4 Commits

Author	SHA1	Message	Date
Jakub Zych	12ee75a509	chore: point MSD at git.golem15.com/golem15/msd-core ... The fork lives on the golem15 Gitea forge, not GitHub. Package identity now parses either host and derives in-place raw URLs for Gitea; the identity-drift lint accepts the new host; README drops GitHub-only badges and the npm quickstart in favour of the checkout installer.	2026-10-06 10:41:56 +02:00
Jakub Zych	a9a7a328e6	refactor: hard-fork GSD -> MSD (Make Software Done) ... Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD across contents and paths, upstream package/repo coordinates -> @golem15/msd-core and golem15com/msd-core. Deep links into upstream history, sibling upstream packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is. Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line, package/plugin identity, regenerated lockfile, install-tree fixtures, derived registries and benchmark baseline; migration checksum baseline re-locked (MSD keeps its own install state, so no install had applied the old sums); sort-order and regex-escaped expectations in tests adjusted.	2026-10-06 01:47:40 +02:00
Tom Boucher	67a9243cf1	chore(#2356): make the ADR index a generated artifact and enforce ADR lifecycle invariants (#2367) ... * chore: rebuild ADR index as a generated artifact and enforce lifecycle invariants The ADR index in docs/adr/README.md was hand-maintained with nothing checking it, and had drifted to 40 of 65 ADRs. The absent rows included the entire capability family (857/894/959/1016/1143/1213/1244) and ADR-1239 (EoS) itself, so the decisions a reader most needed were the ones they could not find. Make the index a derived artifact, matching the repo's existing generated-file idiom (lint:generated-sync), and enforce the corpus' lifecycle invariants: - scripts/gen-adr-index.cjs generates the index between markers and validates the status vocabulary (Accepted/Proposed/Superseded/Legacy/Retired), successor links, id/filename agreement, and supersession symmetry. - Wire --check into lint:generated-sync so drift fails CI. Correct the lifecycle metadata the gate surfaced, without flipping any status: - ADR-1239 (EoS) declared it subsumed ADR-1016/58/3660/894; none recorded it. Add reciprocal "Subsumed by" pointers + dated amendments. Subsumption keeps the target Accepted -- these are live adapters, not dead decisions. - ADR-857/894 carry dated status caveats: they read Proposed while the capability system shipped and epic #857 is closed. Ratification is a maintainer act and is deliberately left open. - Link ADR-0005/0007/0012/3524 -> ADR-0174 and ADR-0010 -> ADR-0009; record the reciprocal Supersedes on ADR-0009. - ADR-218 declared itself "ADR-0175" -- an unfinished rename. - The 0011 PRD moves from the non-canonical "Draft" to "Legacy". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test: capture stderr via spawnSync; record ADR-0010 draft supersession Two fixes surfaced by the first gsd-test run and by regenerating the index: - tests/adr-index-gate.test.cjs used execFileSync, which only surfaces stderr through the thrown error on non-zero exit. The `--write` path exits 0 while reporting outstanding violations on stderr, so the helper always saw ''. spawnSync captures both streams on both outcomes. - The hand-maintained index recorded 0010-skill-surface-budget-module.md as "earlier draft superseded by ADR-0011" while the file itself still said Proposed. Deriving the index from the files would have dropped that assertion and resurrected a superseded draft as a live decision, so it is recorded at its source, with the reciprocal Supersedes on ADR-0011. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: drop the dead sdk/ model-catalog candidate retired by ADR-0174 src/model-catalog.cts resolved model-catalog.json through three candidates, the second being sdk/shared/model-catalog.json three levels up. That was the legacy source-repo fallback kept by the #3288 fix ("check the co-located path FIRST, before the legacy source-repo path"). ADR-0174 then retired the @opengsd/gsd-sdk package boundary and deleted the sdk/ tree (11918dcc3), so the candidate can no longer resolve in any layout: a source repo has no sdk/, and an install layout points it at ~/.claude/sdk/shared/, which the installer never writes -- the original #3288 bug. It was dead weight implying a package boundary this repo no longer has. No test depends on it: the #3288 regression tests in tests/install.test.cjs write their own synthetic old-path fixture and assert it throws. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs: ratify nine shipped ADRs; record why ten others stay Proposed The corpus carried 19 Proposed ADRs, most describing architecture that had already shipped. A Proposed label on live architecture tells contributors and agents the decision is an unbuilt idea -- the capability system and EoS were both being misread that way. Audited all 19 against the shipped tree and GitHub. Each candidate flip then had to survive two independent reviewers instructed to refute it. Ratified Proposed -> Accepted, each with a dated Ratification section carrying the verified evidence (file:line, symbols, tests, issue state): 857 capability system 894 declaration format 1244 capability ecosystem 1577 injection boundary 1610 size-budget ratchet 1990 existing-code onboarding 15 cross-AI convergence 22 plan-drift guard 0011 default reviewers Held ten, each now carrying a "Why this is still Proposed" section naming the blocker and its unblock condition, so the audit is not repeated: 2264 its own headline acceptance criterion is unmet in the tree 230 live branch protection contradicts the decided spec (1 approval, not 2) 660 the namesake release/<version> re-cut is manual, not automated 959 issue #2346 is approved and plans its graduation as its own ADR 1213 the shipped writer's return shape differs from the decided interface 443 the orchestrator override path has no live caller 1143 / 1606 each states its own bar for acceptance; neither is met 612 / 1671 legitimately open Shipped code proved necessary but not sufficient: eight ADRs had every named module, symbol, and test present with their epics closed, and still failed the bar. That lesson is written into README.md's ratification procedure. Also corrected ADR-857's "Supersedes (generalizes)" to "Subsumes": taken literally it would have marked two live seams dead -- ADR-0011 (surface.cts:348) and ADR-58 (runtime-artifact-install-plan.cts:82). Both keep Accepted status and gain Subsumed-by pointers. Index: Active 39->48, Proposed 19->10, Superseded/Legacy 7. 65 total. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: harden gen-adr-index against hostile titles and non-ADR filenames (#2356) Three findings from the pre-PR orthogonal security review, all confirmed: - An ADR title containing the literal ADR-INDEX:END marker was emitted verbatim into its table cell, relocating the splice boundary so the NEXT --write spliced against the wrong marker and truncated README.md. Titles now render through cellText(), which escapes pipes and angle brackets -- making an HTML comment (and any other HTML) unformable from ADR-authored text. - A docs/adr/*.md without a numeric prefix crashed on match(...)[1] of null. Such a file is also invisible to the index -- the very failure this gate exists to prevent -- so it is now reported as a naming-convention violation naming the file and the fix. - Tests leaked their mkdtemp dirs. They now use helpers.createTempDir/cleanup via t.after(); helpers.cleanup carries the Windows-EBUSY retry budget that a raw fs.rmSync lacks (caught by local/no-raw-rmsync-in-tests). Adds five regression tests: marker hijack, HTML injection, pipe cell-break, non-conforming filename, and splice stability across repeated writes. Refs #2356 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: close two gate false-passes; read ## Supersedes sections (#2356) Second round of confirmed findings from the pre-PR orthogonal code review. Both false-passes matter more than a false-fail: a gate that silently misses a violation is worse than no gate, because it is trusted. - A relation field mixing a link with a bare id silently dropped the bare claim: the check tested `rel.links.length` (does this field have ANY link?) instead of whether THAT id was linked. `Supersedes: [ADR-0001](...), ADR-0011` passed clean -- accepting exactly the ambiguous bare reference the rule forbids. Now each bare id is checked against the ids actually linked in the same field, so a repeat in trailing prose stays quiet while an unlinked claim is flagged. - The ratification guard (`statusToken !== 'Accepted'`) skipped BOTH relation directions, which killed the IN check entirely: `supersedes.in` is only ever populated on an ADR whose status IS `Superseded`, so a dangling `Superseded by X` where X never claims it always passed. The guard now applies to OUT only -- a prospective claim must not obligate its target, but an ADR's statement about ITSELF is always owed a reciprocal. - Fixing that surfaced a parser gap: ADR-0174 declares its supersessions in a `## Supersedes` table SECTION, not a header field, and headerBlock() stops at the first `##`. The repo's best-documented supersession was invisible. Section form is now parsed for both relations. - Replaced a vacuous test: the em-dash negation case passed whether or not NEGATED_RELATION_RE matched (a mutation to /$^/ survived). It now carries a link that would create a failing asymmetric relation if negation did not fire. Also removes docs/adr/9401-test-target.md -- a synthetic fixture a reviewer created in the worktree while reproducing a finding, swept in by `git add -A`. Adds regression tests for each: mixed link+bare, linked-and-repeated-in-prose, dangling superseded-by from a non-Accepted ADR, and the ADR-0174 section shape. Refs #2356 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: escape backslashes before pipes in the ADR index cell renderer (#2356) CodeQL js/incomplete-sanitization (high) on scripts/gen-adr-index.cjs: cellText() escaped `|` -> `\|` without first escaping the backslash. Markdown's escape character is the backslash, so the input `\|` became `\\|`, which renders as a literal backslash followed by an UNESCAPED pipe -- re-opening the cell break the pipe escape exists to prevent. Order is load-bearing: escape the escape character first, then everything that emits one. Same class as the index-marker hijack fixed earlier: ADR-authored text breaking out of the cell it is rendered into. Adds a regression test asserting a `\|`-bearing title leaves exactly the row's own 5 unescaped delimiters and cannot forge a Status cell. Uses split(/\r?\n/) per local/no-crlf-fragile-split -- a literal "\n" split is CRLF-fragile on the Windows CI leg. Refs #2356 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-17 10:51:58 -04:00
Tom Boucher	1bc7d61294	chore: introduce next integration branch (Phase 1 — additive) (#231) ... Adds: - docs/branching.md — beginner contributor guide - docs/adr/XXXX-...md — ADR (will be renamed with issue#) - .github/workflows/auto-backmerge.yml — disabled in Phase 1 - .github/workflows/pr-target-validator.yml — warn-only in Phase 1 - scripts/setup-branch-protection.sh — idempotent gh api script Modifies: - .github/workflows/branch-naming.yml — recognize 'next' - CONTRIBUTING.md — 'Where Do I Open My PR?' section Phase 1 is additive: nothing operational changes until Phase 2 flips auto-backmerge.yml's if:false→true, flips pr-target-validator.yml's WARN_ONLY→false, creates the next branch, and switches the default branch. See the ADR for the migration plan.	2026-05-24 17:11:31 -04:00