docs(adr): ADR-0013 — json sidecar cross-process locking (V-L2-F4)

[hyperpolymath]

Documents V-L2-F4 (#150, shipped in #151) — the follow-on that hardened the JSON sidecar after F3 — and runs the standard wrap-up. Docs + config only; no production code.

Document

• ADR-0013 (new) — cross-process advisory write lock (<path>.lock, bounded backoff + stale-steal, RAII release) held across the whole load→mutate→save cycle; atomic-rename durability; the now-wired provenance/history CLI (sqlite + json; postgres still explicit "not yet implemented"). Framed as refining ADR-0012, not reversing it.
• ADR-0012 — its "single-writer limitation" note now forward-references the F4 lock (ADR-0013), so it isn't misleading on main.
• CHANGELOG.md — adds the V-L2-F4 entry (mirrors the CHANGELOG.adoc entry feat(sidecar): cross-process locking + atomic writes, and wire provenance/history CLI (V-L2-F4, #150) #151 added).

Config

• .claude/settings.json — extends the read-only permission allowlist with the git commands these wrap-ups use repeatedly (rev-parse, ls-files, merge-base, remote).

Validation

• cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test (145 pass) all green on main + these changes; settings.json valid JSON; ADR 0012⇄0013 cross-references consistent.

Follows the V-L2-F* arc: F2 drop (#144/#147/#149) → F3 implement (#148/#152) → F4 harden (#151, this PR documents it).

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 82 issues detected

Severity	Count
🔴 Critical	3
🟠 High	7
🟡 Medium	72

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-toolchain@stable needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-toolchain@master needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action Swatinem/rust-cache@v2 needs attention",
    "type": "unpinned_action",
    "file": "rust-ci.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence