Resync the carried canonical and re-audit against the current hub - #34
Merged
Conversation
Two findings from the hub audit run against this repo, both mechanical. repo-config/configure.sh is carried verbatim and the hub's canonical advanced past the copy here: the ruleset normalizer now defines its own walk rather than calling the jq 1.6 builtin, so a host on jq 1.5 fails to compile the filter instead of silently reporting drift on every parameterized rule it never compared. That defect was reported from here as ProjectTemplate#549 and fixed there in #553, so this is the re-vendor that fix is owed. HISTORY.md opens as the README's twin, and the README grew a second intro paragraph that the changelog never took, which the readme-structure check reads as an intro that does not mirror. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The self-audit was written before the deploy existed, before the environments held credentials, and against a hub that had no type for a site that builds and ships to a host it owns. All three have changed, so the run is replaced rather than edited, per the run-stamp discipline the report itself describes. The new section is the nine hugo checks, hand-evaluated with a citation each. Nothing mechanizes them: the hub's audit runner never reads project-types.json, so a clean run of it is not evidence about any of them, and reading one that way is the empty-query trap this repo has been caught by before. Eight pass. hugo.deploy.retention does not, because the count that binds the VPS destination is nowhere declared, and the ten releases recorded beside the ownership line describe the local mirrors instead. TODO.md drops the hub debt it carried, since the hub has authored the type from this repo's measured shape rather than from the intake's prediction, and names the two things that come due when that work promotes to the hub's main. Two hub findings close: the audit runner no longer reports a bypass DEFECT here, and the static-site type exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR re-syncs the repository’s carried canonical files with the hub and refreshes the local audit/reporting to reflect a new conformance run and current operational status.
Changes:
- Updates
repo-config/configure.shruleset-parameter normalization to avoid relying on jq 1.6’swalk/1. - Replaces/refreshes
reports/Blog/audit.mdwith a new audit run and updated conformance/operational narrative. - Updates
TODO.mdandHISTORY.mdto reflect current hub status, outstanding work, and to align changelog intro content with the README.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| TODO.md | Updates backlog items and hub-owed status to match the latest audit and hub work. |
| reports/Blog/audit.md | Rewrites the audit report with a new run stamp and updated conformance/operational findings. |
| repo-config/configure.sh | Adjusts jq normalization logic used for ruleset parameter comparisons to improve portability. |
| HISTORY.md | Adds the live blog URL paragraph and link reference to mirror the README intro. |
Uh oh!
There was an error while loading. Please reload this page.
The two registry notes for this repo's hugo checks describe work that was already merged when they were written, and the record that they would be retired mechanically does not hold: the freshness check is gated on a repo having no findings at all, and the one finding here cannot be cleared from this repo. Both are measured in the issue. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-syncs this repo with the hub and replaces the self-audit with a current run. The hub's
AGENTS.mdbootstrap routes a repo that already carries its instruction set to the hub'sAUDIT.md, and section 10 says the drift a run finds is applied by a pull request on the target rather than left in a report.What the run found
spec/audit.pywas run from a full hub clone againstmain,develop, and this branch. Four findings on the first two, identical on both:verbatim: repo-config/configure.shmatches a past hub revisionmainhistory: HISTORY.md intro does not mirror the README introbranch: validate-task.yml changed on both main and developcarried: AGENTS.md references the template repoThis branch reports zero defect, letter, or error findings.
The re-vendor is the one this repo was owed
repo-config/configure.shis carried verbatim, and the copy here predates ProjectTemplate#553. That change defines the ruleset normalizer's tree walk rather than calling the jq 1.6 builtin, so a host on jq 1.5 fails to compile the filter instead of reporting drift on every parameterized rule it never compared, which is the inverse of the false clean the comparison exists to close. The defect was reported from this repo as ProjectTemplate#549.Run against the live repo with the new copy: 22 assertions, all ok, exit 0. It now compares
copilot_code_reviewparameters as well aspull_requestandrequired_status_checks, so three parameterized rules per ruleset are compared rather than two.The hugo type, evaluated by hand
The hub has authored the
hugotype, theself-hostedtarget, and thedeploy-sshmechanism from this repo's measured deploy shape (ProjectTemplate#560), which closes the spec debtTODO.mdcarried. It is on the hub'sdevelop, notmain, so it is not ground truth yet and the evaluation in the report is anticipatory.Nothing mechanizes those nine checks.
spec/audit.pynever readsspec/project-types.json, so a clean run of it says nothing about any of them. Each row in the report cites the file and line it was judged against.Eight pass.
hugo.deploy.retentiondoes not: the check asks for a retention count declared at the destination, this repo's deploy credential is write-only by design so the prune belongs to the host, that ownership is recorded inOPERATIONS.md, and the count is not. The "ten releases" beside it describesdeploy/make-release.shon the local mirrors rather than the containers on the VPS. Confirming the host's timer and its count is a question for the host side, so it lands inTODO.mdrather than being guessed at here.Still open, and not in this change
develop -> mainpromotion, which is what the branch finding is asking for.developsupersedesmainon every line of the file in question.driftNotesforhugo.vendored.provenanceandhugo.generator.pinneddescribing work Declare the generator pin once and record what the theme is a copy of #30 finished, and this repo'sspec/secrets.jsonnote names one type where it will then declare two.Verification
spec/audit.py --branch <this branch> Blogrepo-config/configure.sh checkjq emptyover every config JSON🤖 Generated with Claude Code