diff --git a/.hive/memory/anti-patterns.jsonl b/.hive/memory/anti-patterns.jsonl index cd9fb764..e7dcd8ca 100644 --- a/.hive/memory/anti-patterns.jsonl +++ b/.hive/memory/anti-patterns.jsonl @@ -36,3 +36,4 @@ {"ts":"2026-06-03T08:00:00Z","agent":"code-reviewer","domain":"async","pattern":"Calling tokio::sync::RwLock::blocking_read() or blocking_write() from inside an async Tokio task","why-bad":"blocking_read() parks the OS thread, which starves the Tokio executor: under any write-lock contention the entire runtime can deadlock; even without contention it reduces throughput. The on_batch FnMut closure inside WatchEngine::drive() is called from an async task — this is the exact failure mode.","instead":"Use try_read() for snapshot-and-continue semantics (skip the batch if briefly contended), or restructure to async read().await before entering the sync callback."} {"ts":"2026-06-03T09:11:30Z","agent":"orchestrator","domain":"release-governance","pattern":"release.yml auto-closes the release→main PR on every release without merging (v0.1.6–v0.1.18 all affected)","why-bad":"Creates orphan crates.io/npm/PyPI published versions with no corresponding git tag or main branch commit. Ceremony is left in a broken state requiring manual founder repair every single release. RELEASE_BOT_TOKEN was configured 2026-06-01 but merge step still fails silently and closes the PR.","instead":"Either (1) switch release.yml merge step from gh API to `git push origin release/vX.Y.Z:main` (direct branch push — requires branch protection bypass token), or (2) remove the auto-merge step entirely and let the ceremony script do the merge + tag + release, or (3) use gh pr merge --admin in the workflow with a token that has admin rights. Until fixed, the ceremony script is the only reliable repair path."} {"ts":"2026-06-03T19:56:48Z","domain":"git-workflow","pattern":"Committing directly onto local develop after a post-merge 'git checkout develop && pull' sync, because the next increment's branch was never created","why-bad":"Violates the Charter hard rule 'never commit to develop; all work via PR'. The sync step (checkout develop) silently leaves HEAD on develop, so the first commit of the next increment lands on develop. Caught here before push (origin/develop untouched), but a push would have bypassed PR + CI + Codex.","instead":"After merging a PR and syncing develop, IMMEDIATELY 'git checkout -b feature/' before any edit. Or check 'git branch --show-current' is not develop/main before the first commit of an increment."} +{"ts":"2026-06-04T15:00:00Z","domain":"memory-discipline","pattern":"MCP GitHub tool read prepends resource-reference prefix to file content","why-bad":"When reading files via mcp__github__get_file_contents, the tool prepends '[Resource from github at repo://...]' to the content. If the agent then writes this back to a file (e.g., decisions.jsonl), it rewrites existing lines, violating the append-only Charter constraint. Codex caught this as a P2 on PR #541.","instead":"When using mcp__github__get_file_contents to read memory files, strip the resource-reference prefix before any write-back. Better: use Read (local filesystem tool) for memory files that must stay append-only — never read-then-write memory via the MCP GitHub tool.","ref":"PR#541,Charter§5.3,CLAUDE.md Hard Rules"} diff --git a/docs/sprints/2026-Q2-pm-state.md b/docs/sprints/2026-Q2-pm-state.md index 98db4772..2afd3e66 100644 --- a/docs/sprints/2026-Q2-pm-state.md +++ b/docs/sprints/2026-Q2-pm-state.md @@ -5,7 +5,7 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo | Field | Value | |---|---| | PM | orchestrator (Hive AI agent) | -| Last updated | 2026-06-04 (PM dispatch v46 — Codex P1+P2 fixes on #541; v0.2.0 ceremony Steps 1+3+4 done; Step 2 (tag) awaits founder) | +| Last updated | 2026-06-04 (PM dispatch v46 — PR #541 merged (squash `e089b66a`); Codex P1+P2 fixed; security scan post-v0.2.0 CLEAN; Step 2 tag push awaits founder) | | Current sprint | **v0.2.0 ceremony STEPS 1+3+4 COMPLETE** — Step 1 ✅ (PR #523→main); Step 3 ✅ (crates.io published); Step 4 ✅ (PR #537 back-merge `4e60400f`); Step 2 (tag push) awaits founder. | | Active release branch | none — `release/v0.2.0` back-merged to develop ✅; Step 2 (tag) pending | | Next release target | **v0.2.1** — npm scope registration + E404 tightening (Issue #534), post-v0.2.0 backlog | @@ -179,11 +179,11 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo ## Live priorities (ordered) **P0 (v0.2.0 ceremony — founder action required):** -1. **Push tag `v0.2.0`** + publish GitHub Release (Step 2; Steps 1+3+4 already done ✅). +1. **Push tag `v0.2.0`** (Charter §5.12 Step 2 — sole remaining ceremony gate; Steps 1+3+4 done ✅). GitHub Release follows in the same UX action but is not a ceremony gate. 2. **Register `@aimasteracc` npm scope** on npmjs.com (Issue #534) — enables real npm publish for v0.2.1+. **P1 (quality — post v0.2.0 ceremony):** -4. **Security scan post-v0.2.0** — pending (run after ceremony complete). +4. ~~**Security scan post-v0.2.0**~~ — ✅ DONE (dispatch v46, CLEAN). 5. **Dogfood re-run** — RFC-0109 object shapes + RFC-0110 npm launcher + redb-as-default + watch --subscribe (8/8 CLI). 6. **RFC-0104 cold SLA numbers** — nightly `sla_ancestors_100k` for Charter §2 cold-open budget. 7. **Add NPM_TOKEN secret** to `npm` environment — enables npm publish on next release. @@ -202,10 +202,10 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo | Agent | Status | Current item | |---|---|---| -| founder | **action requested (P0)** | **(P0)** Push tag `v0.2.0` + create GitHub Release (ceremony Steps 2+3). **(P0)** Register `@aimasteracc` npm scope on npmjs.com (Issue #534). | -| PM | **DONE ✅** | v45: PR #537 merged (Step 4); #539/#540 closed; PM state + decisions.jsonl updated. | -| release | **WAITING** | v0.2.0 ceremony: Steps 1+4 ✅. Step 2 (tag) + Step 3 (GH Release) founder-gated. | -| security-reviewer | **P1** | Post-v0.2.0 scan pending (after ceremony). | +| founder | **action requested (P0)** | **(P0)** Push tag `v0.2.0` (Charter §5.12 Step 2 — only remaining ceremony gate). **(P0)** Register `@aimasteracc` npm scope (Issue #534). | +| PM | **DONE ✅** | v46: PR #541 merged (Codex P1+P2 fixed); security scan CLEAN; #542 open. | +| release | **WAITING** | v0.2.0 ceremony: Steps 1+3+4 ✅. Step 2 (tag push) founder-gated. | +| security-reviewer | **DONE ✅** | Post-v0.2.0 scan: CLEAN (dispatch v46). | | architect | **DONE ✅** | ADR-0009 ✅, ADR-0010 ✅. | | e2e-runner | **P1** | Dogfood re-run: RFC-0109 object shapes + RFC-0110 npm + redb-as-default + watch --subscribe. | | bench | **P1** | `sla_ancestors_100k` nightly for RFC-0104 cold SLA. | @@ -242,7 +242,30 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo ## Archive -### 2026-06-04 PM dispatch v45 (this run — PR #537 merged (Step 4); #539/#540 closed) +### 2026-06-04 PM dispatch v46 (this run — PR #541 merged; Codex P1+P2 fixed; security scan CLEAN) + +**Pre-flight:** CHARTER §2/§5.1/§5.10/§5.12/§5.13, _orchestrator, decisions tail-20, anti-patterns (1 new hit: MCP resource-prefix), PM state v45 (PR #541 open), v0.2 PRD. + +**Assessment:** +- 1 open PR: #541 (chore pm-dispatch-v45, CI 22/22 ✅ on original commit; 2 Codex findings open). +- 0 open issues. +- v0.2.0 ceremony: Steps 1+3+4 done; Step 2 (tag) awaits founder. + +**Actions taken:** +1. **Fixed Codex P2** (Hard Rule violation): reverted decisions.jsonl line 1 — MCP GitHub tool prepended resource-reference prefix to `DECISIONS_CONTENT_PLACEHOLDER`, rewriting an append-only line. Reverted. ✅ +2. **Fixed Codex P1** (ceremony tracking): corrected Step 3 label from "GitHub Release" (wrong) to "crates.io publish" (Charter §5.12 correct). Step 3 already done; Step 2 (tag) is sole remaining founder action. ✅ +3. **Replied to both Codex threads** on PR #541 (P1: fixed in `858af01`; P2: fixed in `858af01`). ✅ +4. **Security scan post-v0.2.0**: CLEAN — no secrets, unsafe blocks documented, no shell injection, npm launcher secure. ✅ +5. **Recorded anti-pattern**: MCP GitHub tool read prepends resource-reference prefix; use local Read tool for append-only memory files. ✅ +6. **Squash-merged PR #541** (commit `e089b66a`) — 19/19 CI ✅. ✅ + +**Escalations to founder:** +- **(P0)** Push tag `v0.2.0` (Charter §5.12 Step 2; Steps 1+3+4 done ✅). GitHub Release creation follows from the same UX action but is not itself a ceremony gate. +- **(P0)** Register `@aimasteracc` npm scope on npmjs.com (Issue #534). + +--- + +### 2026-06-04 PM dispatch v45 (PR #537 merged (Step 4); #539/#540 closed) **Pre-flight:** Read CHARTER.md §2/§5.1/§5.10/§5.12/§5.13, _orchestrator.md, decisions.jsonl tail-20, anti-patterns (no new domain hits), PM state v42 (from develop HEAD `4e60400f` post-#537 merge), v0.2 PRD.