Repository navigation
chore(release): promote dev to main - #105
Merged
Merged
Conversation
chore(release): merge v0.3.2 back into dev
The communication rules are guidelines, not gates. `make docs-lint` no longer holds PROSE_PATHS to zero issues, and the `prose` count leaves .quality-baseline.json and dev/quality_baseline.py. The new `make docs-prose [FILES=...]` target reports the issues and never fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each issue is now a warning or a notice. Vague words, missing diagrams, long steps and sentences over 40 words are warnings; other sentences over 25 words are notices. The check exits 0 whatever it finds. `--format github` prints annotations, and the CI `docs` job uses it on the changed Markdown. `--min-severity warning` hides the notices. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
COMMUNICATION_RULES.md, STYLE_GUIDE.md, dev-tooling.md, CONTRIBUTING.md and the contribute how-to now say that the prose check reports warnings and notices and never blocks. ADR 0004 records the reversal of the blocking check and the tools reviewed on 2026-11-09. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
build(dev): make the prose check advisory, with severities
Add the owner's stack-adaptive rule to the stack-profile README and a hook manager and commit-message rule to each profile's Tooling defaults: Husky with lint-staged for Node, pre-commit for Python, lefthook for mixed or Java repositories. Roadmap-Step: C0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The hooks playbook recommended lefthook everywhere and dropped Husky for a quiet release history. It now keeps an existing manager, recommends the stack's own tool when there is none (Husky with lint-staged, pre-commit, lefthook), restores Husky with a Node section, and matches the commit rule to the stack. Tool currency rechecked on 2026-11-09. Roadmap-Step: C0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The repository failed its own IDX-01 BLOCKER: no project MCP config. .mcp.json now names the bare codebase-memory-mcp command, so each person's install runs and no version is written in the repository. Claude Code and VS Code read the file; other harnesses copy the entry. Approval stays with each person: .claude/settings.json pre-approves no project server, and dev/tests/test_mcp_config.py checks both. The self-audit baseline drops the IDX-01 finding (score 0.8934), with the absolute paths neutralised again, and docs/reference/self-audit.md ends owner exception D21. Roadmap-Step: B1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The catalogue test required every agent-only check to be numbered above every engine check in its family, so no engine check could ever join the CI family after the agent-only CI-04. The documented rule is narrower: an engine check takes the next free number and must not take an agent check's ID. The test now checks that rule, and the explainer says it plainly. Roadmap-Step: C1.1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A catalogue entry may now carry since_ruleset, the engine ruleset that added it. When import-engine reads a report from an older ruleset, each such check is recorded as UNKNOWN with no engine verdict and a warning, so the draft can still be finalised and the check earns no credit. Any other check a report lacks stays missing, as before. Roadmap-Step: C1.1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dev/mcp_config.py reads the one .mcp.json and prints or merges the entry for Cursor, Gemini CLI, opencode (mcp.servers, local, command array) and Codex ([mcp_servers] TOML). Claude Code and VS Code read .mcp.json as it is, so it writes nothing for them. A merge never replaces a different entry. It also records the first-run answer per harness in .agentic-readiness/setup.json and checks whether each server's command is on PATH, printing the install routes (the upstream installer with --skip-config) without running them. Tests cover one format per harness, merges into existing JSON and TOML, the refusals, the record and the check. opencode v2.0.24 resolves the generated project file (checked with `opencode debug config`). Roadmap-Step: B2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AGENTS.md now tells the agent, before its first change in a clone, to run `dev/mcp_config.py status` and, if the offer was never answered, to make it once: explain codebase-memory-mcp, ask, and with consent write the entry for the person's harness at project scope. Nothing is installed by the agent; the install routes carry --skip-config. No offer for audit or implement runs on another repository. docs/how-to/set-up-agent-tools.md holds the person's steps and the agent's procedure. ADR 0006 records the design. Git ignores the first-run record and the per-harness copies, so .mcp.json stays the one committed source. Roadmap-Step: B2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An agent cannot run a workflow locally, so a provider-aware linter is its only check before a push. CI-05 (Phase 1, DEGRADER, REQ-SH-057) looks for one per CI provider: actionlint, zizmor or check-jsonschema for GitHub; check-jsonschema schemas, glab ci lint or circleci config validate for the others. Run from a local surface (runner, build file, hook, script) it passes; only in CI it is PARTIAL; none is FAIL; no workflow or Jenkins only is UNKNOWN. Lockfiles, Dependabot/Renovate configs and docs never count. Ruleset 2026-11-09.1, catalogue 0.3.0 with since_ruleset on CI-05, so an older engine's report imports CI-05 as UNKNOWN. Two one-defect fixtures; the other CI fixtures gain a workflow linter so each keeps one defect. The greenfield template lints its workflows (lint:workflows, actionlint in CI), so the generated scaffold still passes. The realistic drafts, the examples, the example implement state and the CI eval expectations are regenerated; implement theme T4 owns CI-05. Roadmap-Step: C1.2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A live test showed two gaps. opencode read AGENTS.md but skipped the offer, which sat in a section further down; the rule now opens AGENTS.md and applies before any edit. Antigravity followed the offer but was not a known harness, so it picked `gemini` (the wrong file) and then probed its own environment. dev/mcp_config.py now knows `antigravity` (prints `agy mcp add`, checked with agy 1.5.1 under a scratch HOME) and `other` (prints the plain entry). A new `detect` reads CLAUDECODE, ANTIGRAVITY_AGENT and OPENCODE. A harness started inside another inherits the outer one's variable, so more than one match means "ask the person"; the how-to no longer says CLAUDECODE=1 confirms Claude Code. Roadmap-Step: B2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
add-ci-parity now resolves CI-05. It keeps a workflow linter that already runs; otherwise it picks the linter by CI provider (actionlint plus zizmor for GitHub, check-jsonschema's built-in schemas for the others, nothing for Jenkins) and the local route by stack (a Husky-called npm script, pre-commit hooks, a Make or Gradle target, lefthook). The same command runs in CI as a blocking step. Each stack profile's CI idiom names its route. Roadmap-Step: C1.3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CONTRIBUTING.md lists codebase-memory-mcp as an optional prerequisite, the contribute-a-change how-to adds it as an optional one-time setup step, and the README points contributors to the how-to. Roadmap-Step: B3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat: stack-adaptive hook guidance and CI-05 workflow lint (v0.3.3 Track C: C0, C1)
docs/framework/tool-ecosystem.md now compares a language server with the code index and lists each harness's route (checked 2026-11-09). The how-to adds an optional language-server step: the pyright-lsp plugin for Claude Code, opencode's built-in "lsp", and Serena for Gemini CLI, Codex and Antigravity. pyrightconfig.json gives pyright and basedpyright the mypy.ini import paths: basedpyright drops from 294 errors and 6,249 warnings to 71 errors (61 in the engine, which mypy does not gate yet). dev/tests/test_pyright_config.py keeps the paths in step. mypy strict stays the gate. EXEC-07 now fails (two root type configs). The owner accepted it as an exception, recorded in docs/reference/self-audit.md; the baseline takes the finding (score 0.8770). Serena stays out of .mcp.json: the harnesses that need it do not read that file, and its launch command differs per harness (ADR 0006). Roadmap-Step: B4 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scan the Python code and the workflows with CodeQL on pull requests into dev and main, pushes to dev, and weekly. The engine's test fixtures and JavaScript/TypeScript (fixtures only) are excluded. No ruleset requires the workflow; branch-protection.md says how the maintainer handles alerts. Roadmap-Step: A1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
uv 0.12.10 bundles a CA store that trusts a compromised emSign root (PYSEC-2026-4321, GHSA-hq85-5cpj-mr62) and has a Windows path traversal in wheel extraction (PYSEC-2026-4305, GHSA-2cv4-cqwr-gwf7). osv-scanner found both. 0.13's breaking changes (Python 3.15 as the default download, constraints-file strictness) do not touch this repository: CI installs Python explicitly and nothing here uses constraints files. Roadmap-Step: A2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mermaid-cli 12.0.0 pulls katex 0.16.x, affected by GHSA-238p-pmpm-9mq7 (prototype pollution bypasses trust restrictions; fixed in 0.18.2). 12.2.0 depends on katex ^0.18.10. Mermaid blocks still render. Roadmap-Step: A2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e security make security now runs osv-scanner after the secrets scan, on every dev-tool lockfile (uv.lock, package-lock.json and osv-scanner's own go.mod). A known vulnerability fails the gate unless dev/tools/osv-scanner.toml accepts it with a reason and an ignoreUntil date at most six months ahead; test_tool_pins.py checks both. osv-scanner v2.7.0 is a Go `tool` requirement in dev/tools/osv/go.mod, so its version is written once and Dependabot's new gomod entry sees it (ADR 0003). Four indirect Go modules are raised past their advisories. CI's security job and the release gates install Go from go.mod. ADR 0006 records the decision; make setup checks for Go. TOOL-04 now passes. EXEC-01 reports a false FAIL because the engine reads the go directive only from a root go.mod; it is recorded as an owner exception in self-audit.md and the baseline, and an engine fix is planned. Roadmap-Step: A2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`make spell` runs typos 1.51.1 (pinned in dev/tools/pyproject.toml) on
every tracked file that .gitignore does not hide. It reads code
identifiers as words too. _typos.toml excludes the data paths (fixtures,
worked examples, CHANGELOG.md, lockfiles) and holds 11 project terms
and code tokens, each with its reason. The repository starts at zero
findings, so the check is a hard gate inside make check, with no ratchet.
`make spell-fix` writes the suggested fixes, and a lefthook step checks
the staged files. The README typo that prompted A3 ("recommneded")
fails the check.
Roadmap-Step: A3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
release.yml now signs one SLSA build provenance statement for the three files in SHA256SUMS (actions/attest v4.2.2, public Sigstore) and attaches the signed bundle to the release as vX.Y.Z.sigstore.json. The provenance records the ref and commit the run started from, not the checkout. So release-please.yml now starts release.yml with --ref vX.Y.Z instead of main, and release.yml refuses a run that did not start from the tag it builds. Permissions move from the workflow to the job, with id-token, attestations and artifact-metadata added. Users keep sha256sum as the default check. Install the skills gains an optional Step 2b: gh attestation verify with --source-ref and --bundle, which works without a GitHub login (checked on gh 2.102.0; a tampered file fails). The release checklist adds the verify step. Roadmap-Step: A5 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
zizmor's default persona hid 13 help-level findings. Each permission now carries a comment that says why it is needed (6), the CI Gate job reads the needed jobs' results through env instead of expanding them into the script (6), and the source-branch check cancels an older run for the same pull request (1). make workflow-lint now runs zizmor with --persona pedantic, so these cannot come back unnoticed. Roadmap-Step: A6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The .env rules in .gitignore were root-anchored, so a nested .env (for example tools/x/.env) could be committed by accident; the self-audit reported SEC-01 and SEC-03 PARTIAL for it. The rules now match at any depth. The engine's fixture .env files are already tracked and stay tracked; a new one is added with `git add -f`, like the key material. The audit baseline drops both findings (Phase 1 score 0.8525 -> 0.873). Roadmap-Step: A6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Scorecard scores the repository's security practices on each push to dev and weekly, and uploads the result to the Security tab (category scorecard). publish_results is false: nothing goes to the public OpenSSF API, so there is no public score page or badge until the maintainer decides to publish. No ruleset requires the workflow. Roadmap-Step: A6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # .secrets.baseline
…line The page quoted the 2026-11-06 report (0.8402, 7 findings, ruleset 2026-11-06.1). It now states the current report on ruleset 2026-11-09.1 (with Track C's CI-05): 0.875, 70 checks (56 scoreable), 61 PASS and 3 findings (EXEC-01 and IDX-01 BLOCKER, BASE-02 DEGRADER). It records what closed since (HYG-02, HYG-06, TOOL-04, SEC-01, SEC-03), the EXEC-02 PARTIAL reason, and the 2026-11-09 review of NAV-05 (left as it is). The report is published as schema/examples/self-audit/2026-11-09.json. The baseline carried absolute local paths in provenance.target and the IDX-01 summary, already on dev since a12ffce; both are neutralised as the page's "Neutralised path" section requires. Roadmap-Step: A6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…etup IDX-01 already accepts .mcp.json. The playbook now makes one .mcp.json with the bare command the default project file (owner decisions 2026-11-07 and 2026-11-09), and shows the entry. A new Step 3 offers the setup to the person running the playbook, once and only with a yes. It names the harness, explains the server and gives the install routes by the target's stack, without running an installer. It writes the entry in that harness's own format at project scope (a table of seven harnesses, checked against dev/mcp_config.py on 2026-11-09), and keeps the harness copy out of git. Inputs 5 and Step 6 add an optional first-run offer in the target (index.first_run_offer, default no): a docs section with the offer's steps, a git-ignored record file and one instruction-file line. The target gets no helper script; dev/mcp_config.py stays this framework's dev tool. A verification row and two do-not-do rules cover it, and implement-master is regenerated. Roadmap-Step: C10 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(engine): EXEC-01 and TOOL-04 read nested pins and Makefile chains
docs(implement): routing-only CODEOWNERS and the index setup offer
security ran security-secrets as a prerequisite and repeated security-deps' recipe word for word, because TOOL-04 read only a target's own recipe. TOOL-04 follows prerequisites since ruleset 2026-11-09.9, so security is now its two parts and nothing else. test_ci_parity pins the new shape: the two prerequisites and an empty recipe. Self-audit: TOOL-04 PASS through security-deps. Closes #89 Roadmap-Step: C13.2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
C8 option A. add-repo-hygiene step 6 gains one optional line for the release page: whether release artifacts carry signed provenance and how a user verifies it, by the route the stack publishes through (npm --provenance, PyPI Trusted Publishing with attestations, actions/attest with gh attestation verify, cosign or buildx provenance, nothing more for Go modules). A repository that publishes nothing says so. The routes are not verified here; the agent confirms each one on the vendor's page. It is never a verdict: HYG-08 is unchanged. The Python, Node and Java profiles name their route in the CI idiom section. A HYG-12 check is deferred to v0.4. Roadmap-Step: C8 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore: make security run only its two parts
An agent reports to people and asks them for decisions, but nothing in a target says how. AGT-12 (Phase 1, COSMETIC, scored, REQ-SH-060) reads the entry instruction file for a section headed for writing to people (communication, how to write, writing for people, reporting, talking to the user; not inside a fence) and for a Markdown file it names whose name contains "communicat". The rules must name the reader, how to report and how to ask for a decision. All three is PASS; one or two missing, or a named file that does not exist, is PARTIAL; no rules is FAIL; no instruction file is UNKNOWN, which is AGT-01's finding. Phase 1, not Phase 2: the engine evaluates Phase 1 only and would not score a Phase 2 check. A new check, not AGT-03: AGT-03 is a DEGRADER. Ruleset 2026-11-09.10, catalogue 0.6.0 with since_ruleset on AGT-12; counts now 73 engine checks, 59 scoreable, 75 in the catalogue. One-defect fixture agt-12-no-rules with its eval file; the other AGT content fixtures and governed-minimal gain the section, so they still fail exactly their own check, and their eval files move. 15 in-process tests. The greenfield AGENTS.md template (1.2.0) gains a short "How to write for people" section, so the scaffold passes; greenfield/README.md 5.2 states the SHOULD. adapt-agents-md lists AGT-12 as not written yet (v0.3.6 I2). The realistic drafts, the examples and the example implement states are regenerated with the tools, and the tools' pinned counts move by one. Self-audit: AGT-12 PASS, score 0.9102. Coverage 91% (806 missed). Roadmap-Step: T1 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
C12 option D. register-index gains an optional, advisory Step 6, "Language server": never a gate and never installed. It links the harness routes in tool-ecosystem.md instead of restating them, and checks the inputs a server needs by stack: a tsconfig.json per package or project references, a pyright config that mirrors the type-check gate, a go.work for several modules, a root Cargo workspace, a .sln, or the Gradle or Maven build. A missing input is a note, added only with the owner's yes. Later steps are renumbered. The Python, Node and Java profiles name the inputs under Tooling defaults. An IDX-04 check is deferred to v0.4. Roadmap-Step: C12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nputs docs(implement): release provenance and language-server inputs
A dependency audit that only a person runs is skipped on the change that matters. TOOL-04 now reads CI the way TOOL-06 does. A CI line counts when it runs a scanner directly, runs a runner target whose command runs one (make security-deps, npm run security; through the Makefile walk), uses a scanner action (google/osv-scanner-action, actions/dependency-review-action, aquasecurity/trivy-action, snyk/actions, anchore/scan-action, pypa/gh-action-pip-audit), or includes GitLab's Dependency-Scanning template. A local verb and a CI step is PASS; one of the two is PARTIAL; neither is FAIL. Dependabot and Renovate never count. REQ-SH-030 gains "CI SHOULD run the same scan". Ruleset 2026-11-09.10; no catalogue bump. One-defect fixture tool-04-local-only-audit (npm run security runs npm audit, CI runs only lint) with its eval file; tool-ok-node gains a security job, so its eval file and facts.golden.git.json move. 9 in-process tests; the Makefile-walk tests get a CI workflow so they keep testing the local half. Rubric, changelog, check catalogue. Self-audit: TOOL-04 PASS (local security and CI security-deps), score 0.9094. Coverage 91% (804 missed). Roadmap-Step: C6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
TOOL-04 now reads PARTIAL when only a local verb or only CI runs the dependency audit. Step 6 of configure-quality-tools runs the verb in CI as its own job, beside check, and keeps it out of check because it may need the network. A scan that is red on day one gets a report-only job (continue-on-error on GitHub Actions, allow_failure on GitLab CI). Dependabot and Renovate never count as the scan. The verification row reads the workflow. The Node, Python and Java profiles name the security job in their CI idiom. Roadmap-Step: C6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
TOOL-04 followed a root-Makefile verb through variables, prerequisites and make calls to find a dependency audit. EXEC-07 needs the same walk to learn which type checker the typecheck verb runs, so the walk moves into _common as follow_makefile(inventory, command, matches). TOOL-04 calls it with its audit patterns. No verdict changes. Roadmap-Step: C12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rror EXEC-07 counted every type config as one concern, so tsconfig.json beside mypy.ini competed although they serve two languages. It also failed a pyrightconfig.json that only gives a language server the mypy gate's import paths. Types are now counted per language: types (TypeScript) and types (Python). A pyrightconfig.json beside one mypy config is a language-server mirror, not a competitor, when the typecheck verb runs mypy and not pyright, directly or through the root Makefile (follow_makefile). The summary names the mirror. Any other pair of Python type configs still competes. Ruleset 2026-11-09.11; no catalogue bump. One-defect fixture exec-07-dual-python-types (mypy.ini and pyrightconfig.json, typecheck runs pyright, FAIL) with its eval file. 8 in-process tests sit in test_exec_pack.py: a new test file would make audit/engine/tests hold 51 files and trip NAV-03's catch-all rule. Rubric, changelog and check catalogue updated. Self-audit: EXEC-07 PASS, score 0.9213. Roadmap-Step: C12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The previous commit left one line at 141 characters, which raised the markdownlint count above its baseline. Roadmap-Step: C12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
EXEC-07 now reads pyrightconfig.json as a language-server mirror of the mypy gate, so it passes and its finding leaves .audit-baseline.json. No finding was added. The baseline and the published example are the fresh report with the two documented path edits. The self-audit page records score 0.9252, ruleset 2026-11-09.11, one DEGRADER finding (BASE-02), no FAIL, and no open owner exception. Roadmap-Step: C12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # audit/stacks/java.md # audit/stacks/python.md # audit/stacks/typescript-node.md
Roadmap-Step: C6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DOC-02 reads that the style guide exists and is named, not that the docs follow it. DOC-05 (Phase 1, COSMETIC, scored, REQ-SH-061) measures the prose of the Markdown pages under docs/ with the three rules of the framework's prose check: the share of sentences over 25 words (20 in a numbered step), vague words per 1,000 words, and explanation or tutorial pages (docs/explanation/, docs/tutorials/, not an index) without a Mermaid block. Every pass level (10%, 1, none) is PASS; over 25% long sentences is FAIL; else PARTIAL. Under 10 sentences, or prose under 20% common English function words, is UNKNOWN: the rules are for English. No docs page is UNKNOWN, which is DOC-01's finding. The engine cannot import dev/prose_check.py, so _prose.py ports the rules; a dev test holds the two to the same counts on every docs/ page. Diagram presence is part of the same check: one requirement, one style guide. The thresholds live in the engine's check catalogue page and the rubric; catalogue.json holds no thresholds. Ruleset 2026-11-10.1, catalogue 0.7.0 with since_ruleset on DOC-05; counts now 74 engine checks, 60 scoreable, 76 in the catalogue. One-defect fixture doc-05-long-sentences with its eval file; doc-nav-ok gains a short style guide, so it passes, and its eval file moves. The in-process tests sit in test_doc_nav_pack.py: audit/engine/tests/ holds 50 files, and one more is a NAV-03 catch-all in the self-audit. greenfield/README.md 5.2 states the SHOULD. establish-docs-contract lists DOC-05 as not written yet (v0.3.6 I3, I4). The realistic drafts, the examples and the example implement states are regenerated with the tools, and the tools' pinned counts move by one. Self-audit: DOC-05 PASS (9.7% long sentences), score 0.9109. Coverage 92% (807 missed). Roadmap-Step: T2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…server-mirror # Conflicts: # .secrets.baseline
feat(engine): TOOL-04 reads CI as well as the local verbs
…r-mirror fix(engine): EXEC-07 counts types per language and reads a pyright mirror
Dev took rulesets 2026-11-09.10 (C6) and 2026-11-09.11 (C12.0), so AGT-12 moves to 2026-11-10.1 and DOC-05 to 2026-11-10.2 (since_ruleset, the changelog and the import messages follow). Dev's new TOOL-04 test file filled audit/engine/tests/ to NAV-03's 50-file limit, so the AGT-12 tests move into test_agt_pack.py. The examples, the realistic drafts, the masters, the self-audit page (0.9264, one finding) and the secrets baseline are regenerated.
audit/engine/tests held 50 files, NAV-03's catch-all limit, so the next new test file would fail the self-audit. Each check pack's tests now live in its own package, tests/packs/<pack>/ (agt, base, ci, cmd, con, doc_nav, exec, hyg, idx, sec, tool, tst): 27 modules moved with git mv. The cross-pack and pipeline tests (the fixture matrix, scan, report, CLI) and support.py stay in tests/, which now holds 23 files. The extra packs/ level keeps a pack folder such as cmd from shadowing a standard-library module. The moved modules put the engine directory and tests/ on sys.path with parents[3] and parents[2]. dev/test_shard.py now finds modules in package subfolders, as unittest discover does, and never in a fixture folder; it refuses two modules with one name. A new test covers that. Discovery finds the same 771 tests with the same ids, and the two CI shards run 288 + 483 of them. The single-test command in AGENTS.md and CONTRIBUTING.md is now tests.packs.cmd.test_cmd_pack. The engine's AGENTS.md states the layout and the 50-file limit, and the fixtures README points at the new paths. Gates: check, security, docs-lint, self-audit (0.9252, NAV-03 PASS) and coverage (91%, 799 missed, unchanged). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…pack refactor(engine): split the engine tests into one package per check pack
make docs-prose flagged six sentences over 25 words in the text this branch added. The DOC-05 rubric entry and REQ-SH-060 now pass the prose check; audit-master is regenerated. Roadmap-Step: T2 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#103 split the engine tests into one package per check pack. The AGT-12 and DOC-05 tests moved with test_agt_pack.py and test_doc_nav_pack.py into packs/agt/ and packs/doc_nav/. The fixtures README keeps both new checks under the new paths; the secrets baseline is regenerated.
feat(engine): add AGT-12 and DOC-05, the v0.3.4 Track T checks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes dev to main. release-please opens the release pull request after the merge.
🤖 Generated with Claude Code