golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(#3514): deny internal fetch hosts; disclose unverified integrity (#3516)

Browse Source 
* test(#3514): add failing-first denylist and integrity suites

* fix(#3514): deny internal fetch hosts; disclose unverified integrity

* docs(#3514): trust-model, glossary, and changeset entries

* fix(#3514): scope v6 checks to literals; exact pin kinds in prompt

* chore(#3514): backfill changeset pr number

---------

Co-authored-by: sim <sim@local>
This commit is contained in:
Tom Boucher
2026-08-14 21:34:29 -04:00
committed by GitHub
parent 268ca7e32d
commit 6badb839a0
18 changed files with 842 additions and 602 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
CONTRIBUTING.md
View File

@@ -198,52 +198,6 @@ Contributor requirements (summary):
- **CI must pass** — all configured matrix jobs must be green. Node 24 is the compatibility floor and primary target; Node 26 compatibility must be preserved for code and tests even when a Node 26 CI lane is not yet available.
- **Scope matches the approved issue** — if your PR does more than what the issue describes, the extra changes will be asked to be removed or moved to a new issue
### Deleting a module that has a surviving counterpart — disposition required
A consolidation PR that deletes a module, package, or whole lineage — where any part of
the deleted side has a surviving counterpart in the tree — must carry a **symbol-level
disposition table for the deleted side**: for every declared name (exported *or* local),
one of:
- `migrated` — the behavior exists at a named location in the surviving tree,
- `renamed → <new name>` — including convention drift (`verifyX` → `cmdVerifyX`,
`preserveExistingProgress` → `shouldPreserveExistingProgress`),
- `dropped because <reason>` — a deliberate deletion, with the reason stated.
Rank **SCREAMING_CASE constants first** — that is where policy lives; both confirmed
losses from the one retirement this repo has performed were bounds
([#3484](https://github.com/open-gsd/gsd-core/issues/3484)). Local-variable renames are
noise and may be summarized.
**"The surviving tests pass" is not evidence.** The surviving tests belong to the
surviving side and cannot observe behavior only the deleted side had. ADR-0174 retired
the SDK package and deleted ADR-3524's parity apparatus in the same migration; three
invariants went into the bin with the package and nobody noticed for months (#3427,
#3477, epic #3473 B5) — see ADR-0174's behavior-carry-forward amendment (#3484) for the record.
**The audit is a method, not a guess.** The calibrated procedure — pairing by basename,
comment-stripped declared-name diffing, rename normalization, SCREAMING_CASE-first
ranking, and a **mandatory positive control** (the audit must re-detect a known loss or
it is not calibrated; an export-only scan misses `shortFormToId`, which was a *local*
`const` in a surviving function) — is written up step by step in
[`docs/how-to/audit-a-retiring-lineage.md`](docs/how-to/audit-a-retiring-lineage.md).
### A known gap gets an issue — a comment is not a tracking mechanism
Recording a known-but-unfixed gap in a code comment, a changeset note, or a TODO, and
treating that as *tracking* it, is an anti-pattern: all three are attached to code, and
a refactor deletes the code they annotate while the gap stays real. The worked example
is `.changeset/archived/clever-yaks-cheer.md` (PR #3798): it accurately recorded the
`shortFormToId` backfill as "tracked as a follow-up parity gap", a `// KNOWN GAP:`
comment marked the call site, then the SDK retirement deleted both — and no issue was
ever opened. The gap surfaced a year later as production bug #3427.
The rule: **a gap that matters gets an issue. A gap with no issue is not tracked.** If
you find yourself writing "tracked as a follow-up" in a comment or a changeset body,
open the issue first, then cite its number. This is the prose-level twin of epic #3473's
criterion B6 (a guard needs a retirement condition): the tracking mechanism must
survive the artifact it is attached to.
## CHANGELOG Entries — Drop a Fragment
**Do not edit `CHANGELOG.md` directly.** Two PRs that both append to a `### Fixed` block always conflict on merge — git can't pick a serialization order without a human. Instead, every PR with user-facing changes drops a fragment file in `.changeset/`.