Repository navigation
build(repo): retire the repository-local guards for flake, test and engine enforcers - #247
Merged
Merged
Conversation
…te the local guards The repository-local deno guards under scripts/guards/ and their helpers under scripts/lib/ are gone, with the guard:projects and test:scripts scripts that ran them. - single-plan (REPO-D2) now runs as `repo-checks single-plan` from the systemfsoftware flake, exposed as this flake's `repo-checks` output. `pnpm gate:repo` runs it inside check:ci and .husky/pre-push runs it per pushed ref. CI `check` fetches main's commit graph first, and a step plants two plans in a plumbing commit and requires exit 1. - The tarball-contents job is removed: the flake packs the committed tree with `pnpm pack` itself, so the comparison was one command against itself. - AGENTS.md, test/e2e/AGENTS.md, .changeset/README.md and the ledger solution doc now name the enforcer that holds each rule. The plan maps every guard to its enforcer or its drop reason.
The contract-version law the deleted guard read from git history now runs as a test of the product. It reads every contract document of stryker-js-cli-contract and stryker-js-plugin-interface from the released tarballs the workspace dogfoods (installed from .sfs-deps under aliases) and from the committed packages, and weighs them: - a committed document narrower than its release needs a declared next version (the package version raised by its pending intents) at the next major, or the next minor while the release is 0.x; - a narrower stream schema needs a higher stream version major; - a document's law is chosen by the members it declares, never by its file name, and a document that declares none fails by name; - a package whose committed version differs from its released tarball while an intent for it is pending fails as a stale baseline, so a lagging stryker-published pin cannot hide a member added in an unpinned release.
…invariants Reverted by the next commit. A contract member removed under a patch intent must turn the contract version law red, and a registry journey pointing at a missing file must turn the status closure red.
…journey invariants" This reverts commit ebd0fe6.
Pruning scripts/deno.json to what mutation-backstop.ts imports dropped @std/fs/ensure-dir and @std/encoding, which test/e2e/scripts/export-traces.ts and import-traces.ts resolve through the same config, so every e2e lane failed at Export telemetry.
- The contract version law no longer lets a version an unpinned release already raised clear a narrowing: while the released tarball lags the workspace version, any pending intent or any narrowed document refuses the comparison as a stale baseline. - The law's package list must equal the workspace packages whose manifest files field declares a contract directory, so a new contract package cannot go unweighed. - The status closure requires each registry journey's file to exist and no longer scans its source with a skip/only/todo regex, matching the plan's drop of that clause. - The CI plant runs through `pnpm gate:repo --head <planted>`, the script check:ci runs, instead of the repo-checks binary directly.
systemfsoftware-maker
changed the title
This was referenced Oct 9, 2026
![kiro-systemf[bot]](https://avatars.githubusercontent.com/u/172220390?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Conductor verdict: 10/10 green on 1fdacd4; each kept enforcer red on a planted violation in CI (single-plan step, contract law, status closure); review dispositions audited; hunt grep clean.
This was referenced Oct 9, 2026
ryanleecode
pushed a commit
that referenced
this pull request
Oct 10, 2026
…v0.4.0 (#265) #247 added three devDependencies to the published package.json after the v0.4.0 tag and recorded a none intent, so the packed content no longer matches the tag's recorded integrity and the release derive phase refuses with tag-integrity-mismatch. Replace the none intent with a patch intent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Retires every repository-local guard.
scripts/guards/andscripts/lib/are deleted with theguard:projectsandtest:scriptsscripts that ran them; no.claude/hooks/guard-*existed. Each invariant worth keeping is now held by the systemfsoftware flake'srepo-checks, a test of the product, or the engine itself (layer 2, #249). Nothing decides by a name, word or regex over source text.Old guard → enforcer → CI job
check-single-plan.tsdocs/plansrepo-checks single-planfrom the systemfsoftware flake, through this flake'srepo-checksoutput:pnpm gate:repoincheck:ci, and.husky/pre-pushcheck: stepGateruns it, steppnpm gate:repo fails on a change that adds two plansplants two plans in a plumbing commit and requires exit 1check-contract-versions.tspackages/stryker-js-cli-contract/tests/contract-version-law.integration.test.ts: committed documents against the released tarball the workspace dogfoods, law chosen by a member the document declares, a lagging baseline refused, packages weighed equal to those whose manifestfilesdeclarescontractcheck(pnpm test)check-e2e-manifest.ts(journey exists)test/e2e-core/tests/status-closure.integration.test.tscheck(pnpm test)check-verdict-semantics.ts(cache safety)check(pnpm test) on #249Dropped
check-verdict-semantics.ts(trailer discipline): the trailer only forced a hand-bumped integer; the engine digest is derived from the installed files.check-e2e-manifest.ts(path prefix, skip/only/todo marker): a path prefix and a marker regex are name heuristics; vitest refuses.onlyunderCIon its own.check-e2e-manifest.ts(notestscript, uncachedtest:e2e): atestscript would run container journeys in CIcheck, which has no LGTM or microVM, so it fails loudly; CIe2erestores no turbo cache.check-span-names.ts: a regex over callee names, and it certified nothing; the published taxonomy is not a superset of the emitted spans today, and making it one is a product change outside this unit.check-changelog-sections.ts: pnpm-release-management's release engine refuses anyversioning.changelog.storagebutrepository/registryand writes exactly one section per release.check-tarball-contents.sh: the flake tarballs arepnpm packof the committed tree, so the check compared one command against itself;release planverifies each tarball against its tag.Honest violations, shown in CI
check, steppnpm gate:repo fails on a change that adds two plans:repo-checks single-plan: violated … added: docs/plans/planted-a-plan.md … planted-b-plan.md, exit 1 required and observed.properties.configfrom the plugin-interface report schema under apatchintent and pointed a registry journey at a missing file. Run 37915084914, jobcheck, failed oncontract-version-law(pointer: /properties/config … must declare 16.0.0 or higher, declared: 15.0.1) and on bothstatus-closurescenarios. Commit f625c62 reverts it.