fix(install): consumer-install-hardening S1 — make claimed shields live in consumers (F6/F1/F12/F2/F11/F13) - #474
Merged
Merged
Conversation
…ixes + F11 lock Make every shield the framework claims actually live in a real consumer: - F6 ship scripts/audit-r4.ts so the R4 probe in audit-ai-docs.sh resolves - F1 ship pre-push.ts + static import closure so the dispatcher TS-arm is reachable - F2 activate shipped git hooks (core.hooksPath=.husky) + declare husky/lint-staged/sort-package-json devDeps - F12 ship workflow-integrity.yml + align RULES.md R11 claim to shipped CI (manifest SSOT) - F13 detect stryker packageManager from consumer lockfile + repoint RuleCreator doc-URLs to canonical RULES.md - F11 lock: shipped CI reads node-version-file:.nvmrc (already true via FQA W6) + paired-negative guard Each fix carries a paired-negative install-sh acceptance under tests/install-sh/ (14 wired into audit-self.yml). Full install-sh suite: 13/13 green. Bases on live staging via Git Data API (git transport down); #464 audit-consumer-mode CI step preserved. Prior-art: skipped — install-side delivery fixes shipping existing artefacts; per-finding rationale in the umbrella findings file, no new framework capability
This was referenced Jun 13, 2026
This was referenced Jun 13, 2026
artyhoo
added a commit
that referenced
this pull request
Jun 22, 2026
…#678) The render-rules vitest snapshot (packages/core/render/__snapshots__/render-rules.test.ts.snap) expected R11's old framework-internal description (`audit-self.yml ...`), but the manifest R11 row was deliberately updated to the consumer-facing `ci.yml (...)` description in #474 (consumer-install-hardening). RULES.md was regenerated then; the vitest .snap was not — so `vitest run render/` was red on a full local run while CI stayed green, because only principles/ and hooks/ were gated. The render/ suite was never wired into CI or pre-push. - Regenerate the stale snapshot to match the current manifest render (the manifest is the deliberate source of truth; the .snap was the stale frozen copy). - Add `test:render` (`vitest run render/`) script to packages/core. - Gate the render/ suite in the principles-meta-tests CI job, mirroring the existing "CI-gap option C" hooks-suite precedent. Deterministic, no LLM (complies with no-paid-llm-in-ci.md). The manifest→RULES.md `--check` job already catches RULES.md drift; this closes the parallel gap for the vitest snapshot so the same staleness cannot recur silently. Prior-art: skipped — snapshot regen + CI-wiring of an existing test, no new dependency/module/capability surface. Co-authored-by: Art <devartyhoo@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
consumer-install-hardening — Stage S1 (install-side)
Fixes the framework install defects the timeliner consumer audit found (
CONSUMER-FINDINGS-timeliner.md, F1–F13). S1 makes every shield the framework claims to ship actually live in a fresh consumer — hooks fire, the TS pre-push core is reachable, the R4 probe resolves, R11's claim matches shipped CI, and the stryker/doc-URL artefacts are correct.Findings — status + acceptance evidence
ts-serverinstall, paired-negative test undertests/install-sh/)audit-r4.ts→scripts/(FQA-drop correction)scripts/audit-r4.tspresent and shippedaudit-ai-docs.shstill references it (load-bearing neg) —audit-r4-shipped.test.sh2/2pre-push.ts+ 5-file bounded static closureguard-livenessstays dynamic-import —f1-ts-arm.test.sh7/7workflow-integrity.yml+ align R11 claim via manifest SSOT (regenerate RULES.md)f12-workflow-integrity-shipped.test.sh5/5core.hooksPath=.husky) + declares husky/lint-staged/sort-package-json devDepsf2-hook-activation.test.sh6/6factory/RULES.mdgone from eslint-rules; pnpm/npm PM detected —f13-stryker-pm.test.sh2/2node-version-file:.nvmrc); this PR adds the executable lockf11-ci-node-version.test.sh6/6 (ts-server + react-next): posnode-version-file, neg no barenode-version:hardcode,.nvmrcnon-emptyaudit-self.yml, preserving #464'saudit-consumer-modesteptests/install-sh/suite 13/13 green locallyOwn-QA (T19): I re-ran every install-sh acceptance on this branch — 13/13 green (the 6 S1 tests above + 7 pre-existing). The full principle suite + self-install + drift gates run in CI on this PR (cited, not claimed locally). F6/F1/F2/F12/F13 were verified to pass before I built F11 + the #464 reconciliation on top.
Verify-trace
tests/install-sh/suite green on this branch — 13/13 (audit-r4-shipped2/2,f1-ts-arm7/7,f2-hook-activation6/6,f12-workflow-integrity-shipped5/5,f13-stryker-pm2/2,f11-ci-node-version6/6)ts-serverinstall ships audit-r4.ts / pre-push.ts+closure / workflow-integrity.yml; sets core.hooksPath; CI reads node-version-file; detects stryker PMaudit-self.ymldiff vs live staging = only the 6 S1 steps addedts-serverinstall +npm install,git commitof a staged file FIRES the pre-commit hook (lint-staged runs) and BLOCKS the commit (exit 1, no commit landed) — the activated hook is not dead-from-the-boxeslint.config.mjsdoes not load (missing@eslint/js+eslint-config-prettierpeer-deps,./eslint-rules-local/index.ts.ts-import needs a loader, eslint v8-vs-v9 flat-config mismatch) and eslint/prettier aren't consumer devDeps. Not an offline limitation (npm registry reachable). Defer to S4 / after F4 completion.§1.7 Forward-check applied
Change checked against existing disciplines. build-first-reuse / capability-commit — no new capability (ships/aligns existing artefacts; no new
packages/file ≥80 LOC, no new rootpackage.jsondep), so the commit carriesPrior-art: skipped. The push itself reusesharvest-via-api.sh(the repo's Git-Data-API helper), not a new mechanism. no-paid-llm-in-ci — every acceptance is bash/node/vitest, zero API-billed calls. doc-authority-hierarchy / principle 05 — F12 edits the manifest SSOT and regeneratesRULES.md(not a hand-edit of generated output). dual-implementation — install-side single channel, no dual-channel artefact introduced. Serves the README goal directly: the fixes make claimed rules executable + live at the earliest channel in the consumer. Evidence:install.sh:362(F6 copy),install.sh:387-394(F1 closure loop),packages/core/manifest/rules-manifest.jsonR11check(F12),install.shhooksPath+devDeps block (F2),packages/core/eslint-rules/*.ts:6-7(F13),tests/install-sh/f11-ci-node-version.test.sh(F11 lock).§1.7 Backward-check applied
Swept existing artefacts under this change's scope. Extends FQA, no redo: F4 barrel already generated; W1/W2/W4/W6 untouched. Corrects FQA: F6 (audit-r4 orphan FQA dropped after a partial caller-grep) is shipped with a caller-reference negative arm. Preserves the staging delta: the branch base predated #464, so its
audit-consumer-modeaudit-self.ymlstep was re-added ahead of the S1 steps and the Data-API push overrides only S1 paths — #464 is not clobbered (verified: PR shows zero FQA files). F11 verified already-satisfied by FQA W6, so this PR adds only the regression lock, not a duplicate fix. No existing artefact silently superseded. Same-defect-class residue outside S1 scope was surfaced, not swept (below).Out-of-scope observations (surfaced per atomic-umbrella discipline — NOT fixed here)
packages/preset-next-15-canonical/eslint-rules/{require-use-server-directive,no-server-imports-in-client,require-form-safe-parse}.tspoint at absentfactory/RULES.react-next.md. Candidate S2 follow-up.rules-manifest.jsonR11policy(andworkflow-integrity.ymlcomment) may still referencefactory/RULES.md— F13 doc-URL class.install.sh"Next steps" echo still printsnpx husky init— now redundant after F2 auto-activation, and would re-init the shipped hooks; F2/S2 prose follow-up.c1-wiring.test.shis unwired inaudit-self.yml(pre-existing) — not wired here.templates/ts-server/eslint.config.mjsdoesn't load in a fresh consumer — needs@eslint/js+eslint-config-prettier(beyond the@typescript-eslint/utils/eslint-plugin-vitest/globalsthe F4 finding listed), a.ts-import loader for./eslint-rules-local/index.ts, and eslint 9 (flateslint/config). Until fixed, the consumer's edit-time/pre-commit ESLint shield is inert. F4/S2 follow-up.Process note
PR was originally opened by a parallel session mis-based on the (already-merged) FQA branch and missing F11. This branch was force-updated to the clean staging-based commit and the PR retargeted to
staging(operator-authorized). Prior branch content discarded (no reviews; strictly worse base).Scope
IN: S1 install-side fixes (F6/F1/F12/F2/F11/F13) + CI test-wiring. OUT: S2 docs (F8/F9), S3 glob design-forks (F3/F5/F7 — maintainer GO pending), S4 live re-verify. timeliner consumer repo untouched (it's the polygon).
🤖 Generated with Claude Code