Skip to content

chore(pm): dispatch v46 — PR #541 merged; security scan CLEAN; anti-pattern recorded #542

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aimasteracc merged 2 commits into from
Jun 4, 2026
Merged

chore(pm): dispatch v46 — PR #541 merged; security scan CLEAN; anti-pattern recorded #542

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e9a568
chore(pm): dispatch v46 — PR #541 merged; security scan CLEAN
claude Jun 4, 2026
808f500
fix(pm): address Codex P2 findings on #542
claude Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .hive/memory/anti-patterns.jsonl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,4 @@
{"ts":"2026-06-03T08:00:00Z","agent":"code-reviewer","domain":"async","pattern":"Calling tokio::sync::RwLock::blocking_read() or blocking_write() from inside an async Tokio task","why-bad":"blocking_read() parks the OS thread, which starves the Tokio executor: under any write-lock contention the entire runtime can deadlock; even without contention it reduces throughput. The on_batch FnMut closure inside WatchEngine::drive() is called from an async task — this is the exact failure mode.","instead":"Use try_read() for snapshot-and-continue semantics (skip the batch if briefly contended), or restructure to async read().await before entering the sync callback."}
{"ts":"2026-06-03T09:11:30Z","agent":"orchestrator","domain":"release-governance","pattern":"release.yml auto-closes the release→main PR on every release without merging (v0.1.6–v0.1.18 all affected)","why-bad":"Creates orphan crates.io/npm/PyPI published versions with no corresponding git tag or main branch commit. Ceremony is left in a broken state requiring manual founder repair every single release. RELEASE_BOT_TOKEN was configured 2026-06-01 but merge step still fails silently and closes the PR.","instead":"Either (1) switch release.yml merge step from gh API to `git push origin release/vX.Y.Z:main` (direct branch push — requires branch protection bypass token), or (2) remove the auto-merge step entirely and let the ceremony script do the merge + tag + release, or (3) use gh pr merge --admin in the workflow with a token that has admin rights. Until fixed, the ceremony script is the only reliable repair path."}
{"ts":"2026-06-03T19:56:48Z","domain":"git-workflow","pattern":"Committing directly onto local develop after a post-merge 'git checkout develop && pull' sync, because the next increment's branch was never created","why-bad":"Violates the Charter hard rule 'never commit to develop; all work via PR'. The sync step (checkout develop) silently leaves HEAD on develop, so the first commit of the next increment lands on develop. Caught here before push (origin/develop untouched), but a push would have bypassed PR + CI + Codex.","instead":"After merging a PR and syncing develop, IMMEDIATELY 'git checkout -b feature/<next>' before any edit. Or check 'git branch --show-current' is not develop/main before the first commit of an increment."}
{"ts":"2026-06-04T15:00:00Z","domain":"memory-discipline","pattern":"MCP GitHub tool read prepends resource-reference prefix to file content","why-bad":"When reading files via mcp__github__get_file_contents, the tool prepends '[Resource from github at repo://...]' to the content. If the agent then writes this back to a file (e.g., decisions.jsonl), it rewrites existing lines, violating the append-only Charter constraint. Codex caught this as a P2 on PR #541.","instead":"When using mcp__github__get_file_contents to read memory files, strip the resource-reference prefix before any write-back. Better: use Read (local filesystem tool) for memory files that must stay append-only — never read-then-write memory via the MCP GitHub tool.","ref":"PR#541,Charter§5.3,CLAUDE.md Hard Rules"}
39 changes: 31 additions & 8 deletions docs/sprints/2026-Q2-pm-state.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo
| Field | Value |
|---|---|
| PM | orchestrator (Hive AI agent) |
| Last updated | 2026-06-04 (PM dispatch v46 — Codex P1+P2 fixes on #541; v0.2.0 ceremony Steps 1+3+4 done; Step 2 (tag) awaits founder) |
| Last updated | 2026-06-04 (PM dispatch v46 — PR #541 merged (squash `e089b66a`); Codex P1+P2 fixed; security scan post-v0.2.0 CLEAN; Step 2 tag push awaits founder) |
| Current sprint | **v0.2.0 ceremony STEPS 1+3+4 COMPLETE** — Step 1 ✅ (PR #523→main); Step 3 ✅ (crates.io published); Step 4 ✅ (PR #537 back-merge `4e60400f`); Step 2 (tag push) awaits founder. |
| Active release branch | none — `release/v0.2.0` back-merged to develop ✅; Step 2 (tag) pending |
| Next release target | **v0.2.1** — npm scope registration + E404 tightening (Issue #534), post-v0.2.0 backlog |
Expand Down Expand Up @@ -179,11 +179,11 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo
## Live priorities (ordered)

**P0 (v0.2.0 ceremony — founder action required):**
1. **Push tag `v0.2.0`** + publish GitHub Release (Step 2; Steps 1+3+4 already done ✅).
1. **Push tag `v0.2.0`** (Charter §5.12 Step 2 — sole remaining ceremony gate; Steps 1+3+4 done ✅). GitHub Release follows in the same UX action but is not a ceremony gate.
2. **Register `@aimasteracc` npm scope** on npmjs.com (Issue #534) — enables real npm publish for v0.2.1+.

**P1 (quality — post v0.2.0 ceremony):**
4. **Security scan post-v0.2.0** — pending (run after ceremony complete).
4. ~~**Security scan post-v0.2.0**~~ — ✅ DONE (dispatch v46, CLEAN).
5. **Dogfood re-run** — RFC-0109 object shapes + RFC-0110 npm launcher + redb-as-default + watch --subscribe (8/8 CLI).
6. **RFC-0104 cold SLA numbers** — nightly `sla_ancestors_100k` for Charter §2 cold-open budget.
7. **Add NPM_TOKEN secret** to `npm` environment — enables npm publish on next release.
Expand All @@ -202,10 +202,10 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo

| Agent | Status | Current item |
|---|---|---|
| founder | **action requested (P0)** | **(P0)** Push tag `v0.2.0` + create GitHub Release (ceremony Steps 2+3). **(P0)** Register `@aimasteracc` npm scope on npmjs.com (Issue #534). |
| PM | **DONE ✅** | v45: PR #537 merged (Step 4); #539/#540 closed; PM state + decisions.jsonl updated. |
| release | **WAITING** | v0.2.0 ceremony: Steps 1+4 ✅. Step 2 (tag) + Step 3 (GH Release) founder-gated. |
| security-reviewer | **P1** | Post-v0.2.0 scan pending (after ceremony). |
| founder | **action requested (P0)** | **(P0)** Push tag `v0.2.0` (Charter §5.12 Step 2 — only remaining ceremony gate). **(P0)** Register `@aimasteracc` npm scope (Issue #534). |
| PM | **DONE ✅** | v46: PR #541 merged (Codex P1+P2 fixed); security scan CLEAN; #542 open. |
| release | **WAITING** | v0.2.0 ceremony: Steps 1+3+4 ✅. Step 2 (tag push) founder-gated. |
| security-reviewer | **DONE ✅** | Post-v0.2.0 scan: CLEAN (dispatch v46). |
| architect | **DONE ✅** | ADR-0009 ✅, ADR-0010 ✅. |
| e2e-runner | **P1** | Dogfood re-run: RFC-0109 object shapes + RFC-0110 npm + redb-as-default + watch --subscribe. |
| bench | **P1** | `sla_ancestors_100k` nightly for RFC-0104 cold SLA. |
Expand Down Expand Up @@ -242,7 +242,30 @@ This file is the **live state** of the PM brain. Update on every cadence checkpo

## Archive

### 2026-06-04 PM dispatch v45 (this run — PR #537 merged (Step 4); #539/#540 closed)
### 2026-06-04 PM dispatch v46 (this run — PR #541 merged; Codex P1+P2 fixed; security scan CLEAN)

**Pre-flight:** CHARTER §2/§5.1/§5.10/§5.12/§5.13, _orchestrator, decisions tail-20, anti-patterns (1 new hit: MCP resource-prefix), PM state v45 (PR #541 open), v0.2 PRD.

**Assessment:**
- 1 open PR: #541 (chore pm-dispatch-v45, CI 22/22 ✅ on original commit; 2 Codex findings open).
- 0 open issues.
- v0.2.0 ceremony: Steps 1+3+4 done; Step 2 (tag) awaits founder.

**Actions taken:**
1. **Fixed Codex P2** (Hard Rule violation): reverted decisions.jsonl line 1 — MCP GitHub tool prepended resource-reference prefix to `DECISIONS_CONTENT_PLACEHOLDER`, rewriting an append-only line. Reverted. ✅
2. **Fixed Codex P1** (ceremony tracking): corrected Step 3 label from "GitHub Release" (wrong) to "crates.io publish" (Charter §5.12 correct). Step 3 already done; Step 2 (tag) is sole remaining founder action. ✅
3. **Replied to both Codex threads** on PR #541 (P1: fixed in `858af01`; P2: fixed in `858af01`). ✅
4. **Security scan post-v0.2.0**: CLEAN — no secrets, unsafe blocks documented, no shell injection, npm launcher secure. ✅
Comment thread
aimasteracc marked this conversation as resolved.
5. **Recorded anti-pattern**: MCP GitHub tool read prepends resource-reference prefix; use local Read tool for append-only memory files. ✅
6. **Squash-merged PR #541** (commit `e089b66a`) — 19/19 CI ✅. ✅

**Escalations to founder:**
- **(P0)** Push tag `v0.2.0` (Charter §5.12 Step 2; Steps 1+3+4 done ✅). GitHub Release creation follows from the same UX action but is not itself a ceremony gate.
- **(P0)** Register `@aimasteracc` npm scope on npmjs.com (Issue #534).

---

### 2026-06-04 PM dispatch v45 (PR #537 merged (Step 4); #539/#540 closed)

**Pre-flight:** Read CHARTER.md §2/§5.1/§5.10/§5.12/§5.13, _orchestrator.md, decisions.jsonl tail-20, anti-patterns (no new domain hits), PM state v42 (from develop HEAD `4e60400f` post-#537 merge), v0.2 PRD.

Expand Down
Loading