Conversation
Thirteen verbatim sections had fallen behind the hub canonical and one had never arrived. Fleet Bootstrap and Where the Rules Live in AGENTS.md, and eleven sections in GOVERNANCE.md, are copied from the hub. Hub-Hosted Tooling was absent and is inserted after Operational Repositories, which is its position in the declared order once the hub-only Repository Onboarding and Conformance section is excluded. .markdownlint-cli2.jsonc is a whole-file verbatim unit that matched a past hub revision, so it is replaced by the current canonical. Two of the sections, Repository Boundaries and Write Safety and Branching Model, are taken from the hub revision that stops citing repo-config/configure.sh as a repo-local path. The earlier canonical carried a dead relative link to a file this repo does not have, so re-vendoring from it would have needed a second pass. All 21 verbatim sections and the whole-file unit are verified by the audit's own content hash rather than by eye, which is what caught an inserted section that looked identical and differed by the blank line before the next heading. Every file is written LF to match this repo's declared line endings rather than the hub's CRLF. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Retire the Carried Copy of the Configure Script The hub hosts repo-config/configure.sh and no repository carries it, per the Hub-Hosted Tooling rule and the retire disposition in the hub's spec/divergences.json. A carried copy is current only until the next fix to it, and this one was already a past revision. The deletion is one edit and the sweep around it is four more, which is what the hub's RESYNC.md section 4 requires of any removal. repo-config/README.md now describes the script as hub-hosted and names the invocation with this repository as its argument, rather than describing a local file. AUDIT.md's runnable check says it runs from a hub checkout, so the path in it resolves where it is typed. TODO.md no longer lists the script among the files that must not be edited, since there is no local copy to protect. Four mentions stay and are correct. GOVERNANCE.md carries two in verbatim sections that name it as the hub's, which this repository may not edit and does not need to. Two in TODO.md are history about a past re-vendor and a statement about what the check reports, neither of which asserts a local file. The committed audit report keeps its own, being a point-in-time record replaced by a new run rather than edited. One unrelated correction in the same file, since leaving a known-false claim in a file being edited is worse than the edit: repo-config/README.md described the ruleset payloads as carrying bypass_actors. No payload declares one, the field is deliberately unmanaged, and the hub corrected the same sentence in its own copy. It reads as intent fidelity, so nothing mechanical would have reported it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Say That the Self-Audit Validates Rather Than Diffs The payload bullet said the self-audit diffs the live rulesets, and this repo's own AUDIT.md says the opposite one file away: the check asserts rule presence, merge methods and required checks rather than diffing bytes, which is what keeps a ruleset GitHub has normalized from reading as drift. Two carried documents describing one behavior two ways is worse than either wording alone. The hub's copy says diffs and is right to, because the hub's own AUDIT.md section 6 runs a normalized diff. This repo's audit runs the configure check instead, so the wording diverges deliberately. That is what intent fidelity is for: the file is judged by meaning and describes the repository carrying it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Make the Documented Invocations Runnable From a Hub Checkout The rewritten bullet gave the commands as `configure.sh apply ...` and `configure.sh check ...`. From a hub checkout root the script sits at repo-config/configure.sh, so neither runs unless the caller is already in that directory or has it on PATH. AUDIT.md gives the same command with its path, so the two carried documents disagreed on the one thing a reader would copy. That is the defect this pull request exists to fix, introduced while fixing it. A documented command that fails is the expensive shape, which is why the hub's sweep rule names it separately from a dead link. Every invocation now carries its path. Prose that names the check rather than presenting it as a command is left alone, in AUDIT.md and TODO.md, since the point is that a command a reader copies has to work rather than that the string never appears bare. One terminology slip with it: the bullet establishes that the audit asserts rather than diffing, then said nothing diffs bypass_actors. It says nothing asserts it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Give Every Documented Invocation Its Target Repository The Repo Settings paragraph called the script with a path but no arguments, as `repo-config/configure.sh apply`. The bullet three paragraphs above says the command defaults to whichever repository the shell is sitting in, and the script is run from a hub checkout, so a reader copying that line while sitting in the hub would have applied configuration to the hub rather than to this repository. That is a mis-targeted write rather than a documentation nit, and it is an apply rather than a check, so it writes by default. Every invocation in the file now names the repository and the model, and the argument-less forms are gone. This is the second correction to the same commands in this pull request. The first added the path so they would run at all, and adding the path is what made the missing arguments dangerous rather than merely incomplete: before it, the line did not run, and after it, it ran against the wrong target. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
host-tools.json is a carried baseline file the hub added, so every repository owes one. This is not the empty stub, because this repository genuinely needs a tool the fleet declaration does not carry. Hugo is the site generator and this repository's whole output, and AUDIT.md section 3 runs it locally to prove the URL contract, so a host auditing this repository needs it rather than only the CI runner. The floor is 0.164.0, a target anchored to the version .github/actions/install-hugo pins, since that action states a minor bump can change rendered output. The entry is honest that a floor cannot enforce a pin: a floor is a minimum and the pin is exact, so a newer Hugo passes here and can still build output CI would not, and the checksum-verified install is what guarantees reproducibility. The vendored theme's own 0.146.0 minimum is recorded as the lower measured boundary. Only Hugo is declared. The deploy reaches rsync and ssh and the live check reaches curl, but all three run on the CI runner or the VPS rather than on a maintainer's host, so declaring them would fail a host that never needed them. The file carries no $schema pointer, because the schemas are hub-only and a relative pointer would resolve to a path this repository does not have. The carried spec/secrets.json already omits its own for the same reason. One correction the previous pull request's sweep missed: the Repository Layout bullet still described repo-config/ as holding "the apply script", which was deleted there. That sweep grepped for the path, and a bullet describing the file without naming it cannot be found that way. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Ten findings, all in the README, and none of them visible to a reader who is not comparing it against the fleet model. The Overview section carried its retired name, Use Cases. Renaming it orphaned the Table of Contents anchor, which markdownlint caught as MD051 rather than shipping a link into nothing, and that is the whole reason a rename is not a one-line change. The link definitions used a Workflow group the model does not declare, and the Repo group held six references to this repository's own GitHub pages, which the model classifies as distribution rather than local. The block is rebuilt into the four declared groups it needs, Shields, Distribution, Repo and External, each sorted by reference name. Every one of the 29 definitions is preserved, and the classification comes from the audit's own link_kind rule against the model's declared URL prefixes rather than from reading the URLs by eye. The 3rd Party Tools table dropped its License column, since a license belongs to the dependency and is authoritative at its source, so restating it is a maintenance obligation carrying no information. Its three rows now use the fleet's own descriptions, because a shared tool carries one description across the fleet rather than a per-repo paraphrase, and the rows are alphabetized, since the list is scanned rather than read. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR promotes the completed fleet resync work onto main (with develop as the PR head), aligning this repository’s carried governance/tooling documentation with the hub’s current canonical state and removing the last repo-local copy of hub-hosted tooling.
Changes:
- Retire the carried
repo-config/configure.shand update docs to describe running the hub-hosted script from a hub checkout. - Add
host-tools.jsonto declare the repo-specific host tool requirement (Hugo) layered over the hub’s fleet declaration. - Align repo docs/governance text with the updated hub model (Hub-Hosted Tooling, merge gate wording, README structure/link grouping).
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
TODO.md | Updates the “do not edit” guidance to reflect repo-config/configure.sh being retired and hub-hosted. |
repo-config/README.md | Corrects ruleset payload description and documents configure.sh as hub-hosted (run from hub checkout). |
repo-config/configure.sh | Deletes the repo-local copy of the configure script (now reached from the hub). |
README.md | Renames “Use Cases” to “Overview”, updates the 3rd-party tools table, and reclassifies/sorts reference links. |
host-tools.json | Adds repo-local host tool declaration (requires Hugo with a minimum version). |
GOVERNANCE.md | Updates write-safety guidance, adds Hub-Hosted Tooling section, and refines PR review/merge gate wording. |
AUDIT.md | Updates the example command to clarify it is run from a hub checkout. |
AGENTS.md | Updates fleet bootstrap/resync routing language and adds “Hub-Hosted Tooling” to the rules map. |
.markdownlint-cli2.jsonc | Comment-only wording/capitalization adjustments. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four squashes, the whole resync against hub
main=d9b5ffa.Merge with a merge commit, never a squash, and never with
--delete-branch— this PR's head isdevelop.verbatimsections and insertedHub-Hosted Tooling, which had never arrivedrepo-config/configure.sh, with the four-file inbound sweephost-tools.json, declaring Hugo with a floor anchored to the pinned version3rd Party ToolsWhy this promotion is the point rather than a formality
The audit reads
mainas ground truth. Until this merges it still reports the pre-resync state, so the work is invisible to every check that matters and to any future re-vendor comparing against this repo.Measured on
developat012cc2a, against hub9614d99:Both survivors are
hub-onlyentries forpublish-release.ymlandvalidate-task.yml, dispositionedinvestigatein the hub'sspec/divergences.json, which explicitly makes them not this repository's to settle.What was verified rather than assumed
verbatimsections plus the whole-file unit match the hub canonical by the audit's own content hash, re-checked against the promotedmainrather than the branch they were built from.lineEndings, against the hub's CRLF, verified byte-wise per file.8 declared tool(s)with1 local entry layered, and tighten-only was proven in both directions: a raised floor honoured, a relaxation refused.link_kindagainst the model's declared prefixes, not from reading URLs by eye.Two defects found that no gate reports
Both in
intent-fidelity files, which are presence-checked only, and both found by reading a file already being edited:repo-config/README.mdclaimed the ruleset payloads carrybypass_actors. They do not, and the hub corrected the same sentence in its own copy.AUDIT.mdsays it asserts.This is the blind spot the hub's
RESYNC.mdsection 5 names, demonstrated on a live repo.🤖 Generated with Claude Code