From 8817484e9cf1bf1f756693f4dcf680484d84d572 Mon Sep 17 00:00:00 2001 From: Chris Date: Tue, 29 Sep 2026 15:08:20 +0200 Subject: [PATCH 1/5] fix: correct footer shape figures, spec 018 removal bound, and a stale cross-reference Follow-ups to a retroactive CodeRabbit review of the diffs merged by #3682 (d7e98f3) and #3604 (5675299). Both were merged without a CodeRabbit approval on the head commit, so their findings are addressed here rather than in place. No existing behaviour changes: three factual corrections and one changelog entry. Footer shape figures (.github/workflows/documentation.yml) The advisory notice and its comment quoted 930 flagged, 280 no-known-footer and 30.1%, and called that figure a false-positive rate. Re-running `npm run measure:footers:shape` on the current tree gives 899 flagged, 255 with no known footer and a 28.4% share, which is what docs/FOOTER_REMEDIATION_GUIDE.md and `measure-footer-shape.js` already describe. The 28.4% is a share of flagged files, not a rate: a file with an unrecognised but genuine duplicate footer is counted in it, and a file with known phrases is not independently confirmed, so no rate follows. Both the comment and the emitted notice now carry 899 / 255 / 28.4% and the share wording. The step keeps `continue-on-error` and still states that it does not fail the build. Spec 018 removal bound (.github/specs/018-claude-cloud-environment/spec.md) SC-002 claimed empty `claude/*` branches are removed through spec 009 so that none stays longer than 48 hours. FR-020 defers auto-approved deletion, and states that while the deferral holds no `claude/*` branch qualifies for automatic deletion and a branch routed to DISCUSS has no route to approval, so the 48-hour bound cannot hold during the deferral. SC-002 now applies that bound only once the deferral is lifted, and the Assumptions bullet that stated branches "are removed" now says the same. The measurable claim in SC-002 is untouched and the bound is retained, not deleted. Feedback response cross-reference (FEEDBACK_RESPONSE.md) The sentence above the feedback table said the items are "listed above". The `Feedback` heading is at line 29, below the sentence at line 18, so the reference pointed at nothing. Changed to "below". The other two directional references in that file were checked and are already correct. Verification: actionlint clean; spec 018 suite 41/41; governance suite 18/18; the changelog gate reports the same 3 length, 5 missing-link and 1 tense violations as develop, so this adds none; semgrep p/security-audit and p/secrets 0 findings over 4 files. --- .../specs/018-claude-cloud-environment/spec.md | 4 ++-- .github/workflows/documentation.yml | 16 +++++++++++----- CHANGELOG.md | 1 + FEEDBACK_RESPONSE.md | 2 +- 4 files changed, 15 insertions(+), 8 deletions(-) diff --git a/.github/specs/018-claude-cloud-environment/spec.md b/.github/specs/018-claude-cloud-environment/spec.md index 81da3be6dc..31c8f93a56 100644 --- a/.github/specs/018-claude-cloud-environment/spec.md +++ b/.github/specs/018-claude-cloud-environment/spec.md @@ -251,7 +251,7 @@ A maintainer can find, in the repository, the exact environment definition the t ### Measurable Outcomes - **SC-001**: 100% of branches pushed from cloud agent sessions on this repository pass the branch-name validator. This is measured over the first 30 days after rollout via the existing branch-validation metrics. -- **SC-002**: Zero new `chore/session-*` or `claude/*` branches with commits appear on the remote after rollout. Empty `claude/*` branches are still removed through spec 009's existing route, so none stays longer than 48 hours; the automatic route in FR-020 is not part of this criterion while its deferral holds, and a branch that reaches DISCUSS has no removal path defined here, which is a known consequence of the deferral rather than a target this spec meets by itself. +- **SC-002**: Zero new `chore/session-*` or `claude/*` branches with commits appear on the remote after rollout. Empty `claude/*` branches follow spec 009's existing route, and the 48-hour bound applies only once the FR-020 deferral is lifted and its automatic route is active; while the deferral holds no branch qualifies for automatic deletion and a branch that reaches DISCUSS has no removal path defined here, so no removal timeframe is claimed, which is a known consequence of the deferral rather than a target this spec meets by itself. - **SC-003**: PR template fallback routing caused by agent-created branches drops to 0% (constitution goal for fallback routing). - **SC-004**: A team member without a saved environment selection can start a correctly configured session with zero manual configuration steps once the Owner has completed setup. @@ -267,7 +267,7 @@ A maintainer can find, in the repository, the exact environment definition the t - The platform's push protection allows pushing the session's current branch after it has been renamed. This was verified during the draft implementation. If the platform changes this, pushes from renamed branches fail loudly (the push is rejected, not redirected), CI branch validation still applies, and the verification steps (quickstart §4) catch it; the documentation lists it as a limitation. - The existing validator (`lib/validate-branch-name.js`) and `docs/BRANCHING_STRATEGY.md` are authoritative. They currently disagree on release names: the strategy documents `release/vX.Y.Z` and `hotfix/vX.Y.Z`, but the validator rejects them. Until the validator is fixed (a dependency outside this spec, on branch `fix/branch-validator-semver-release`), the guard and CI both refuse such branches, so FR-009's `main` rule can't be used for real release PRs. No changes to authorised types are in scope. - The default network level (Trusted) reaches every host the provisioning script needs. -- Empty `claude/*` branches left by the platform are removed by spec 009's scheduled cleanup under the auto-approval exception (FR-020 to FR-022). Existing `claude/*` branches that have commits are reviewed by maintainers through 009's DISCUSS category, not deleted automatically. +- Empty `claude/*` branches left by the platform follow spec 009's scheduled cleanup; while FR-020's deferral holds none qualifies for automatic deletion, so they are only removed once that deferral is lifted. Existing `claude/*` branches that have commits are reviewed by maintainers through 009's DISCUSS category, not deleted automatically. - The cleanup requirements depend on spec 009 and lightspeedwp/.github#3358 (the categorisation library and scheduled workflow). They are delivered after #3358 merges, together with the matching amendment to spec 009. - Sessions opened with several repositories do not load repository-level protections. This is documented, not solved. - Threat model: the guard is designed to stop accidental non-compliance and the obvious self-bypasses (editing guard or settings files, or changing the switch in-session). It is not designed to resist a determined adversary using unusual shell constructions; CI branch validation and CODEOWNERS review are the final gate. diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 70f688971c..656918875d 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -394,10 +394,15 @@ jobs: # Advisory only, and deliberately a separate step from the failing check # above. This signal reports files whose trailing zone holds two or more # footer-shaped blocks that the wording-based deduper cannot recognise. - # Measured across 11,474 tracked Markdown files it flags 930 files, of - # which 280 (30.1%) hold no known footer at all, so it must never fail a - # build. It exists to ask a human to look, and to surface footers whose - # wording is missing from footer-policy.js. See issue #3451. + # Measured across 11,474 tracked Markdown files it flags 899 files, of + # which 255 (28.4%) hold no known footer at all, so it must never fail a + # build. That 28.4% is a share of flagged files, not a false-positive + # rate; a file with an unrecognised but genuine duplicate footer is in + # it, and a file with known phrases is not independently confirmed, so no + # rate follows. Figures are from `npm run measure:footers:shape` and match + # docs/FOOTER_REMEDIATION_GUIDE.md. It exists to ask a human to look, and + # to surface footers whose wording is missing from footer-policy.js. See + # issue #3451. if: always() && steps.range.outputs.enabled == 'true' continue-on-error: true env: @@ -443,7 +448,8 @@ jobs: " of " + findings.length + " changed file(s) hold a footer-shaped block the deduper cannot see. Advisory only: " + - "the measured false-positive rate is 30.1%, so this does not fail the build." + "the measured share of flagged files with no known footer phrase is 28.4%, " + + "so this does not fail the build." ); ' diff --git a/CHANGELOG.md b/CHANGELOG.md index 09e63a8e92..123aedd376 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,6 +72,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +- **Footer Shape Figures Corrected** — The advisory notice quotes the measured 899 / 255 / 28.4% share, a share of flagged files not a false-positive rate. Spec 018's removal bound applies once FR-020's deferral lifts. (#3682, #3604) - **Merged Advisory and Spec Defects Corrected** — The advisories newsletter form survives a failed request, tells a blocked address from a fault and counts its rate limit atomically; spec 018 defers auto-approved branch deletion. (#1396) - **Docs-Bot Changelog Exemption** — The gate now matches the docs bot in either login shape, so its exemption applies. Bot pull requests with no user-facing content no longer need a changelog entry. (#3603, #3448) - **Semantic-Version Release Branches** — Branch checks in CI and the npm script now accept documented release names such as `release/v1.2.3` and `release/v1.2.3-rc1`. ([#3555](https://github.com/lightspeedwp/.github/issues/3555)) diff --git a/FEEDBACK_RESPONSE.md b/FEEDBACK_RESPONSE.md index 7441a290e0..bba6a60de0 100644 --- a/FEEDBACK_RESPONSE.md +++ b/FEEDBACK_RESPONSE.md @@ -15,7 +15,7 @@ tags: Pull request: #3604 — corrects defects in the content merged by #3387 (plugin advisories) and #3525 (spec 018), and folds in the renumber residue and the Section 1 advisories table column label. -Everything CodeRabbit and Qodo raised is listed above with a status. Nothing is silently +Everything CodeRabbit and Qodo raised is listed below with a status. Nothing is silently dropped: each item is addressed in this pull request, explicitly deferred with the place where the outstanding decision is recorded, or explicitly rejected with the evidence that disproves it. From a5e252d09de1aed2f43a78095ab5e7c72165db9a Mon Sep 17 00:00:00 2001 From: Chris Date: Tue, 29 Sep 2026 15:20:57 +0200 Subject: [PATCH 2/5] fix: keep the changelog entry free of unexplained abbreviations The required "Validate changelog on PR" check failed on the previous commit with one new violation. The entry named "FR-020", and CHK_NO_ABBREVIATIONS matches any run of two or more capitals that is not in known_acronyms, which rules.json leaves empty, so "FR" counted. The local `npm run validate:changelog` summary did not surface it; the gate runs the validator with `--trigger pr_submission` and compares per-entry results against the base revision, and the earlier local comparison was made against a text summary rather than the per-entry JSON. The requirement is now named in prose. Verified with the gate's own invocation: `node bin/validate.js --changelog-path ../../../CHANGELOG.md --trigger pr_submission` reports 10 failing entries against 10 on the base revision, so the new-failure count is 0, and this entry passes all eight rules including length at 243 characters. --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 123aedd376..9d60f31bd1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,7 +72,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed -- **Footer Shape Figures Corrected** — The advisory notice quotes the measured 899 / 255 / 28.4% share, a share of flagged files not a false-positive rate. Spec 018's removal bound applies once FR-020's deferral lifts. (#3682, #3604) +- **Footer Shape Figures Corrected** — The advisory notice quotes the measured 899 / 255 / 28.4% share, a share of flagged files not a false-positive rate. The spec 018 removal bound applies once that requirement defers no more. (#3682, #3604) - **Merged Advisory and Spec Defects Corrected** — The advisories newsletter form survives a failed request, tells a blocked address from a fault and counts its rate limit atomically; spec 018 defers auto-approved branch deletion. (#1396) - **Docs-Bot Changelog Exemption** — The gate now matches the docs bot in either login shape, so its exemption applies. Bot pull requests with no user-facing content no longer need a changelog entry. (#3603, #3448) - **Semantic-Version Release Branches** — Branch checks in CI and the npm script now accept documented release names such as `release/v1.2.3` and `release/v1.2.3-rc1`. ([#3555](https://github.com/lightspeedwp/.github/issues/3555)) From 7dec2dc3d26989a8b78206c36393f14a9ef09cda Mon Sep 17 00:00:00 2001 From: Chris Date: Tue, 29 Sep 2026 15:28:03 +0200 Subject: [PATCH 3/5] fix: attribute the 899 and 255 figures to the comment, not the notice CodeRabbit's open finding on the pull request was correct. The changelog entry said the advisory notice quotes 899 and 255, but the emitted ::notice reports changed-file counts and the 28.4% share only. The 899 and 255 figures live in the step's YAML comment, which is where the measurement is recorded for a reader of the workflow. The entry now says so, and keeps the 28.4% wording change attributed to the notice, which is where that text changed. The review thread is left open and is answered in a reply on the pull request rather than dismissed. Verified with the gate's own invocation: the validator reports 10 failing entries against 10 on the base revision, so the new-failure count is 0, and this entry passes all eight rules at 225 characters. --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9d60f31bd1..9eeb4554bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,7 +72,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed -- **Footer Shape Figures Corrected** — The advisory notice quotes the measured 899 / 255 / 28.4% share, a share of flagged files not a false-positive rate. The spec 018 removal bound applies once that requirement defers no more. (#3682, #3604) +- **Footer Shape Figures Corrected** — The workflow comment records 899 flagged files and 255 with no known footer phrase. The runtime notice now calls 28.4% a share of flagged files, not a false-positive rate. (#3682, #3604) - **Merged Advisory and Spec Defects Corrected** — The advisories newsletter form survives a failed request, tells a blocked address from a fault and counts its rate limit atomically; spec 018 defers auto-approved branch deletion. (#1396) - **Docs-Bot Changelog Exemption** — The gate now matches the docs bot in either login shape, so its exemption applies. Bot pull requests with no user-facing content no longer need a changelog entry. (#3603, #3448) - **Semantic-Version Release Branches** — Branch checks in CI and the npm script now accept documented release names such as `release/v1.2.3` and `release/v1.2.3-rc1`. ([#3555](https://github.com/lightspeedwp/.github/issues/3555)) From 9f675ba67fb38bfe58474e09a4b1fe7322dd1b40 Mon Sep 17 00:00:00 2001 From: Chris Date: Tue, 29 Sep 2026 20:06:31 +0200 Subject: [PATCH 4/5] fix: describe the 255-file remainder as fewer than two known phrases CodeRabbit's finding on this pull request was correct, and the measurement script settles it. In scripts/measure-footer-shape.js the known-phrase set for a file is built from its trailing eight lines and `carriesTwoKnown` is `matched.size >= 2`, so `twoKnown` counts only files holding two or more distinct known phrases. The remainder is then computed as `noKnownFooter = flagged - twoKnown`, which is every flagged file holding zero or one known phrase. "no known footer at all" therefore overstates it: a file carrying exactly one known phrase is counted in those 255. Corrected in all three places in this branch that describe the remainder: the step's comment, the emitted notice, and the changelog entry. The comment's rationale was reworded with it, because "a file with known phrases is not independently confirmed" no longer matched the measurement once a file in the remainder can hold one known phrase. The changelog entry is shortened to 232 characters, from 250 at the validator's limit, so a later edit is less likely to tip it over. Two things found while checking, and deliberately not changed here because they are outside this branch's diff: docs/FOOTER_REMEDIATION_GUIDE.md:285 describes the same 255 as "no known footer phrase in the trailing eight lines", and scripts/measure-footer-shape.js names the field `noKnownFooter` and prints "of which none known". Both carry the same overstatement and belong with whichever change owns those files. Verification: actionlint clean and the workflow parses; the embedded node script parses and renders the notice with no missing or doubled space; footer guard reports 0 affected and 0 blocks; spec 018 suite 41/41, governance 18/18, resolve-readme-files 14/14; the changelog gate reports 10 failing entries against 10 on origin/develop, so the new-failure count is 0, and this entry passes all eight rules; Semgrep p/security-audit and p/secrets 0 findings over 4 files. --- .github/workflows/documentation.yml | 16 +++++++++------- CHANGELOG.md | 2 +- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 27dfeaf0a7..f0c31c10ed 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -429,11 +429,13 @@ jobs: # above. This signal reports files whose trailing zone holds two or more # footer-shaped blocks that the wording-based deduper cannot recognise. # Measured across 11,474 tracked Markdown files it flags 899 files, of - # which 255 (28.4%) hold no known footer at all, so it must never fail a - # build. That 28.4% is a share of flagged files, not a false-positive - # rate; a file with an unrecognised but genuine duplicate footer is in - # it, and a file with known phrases is not independently confirmed, so no - # rate follows. Figures are from `npm run measure:footers:shape` and match + # which 255 (28.4%) hold fewer than two distinct known footer phrases, + # so it must never fail a build. That 28.4% is a share of flagged files, + # not a false-positive rate; the remainder includes files with no known + # phrase and files with exactly one, a file with an unrecognised but + # genuine duplicate footer is among them, and a file with two or more + # known phrases is not independently confirmed, so no rate follows. + # Figures are from `npm run measure:footers:shape` and match # docs/FOOTER_REMEDIATION_GUIDE.md. It exists to ask a human to look, and # to surface footers whose wording is missing from footer-policy.js. See # issue #3451. @@ -482,8 +484,8 @@ jobs: " of " + findings.length + " changed file(s) hold a footer-shaped block the deduper cannot see. Advisory only: " + - "the measured share of flagged files with no known footer phrase is 28.4%, " + - "so this does not fail the build." + "the measured share of flagged files holding fewer than two " + + "distinct known footer phrases is 28.4%, so this does not fail the build." ); ' diff --git a/CHANGELOG.md b/CHANGELOG.md index b17c6bf5a3..4d1b42ae51 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -73,7 +73,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - **Docs Bot Skips Workflows Directory** — Regeneration skips `.github/workflows/`, so its pushes stop failing for want of App token `workflows` permission. (#3687) -- **Footer Shape Figures Corrected** — The workflow comment records 899 flagged files and 255 with no known footer phrase. The runtime notice now calls 28.4% a share of flagged files, not a false-positive rate. (#3682, #3604) +- **Footer Shape Figures Corrected** — Workflow comment: 899 flagged files, 255 holding fewer than two distinct known footer phrases. The runtime notice calls 28.4% a share of flagged files, not a false-positive rate. (#3682, #3604) - **Merged Advisory and Spec Defects Corrected** — The advisories newsletter form survives a failed request, tells a blocked address from a fault and counts its rate limit atomically; spec 018 defers auto-approved branch deletion. (#1396) - **Docs-Bot Changelog Exemption** — The gate now matches the docs bot in either login shape, so its exemption applies. Bot pull requests with no user-facing content no longer need a changelog entry. (#3603, #3448) - **Semantic-Version Release Branches** — Branch checks in CI and the npm script now accept documented release names such as `release/v1.2.3` and `release/v1.2.3-rc1`. ([#3555](https://github.com/lightspeedwp/.github/issues/3555)) From 9e2881e85d70cfd114d514f2600c9beb82a0936a Mon Sep 17 00:00:00 2001 From: Chris Date: Wed, 30 Sep 2026 06:23:38 +0200 Subject: [PATCH 5/5] fix: drop three remaining overclaims in the corrected wording CodeRabbit raised two findings on this pull request and both are correct, and a re-read of every sentence this branch adds turned up one more of the same kind. All three are fixed here. SC-002 named "spec 009's existing route" as the route empty `claude/*` branches follow. Checked in spec 009, that route does not exist. Its scenario at 009-audit-branch-cleanup/spec.md:66 sends branches with invalid names, naming `claude/*` among them, to DISCUSS, FR-006 requires the same, and the file contains no mention of auto-approval at all. The auto-approved deletion is conditional, defined by FR-020 in this spec, and lands only with the matching spec 009 amendment that 018's own assumptions record as delivered after #3358 merges. SC-002 now names the conditional route and the amendment instead. The Assumptions bullet made the same claim from the other side, saying the branches are "only removed once that deferral is lifted", which implies a removal route that already exists. It now states what 009 does today, DISCUSS, and that the auto-approved route lands with the amendment. The workflow comment claimed a file with an unrecognised genuine duplicate footer "is among" the remainder. The measurement cannot support that. measure-footer-shape.js flags a file on shape alone, `findShapeMultiples(content).count >= 2`, and separately counts known phrases via `matched.size`; it never establishes that a flagged file really holds a duplicate. The comment now says such a file "may be among them" and states plainly that nothing in the measurement confirms any flagged file really holds one. The same comment claimed the figures "match" the guide. The figures do match, but the guide labels that row "No known footer", the label this comment does not adopt, so the comment now says which label the guide uses rather than implying agreement on wording. Verification: actionlint clean and the workflow parses; the embedded node script parses and renders the notice unchanged; footer guard 0 affected and 0 blocks; spec 018 suite 41/41, governance 18/18, resolve-readme-files 14/14; spec numbering audit sequential 001 to 018, 18/18 naming and 18/18 spec.md; the changelog gate reports 10 failing entries against 10 on origin/develop, so the new-failure count is 0; Semgrep p/security-audit and p/secrets 0 findings over 4 files. markdownlint reports 4 MD046 issues, all present on origin/develop, and its blank-line insertion into the workflow frontmatter is reverted so the diff carries only the corrections above. --- .github/specs/018-claude-cloud-environment/spec.md | 4 ++-- .github/workflows/documentation.yml | 12 +++++++----- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/specs/018-claude-cloud-environment/spec.md b/.github/specs/018-claude-cloud-environment/spec.md index 31c8f93a56..11d864df0d 100644 --- a/.github/specs/018-claude-cloud-environment/spec.md +++ b/.github/specs/018-claude-cloud-environment/spec.md @@ -251,7 +251,7 @@ A maintainer can find, in the repository, the exact environment definition the t ### Measurable Outcomes - **SC-001**: 100% of branches pushed from cloud agent sessions on this repository pass the branch-name validator. This is measured over the first 30 days after rollout via the existing branch-validation metrics. -- **SC-002**: Zero new `chore/session-*` or `claude/*` branches with commits appear on the remote after rollout. Empty `claude/*` branches follow spec 009's existing route, and the 48-hour bound applies only once the FR-020 deferral is lifted and its automatic route is active; while the deferral holds no branch qualifies for automatic deletion and a branch that reaches DISCUSS has no removal path defined here, so no removal timeframe is claimed, which is a known consequence of the deferral rather than a target this spec meets by itself. +- **SC-002**: Zero new `chore/session-*` or `claude/*` branches with commits appear on the remote after rollout. Empty `claude/*` branches follow the conditional cleanup route defined by FR-020, subject to the matching spec 009 amendment, and the 48-hour success target applies only once the FR-020 deferral is lifted and its automatic route is active; while the deferral holds no branch qualifies for automatic deletion and a branch that reaches DISCUSS has no removal path defined here, so no removal timeframe is claimed, which is a known consequence of the deferral rather than a target this spec meets by itself. - **SC-003**: PR template fallback routing caused by agent-created branches drops to 0% (constitution goal for fallback routing). - **SC-004**: A team member without a saved environment selection can start a correctly configured session with zero manual configuration steps once the Owner has completed setup. @@ -267,7 +267,7 @@ A maintainer can find, in the repository, the exact environment definition the t - The platform's push protection allows pushing the session's current branch after it has been renamed. This was verified during the draft implementation. If the platform changes this, pushes from renamed branches fail loudly (the push is rejected, not redirected), CI branch validation still applies, and the verification steps (quickstart §4) catch it; the documentation lists it as a limitation. - The existing validator (`lib/validate-branch-name.js`) and `docs/BRANCHING_STRATEGY.md` are authoritative. They currently disagree on release names: the strategy documents `release/vX.Y.Z` and `hotfix/vX.Y.Z`, but the validator rejects them. Until the validator is fixed (a dependency outside this spec, on branch `fix/branch-validator-semver-release`), the guard and CI both refuse such branches, so FR-009's `main` rule can't be used for real release PRs. No changes to authorised types are in scope. - The default network level (Trusted) reaches every host the provisioning script needs. -- Empty `claude/*` branches left by the platform follow spec 009's scheduled cleanup; while FR-020's deferral holds none qualifies for automatic deletion, so they are only removed once that deferral is lifted. Existing `claude/*` branches that have commits are reviewed by maintainers through 009's DISCUSS category, not deleted automatically. +- Empty `claude/*` branches left by the platform are routed by spec 009's scheduled cleanup, which currently sends them to DISCUSS; the auto-approved deletion that would remove an empty one is the conditional route FR-020 defines, and it lands only with the matching spec 009 amendment. Existing `claude/*` branches that have commits are reviewed by maintainers through 009's DISCUSS category, not deleted automatically. - The cleanup requirements depend on spec 009 and lightspeedwp/.github#3358 (the categorisation library and scheduled workflow). They are delivered after #3358 merges, together with the matching amendment to spec 009. - Sessions opened with several repositories do not load repository-level protections. This is documented, not solved. - Threat model: the guard is designed to stop accidental non-compliance and the obvious self-bypasses (editing guard or settings files, or changing the switch in-session). It is not designed to resist a determined adversary using unusual shell constructions; CI branch validation and CODEOWNERS review are the final gate. diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index f0c31c10ed..b09d624476 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -432,11 +432,13 @@ jobs: # which 255 (28.4%) hold fewer than two distinct known footer phrases, # so it must never fail a build. That 28.4% is a share of flagged files, # not a false-positive rate; the remainder includes files with no known - # phrase and files with exactly one, a file with an unrecognised but - # genuine duplicate footer is among them, and a file with two or more - # known phrases is not independently confirmed, so no rate follows. - # Figures are from `npm run measure:footers:shape` and match - # docs/FOOTER_REMEDIATION_GUIDE.md. It exists to ask a human to look, and + # phrase and files with exactly one, and a file with an unrecognised + # genuine duplicate footer may be among them. Nothing here confirms that + # any flagged file really holds a duplicate, and a file with two or more + # known phrases is not independently confirmed either, so no rate follows. + # Figures are from `npm run measure:footers:shape`; the guide records the + # same figures under a "No known footer" label, which this comment does + # not adopt. It exists to ask a human to look, and # to surface footers whose wording is missing from footer-policy.js. See # issue #3451. if: always() && steps.range.outputs.enabled == 'true'