* test(graphify): TDD-red design contract for #3170 commit-staleness signal Captures the proposed extension to graphifyStatus() as 8 failing assertions across 3 groups (git-aware, non-git, back-compat). Suite is describe.skip()'d so npm test stays green on the branch — removing .skip is the green-light moment when the enhancement is approved and implementation lands. Verified against safishamsi/graphify v0.7.0 release notes: the field on graph.json is built_at_commit (full git HEAD), not commit_hash as originally guessed in #3170. Tests assert against the verified name. Design highlights captured in the file's docstring: - Tri-state commit_stale (true/false/null) — null means "we don't know" (pre-v0.7 graph or no git), distinct from false ("known fresh") - Argument-injection fence /^[0-9a-f]{4,40}$/i validates built_at_commit before it reaches `git` as an argv element - Existing graphifyStatus() fields (node_count, edge_count, stale, age_hours, etc.) are unchanged — back-compat fenced Per the issue's enhancement template: no PR will be opened until the issue is labeled `approved-enhancement`. Refs #3170 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(graphify): surface commit-based staleness from graphify v0.7+ built_at_commit Closes #3170 graphify v0.7+ embeds built_at_commit (full git HEAD) into graph.json at write time. GSD's existing graphifyStatus() ignored it; staleness was mtime-only, which is a poor proxy for "does this graph reflect the current code." A CI-built graph rebuilt minutes ago against an old checkout reads as FRESH on mtime but is materially stale. graphifyStatus() now returns four additional fields on the success path: built_at_commit short hash from graph.built_at_commit, or null current_commit short hash of git HEAD, or null when no git commits_behind git rev-list --count <built>..HEAD, or null commit_stale true | false | null Tri-state on commit_stale is load-bearing. null means "we don't know" (pre-v0.7 graph, non-git cwd, unreachable commit) — semantically distinct from false ("known fresh"). Agents reading null should fall back to mtime; reading false can confidently skip a rebuild. Security: built_at_commit is on-disk and user-influenceable. Without validation, a hostile value (e.g. "--upload-pack=evil") would reach git as an argv element and be interpreted as an option. The /^[0-9a-f]{4,40}$/i fence rejects anything else as absent. spawnSync's array args (no shell) is defense in depth, not the boundary. Skill (commands/gsd/graphify.md) Step 2b renders one conditional line: Source commit: abc1234 (5 commits behind HEAD) Source commit: abc1234 (current) Source commit: abc1234 (freshness unknown) Pre-v0.7 graphs omit the line entirely — no confusing "Source commit: unknown" rendered. Also documents `graphify hook install` in docs/CONFIGURATION.md for multi-dev teams who would otherwise hit graph.json merge conflicts on parallel rebuilds (sub-enhancement 2 from #3170). TDD red→green: tests/enh-3170-graphify-commit-staleness.test.cjs (8 assertions across git-aware, non-git, back-compat) was committed describe.skip()'d in c567f23d when the issue was filed; this commit removes .skip and lands the implementation that makes them green. Full suite 7503/7503 passes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
@@ -55,6 +55,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
||||
|
||||
### Enhancement
|
||||
|
||||
- **`/gsd-graphify status` surfaces commit-based staleness from graphify v0.7+** — `graphifyStatus()` now reads `built_at_commit` from `graph.json` (graphify v0.7+ embeds it at build time), compares against `git HEAD`, and returns four new fields: `built_at_commit`, `current_commit`, `commits_behind`, and `commit_stale`. The `commit_stale` flag is tri-state (`true`/`false`/`null`) — `null` means the signal is unavailable (pre-v0.7 graph, non-git checkout, or unreachable commit) and callers should fall back to the existing mtime-based `stale` flag. The skill renders `Source commit: <hash> (N commits behind HEAD | current | freshness unknown)` when the signal is present, and omits the line entirely for pre-v0.7 graphs. The `built_at_commit` value is validated as 4–40 hex chars before reaching `git`, so a hostile `graph.json` cannot smuggle dashed options into the argv. Also documents `graphify hook install` in `docs/CONFIGURATION.md` for multi-dev teams who would otherwise hit `graph.json` merge conflicts on parallel rebuilds. Regression covered by `tests/enh-3170-graphify-commit-staleness.test.cjs` (8 assertions across git-aware, non-git, and back-compat groups). (#3170)
|
||||
- **Test suite for `config-schema.cjs` is now mutation-resistant** — Stryker measured a 4.62% mutation score on `get-shit-done/bin/lib/config-schema.cjs` (6 killed, 124 survived out of 130). Surviving mutants flagged that existing tests were exercising paths but not verifying outputs: a polarity flip (`return true` → `return false`), a predicate swap (`.some` → `.every`), or a guard removal (`if (VALID_CONFIG_KEYS.has(...)) return true;` → unguarded fallthrough) all passed every test. New `tests/bug-2986-config-schema-mutation-killers.test.cjs` adds 95 tests across four suites that target each surviving mutant class: (1) parameterized `isValidConfigKey('${key}') === true` for every member of `VALID_CONFIG_KEYS` (kills the static-key-fast-path mutation), (2) representative dynamic-pattern keys that match exactly one pattern (kills the `.some` → `.every` mutation, with an inline mutual-exclusivity invariant check), (3) `strictEqual` against the literal boolean `true`/`false` instead of `assert.ok` truthy checks (kills polarity-flip mutations), (4) anchor-tightening cases that differ from valid keys by one character beyond the documented shape (kills regex-loosening mutations on `^`, `$`, and character-class boundaries). Tests use the lib's public surface (typed boolean assertions on `isValidConfigKey` return values), no source-grep. (#2986)
|
||||
- **Hotfix release flow now auto-incorporates fixes from `main` and bundles the SDK** — `hotfix.yml create` auto-cherry-picks every `fix:`/`chore:` commit on `origin/main` not yet shipped (oldest-first; patch-equivalents skipped via `git cherry`; `feat:`/`refactor:` excluded; conflicts halt with the offending SHA; run summary lists every included SHA). `hotfix.yml finalize` adds the `install-smoke` cross-platform gate, bundles `sdk-bundle/gsd-sdk.tgz` inside the CC tarball (parity with `release-sdk.yml`), tightens the `next` dist-tag re-point, and marks the GitHub Release `--latest`. `release-sdk.yml` gains `action: publish | hotfix` plus an `auto_cherry_pick` toggle, with a new `prepare` job that branches `hotfix/X.YY.Z` from the highest existing `vX.YY.*` tag and runs the same cherry-pick logic — idempotent if the branch was pre-prepared via `hotfix.yml`. Hotfix `vX.YY.Z` is now defined as everything in `vX.YY.{Z-1}` plus every `fix:`/`chore:` since that base, so each tag is the cumulative-fix anchor for the next. (#2955)
|
||||
- **Planning workspace seam extracted from `core.cjs` into `planning-workspace.cjs`** — path/workstream/lock behavior now lives in a dedicated module (`planningDir`, `planningPaths`, `planningRoot`, active-workstream routing, `withPlanningLock`). `core.cjs` keeps compatibility re-exports while call-sites migrate to direct imports, improving locality and reducing coupling. (#2900)
|
||||
|
||||
Reference in New Issue
Block a user