Repository navigation
Conversation
Refs #740. Recover C14/C15 planning and rescope dependencies. Planning-only exception: local cli-block2 rejects six changes with unsupported-sidecar-schema. Strict OpenSpec validation passed for all 12 touched changes. No runtime files changed; remote checks and merge protections remain unchanged.
Clarify trusted C14 execution and compatible publication, move governance first, retire the superseded R07 queue, and make optional assurance boundaries explicit. Validation: eight strict OpenSpec checks, scoped Markdown lint and diff checks pass. Planning-only cli-block2 exception retained: existing Requirements gate rejects six missing/unsupported sidecars. Remote checks and runtime policy are unchanged.
Triage PR #741 follow-up findings: regenerate trusted context per job, map effective governance gates, and remove stale optional blocker wording. Planning only. Strict validation passes for all three touched changes. Reuse the disclosed SKIP=cli-block2 exception for the unchanged legacy evidence gate; runtime enforcement remains unchanged.
Place optional-policy qualifiers in normative preflight requirements and ordinary-delivery scenarios so archival cannot discard their scope. Planning only; three strict OpenSpec validations pass. Reuse the disclosed SKIP=cli-block2 exception; runtime policy remains unchanged.
Refresh current core ownership and actual prerequisites when implementation starts; the recovered historical check cannot establish future readiness. Planning-only hook exception: SKIP=cli-block2.
Replace inherited C14 blocking contracts when C15 adopts schema 1.7. Keep reviewed implementation slices before trusted pilot and coordinated cutover. Strict changed-proposal validation passes; sequential C14/C15 merge projection succeeds. Existing canonical Purpose placeholders remain. Planning-only SKIP=cli-block2 exception is unchanged.
Separate historical checks from current planning validation without claiming implementation or CI readiness. Disclosed planning-only SKIP=cli-block2 remains unchanged.
Keep the existing ordinary-pass boundary explicit in R09, including non-strict XPASS and empty wasxfail metadata. Planning only; disclosed SKIP=cli-block2 remains unchanged.
Put reviewed integration and protected publication before trusted enforcement and release handoffs. Refresh C14 readiness and remove remaining optional-preflight dependency and authored-ledger contradictions from active plans. Six affected OpenSpec changes validate strictly; existing unrelated archive-target notices remain. Reuse the disclosed planning-only SKIP=cli-block2 exception; runtime policy unchanged.
Add paired workflow proposal for #742/#483 and align R09 current-run consumer boundaries, ownership and delivery dependencies. Validation: all 13 active PR changes pass strict OpenSpec; scoped Markdown, metadata readback and whitespace pass. Normal Block2 reports unsupported-sidecar-schema for R09 and workflow; retain the existing planning-only SKIP=cli-block2 exception. Runtime and remote required gates are unchanged.
Address reviewed C15 trusted activation and fresh worktree setup, exact preflight dogfood identities, and R09 matrix/retry uniqueness plus duplicate rejection. Three affected changes pass strict OpenSpec and scoped Markdown/whitespace. Existing planning-only cli-block2 exception retained; no runtime or remote gate changes.
Make current execution, optional history and producer status boundaries normative. Preserve additive serialization and producer ownership; align archive compatibility and inventory without implementing runtime code. Strict OpenSpec: all 13 touched active changes pass. Scoped Markdown and whitespace pass. Reuse the owner-authorized planning-only Block2 skip; legacy Requirements sidecar failure remains disclosed, not a passing gate.
Move workflow01 and its integration sections out of the lean-delivery PR while retaining generic current-run consumer boundaries and later review corrections. No history rewrite; planning-only disclosed SKIP=cli-block2 remains unchanged.
Clarify shared current execution identities from existing metadata, conditional preflight instructions, rollback acceptance and native archival. No new receipt protocol; planning-only disclosed SKIP=cli-block2 remains unchanged.
Advance the canonical protected green-check requirement to schema1.7 while preserving C14 trust and scenario coverage. Sequential C14/C15 merge projection passes. Planning-only disclosed SKIP=cli-block2 remains unchanged.
Validate the signed module against the resulting core version and repeat affected compatibility checks if either identity changes before publication. Planning-only disclosed SKIP=cli-block2 remains unchanged.
## Description Planning-only PRs that update multiple active OpenSpec changes pass the producer's classification but fail implementation review selection in the fresh consumer and final verifier. Five condition changes keep implementation approval records out of planned validation in all three stages. Every selected source is still validated, and independently regenerated plans must match. Implementation scope restrictions, execution/provenance checks, exact-head trusted authority and promotion verification remain intact. No CLI/API, signed module payload or dependency changes; no R09 activation. Fixes #745. Unblocks planning integration of #741; independent of the R09 policy redesign. OpenSpec: `fix-planning-evidence-multichange`. ## Type of Change - [x] Bug fix - [x] Test enhancement ## Validation - Actual workflow shell regression tests: two planning failures before implementation; existing implementation-scope protection passed. - Existing gate accepted genuine RED evidence at test-only commit `3e9a4ada2eed2a6a60427c3d5e517f33c5c92c79`, [run 35569603411](https://github.com/nold-ai/specfact-cli/actions/runs/35569603411). The passing preservation test remains in the regular regression suite, not the failing-proof selection. - All 29 affected workflow tests pass after the fix, including promotion verification coverage. - Strict OpenSpec, reproducible-delivery validation, lock consistency and BasedPyright in the worktree environment pass (zero type errors; existing warnings remain). - Normal signed-commit hooks pass without exceptions, using the supported separate documentation and Requirements fixtures. - Independent plan and implementation trust review found no remaining blocking issues. Remote checks remain authoritative. Merge this prerequisite only after approval and required checks; then refresh #741 against dev so its diff remains planning-only. Reverting the workflow commit restores the previous selection behavior.
Current Requirements delivery demands retained development history beyond current-run validation. This planning PR defines the R09 minimal-evidence migration, preserves independent producer outcomes, and reconciles optional-assurance dependencies plus core C14/C15 planning. Refs #740, #662, #679 and #680. Paired modules story: nold-ai/specfact-cli-modules#481; paired planning PR: nold-ai/specfact-cli-modules#482. All implementation stories remain open. Changes are planning documents only; executable code, runtime gates, signed assets, versions and remote enforcement are unchanged. The plan retains useful regression tests, current-candidate outcomes, trusted CI provenance, signatures, independent security and review. It removes mandatory historical RED ledgers, approval-comment loops, duplicate evidence suites and optional-preflight prerequisites from ordinary delivery. Current reconciliation needs no prior session receipt and does not grant local state protected authority. Delivery proceeds through reviewed governance preparation, signed module publication, reviewed core adoption/trusted pilot and coordinated repository/organization policy cutover with rollback. C14/C15 readiness, schema migration and trusted integration remain explicit. Harness workflow proposals are being separated into their own issue-linked PRs; they are not part of this PR's scope. Validation: scoped strict OpenSpec validations, Markdown, whitespace and applicable signature/version hooks pass across the review corrections. Existing canonical Purpose placeholders and unrelated archival-target notices are recorded rather than claimed repaired. No runtime implementation or full behavioral test completion is claimed. Known limitation: the legacy Requirements producer rejects six planning sources as unsupported-sidecar-schema; dependent execution lacks proof artifacts, and the organization authority rejects its current policy check. The previously disclosed planning-only SKIP=cli-block2 exception is retained locally; downstream Block2 review/contracts did not run. No Requirements/authority CI PASS is claimed, no evidence sidecars or transcripts were manufactured, and remote required checks/protections remain unchanged.
Refs #742. Planning artifacts only; preserve assurance, ownership, signed compatibility and unchecked implementation/trial tasks.
Refs #742. Planning artifacts only; preserve assurance, ownership, signed compatibility and unchecked implementation/trial tasks.
Refs #742. Planning artifacts only; preserve assurance, ownership, signed compatibility and unchecked implementation/trial tasks.
Core PR #755 fails on unchanged dev dependencies and a versioning fixture that stages Git metadata. This owner-authorized slice of #747 upgrades the five necessary frozen packages, restricts fixture staging to generated projects, and isolates the smoke fallback from inherited unverified seed caches. The Semgrep sentinel follows the lock while retaining its security floor, MCP and no-waiver checks. Frozen updates: PyJWT 2.15.1, urllib3 2.8.0, virtualenv 21.11.0, Semgrep 1.179.0 and python-discovery 1.6.0. Module/release identity, verifier dependencies, workflows, gate policy and trust exceptions are unchanged. **Signed final head:** `9ed629582d5bdfe4a93610178b95772f58a1c2a3`, tree `982b8ffe2f2e56c56f46340dff9328c8d090fdfd`. The isolated JWT probe tests the hash-pinned delivery wheel in a separate temporary target, retaining the trusted verifier's base environment. Frozen parent assertions verify its bound version, unchanged caller options and expiry on reuse. The cache probe preserves its process-boundary assertions. **Authenticated RED:** authored head `0f9d114be7e4fd70083d0c1a101590c2ab9ca06d`, Requirements run [37896570864](https://github.com/nold-ai/specfact-cli/actions/runs/37896570864), artifact 11600054315, ZIP byte digest `sha256:b30ddc50df79e0ceb1465baaec8f3ab8872f60e5b4f9c4d458c470651d4befa0`. The actual report passes RED with no findings. The selected tests, mapping and acceptance record remain unchanged through final publication. Earlier rejected snapshots are retained in TDD_EVIDENCE.md and are not substituted for this proof. **Validation:** published-head provenance and local native final reconciliation pass (verified maturity, zero findings). Twenty-five scoped tests pass. Ruff check/format, project BasedPyright (zero errors), scoped Markdown/YAML, selected strict OpenSpec, coherent export and lock checks pass. Self-review has zero blocking findings, with explicit dispositions for two baseline warnings, four unchanged AST suggestions and one probe-readability advisory. The unchanged reviewed graph previously passed both advisory gates, trust/licenses and fifteen security/control probes; current hosted gates and full-suite/matrix results remain independently required. All-change OpenSpec retains the known unrelated governance delta failure (39/40). Prior broad local runs had environment failures and nested Hatch graph drift; those results are not frozen delivery proof. Artifact screening retains provenance-verification and optional Semgrep Pro limitations. Upgrading cannot sanitize external previously compromised Hatch/user caches; this change does not purge shared caches. Current-head hosted final execution, exact-head human authority and completed required reviews remain necessary before integration. Refs #747 and #755. Original #748's broader consolidation stays open and unchanged. This slice does not close #747, archive the broad change or implement planned workflow runtime. After integration, refresh the internal wiki's merged/dependency status and rebuild its graph; its mirror was updated and rebuilt on the authoring host on 9 October 2026.
Keep harness planning separate from lean evidence delivery. Define exact signed Requirements v3 compatibility, independent producer outcomes, read-only verification and bounded resumable local/PR loops. Strict OpenSpec, scoped Markdown and whitespace pass. Retain the existing owner-authorized planning-only Block2 exception for these unchanged planning artifacts; legacy sidecar failure is not a green gate.
Preserve deferred workflow scope and authenticate the fresh security root. Refs #742
Align to current signed root and retain the verified consumer rejection until authentic finalized proof is available through protected integration. Refs #742
Preserve the immutable provider RED and approved legacy TDD bases without adding a transport-only policy restriction. Refs #760
Fix the existing docstring review warning without changing proof validation logic, authored controls or the 80% threshold. Refs #768
# Description Protective prerequisite for stack #759: the planning-child receipt passes planned reconciliation but is correctly rejected by the frozen Code Review provider as non-final execution proof. Authenticate and transport the genuine exact-root final artifact while retaining full inherited review against protected `dev`, complete provider validation and every required gate. Related: #760. OpenSpec: `fix-planning-review-proof-context`. Coherent bugfix version: 0.55.9. No merge is authorized; #719/#743/#751 remain unmerged. ## Type of Change - [x] Bug fix - [x] Test enhancement - [x] Documentation update ## Contract-First Testing Evidence Signed specification precedes corrected signed authored head `908bc3ad40f318e58e3596960be05335058f440e`. Genuine native RED run38314212556/artifact11776331094 reproduces two finalized-proof failures after the ordinary positive control passes; zero errors/skips/findings. Superseded run38313685016 failed a trusted-core import and is excluded from behavioral proof. Owner djm81 accepted canonical mapping `sha256:a0ec5078fe769838f653c4069b0cd5752b46a5d8038fcbb132564d38f7a85c5e` and authorized verified exact-head grants. Ordinary approved RED/legacy final contexts remain accepted. Synthetic boundary fixtures are test inputs, never published execution proof. Authored test SHA256 `0af9e8a14160498124e115e79ff0426291d32ee8eb5e54311b2101dea88318fd` remains unchanged through the current head. ## How Has This Been Tested? Current signed head `a692169a36f534c81cadff65ec42c0945a25e3e0` documents ten helper validation boundaries. Executable AST excluding docstrings is unchanged; all13 helper functions have docstrings. It corrects the real55.56% docstring warning without changing the80% threshold. CodeRabbit genuinely completed the preceding364dd781 review with no new actionable comments and zero unresolved threads; CodeRabbit completed current-head review at23:17:45UTC on2026-10-12, with no actionable comments and zero unresolved threads. Hosted docstring coverage now passes92.59% against the unchanged80% threshold. The complete local suite passes:3314 tests, nine skips, zero failures/errors in197.049s; all787 tracked inputs match the validated candidate snapshot. One previously skipped version-matches-HEAD check now runs and passes. Format/lint/YAML/contracts and frozen local helper/test review pass with zero findings. Canonical typing remains zero errors/1522 protected-baseline warnings. Normal signed hooks and literal-current-head retained-RED provenance pass. Existing frozen delivery/version/audit/trust/license/signature/security inputs and required policies remain intact; hosted gates run again on this exact head. Actual root archive11773232592/run38306990823 matches its genuine service digest and passes both transport integrity and the frozen provider final-context reader, preserving root57f51829/report bytes. This local compatibility probe does not replace native child proof. Fixed argv, literal executable/hostname and internal repository/numeric routes refute the tool's shell-injection warning; independent security gates remain required. Historical native final run38316675410/artifact11777665252 and all required CI passed at364dd781. Current-head producer/execution/final all pass in run38321075799. Final artifact11778328718 verifies service digest6fc3d56cffaddc91abd3f4e817f27b20a7c14e897331ce5342033794cd4f8c66, exact sourceRef/final stage, verified/pass/no proof findings and two passing controls. Authority run38321075557 passes its normal second attempt after verified djm81 grant6134427051. All13 effective required checks pass with exact expected integration IDs; all43 checks have37 success/six existing configured skips. All six PR commit signatures verify; GitHub reports CLEAN/MERGEABLE. Current-head CodeRabbit review is completed and the docstring check passes. Separate merge authorization remains required. Three unchanged promotion-fixture advisories retain their explicit protected-baseline exception in TDD evidence; no new findings or suppressions are accepted. ## Checklist - [x] Signed specification and accepted security controls - [x] Corrected genuine native authored RED retained - [x] Unchanged-test signed correction and literal-head provenance - [x] Complete local suite, local review and normal hooks - [x] Current-head native final proof and exact-head authority - [x] All required current-head CI - [x] Completed current-head review and corrected docstring check - [ ] Separate owner merge approval ## Risks and rollback Fail closed on changed live lineage, stale checks, foreign/corrupted artifacts and incomplete final proof. Retain protected helper trust, immutable provider pins, complete review scope and all authority/signature/execution checks. Rollback restores captured signed364dd781 using an exact lease; backup branch `codex/backup-planning-review-364` and coherent dependency/version artifacts are retained.
Record exact owner-accepted100 mapping and nine authored hashes. Preserve root/store observations and protected source for native RED.
Retain accepted100 selectors and all encoding observations. Add owned path-link fallback and legacy native suffix controls. Keep protected production unchanged for genuine native RED.
Check lexical roots and owned stores before and after verification. Preserve genuine signed bundles, canonical workspace aliases and fallback. Actual signed native100 RED precedes runtime and coherent0.55.10.
Record actual e4 native GREEN and exact-scope task completion. Retain historical receipts and pending exact-head/companion gates. Preserve accepted runtime, tests, mapping and dependency inputs.
# Description Module #481 remains In Progress, while paired #483 remains Todo as checked on 12 October 2026. Preserve the newer proposal already on dev and defer core runtime adoption until its signed module contract is implemented. **Refs** #742 **Contract References**: Planning-only contract research and dependency reconciliation. No future runtime execution or delivery completion is claimed. ## Type of Change - [x] 📚 Documentation update ## Contract-First Testing Evidence Strict OpenSpec and local planned Requirements validate the proposal. Existing completed evidence is preserved with its original scope. Runtime adoption requires its own spec, actual failing-first tests, implementation and passing exact-head evidence. ## How Has This Been Tested? Validate source proposals, current repository contents and paired implementation readiness. Prerequisites [#761](#761) and [#767](#767) are merged at protected dev `c6af68a0`. Signed #743 head `4d1e7429` follows signed security parent `57f51829`, whose [native Requirements](https://github.com/nold-ai/specfact-cli/actions/runs/38306990823) is verified with no findings and whose exact-head authority passes. Strict selected OpenSpec, documentation validation and unchanged-provider planned Requirements pass locally: one source, planned maturity, no findings. Hosted producer/execution/final verdict must independently authenticate inherited root proof with scoped tokens; those current-head checks remain pending. ## Checklist - [x] Verify planning scope and preserve completed work - [x] Keep deferred runtime tasks unchecked - [x] Signed branch history and owner-authorized exact-head grants - [x] Protected prerequisite integration and signed restacking onto the validated root - [ ] Final exact-head Requirements, required CI and review closure ## Quality Gates Status Current signed head: `4d1e7429c2dfb69e9d33a93bf554aed8aae6affd`. Normal applicable hooks passed and GitHub signature verification precedes the authorized new djm81 grant. No required execution, signature, authority, review or security gate is bypassed. Final current-head checks and review remain required. ## Stack Native [stack #759](https://github.com/nold-ai/specfact-cli/pull/759): `dev ← #719 security implementation ← #743 workflow planning ← #751 roadmap planning`. Leave all three stack PRs unmerged for owner review. The earlier planning consumer ancestry failure is corrected by protected #767. Current hosted consumers must independently validate that correction with the fresh root proof; no gate or trust boundary is weakened. Independent Code Review correctly rejected the planned receipt as non-final execution proof (run 38303860784). The reviewed local protective follow-up preserves full protected-dev review and authentic finalized root proof; exact acceptance, native proof and protected integration remain pending. Current inherited review gates stay enforced; this PR is not yet ready to merge.
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This was referenced Oct 16, 2026
chore(deps-dev): bump hatchling from 1.32.0 to 1.32.4 in the development-security-updates group
#766
Open
Contributor
SpecFact CLI Validation Report✅ All validations passed! |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| (tmp_path / "ci/runtime-smoke-fixture.lock.json").write_text(json.dumps({"commit": commit})) | ||
| monkeypatch.setattr(smoke, "REPO_ROOT", tmp_path) | ||
| (repo / "packages/specfact-project/ignored.py").write_text("raise RuntimeError('unreviewed')\n") | ||
| assert subprocess.check_output(["git", "-C", str(repo), "status", "--porcelain"], text=True) == "" |
|
|
||
|
|
||
| # Explicit stdlib-only entry point loaded from the protected Git archive. | ||
| PLANNING_RESOLVER: Callable[[dict[str, object], ApiReader], dict[str, object]] = _resolve_planning_context |
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepare the current development changes for promotion to
main. This PR is a draft and is not ready to merge or publish.The captured comparison is dev
729a53bdagainst main5262efb0. It includes #719's signed path-security fix, #743's workflow planning, and the earlier dependency consolidation. #751 is still open and is not included in dev.Blocking prerequisites remain.
ec702e40; all three current-head Requirements checks pass in run 38960072326. The owner approved its exact new authority grant, and Trusted Requirements Authority passes in run 38960072374 attempt 2. Other current-head hosted checks remain required. The review thread is resolved. Human disposition remains required.The named targets of #762, #764, #765, and #766 are covered in dev but still absent from main. Their incidental Ruby upgrades are not duplicates. Keep those PRs open until verified promotion or maintainer disposition. #763's JSON 3 migration is excluded because it downgrades Jekyll 4.4.1 to 4.3.4; dev retains JSON >=2.21.2,<3.
No merge, tag, package publication, or trust-policy relaxation is included. Closing this draft reverses the release preparation without changing source branches.