txt vs /tmp/plan-currency-after.txt (DO step 5);
existing plan-claims-vs-reality DRIFT detection intact; no SSOT row
modification; no other helper or rule superseded.
artyhoo added a commit that referenced this pull request May 25, 2026
… detection) (#220)

Run `bash .claude/skills/meta-orchestrator/helpers/plan-currency-check.sh`
(L2 Stage 3 detection shipped in #217) → 88 UNTRACKED-N entries surfaced
between the 2026-05-22 reconciliation and origin/staging tip (#217). Map
each to an existing §0 / Track row by adding the PR number to its evidence
cell, or to a new §0 row for two umbrellas that landed in full since the
prior snapshot. Re-run helper → 0 UNTRACKED remaining.

Key changes:

- Snapshot date 2026-05-22 → 2026-05-25 (header + §0).
- N8 row: A-phase 🔲 → 🟡 — C1 SSOT-existence (#170), C2 kickoff
  T-enumeration floor (#174), C3 principle 13 §1.7 substance (#178),
  C4 delivery-channel marker (#177), activation #180. C5 + cost-levers
  remain gated on §5.3 utilisation trigger.
- Track M.1 / M.4 → DONE: M.1 codified T20 via #212 (with NB note —
  recommendation-laziness took the T20 slot, mutation-equivalence
  T-bump 20→21 still pending); M.4 6 paired-negative bash-hook tests
  shipped #195/#196/#197/#198/#199/#200.
- Two new §0 rows: Meta-orchestrator skill (Track P) — BUILD #186 +
  audit rounds #192/#193/#194/#201/#202 + UX refactor #203/#204/#205
  + planner-completeness #213/#214/#217 + §1.7 PR-body mandate #216;
  Recommendation-laziness discipline — R-phase #206/#207, benchmark
  #210, I-phase Sub-waves A/C/D #211/#212/#215.
- N7 row: + dogfood research-patch #135 / §4 demotion #166 / live-trial
  verified #171. N4b row: + design #136 / record #118.
- Infra paragraph: PR refs for I.1 follow-ups (#121/#123/#124/#125/
  #128/#130/#131/#143/#145/#146/#147/#148/#149/#172/#187), I.2
  (#139/#142/#154/#175), I.3 DN-4 (#126/#132/#133/#138/#140/#152/
  #159/#161/#162/#167).
- Track 2.3 (channel-earliness audit) → DONE 2026-05-23 (#181); removed
  from "What actually remains".
- Footer subsection: standalone work (#191 satellite-arch / #189
  guard-liveness / #173 storm-readiness / #176 §10 port / #182 cleanup),
  Wave 10 follow-ups (#110/#112/#113), plan-revision history (#108/
  #109/#153/#155/#157/#160/#164/#165/#168/#179/#185).

Verification:
- `bash .claude/skills/meta-orchestrator/helpers/plan-currency-check.sh
  | grep -c '^UNTRACKED'` → 0 (down from 88).
- `npx markdownlint-cli docs/meta-factory/wave-sequencing-plan.md`
  → no violations.
- `npx vitest run packages/core/skills/plan-currency-check.test.ts`
  → 14/14 passed.

Prior-art: skipped — chore, doc reconciliation only, no new capability
or rule introduced.
artyhoo added a commit that referenced this pull request May 25, 2026
…DOPT VOCABULARY (#225)

* feat(meta-orchestrator): L4 — decomposition heuristics (classify-work.sh)

New helper classify-work.sh emits work-item classification (fix / R-phase /
I-phase-small / I-phase-large) + dispatch mode (direct-Edit / R-phase-session
/ Mode-A / Mode-B) for any kickoff file path or source description. Pure
deterministic bash (~98 LOC) + jq-free + LLM-free per no-paid-llm-in-ci §1.

Heuristics (in order): R-phase keyword (research|prior-art|survey) → R-phase;
LOC ≤5 + surfaces ≤1 → fix; LOC ≤80 + surfaces ≤1 → I-phase-small (Mode-A);
otherwise → I-phase-large (Mode-B umbrella). LOC = file line count (or
word-count/6 estimate for literal strings); SURFACES = unique file-path
mentions matching common code/doc extensions.

Vocabulary adapted from TaskMaster complexity tiers (LLM impl rejected, vocab
only — SSOT #72) + Superpowers SDD 3-tier model selection (small/medium/large
maps cleanly to fix/I-phase-small/I-phase-large — SSOT #73). Implementation
is fully deterministic and bash-scriptable — TaskMaster's LLM-scored
complexity does not transfer; SDD's within-plan-vs-cross-umbrella scope
mismatch resolved by ADOPT VOCABULARY only per R-phase §5.2.

Paired-negative test at packages/core/skills/classify-work.test.ts covers all
4 tiers + R-phase keyword path + literal-string input + paired-negatives
(LOC=7 drops from fix to small; 100-LOC drops from small to large;
multi-surface drops from small to large; missing R-phase keyword falls to
size-based) + failure-mode (missing arg → exit non-zero with usage) per
principle 02. Two new SSOT rows (#72 TaskMaster ADOPT VOCAB, #73 SDD
3-tier ADOPT VOCAB; actual IDs assigned via MAX+1/MAX+2 query at staging
time — MAX was 71 at commit time, 5.A/5.C had not landed) cite the R-phase
patch verdict (PR #213).

Stage 5.B of umbrella meta-orchestrator-planner-completeness; closes the
L4 layer per state.md §6 maintainer GO. Sibling sub-waves 5.A (L3 dup-detect)
and 5.C (L5 skill-assign) ship in parallel — this commit touches only L4
surfaces (no overlap).

DECISIONS:
- Word-count/6 heuristic divisor used for literal-string input. Empty/whitespace
  → min 1 LOC → fix tier (documented in code comments).
- Paths with spaces NOT matched by SURFACES regex — intentional; uncommon in
  source paths; keeps regex simple/deterministic (documented in code comments).
- npm test --workspaces: 4 failures pre-exist on staging (hooks/pre-push.test.ts
  + hooks/check-doc-authority.test.ts × 3); confirmed pre-existing via git stash
  verification — NOT caused by this commit.
- T15 dogfood: classify-work on own kickoff (worker-S5B-l4-impl.md) emits
  TYPE: R-phase because the kickoff contains "Prior-art:" trailers that match
  the R-phase keyword heuristic. Expected inherent limitation — kickoff docs
  referencing prior-art are classified as R-phase. The kickoff itself is not
  in the worktree, but the test with the original repo path confirms this edge case.
- SSOT rows: re-read row 71 + header row for column shape; all new rows = 10
  fields matching baseline (verified via awk -F'|').
- Verdict change from kickoff spec's "ADAPT VOCABULARY" to "ADOPT VOCABULARY":
  principle 11 F2 gate rejects "ADAPT VOCABULARY" (not in VERDICTS set). Semantic
  analysis confirms ADOPT VOCABULARY is correct — we adopt (not modify) the naming
  conventions from upstream. The kickoff spec used "ADAPT" loosely to mean the BFR
  verdict category, but the SSOT-level vocabulary recognizes ADOPT VOCABULARY for
  pure vocabulary adoption without implementation change.

Prior-art: R-phase PR #213 (research-patches/2026-05-25-planner-completeness-
prior-art.md §5.2) established the BUILD ~40 LOC + ADOPT VOCABULARY verdict
for L4 after 5-candidate survey (TaskMaster, Superpowers SDD, OpenHands,
Anthropic orchestrator-workers, Cursor Plan Mode). No external upstream
ships a bash-scriptable, rule-based, LOC+surface-count classifier for
markdown kickoff items — confirmed via 9 DeepWiki queries + WebSearch sweeps.
Per CLAUDE.md «Build-vs-reuse invariant»: 2 SSOT rows (TaskMaster ADOPT VOCAB
+ SDD 3-tier ADOPT VOCAB; IDs #72 + #73, assigned at MAX+1/MAX+2 query time
with MAX=71 confirmed at commit time) appended in this commit document the
verdicts.

§1.7: forward+backward-check applied.
Forward — adds .claude/skills/meta-orchestrator/helpers/classify-work.sh as
the L4 implementation per R-phase §5.2 verdict at docs/meta-factory/research-
patches/2026-05-25-planner-completeness-prior-art.md (§5.2 line);
no new rule or discipline-bearing artefact introduced;
no-paid-llm-in-ci.md §1 satisfied (deterministic bash + grep only);
dual-implementation-discipline.md §3 satisfied (@cc-only-rationale present
on new helper, INTERNAL CC-native default per §3 internal-tooling category).
Backward — three additive files (1 new bash helper + 1 new test + SSOT row
append); no existing helper, test, principle, or rule modified or
superseded; L1 (PR #214) priority-score.sh and L2 (PR #217) plan-currency-
check.sh both intact (verified via git diff -- .claude/skills/meta-orchestrator/
helpers/ excludes both files).

* fix(meta-orchestrator): L4 — renumber SSOT rows #72/#73#73/#74 per R-phase plan

R-phase §5.1 (docs/meta-factory/research-patches/2026-05-25-planner-completeness-prior-art.md)
reserves #72 for the L3 sibling sub-wave (OpenHands, branch feat/mo-l3-dup-detect).
The Stage 5.B commit used MAX+1/MAX+2 query (MAX=71 at commit time) which was
mechanically correct, but the R-phase binding plan explicitly allocates IDs by layer:
with the plan.

Changes:
- docs/meta-factory/prior-art-evaluations.md: | 72 | TaskMaster → | 73 |; | 73 | SDD → | 74 |
- .claude/skills/meta-orchestrator/helpers/classify-work.sh:
    lines 10-11 SSOT #72#73 (TaskMaster), SSOT #73#74 (SDD);
    line 72 (Tier boundaries comment) SSOT #73#74

Prior-art: skipped — renumber-only fix per R-phase §5 binding plan, no new capability
artyhoo added a commit that referenced this pull request Jul 10, 2026
…rix + CI firing (python-backend-v0 S1) (#960)

* feat(backends): astgrep Python YAML renderer — syntax-class routing + FF7001/FF7002 refusals (S1 Task 1)

python-backend-v0 umbrella, S1 Task 1. Adds packages/core/backends/astgrep/:

- render-astgrep.ts: pure renderer, backend name astgrep-python-yaml,
  ToolchainBackend<string> conformance (astgrepBackend), mirroring
  backends/cargo/render-clippy.ts seams. Routing is the INVERSE of cargo:
  selectorClass 'syntax' renders (native per-rule severity — defaultSeverity
  projected directly, NO FF7003 degrade path); 'type-aware' refused FF7001
  (mypy backend deferred); 'dep-graph' refused FF7001 (import-linter backend
  deferred); malformed/missing params refused FF7002. Params contract:
  {kind: 'call'|'attribute'|'import', pattern, replacement?}. Rule message
  is ALWAYS node.claim (render-clippy.ts:112 parity). Artifact: ast-grep
  YAML rule-set string (header + one doc per rule, ---separated, id-sorted).
  Emission shape live-verified against @ast-grep/cli@0.44.1
  (scan --json: ruleId identity, exit 1 on error findings, exit 0 clean).
- test-fixtures.ts: FIXTURE_NODE = ban datetime.datetime.now (the P5
  live-fired case, research-patches/2026-07-02-multi-toolchain-generalization.md:409-423).
- render-astgrep.test.ts: 15 unit tests (TDD red-first) — T15 grammar-gate
  self-application, FF7001/FF7002 paired negatives, severity projection
  incl. note→hint, byte-for-byte golden, YAML shape + escaping + sort.

SSOT: appends rows #212 (ast-grep as Python rule-emission target, ADOPT),
#213 (mypy, DEFER — trigger: first type-aware Python node), #214
(import-linter, DEFER — trigger: first dep-graph Python node) to
docs/meta-factory/prior-art-evaluations.md (append-only §3 procedure).

Tests: npm --prefix packages/core run test:backends (9 files / 80 tests
green) + test:principles (33 files / 303 tests green).

Prior-art: prior-art-evaluations.md#212 (ast-grep @ast-grep/cli@0.44.1 as the Python syntax-class rule-emission target, ADOPT — #199 render-target lineage, #185 distinct search-surface capability, P5 live-fire evidence).

* feat(backends): astgrep firing harness — fixtures + shared JSON-array parser + capability matrix (S1 Task 2)

Firing fixtures (invalid/valid/valid-clean) + firing-contract.json + live-fire
firing.test.ts + self-application drift gate + shared JSON-array diagnostic parser
+ capability-matrix.json with live-fired evidence, for the astgrep-python-yaml backend.

- Fixtures: canonical rule bans datetime.datetime.now (FIXTURE_NODE). invalid calls
  it; valid wraps it in an injected-clock accessor + the `# ast-grep-ignore: <rule-id>`
  suppression escape hatch; valid-clean is conformant with zero findings. Each fixture's
  committed rules/no-datetime-now.yml is byte-identical to render(FIXTURE_NODE) — the
  always-on self-application drift test gates it (runs in CI, no tool needed).
- firing.test.ts: presence-check + loud-skip when the pinned ast-grep is unavailable,
  but NO `!isCI` guard — CI fires for real (owner decision). Live-fire RED (invalid ->
  ruleId no-datetime-now) / GREEN (valid + valid-clean -> zero findings).
- Shared backends/shared/json-array-parse.ts: parseIdentitiesFromJsonArray for the
  JSON-array diagnostic shape. Justified per the kickoff §1 two-consumer condition —
  ast-grep (S1) and ruff (S2) both emit JSON arrays with a flat identity field. The
  cargo NDJSON parser is untouched.
- capability-matrix.json: syntax=yes (live-fired evidence, ruleId identity matches the
  firing contract), type-aware=no FF7001, dep-graph=no FF7001. Toolchain-freshness gate
  derives the resolving ast-grep version at run time (no version literal in code) and
  turns RED on a pin bump without evidence regen.

Live-fired against @ast-grep/cli@0.44.1 (2026-07-11): invalid -> 1 finding ruleId
no-datetime-now severity error (exit 1); valid + valid-clean -> [] (exit 0). Review
carry-forwards closed empirically: (m1) a 2-rule `---`-separated multi-document YAML
fired BOTH rules (no-datetime-now + no-os-system) — multi-doc parses; (m2) a
`severity: hint` finding DOES surface in `scan --json` default output (exit 0, not 1),
so the Task-1 note->hint mapping is safe (findings visible, just non-erroring).

ast-grep invocation detail encapsulated in fireContract: `scan` anchors its project
root to the enclosing git repo, so both `-c <config>` and the scan target are passed
as absolute paths under the fixture dir to scope the scan to that fixture's src.py.

Prior-art: prior-art-evaluations.md#212 (ast-grep as Python rule-emission target, ADOPT — this commit ships the S1 firing harness + capability matrix for that emission target; SSOT row added in Task 1 commit fb07a5f).

* ci(backends): astgrep live-fire via pinned PATH install — bare-binary firing model (S1 Task 3)

Wire the astgrep-python-yaml backend's live-fire to fire FOR REAL in CI, and
switch the firing model from an npx-resolved pin to a bare PATH binary backed by
a hard, exact-pinned CI install (owner binding decision, Task 2 review follow-up).

- firing-contract.json `command`: `npx -y -p @ast-grep/cli@0.44.1 ast-grep scan
  --json` -> `ast-grep scan --json`. The tool is NOT a package.json dependency; it
  comes via a workflow global install. deriveToolVersion/fireContract token
  handling is form-agnostic (splits on the `ast-grep` bin token), so no logic
  change was needed — only the recorded command and the surrounding rationale
  comments in firing-runner.ts / firing.test.ts / capability-matrix.test.ts.
- audit-self.yml (principles-meta-tests job): add `npm install -g
  @ast-grep/cli@0.44.1` BEFORE the `test:backends` step. Exact pin, no float, no
  `latest` (ci-tool-pinning.md Rule A); no secrets, no third-party action
  (zizmor/no-paid-llm clean).

Rationale (owner STOP-line): an npx-resolved pin converts a registry flake into a
loud-skip — CI goes green without ever firing the backend. A hard install step
fails loud-red instead, keeping "CI fires for real" honest. Kickoff: "Tool comes
via workflow install, NOT a package.json dependency". No `!isCI` guard is
re-introduced (cargo firing.test.ts:31-49 loud-skip shape, kept for the
local-absent-tool path only).

Evidence unchanged: capability-matrix.json still claims `ast-grep 0.44.1`; a live
`ast-grep 0.44.1 scan --json` run against the invalid fixture reproduces the
committed capturedDiagnostic byte-for-byte (byteOffset 38-61, ruleId
no-datetime-now, severity error) modulo the already-normalized repo-relative
`file` field — so no matrix regeneration was required.

Verified: `npm --prefix packages/core run test:backends` green with the 3
live-fire tests FIRING (0.44.1 on PATH; 108 passed) and loud-skipping when the
binary is absent (3 skipped + drift block green); `test:principles` 303 passed.

Prior-art: prior-art-evaluations.md#212 (ast-grep @ast-grep/cli@0.44.1 as the Python rule-EMISSION target, verdict ADOPT — this commit wires that ADOPTed backend's live-fire into CI via a pinned PATH install; no new capability, modifies existing astgrep backend files + the CI gate).

* ci(backends): suppress zizmor adhoc-packages on the pinned ast-grep global install

zizmor 1.26.1 (CI-pinned) flags any npm install outside a lockfile; a global
CLI tool has no lockfile surface and the exact @0.44.1 pin is the determinism
mechanism (ci-tool-pinning.md Rule A). Inline-ignore precedent:
demo-regen.yml:62. Verified clean against zizmor==1.26.1 locally.

Prior-art: skipped — CI suppression comment only, no new capability

---------

Co-authored-by: t <t@t.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant