From 716185a989ad1ff0127143dd982acb5f60e96282 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 07:39:37 +0000 Subject: [PATCH] docs(core): retract the config-validation claim that never ran, and record its retirement REFACTORING_SUMMARY.md section 5 claimed PluginConfigValidator had been integrated into PluginLoader and that validatePluginConfig performed real schema validation. Measured on this repository's whole recorded history, it never did: the loader's only call site passed one argument, so the method always returned from its `config === undefined` branch before reaching the validator, and no plugin ever declared a PluginMetadata.configSchema for the enclosing guard to fire on. Rewriting the section as merely "later retired" would have preserved the false claim that it once worked, so the correction answers both defects: the fix never took effect, AND the surface was retired under ADR-0049 on 2026-08-27. The section is corrected in place rather than deleted, mirroring the tombstones the retirement deliberately left in plugin-loader.ts and security/index.ts. The adjacent `## Verification` line is deliberately untouched and reported to the PM instead: its counts have drifted (380/22 claimed, 1015/41 measured now), but unlike section 5 they were accurate when written. Part of #12688 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LZbWd2jNV1FErXTPSS4Dry --- packages/core/REFACTORING_SUMMARY.md | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/packages/core/REFACTORING_SUMMARY.md b/packages/core/REFACTORING_SUMMARY.md index 854ec10be7..27a06e7943 100644 --- a/packages/core/REFACTORING_SUMMARY.md +++ b/packages/core/REFACTORING_SUMMARY.md @@ -29,11 +29,27 @@ This document summarizes the critical architectural improvements made to the `pa - Refined `Kernel.getService` to distinguish between "service registration missing" and "factory execution failed". - Factory errors are now re-thrown with their original stack trace and message. -## 5. Configuration Validation +## 5. Configuration Validation — retracted; the surface has since been retired + **Problem:** Configuration validation was a scaffold without implementation. -**Fix:** -- Integrated `PluginConfigValidator` (Zod-based) into `PluginLoader`. -- `validatePluginConfig` now performs actual schema validation against `plugin.configSchema`. + +**Claimed fix — never took effect.** This section originally recorded that +`PluginConfigValidator` (Zod-based) had been integrated into `PluginLoader`, and that +`validatePluginConfig` performed real schema validation against `plugin.configSchema`. +It did not. The loader's only call site passed no config, so `validatePluginConfig` +always returned from its `config === undefined` branch — logging "config validation +postponed" — without ever reaching the validator. The kernel validated no plugin config +on any commit in this repository's recorded history, and no caller could have supplied +one: plugin factories close over their own config, so the kernel never receives it. The +scaffold stayed a scaffold. + +**Actual resolution (2026-08-27).** The surface was retired rather than implemented, under +ADR-0049 (enforce-or-remove) and recorded in ADR-0025 §3.7: `PluginMetadata.configSchema`, +`PluginConfigValidator` and `createPluginConfigValidator` are gone, and plugins parse their +own config at their own seam. Tombstones marking the decision live in `src/plugin-loader.ts`, +`src/security/index.ts` and `src/plugin-loader.retired-fields.pin.test.ts`. Re-declaring a +kernel-owned config-validation surface is a fresh decision for the day the ADR-0025 +distribution layer lands. ## Verification - **Build:** Clean build of `dist` artifacts.