feat: OSS first-run, CLI fail-on, honest install path - #27
Merged
Conversation
added 8 commits
August 22, 2026 18:04
Keep schemaVersion pinned at 0.1, but stop treating evaluatorVersion as the literal 0.1.0-dev const so a version bump no longer invalidates the receipt contract. Rebuild the Action bundle so the compiled schema matches source.
evaluate and github snapshot now share shouldFailAction with the Action. Default blocked fails blocked, evidence_missing, and policy_ambiguous, while human_review_required stays non-failing until the threshold is raised. Invalid values exit 2 as FAIL_ON_INVALID. validate accepts --base as an alias of --policy, and root help lists --json, --fail-on, --report, and --output.
Keep the package private and unpublished. Document clone + npm ci + build as the working first-run; npx from GitHub was tried against main and failed because committed dist/ has the Action bundle only. Add a files allowlist for a future maintainer publish, a short getting-started walkthrough, and update the Codex form draft to the current v0.1.0-beta.2 tag without claiming adoption or program selection.
When --base is not an existing file or directory and the current work tree is a Git repository, preflight loads policy from Git objects the same way --repo already did. Filesystem paths stay local-file mode. doctor no longer treats a missing package.json as blocking for non-JS repositories, and the init draft points at the example policy.
Consumer shadow quick start uses daichunghy/patchgate@v0.1.0-beta.2 with fail-on never; npm ci plus uses ./ is labeled as developing PatchGate itself. Dossier, evidence index and constitution matrix stop describing open PR #9 or zero tags. AGENTS.md records origin/main at 6db56a4 without new gate or CI-run claims.
Keep application language honest: no adoption, no pilots, one-repo form. P0 from this branch is listed separately from P1 maintainer-gated work.
Review follow-up: create missing init parents; fall through to .github/patchgate.yml only when the root blob is absent; apply --fail-on to rejected snapshots; stop advertising npx patchgate (the npm name is a different project).
Write .github/patchgate.yml on request. A directory with a valid policy and no Git repo can still be ready_for_local_preflight.
Owner
Author
|
Maintainer merge follows this comment. CI is green. Branch protection still required an approving review that does not exist (solo maintainer). This merge is an administrator decision, not independent-review evidence for Codex for Open Source. G2 sessions and external shadow installs remain open. |
daichunghy
pushed a commit
that referenced
this pull request
Aug 22, 2026
Resolve squash #27 overlap. Keep commented init draft, contributor-health docs, and receipt-schema constraint. CLI smoke still asserts version: 1 only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
OSS-readiness for PatchGate: a stranger can clone, build, init, preflight, and evaluate a fixture. Docs stop advertising
npx patchgate(that npm name is a different project). Independent review findings from four angles are indocs/reviews/2026-08-22-multi-angle-*.mdand the follow-up commit addresses the bugs.Not claimed
No production, no
v0.1, no external pilots, no npm publish. Package staysprivate: true.Verify
npm run typechecknpm test(99)npm run build && npm run test:cli(5)node scripts/check-application-dossier.mjsnode scripts/check-doc-links.mjsnode scripts/check-release-candidate.mjs