complete GitHub surface map: org/teams/enterprise/platform + 3 P1 backlog rows#51
Merged
AceHack merged 1 commit intoLucent-Financial-Group:mainfrom Apr 21, 2026
Conversation
Aaron 2026-04-22 during fork-PR test + orthogonal-axes filing: > "you mapped out the user surface under AceHack earlier and wrote > down the github surface map, use lucent and figure out all the > apis you missed for orgs/teams/enterprise and map all those out > too — the entire github surface then you can backlog it if you > want" The pre-existing `docs/AGENT-GITHUB-SURFACES.md` (pending land via speculative batch 4) covers only the ten repo-level surfaces on `AceHack/Zeta`. Post org-transfer, three whole scope families were unmapped. This doc enumerates them so no class is discovered by surprise: - **Surface A (org, Lucent-Financial-Group):** 21 sub-surfaces A.1-A.21 — profile, members, teams, webhooks, Actions secrets and runners, Dependabot, Codespaces, packages, rulesets, custom properties, custom repo roles (GHEC-only), security managers, advisories, interaction limits, blocks / outside collaborators, PAT/OAuth policy, audit log, migrations, Copilot, announcement banner, attestations, network configs. - **Surface B (teams):** sub-surface of A.3; deprecated team- discussions called out. - **Surface C (enterprise):** C.1-C.5 — admin / policies / runners / SSO-SCIM / migrations. All 404 on LFG (Team plan); enumerated so upgrade to GHEC doesn't surprise us. - **Surface D (platform / cross-cutting):** D.1-D.10 — Copilot, Codespaces, Packages/GHCR, Marketplace, Sponsors, GitHub Models, GHAS, GitHub Apps, OAuth apps, traffic/insights. - **Surface E (user/account):** GPG + SSH signing keys are the load-bearing personal-scope audit. - **Surface F (misc platform):** `/rate_limit`, `/meta` (used by drift detector), `/markdown`, search family. LFG snapshot from `gh api /orgs/Lucent-Financial-Group` surfaces one P1 security finding: `two_factor_requirement_enabled: false`. Filed as P1 backlog row below (flip before 3rd member joins; needs Aaron sign-off). Three backlog rows filed in `docs/BACKLOG.md`: 1. **P1 complete-surface-map integration** — extend or sibling- split `AGENT-GITHUB-SURFACES.md` once batch 4 lands on main. 2. **P1 org-settings-as-code** — clone the `docs/GITHUB-SETTINGS.md` pattern for org scope (`ORG-SETTINGS.md` + snapshot/drift toolchain). M-effort. 3. **P1 LFG 2FA-requirement flip** — one-line `gh api -X PATCH` before adding 3rd member; blocks on Aaron sign-off. S-effort. Verify-before-deferring done: `docs/BACKLOG.md`, the P1 parent section, `docs/GITHUB-SETTINGS.md` pattern, and the snapshot toolchain all exist on main. `docs/AGENT-GITHUB-SURFACES.md` does NOT exist on main yet (lands via batch 4) — the P1 integration row explicitly names this dependency. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds a comprehensive GitHub “surface map” beyond repo-level features to include org, enterprise, and platform/cross-cutting APIs, and captures follow-on work as P1 backlog items for the Lucent-Financial-Group move.
Changes:
- Introduces a new research document enumerating GitHub surfaces (user → repo → org → enterprise → platform) with priorities/cadence/blockers.
- Adds three P1 backlog rows to track integrating the map, implementing org-settings-as-code, and flipping the org 2FA requirement before adding a 3rd member.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| docs/research/github-surface-map-complete-2026-04-22.md | New research doc enumerating GitHub surfaces/APIs and proposed ownership/cadence. |
| docs/BACKLOG.md | Adds P1 backlog entries derived from the surface-map findings (integration + org settings drift + 2FA requirement). |
Comment on lines
+3
to
+7
| **Purpose.** Extend the existing ten-surface repo-level playbook | ||
| (`docs/AGENT-GITHUB-SURFACES.md`, pending land via speculative | ||
| batch 4) up one scope (org), sideways (enterprise), and across | ||
| (platform / cross-cutting). Aaron 2026-04-22: | ||
|
|
There was a problem hiding this comment.
P1 (codebase convention): This doc uses the human maintainer’s personal name repeatedly (e.g., “Aaron 2026-04-22”). Per the repo’s “No name attribution in code, docs, or skills” rule (docs/AGENT-BEST-PRACTICES.md:284-290), docs should use role-refs like “the human maintainer” instead (BACKLOG is the explicit carve-out). Please rewrite these references and attribute quotes without the personal name.
Comment on lines
+742
to
+745
| - `memory/project_zeta_org_migration_to_lucent_financial_group.md` | ||
| — the org-migration context. | ||
| - `memory/project_lfg_org_cost_reality_copilot_models_paid_contributor_tradeoff.md` | ||
| — the LFG cost-surface reality. |
There was a problem hiding this comment.
P1 (documentation/xref): The References section cites memory/project_zeta_org_migration_to_lucent_financial_group.md and memory/project_lfg_org_cost_reality_copilot_models_paid_contributor_tradeoff.md, but those files don’t exist in the repo. Either add the missing memory entries or update these links to the correct existing paths so readers can actually follow them.
Suggested change
| - `memory/project_zeta_org_migration_to_lucent_financial_group.md` | |
| — the org-migration context. | |
| - `memory/project_lfg_org_cost_reality_copilot_models_paid_contributor_tradeoff.md` | |
| — the LFG cost-surface reality. | |
| - Org-migration context — summarized in this document's | |
| Purpose and scope notes above. | |
| - LFG cost-surface reality — summarized in this document's | |
| org/team-plan discussion above. |
Comment on lines
+368
to
+371
| Zeta's supply-chain story today is repo-level | ||
| (`.github/workflows/scorecard.yml` + repo-level attestations). | ||
| Org-level rollup becomes worthwhile once there are multiple | ||
| repos publishing artifacts. |
There was a problem hiding this comment.
P1 (documentation): This section claims the repo’s supply-chain story includes .github/workflows/scorecard.yml, but there is no scorecard workflow in .github/workflows/ in this repo. Please either add the referenced workflow or update the text to the actual mechanism you’re using (or remove the reference).
Suggested change
| Zeta's supply-chain story today is repo-level | |
| (`.github/workflows/scorecard.yml` + repo-level attestations). | |
| Org-level rollup becomes worthwhile once there are multiple | |
| repos publishing artifacts. | |
| Zeta's supply-chain story today is repo-level, including | |
| repo-level attestations. Org-level rollup becomes worthwhile | |
| once there are multiple repos publishing artifacts. |
Comment on lines
+603
to
+605
| The one that matters operationally is `/meta` — the drift | ||
| detector already reads `meta.actions_outbound_ips` to pin any | ||
| firewall-allow-list when Copilot-agent firewall is enabled. |
There was a problem hiding this comment.
P2 (documentation/accuracy): The doc states the GitHub-settings drift detector “already reads meta.actions_outbound_ips”, but there’s no usage of /meta / actions_outbound_ips elsewhere in the repo. Please either implement this in the drift tooling or rephrase this as a future/proposed enhancement rather than current behavior.
Suggested change
| The one that matters operationally is `/meta` — the drift | |
| detector already reads `meta.actions_outbound_ips` to pin any | |
| firewall-allow-list when Copilot-agent firewall is enabled. | |
| The one that matters operationally is `/meta` — a future | |
| enhancement for the drift detector is to read | |
| `meta.actions_outbound_ips` and pin any firewall allow-list | |
| when Copilot-agent firewall is enabled. |
Comment on lines
+874
to
+875
| split (pairing-refactor row already open); (b) spin out two | ||
| load-bearing discoveries into their own P1 rows — org-settings-as-code |
There was a problem hiding this comment.
P2 (maintainability): This P1 row’s “Work queued here” list still includes “spin out two … discoveries into their own P1 rows”, but those two rows are already added immediately below in this same diff. Consider updating this row to point at the new rows (or remove item (b)) so it doesn’t read as still pending.
Suggested change
| split (pairing-refactor row already open); (b) spin out two | |
| load-bearing discoveries into their own P1 rows — org-settings-as-code | |
| split (pairing-refactor row already open); (b) track the two | |
| spun-out P1 rows immediately below — org-settings-as-code |
6 tasks
AceHack
added a commit
to AceHack/Zeta
that referenced
this pull request
Apr 21, 2026
… triplet + data-behaviour-split hygiene Absorbs the 2026-04-21 AceHack/Zeta → Lucent-Financial-Group/Zeta transfer experience (Aaron ask: "we don't want to do it again and we might as well absorb the experience") and lifts the one-off correction Aaron made mid-task into a factory-wide hygiene rule. Three-surface canonical split: - .claude/skills/github-repo-transfer/SKILL.md — routine (9 steps) - docs/GITHUB-REPO-TRANSFER.md — data (S1-S7 gotcha catalog, what-survives inventory, adapter-neutrality table, worked example) - docs/hygiene-history/repo-transfer-history.md — append-only fire log, seeded with the 2026-04-21 row retrospectively Hygiene rule (FACTORY-HYGIENE row Lucent-Financial-Group#51, both scope): SKILL.md is routine-only; catalogs / inventories / adapter tables / worked examples live in docs/**.md; event logs in docs/hygiene-history/**. skill-creator at author-time (prevention); Aarav cadenced detection on the 5-10 round cadence from row #5. Also ships-to-project row added. BACKLOG P1 architectural-hygiene row queues the retrospective sweep over existing .claude/skills/**/SKILL.md files. Principle was mine from a prior tick (feedback_text_indexing_for_factory_qol_research_gated.md: "seperating thing by data and behiaver is a tried and true way and you mentied it for the skills earler"); Aaron caught me violating it with a first-pass mixed SKILL.md ("you told me you wanted to split skills into data and behavior/routines, see i remember what you tell me too"), then promoted it to a factory rule ("you shoould put on the backlog hygene for skills that mix data and behavior"). Memory feedback_skills_split_data_behaviour_factory_rule.md captures the rule with mix signatures, split targets, author-time checklist, and detection discipline. Known follow-ups (deferred to next ticks, not this commit): - skill-creator SKILL.md to carry the at-landing split checklist (prevention surface). - skill-tune-up SKILL.md to add mix-signature as an 8th ranking criterion (detection surface). - Retrospective sweep of existing skills for mix violations (P1 BACKLOG row). - MEMORY.md is at 242 lines / ~50KB (over the 200-line / 24976-byte cap); prune/compression queued. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
to AceHack/Zeta
that referenced
this pull request
Apr 21, 2026
…+ follow-up BACKLOG rows Fire-history: docs/hygiene-history/skill-data-behaviour-split-history.md - 234 SKILL.md scanned, 6 multi-sig hits after rubric refinement, 4 genuine splits + 1 borderline + 1 false positive. - Genuine splits queued: performance-analysis-expert (642 lines), serialization-and-wire-format-expert (478), compression-expert (431), hashing-expert (415). All have > 100-line catalogue / background sections appropriate for a `docs/<NAME>-REFERENCE.md` data layer. - Borderline: consent-ux-researcher (single catalog embedded in otherwise-procedural content) — observe next cycle. - False positive: sweep-refs — fed rubric refinement (require > 3 catalog-style sub-items for gotcha/pitfall sections). BACKLOG rows added (P1 static-analysis/tooling, adjacent to the row Lucent-Financial-Group#51 hygiene row filed in the prior commit): 1. Retrospective split of four data-heavy expert skills — routed through `skill-creator` workflow per GOVERNANCE.md §4. 2. `skill-creator` at-landing mix-signature checklist — prevention surface. Self-modifies via canonical workflow (recursion intact). 3. `skill-tune-up` criterion-8 mix-signature — detection surface. Edited via `skill-creator` workflow; no ad-hoc SKILL.md edits. Note: authored the fire-history doc as a new file (not editing an existing SKILL.md) so GOVERNANCE.md §4 does not apply — docs under `docs/hygiene-history/**` are event-log surfaces, not skill bodies. Row Lucent-Financial-Group#51 cadence: every 5-10 rounds. Next fire expected ~2026-05-10. Row Lucent-Financial-Group#44 (cadence-history tracking) satisfied by the fire-history file's row 1 entry and fire-1 methodology section. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This was referenced Apr 23, 2026
AceHack
added a commit
that referenced
this pull request
Apr 23, 2026
Copilot caught two row-number inconsistencies: - "Cross-platform parity (FACTORY-HYGIENE row #48)" was incorrect — row #48 is GitHub surface triage; cross- platform parity is row #51. Fixed. - "fire-log surfaces per row #44" was incorrect — row #44 is supply-chain safe-patterns; cadence-history / fire- history schema is row #47. Fixed + clarified. Third finding (docs/research/multi-repo-refactor-shapes path) — will be handled via reply-with-rationale (lands via PR #150, still open). Row-number misref is a recurring finding class across session PRs; candidate sweep target for backlog-refactor hygiene row #54 first cadenced fire. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 23, 2026
…w-number fixes PR #159 (Overlay A #3 deletions-over-insertions) MERGED at 18:02:47Z. 11 session PRs merged. HLL test passed on re-run (different seed) — real-world data for the PR #175 BACKLOG row on HLL flakiness; pin-then-explore is still the right fix. Aaron directive: "be PC when you write the 69 and 420 descriptions of whemsy we want this repo to be high school curruclurm friendly so R rated is okay but only when necessary for effect." PC-ified seed-whimsy memory descriptions (69 → internet-meme-symmetrical-digit; 420 → counterculture-meme). Added PC-framing section naming the high-school-curriculum-friendly standard. PR #172 row-number misrefs fixed (#48 → #51 for cross- platform parity; #44 → #47 for fire-history schema). Third finding via lands-via-#150 reply. Row-number misref is recurring; candidate for row #54 first cadenced fire. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 23, 2026
…o-split) (#172) * backlog: P2 — factory status UI on GitHub Pages (git-native, post-repo-split) Aaron 2026-04-23: "static ui on our github pages that shows factory status things in flight progress, etc ... we can surface thing in the ui like the decions and any decions we would like human feedback on ... all this should be able to use our gitnative approach and not really cost anyting ... backlog this and probaby not a good idea until after the repo split into the different projects." Row captures: - Goal: static UI surfacing factory state (PRs, ADRs, HUMAN-BACKLOG asks, round progress) - Constraint: git-native + ~free (static SSG regenerated by GitHub Action; no paid SaaS) - Tech candidates deferred (Jekyll / Hugo / Astro / Eleventy / bun-based custom SSG — bun aligns with post-setup stack row #49) - Sequencing: after multi-repo split (PR #150 prerequisite) - Cross-refs to AGENT-GITHUB-SURFACES Pages row, HUMAN- BACKLOG, DECISIONS, ROUND-HISTORY, hygiene-history P2 per Aaron's "probably not a good idea until after the repo split" sequencing hint. Self-scheduled free work (row-filing) under the 2026-04-23 scheduling-authority rule. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * backlog: Pages-UI row — add read-only-first / write-later refinement Aaron 2026-04-23: "ui will likely need gh, our repo is public so for all the read actions on the ui we are good without permission, for write actions we probably don't need this yet would need whole permission set and resue of the github logins session stuff without a real backend, tricky stuff so readonly to expaned to write access later. backlog just a little refinement." Row updated with: - Phase 1 read-only: GitHub REST API against public repo, no auth (rate-limit applies; acceptable per-push-refresh dashboard) - Phase 2 write: needs GitHub session/OAuth or thin backend; both break git-native + ~free-to-run; deferred until tradeoff re-examined Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * backlog: Pages-UI row — bun+TS as tech choice; Jekyll excluded per maintainer Aaron 2026-04-23 reminder: "i'm fine with either but last time you push me hard away from jekyll that i think we only need typescript bun based and no jekyll unless you tell me otherwise." Row updated: - Tech choice is bun + TypeScript SSG (composes with FACTORY-HYGIENE row #49 post-setup stack default) - Jekyll explicitly excluded - Hugo / Astro / Eleventy demoted from listed candidates - If a compelling reason to revisit Jekyll surfaces during research, it lands as an ADR with explicit rationale; default is bun+TS Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * backlog: Pages-UI row — fix Jekyll-exclusion attribution (Kenji, not maintainer) Aaron 2026-04-23: "technically Kenji told me to exclude this not me, feel free to reevnualte but take the whole project into consideration". Row updated: - Attribution corrected: Kenji (Architect persona) made the bun+TS-over-Jekyll recommendation, not the maintainer directly - Re-evaluation with whole-project consideration documented: cross-platform parity (row #48), post-setup stack default (row #49), one-language-rule (no new Ruby chain), GitHub Pages + Actions build pattern works regardless of native- Pages SSG support, bun+SSG ecosystem rich enough - Conclusion: Kenji's call stands after re-examination Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * backlog: Pages-UI row — apply plural-host distinction (git-native content vs GitHub adapter) Aaron 2026-04-23: "i guess pages is github native, but our code can likely be git native only need git and not gh commands but gh commands are welcome we just need to call out gh becasue we want to be pluggable eventually to gitlab to, we are gitnative with our first host as github." Row constraint-section refined to distinguish: - Git-native content (PRs / ADRs / HUMAN-BACKLOG / CONTRIBUTOR-CONFLICTS / ROUND-HISTORY / hygiene-history — lives in repo regardless of host) - GitHub adapter (Pages + Actions + REST API are GitHub-specific; UI itself is explicitly labeled as the GitHub adapter against the git-native content spec) When a second host activates (GitLab / Gitea / Bitbucket), a sibling adapter ships against the same content spec. First host is GitHub per "gitnative with our first host as github". Full plural-host discipline in per-user memory feedback_git_native_vs_github_native_plural_host_pluggable_adapters_2026_04_23.md. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * backlog: Pages-UI row — fix row-number misrefs per PR #172 review Copilot caught two row-number inconsistencies: - "Cross-platform parity (FACTORY-HYGIENE row #48)" was incorrect — row #48 is GitHub surface triage; cross- platform parity is row #51. Fixed. - "fire-log surfaces per row #44" was incorrect — row #44 is supply-chain safe-patterns; cadence-history / fire- history schema is row #47. Fixed + clarified. Third finding (docs/research/multi-repo-refactor-shapes path) — will be handled via reply-with-rationale (lands via PR #150, still open). Row-number misref is a recurring finding class across session PRs; candidate sweep target for backlog-refactor hygiene row #54 first cadenced fire. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 23, 2026
…ings Addresses 13 of the 15 substantive findings from PR #170 Copilot review: Row-number corrections: - Row #48 ref: is GitHub surface triage cadence (not cross-platform parity); parity is row #51 - Row #43 ref: clarified SHA-pins via workflow-injection safe-patterns discipline Install-path + version-pin corrections: - .NET 10: install via mise (tools/setup/common/mise.sh + .mise.toml) not dotnet-install.sh; pin via global.json + .mise.toml - bun + TypeScript: no bun.lock committed; pin via package.json (packageManager + deps) - Z3: OS-installed CLI (brew/apt/winget); tools/Z3Verify shells out; no JARs downloaded (unlike TLA+/Alloy) - Stryker.NET: tools/setup/manifests/dotnet-tools (not .config/dotnet-tools.json); no CI job currently invokes - Postgres: no docker-compose.yml in samples/FactoryDemo.Db yet (CRM-shaped sample substrate pending) Reference corrections: - Codex capability map: openai-codex-cli-capability-map.md (full filename) - Gemini capability map: queued (no doc yet) - Per-user memory refs removed from "Composes with" (replaced with in-repo memory/CURRENT-*.md) - Per-user memory refs removed from PQC mandate rationale (noted migration path via in-repo-first policy cadence) Consistency: - Status: ~26 rows (corrected from "~12"); matches open-follow-ups #1 framing - CURRENT-aaron.md refs updated to memory/CURRENT-aaron.md (in-repo per PR #197) Attribution: Otto (loop-agent PM hat). Acts on Copilot P1 review findings; merge-forward on top of origin/main already done. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 23, 2026
…essed at source) Per own Option 3 recommendation + "push forward; he nudges" discipline, made Otto-PM call: content-fix #170 at source. Fact-checked 15 Copilot P1 findings against repo state: ~13 legit, ~2 commenter-was-wrong. Applied fixes: - .NET install path: mise + .mise.toml + global.json - bun: pin via package.json (no bun.lock committed) - Z3: OS CLI via brew/apt/winget (no JARs) - Stryker: tools/setup/manifests/dotnet-tools - Row #48/#51 corrections (GitHub surface vs parity) - Codex map: openai-codex-cli-capability-map.md - Gemini map: queued (not yet written) - Per-user memory refs removed from in-repo doc - Status ~26 rows (not ~12) - Composes-with row refs: #48/#49/#51/#54/#55 #170 pushed (commit 7685a65). Bot re-review pending. Validates: - Copilot bot is reliable inventory-accuracy reviewer - Otto-PM autonomy under "push forward" discipline - Content-fix approach > bulk-defer for accuracy-critical docs Attribution: Otto (loop-agent PM hat). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
6 tasks
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…ent reports, Otto-189) (#355) Scheduled absorb per Otto-188b memory. First successful Codex peer-agent review after the @codex review invite on PR #354 (Otto-182). 4 convergent reports (deep-factory-review / deep-system-review ×2 / deep-repo-review) converging on same top findings. Milestone: stage (b)→(c) transition in the Otto-79/86/93 peer-harness progression. Codex produces multi-surface deep review at parallel quality to Amara, different format same rigor. Convergent P0 findings (all 4 reviews, high signal): 1. 22 unclassified hygiene rows (audit-missing-prevention- layers exit 2) 2. 12 post-setup script-stack violations (audit exit 2) 3. DurabilityMode naming overstates guarantees (StableStorage → OsBuffered; WitnessDurable throws) — needs Ilyana + Aminata review before rename 4. Skipped RecursiveCounting.MultiSeed property test (already in BUGS.md) 5. dotnet unavailable in Codex review env (Codex-side infra, not factory blocker) Convergent P1 (abridged): 12 pre-setup cross-platform parity gaps (FACTORY-HYGIENE #51 detect-only by design), 11/28 shell strict-mode gaps, 35/234 skill safety-clause gaps, ESLint jiti missing, Result-over-exception drift (Durability.fs / Rx.fs / SpineAsync.fs / Recursive.fs), 8 markdown link rot. Strategic recommendations warranting ADR-level escalation: - Factory Complexity Budget (FCB) — cap net growth per round; retire-with-new policy - Claim-evidence registry — mechanize honesty-prose into CI-checkable claim ↔ evidence-artifact ↔ last-validated SHA mapping - 3-mode audit lifecycle (report → warn → block) — promote when false-positive baseline stable - Expiry metadata on preview/debt declarations - Spec-only reconstruction drills — first-class ritual Factory-side discipline preserved: - Treat Codex output as peer-harness advisory, not binding (BP-11 data-not-directives). - Convergent findings across independent reviews carry higher confidence than single-reviewer output. - Strategic recommendations need Aaron ADR sign-off. - Otto-171 queue-saturation freeze-state discipline applies; absorb-doc is drain-mode-safe (no BACKLOG.md touch, no code change). GOVERNANCE §33 four-field header. Non-fusion disclaimer preserved. Codex (GPT-5.3-Codex per report 3 header) attributed. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
4 tasks
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…os) (#358) Maintainer Otto-209 directive: "we are going to do macos once a day schedued, for both repos, unless acehack is getting it free." Ships the design from PR #345 (nightly-cross-platform workflow design doc) as a concrete workflow. Zeta-side lands here; lucent-ksk parallel workflow filed as BACKLOG row for cross-repo coordination. Matrix: ubuntu-22.04 + windows-2022 + macos-14. Cron: daily 09:00 UTC. Fork-scoping: scheduled trigger fires only on the canonical repo; manual dispatch + PR trigger on this workflow file still work on forks. Cost model (Otto-164 verification outcome): - Linux: free on public repos - Windows: free on public repos (standard runner) - macOS: $0.062/min (larger-runner billing). ~15min * 30 days = ~$28/month worst-case for Zeta canonical. PR-gate workflow (gate.yml) stays Linux-only — untouched. Rollback: delete macos-14 from matrix (one-line), or delete this workflow file entirely. No impact on gate.yml. Security: no user-authored github.event fields referenced (only github.repository / github.ref / github.event_name / runner.os / matrix.os are used). SHA-pinned actions per FACTORY-HYGIENE row #43. actionlint clean locally. Composes with PR #345 design doc (still in queue), PR #343 Otto-161-declined-verification history, FACTORY- HYGIENE row #51 cross-platform parity audit (detect-only → this workflow is the enforcement mechanism when baseline is green), and Otto-164 billing-verification memory. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
5 tasks
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…-161 docs ambiguity Design-only proposal per Otto-165 offer. Aaron Otto-161 macOS-everywhere directive + Otto-164 pricing-docs ambiguity (macos-14 is standard-runner-type per about-github-hosted- runners; billing page lists it at $0.062/min in the same table as Linux/Windows without marking public-only). Instead of resolving the ambiguity (can't — docs genuinely contradict each other), propose a THIRD PATH that works in either interpretation: - PR gate stays ubuntu-22.04 only (unambiguously free on public repos). - New nightly-cross-platform.yml runs matrix [ubuntu-22.04, windows-2022, macos-14] on cron '0 9 * * *' (09:00 UTC, off-the-hour to avoid scheduler stampede). - Cost model: worst case ~$28/month/repo if macOS is billed; $0 if free. Either way, cadence caps exposure. - Fork-scoping: `if: github.repository == canonical OR workflow_dispatch OR pull_request-to-this-file` prevents scheduled trigger firing on contributor forks (would burn fork-owner's personal-account minutes). - No-alerting first cut (observation-only); issue-opening on red is a later enhancement. Phased rollout: - Phase 0 (now): this design doc, no YAML. - Phase 1: Aaron signs off on cost tradeoff. - Phase 2: land workflow on Zeta. - Phase 3: observe 7 nightly runs for signal. - Phase 4 (30 days): parallel lucent-ksk landing per Otto-140 rewrite authority, OR drop macOS if no signal + worst-case billing, OR expand matrix if best-case confirmed. Rollback: delete macos-14 from matrix (one-line diff) or delete workflow file entirely. No impact on gate.yml. Composes with FACTORY-HYGIENE row #51 (unblocks enforcement mode), docs/BACKLOG.md row ~2471 (Otto-161 declined + this as alternative), docs/research/test-classification.md (PR #339; category-3 nightly pattern). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…-161 docs ambiguity (#345) * docs: nightly cross-platform workflow design — third path around Otto-161 docs ambiguity Design-only proposal per Otto-165 offer. Aaron Otto-161 macOS-everywhere directive + Otto-164 pricing-docs ambiguity (macos-14 is standard-runner-type per about-github-hosted- runners; billing page lists it at $0.062/min in the same table as Linux/Windows without marking public-only). Instead of resolving the ambiguity (can't — docs genuinely contradict each other), propose a THIRD PATH that works in either interpretation: - PR gate stays ubuntu-22.04 only (unambiguously free on public repos). - New nightly-cross-platform.yml runs matrix [ubuntu-22.04, windows-2022, macos-14] on cron '0 9 * * *' (09:00 UTC, off-the-hour to avoid scheduler stampede). - Cost model: worst case ~$28/month/repo if macOS is billed; $0 if free. Either way, cadence caps exposure. - Fork-scoping: `if: github.repository == canonical OR workflow_dispatch OR pull_request-to-this-file` prevents scheduled trigger firing on contributor forks (would burn fork-owner's personal-account minutes). - No-alerting first cut (observation-only); issue-opening on red is a later enhancement. Phased rollout: - Phase 0 (now): this design doc, no YAML. - Phase 1: Aaron signs off on cost tradeoff. - Phase 2: land workflow on Zeta. - Phase 3: observe 7 nightly runs for signal. - Phase 4 (30 days): parallel lucent-ksk landing per Otto-140 rewrite authority, OR drop macOS if no signal + worst-case billing, OR expand matrix if best-case confirmed. Rollback: delete macos-14 from matrix (one-line diff) or delete workflow file entirely. No impact on gate.yml. Composes with FACTORY-HYGIENE row #51 (unblocks enforcement mode), docs/BACKLOG.md row ~2471 (Otto-161 declined + this as alternative), docs/research/test-classification.md (PR #339; category-3 nightly pattern). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(#345): 6 review threads — name attribution + cron + YAML + fork-scheduling + BACKLOG ref - thread Wkcz (line 327): removed broken `memory/feedback_ksk_naming_...` reference (factory-personal memories live in `~/.claude/projects/<slug>/memory/`, not in-repo); paraphrased the rewrite-authority rule in §10 without promising an in-repo path. - thread WkdI (line 7): purged name-attribution tokens per Otto-220 code-comments-not-history + doc-comment-history-audit lint (PR #363). All "Aaron" / "Otto-NN" / "Amara" / "Max" references rewritten to role references ("human maintainer", "prior-contributor", "autonomous loop", "initial-starting-point contributor"). - thread WkdX (line 163): cron changed `0 9 * * *` → `7 9 * * *` (09:07 UTC) so it matches the "off the hour" comment; note now calls out alignment with the sibling scheduled workflow `github-settings-drift.yml` (`17 14 * * 1`). - thread Wkdk (line 146): YAML sketch rewritten to match the actual `.github/workflows/gate.yml` installer pattern — three-way-parity `./tools/setup/install.sh` invocation plus the same cache-key shape (dotnet / mise / nuget). Added explicit note that Windows matrix leg depends on `tools/setup/install.sh` growing Windows support first per the existing BACKLOG row. - thread Wkdz (line 248): corrected the fork-scheduling claim. GitHub disables scheduled workflows on forks by default — the repo's own `github-settings-drift.yml` runs without fork-scoping and proves this. The `if: github.repository ==` guard is kept as optional hygiene for the rare opt-in-fork case, not as a cost- safety requirement. - thread WkeB (line 316): replaced the wrong `docs/BACKLOG.md` line-number reference (~2471 is actually the mise-activate / HLL-flakiness neighborhood) with stable grep anchors ("Windows matrix in CI" + "Parity swap: CI's `actions/setup-dotnet`"). Markdownlint passes on the edited file. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Merged
3 tasks
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…CTORY-HYGIENE format) Three P1/nit review threads on the Otto-86 4-stage peer-harness progression refinement, fixed in-row (same-row body edits, no cross-row reshuffling): 1. PRRT_kwDOSF9kNM59R5L8 (line 2638): dropped the incorrect "Otto-79's 3-stage arc" parenthetical. Otto-79 in BACKLOG is the agent-email-password-storage row, not a 3-stage arc; the 4-stage progression stands on its own description. 2. PRRT_kwDOSF9kNM59R5Ly (line 2645): rephrased the readiness- signal paragraph to name the Otto-82 design-review discipline directly instead of pointing at an in-repo memory path (memory/ paths are generally out-of-repo per drain convention applied to earlier review threads of this shape). 3. PRRT_kwDOSF9kNM59R5MD (line 2656): normalised "FACTORY-HYGIENE #51 + #55" → "FACTORY-HYGIENE row #51 and row #55" to match the common "row #NN" format used elsewhere in the file. No new semantics; pure review-thread drain edits inside the same BACKLOG row body (append-only-within-section discipline preserved — no row added, no row reordered). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…st-mode bounding + Windows-support use case (#255) * backlog: Codex-parallel Otto-86 refinement — 4-stage progression, test-mode bounding, Windows-support use case Aaron Otto-86 two-message refinement of the Otto-78 Codex-parallel row: Message 1 (progression + use case): extends Otto-79's 3-stage progression (a single-today / b bounded-experiment / c peer-harness) into a 4-stage arc with a new intermediate: - (a) single coordinator today - (b) NEW multi-Claude-Code peer-harness experiment before Codex - (c) multi-harness with Codex (gated on (b) + Codex ready) - (d) full peer-harness with Windows-support real workload (possibly Codex, end-to-end "telephone line" test) Otto is the readiness-signaller; Aaron waits. Stage (c) launch is a specifically-asked-for design review per Otto-82 authority-calibration — Otto's readiness signal is the gate. Message 2 (test-mode bounding, hard requirement): "make sure when in peer-harness mode you give the other one time limits or process kill them either way, just while we are testing we don't want the other peer harness to run forever during tests only when in real use." Time-limits / process-kill on the non-primary during testing; removed once the peer-harness moves from test-mode to real use. Concrete bounding options named (Otto designs the specific mechanism in a test-plan doc): - wall-clock timeout per experiment - explicit process-kill target at end - test-mode flag capping async-dispatch budget - wall-time instrumentation Scope limits: - No second Claude session without experiment design + dry-run - No skipping multi-Claude stage (b) to jump to Codex (c) - No unbounded test runs — time-limits load-bearing - No premature readiness-signals - Otto-78 primary-switch clause unchanged; this refines stages around it, not the primary-determination model Lands within-standing-authority per Otto-82 calibration (BACKLOG-row refinement on a row that was already refinement- friendly; no signoff gate triggered). Authorising memory: memory/feedback_peer_harness_progression_starts_multi_claude_ first_windows_support_concrete_use_case_otto_signals_ readiness_2026_04_23.md Otto-86 tick split-attention deliverable (alongside Muratori corrected-table research PR #254). * backlog: drain PR #255 review threads (Otto-79 ref / memory path / FACTORY-HYGIENE format) Three P1/nit review threads on the Otto-86 4-stage peer-harness progression refinement, fixed in-row (same-row body edits, no cross-row reshuffling): 1. PRRT_kwDOSF9kNM59R5L8 (line 2638): dropped the incorrect "Otto-79's 3-stage arc" parenthetical. Otto-79 in BACKLOG is the agent-email-password-storage row, not a 3-stage arc; the 4-stage progression stands on its own description. 2. PRRT_kwDOSF9kNM59R5Ly (line 2645): rephrased the readiness- signal paragraph to name the Otto-82 design-review discipline directly instead of pointing at an in-repo memory path (memory/ paths are generally out-of-repo per drain convention applied to earlier review threads of this shape). 3. PRRT_kwDOSF9kNM59R5MD (line 2656): normalised "FACTORY-HYGIENE #51 + #55" → "FACTORY-HYGIENE row #51 and row #55" to match the common "row #NN" format used elsewhere in the file. No new semantics; pure review-thread drain edits inside the same BACKLOG row body (append-only-within-section discipline preserved — no row added, no row reordered). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2 tasks
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…ings Addresses 13 of the 15 substantive findings from PR #170 Copilot review: Row-number corrections: - Row #48 ref: is GitHub surface triage cadence (not cross-platform parity); parity is row #51 - Row #43 ref: clarified SHA-pins via workflow-injection safe-patterns discipline Install-path + version-pin corrections: - .NET 10: install via mise (tools/setup/common/mise.sh + .mise.toml) not dotnet-install.sh; pin via global.json + .mise.toml - bun + TypeScript: no bun.lock committed; pin via package.json (packageManager + deps) - Z3: OS-installed CLI (brew/apt/winget); tools/Z3Verify shells out; no JARs downloaded (unlike TLA+/Alloy) - Stryker.NET: tools/setup/manifests/dotnet-tools (not .config/dotnet-tools.json); no CI job currently invokes - Postgres: no docker-compose.yml in samples/FactoryDemo.Db yet (CRM-shaped sample substrate pending) Reference corrections: - Codex capability map: openai-codex-cli-capability-map.md (full filename) - Gemini capability map: queued (no doc yet) - Per-user memory refs removed from "Composes with" (replaced with in-repo memory/CURRENT-*.md) - Per-user memory refs removed from PQC mandate rationale (noted migration path via in-repo-first policy cadence) Consistency: - Status: ~26 rows (corrected from "~12"); matches open-follow-ups #1 framing - CURRENT-aaron.md refs updated to memory/CURRENT-aaron.md (in-repo per PR #197) Attribution: Otto (loop-agent PM hat). Acts on Copilot P1 review findings; merge-forward on top of origin/main already done. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
Per-thread fixes: - Gemini CLI capability-map now points at existing docs/research/gemini-cli-capability-map.md (no longer marked as queued / not-yet-present). - OpenAI web UI + Playwright rows: drop the bun + @playwright/test claim and the package.json version-pin claim. package.json has no Playwright dependency; Playwright is plugin-enabled only via .claude/settings.json. - Stryker.NET row: corrected Version pin to 'unversioned in setup manifest (tracks latest)' to match tools/setup/manifests/dotnet-tools, and synced TECH-RADAR ring to Trial. - Semgrep / CodeQL / Stryker / bun+TS rings synced to TECH-RADAR (Trial, not Adopt). - Semgrep install: corrected to 'CI-installed via pip install semgrep in .github/workflows/gate.yml' and removed the hardcoded '14 custom rules' count. - Docker row: corrected Install path to 'Manual / OS package install' (setup scripts do not detect or install Docker today). - Postgres row: dropped reference to a non-present samples/FactoryDemo.Db/docker-compose.yml; points at the real samples/FactoryDemo.Api.* trees instead. - GitHub Actions row: clarified SHA-pin is the actual pin mechanism; row #43 cited as the workflow-injection audit (the source-of-truth row), not as the SHA-pin policy itself. - Open follow-up #2: corrected row reference from #48 (GitHub surface triage) to #51 (cross-platform parity).
AceHack
added a commit
that referenced
this pull request
Apr 24, 2026
…e noted (#170) * docs: factory technology inventory — first-pass ~26 rows + PQC mandate noted First-pass population of the factory technology inventory doc queued by PR #165's BACKLOG row (Aaron 2026-04-23). Unified tie-together of HARNESS-SURFACES (harnesses), TECH-RADAR (ring adoption), tools/setup/ (install), and per-tech expert skills. Coverage: - Language runtimes + build (.NET 10 F#+C# / Rust / bun+TS / bash+PowerShell) - Data infrastructure (Postgres / Docker / Apache Arrow) - Agent harnesses (Claude Code / Codex CLI / Gemini CLI / OpenAI web UI via Playwright / Playwright) - Formal verification + testing (Lean 4 / Z3 / TLA+ / Alloy 6 / FsCheck / xUnit / Stryker.NET / BenchmarkDotNet) - Static analysis + security (Semgrep / CodeQL / Roslyn / F# analyzers / markdownlint-cli2 / actionlint / shellcheck) - CI + publishing (GitHub Actions / NuGet) PQC-mandate added to Open follow-ups per Aaron 2026-04-23: "any crypto graphy we decide to use should be quantium resisten, even one place we don't use it could be a place for attack". Currently no crypto in violation; rule is forward-looking. Full mandate in per-user memory feedback_all_cryptography_quantum_resistant_even_one_gap_is_attack_vector_2026_04_23.md. Living doc — ~26 rows in first-pass; more rows land on future on-touch fires. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs(factory-technology-inventory): content fixes per Copilot P1 findings Addresses 13 of the 15 substantive findings from PR #170 Copilot review: Row-number corrections: - Row #48 ref: is GitHub surface triage cadence (not cross-platform parity); parity is row #51 - Row #43 ref: clarified SHA-pins via workflow-injection safe-patterns discipline Install-path + version-pin corrections: - .NET 10: install via mise (tools/setup/common/mise.sh + .mise.toml) not dotnet-install.sh; pin via global.json + .mise.toml - bun + TypeScript: no bun.lock committed; pin via package.json (packageManager + deps) - Z3: OS-installed CLI (brew/apt/winget); tools/Z3Verify shells out; no JARs downloaded (unlike TLA+/Alloy) - Stryker.NET: tools/setup/manifests/dotnet-tools (not .config/dotnet-tools.json); no CI job currently invokes - Postgres: no docker-compose.yml in samples/FactoryDemo.Db yet (CRM-shaped sample substrate pending) Reference corrections: - Codex capability map: openai-codex-cli-capability-map.md (full filename) - Gemini capability map: queued (no doc yet) - Per-user memory refs removed from "Composes with" (replaced with in-repo memory/CURRENT-*.md) - Per-user memory refs removed from PQC mandate rationale (noted migration path via in-repo-first policy cadence) Consistency: - Status: ~26 rows (corrected from "~12"); matches open-follow-ups #1 framing - CURRENT-aaron.md refs updated to memory/CURRENT-aaron.md (in-repo per PR #197) Attribution: Otto (loop-agent PM hat). Acts on Copilot P1 review findings; merge-forward on top of origin/main already done. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * docs(factory-technology-inventory): drain PR #170 review threads Per-thread fixes: - Gemini CLI capability-map now points at existing docs/research/gemini-cli-capability-map.md (no longer marked as queued / not-yet-present). - OpenAI web UI + Playwright rows: drop the bun + @playwright/test claim and the package.json version-pin claim. package.json has no Playwright dependency; Playwright is plugin-enabled only via .claude/settings.json. - Stryker.NET row: corrected Version pin to 'unversioned in setup manifest (tracks latest)' to match tools/setup/manifests/dotnet-tools, and synced TECH-RADAR ring to Trial. - Semgrep / CodeQL / Stryker / bun+TS rings synced to TECH-RADAR (Trial, not Adopt). - Semgrep install: corrected to 'CI-installed via pip install semgrep in .github/workflows/gate.yml' and removed the hardcoded '14 custom rules' count. - Docker row: corrected Install path to 'Manual / OS package install' (setup scripts do not detect or install Docker today). - Postgres row: dropped reference to a non-present samples/FactoryDemo.Db/docker-compose.yml; points at the real samples/FactoryDemo.Api.* trees instead. - GitHub Actions row: clarified SHA-pin is the actual pin mechanism; row #43 cited as the workflow-injection audit (the source-of-truth row), not as the SHA-pin policy itself. - Open follow-up #2: corrected row reference from #48 (GitHub surface triage) to #51 (cross-platform parity). * docs(pr-preservation): drain log for PR #170 (factory technology inventory) 23 threads drained; rebase + content fixes per drain log. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 25, 2026
… lint v0 (detect-only) Amara's 5th-ferry Artifact C landing (PR #235 absorb). Detect-only lint for the four archive-header fields proposed in §33 (PR #235 exemplar; not yet governance-landed): - Scope: - Attribution: - Operational status: - Non-fusion disclaimer: Defaults to checking docs/aurora/*.md; --path DIR overrides. --enforce flips exit 2 on any gap; CI does not currently call it (Aminata Otto-80 pass classified §33 as IMPORTANT-pending- Aaron-signoff + lint-required-to-prevent-3-5-round-decay). First-run baseline: 2/2 existing aurora absorbs missing all four headers (predate the proposal). Detect-only first prevents CI block on baseline; enforcement flips when Aaron signs off on §33 + baseline is green (either backfill the 2 absorbs or explicit grandfather clause in §33). v0 limitations documented in script: - Partial-header adversary (label anywhere in first 20 lines passes; no syntactic check). - Fake-header adversary (values not content-audited). - In-memory-import adversary (memory/ not covered; different surface). Harden in follow-up after §33 lands. Bash 3.2 compatible (while-read loop, not mapfile) for macOS default shell. Same --json / --out DIR / exit code shape as existing audit_commit.sh / audit_personas.sh / audit_skills.sh. FACTORY-HYGIENE row #60 added: - Detect-only cadence landed. - Enforcement deferred until Aaron §33 signoff + baseline green. - Same detect-only → triage → enforce pattern as rows #51 (cross-platform parity) and #55 (machine-specific scrubber). tools/alignment/README.md table updated with new row. Composes with: - Aminata threat-model pass (PR #241; names the decay risk this lint prevents). - Amara's 5th-ferry absorb (PR #235; exemplar self-applies the format). - Memory-index hygiene trio (rows #58 / #59 + this row's archive-header hygiene trio). Otto-81 tick deliverable.
AceHack
added a commit
that referenced
this pull request
Apr 25, 2026
… lint v0 (detect-only) Amara's 5th-ferry Artifact C landing (PR #235 absorb). Detect-only lint for the four archive-header fields proposed in §33 (PR #235 exemplar; not yet governance-landed): - Scope: - Attribution: - Operational status: - Non-fusion disclaimer: Defaults to checking docs/aurora/*.md; --path DIR overrides. --enforce flips exit 2 on any gap; CI does not currently call it (Aminata Otto-80 pass classified §33 as IMPORTANT-pending- Aaron-signoff + lint-required-to-prevent-3-5-round-decay). First-run baseline: 2/2 existing aurora absorbs missing all four headers (predate the proposal). Detect-only first prevents CI block on baseline; enforcement flips when Aaron signs off on §33 + baseline is green (either backfill the 2 absorbs or explicit grandfather clause in §33). v0 limitations documented in script: - Partial-header adversary (label anywhere in first 20 lines passes; no syntactic check). - Fake-header adversary (values not content-audited). - In-memory-import adversary (memory/ not covered; different surface). Harden in follow-up after §33 lands. Bash 3.2 compatible (while-read loop, not mapfile) for macOS default shell. Same --json / --out DIR / exit code shape as existing audit_commit.sh / audit_personas.sh / audit_skills.sh. FACTORY-HYGIENE row #60 added: - Detect-only cadence landed. - Enforcement deferred until Aaron §33 signoff + baseline green. - Same detect-only → triage → enforce pattern as rows #51 (cross-platform parity) and #55 (machine-specific scrubber). tools/alignment/README.md table updated with new row. Composes with: - Aminata threat-model pass (PR #241; names the decay risk this lint prevents). - Amara's 5th-ferry absorb (PR #235; exemplar self-applies the format). - Memory-index hygiene trio (rows #58 / #59 + this row's archive-header hygiene trio). Otto-81 tick deliverable.
AceHack
added a commit
that referenced
this pull request
Apr 25, 2026
… lint v0 (detect-only) (#243) * artifact-c: tools/alignment/audit_archive_headers.sh — archive-header lint v0 (detect-only) Amara's 5th-ferry Artifact C landing (PR #235 absorb). Detect-only lint for the four archive-header fields proposed in §33 (PR #235 exemplar; not yet governance-landed): - Scope: - Attribution: - Operational status: - Non-fusion disclaimer: Defaults to checking docs/aurora/*.md; --path DIR overrides. --enforce flips exit 2 on any gap; CI does not currently call it (Aminata Otto-80 pass classified §33 as IMPORTANT-pending- Aaron-signoff + lint-required-to-prevent-3-5-round-decay). First-run baseline: 2/2 existing aurora absorbs missing all four headers (predate the proposal). Detect-only first prevents CI block on baseline; enforcement flips when Aaron signs off on §33 + baseline is green (either backfill the 2 absorbs or explicit grandfather clause in §33). v0 limitations documented in script: - Partial-header adversary (label anywhere in first 20 lines passes; no syntactic check). - Fake-header adversary (values not content-audited). - In-memory-import adversary (memory/ not covered; different surface). Harden in follow-up after §33 lands. Bash 3.2 compatible (while-read loop, not mapfile) for macOS default shell. Same --json / --out DIR / exit code shape as existing audit_commit.sh / audit_personas.sh / audit_skills.sh. FACTORY-HYGIENE row #60 added: - Detect-only cadence landed. - Enforcement deferred until Aaron §33 signoff + baseline green. - Same detect-only → triage → enforce pattern as rows #51 (cross-platform parity) and #55 (machine-specific scrubber). tools/alignment/README.md table updated with new row. Composes with: - Aminata threat-model pass (PR #241; names the decay risk this lint prevents). - Amara's 5th-ferry absorb (PR #235; exemplar self-applies the format). - Memory-index hygiene trio (rows #58 / #59 + this row's archive-header hygiene trio). Otto-81 tick deliverable. * drain(#243): seven Copilot/Codex threads — recursive scan + name-attribution + exit-code alignment - Switch audit_archive_headers.sh from -maxdepth 1 to recursive find matching documented `docs/aurora/**/*.md` scope; exclude `references/` as bibliographic substrate. - Encode subdirectory in --out per-file JSON basename to avoid collisions under recursive scan. - Replace 'Aaron' with 'human-maintainer' role ref in script and FACTORY-HYGIENE row 60 (FACTORY-DISCIPLINE name-attribution rule). - Drop persona names (Aminata, Amara) from script comments and row 60 in favour of role references (threat-model reviewer, absorbing agent), per Otto-220 code-comments-explain-code rule. - Realign exit codes to sibling audit_*.sh convention: 1 = content-level signal under --enforce; 2 = script error / missing dependency / bad arg. Update header doc-block + row 60 wording to match. - Remove dead cross-reference to non-existent `docs/aurora/2026-04-23-amara-zeta-ksk-aurora-validation-5th-ferry.md` in row 60. Verified the aminata-threat-model-5th-ferry citation does exist on origin/main; kept that one. - Append docs/pr-preservation/243-drain-log.md per Otto-250. Smoke-tested: clean run exit 0 (16 files scanned), --enforce exit 1, bad --path exit 2, --json exit 0, --out has no basename collisions. * drain(#243): quote target_path inside parameter expansion (SC2295) Local shellcheck install only flagged this on the lint runner with --severity=style. Quote $target_path inside the ${file#...} prefix-strip so the prefix is not interpreted as a glob pattern. * drain: PR #243 round 2 — address 6 late-review threads Round 2 drain after round 1 closed all 7 threads. Copilot re-reviewed and opened 6 new P2 suggestion-shape threads; all 6 are FIX outcomes: - r2-1 (line 128): normalise --path to strip trailing slash so `docs/aurora/` matches the references/ exclusion. - r2-2 (line 172): make --out filename encoding injective by percent-encoding literal `_` to `_5F` before the `/` -> `__` swap. Was non-injective: `a/b__c.md` and `a__b/c.md` both became `a__b__c.json`. - r2-3 (line 26): fix stale Usage wording — `--enforce` exits 1 on gap (matches the dedicated Exit-codes section and round-1 Thread-7 realignment). - r2-4 (line 61): correct factual error about memory surface — in-repo `memory/` is canonical per GOVERNANCE.md §18 and `memory/README.md`; per-user path is staging. - r2-5 (line 128): force C-locale sort with `LC_ALL=C` for deterministic byte-order output regardless of caller env. - r2-6 (line 7): drop persona name "Amara" from header banner in favour of role/artifact references ("5th-ferry Artifact C" / "the 5th-ferry external- research absorb"). Round 1 caught "Aaron" but missed "Amara". Append-only drain-log update per Otto-229: prior round-1 sections untouched; new "Drain pass: 2026-04-24 (round 2 — 6 threads)" section appended. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 25, 2026
…le + safe-ROM substrate (#400) * artifact-c: tools/alignment/audit_archive_headers.sh — archive-header lint v0 (detect-only) Amara's 5th-ferry Artifact C landing (PR #235 absorb). Detect-only lint for the four archive-header fields proposed in §33 (PR #235 exemplar; not yet governance-landed): - Scope: - Attribution: - Operational status: - Non-fusion disclaimer: Defaults to checking docs/aurora/*.md; --path DIR overrides. --enforce flips exit 2 on any gap; CI does not currently call it (Aminata Otto-80 pass classified §33 as IMPORTANT-pending- Aaron-signoff + lint-required-to-prevent-3-5-round-decay). First-run baseline: 2/2 existing aurora absorbs missing all four headers (predate the proposal). Detect-only first prevents CI block on baseline; enforcement flips when Aaron signs off on §33 + baseline is green (either backfill the 2 absorbs or explicit grandfather clause in §33). v0 limitations documented in script: - Partial-header adversary (label anywhere in first 20 lines passes; no syntactic check). - Fake-header adversary (values not content-audited). - In-memory-import adversary (memory/ not covered; different surface). Harden in follow-up after §33 lands. Bash 3.2 compatible (while-read loop, not mapfile) for macOS default shell. Same --json / --out DIR / exit code shape as existing audit_commit.sh / audit_personas.sh / audit_skills.sh. FACTORY-HYGIENE row #60 added: - Detect-only cadence landed. - Enforcement deferred until Aaron §33 signoff + baseline green. - Same detect-only → triage → enforce pattern as rows #51 (cross-platform parity) and #55 (machine-specific scrubber). tools/alignment/README.md table updated with new row. Composes with: - Aminata threat-model pass (PR #241; names the decay risk this lint prevents). - Amara's 5th-ferry absorb (PR #235; exemplar self-applies the format). - Memory-index hygiene trio (rows #58 / #59 + this row's archive-header hygiene trio). Otto-81 tick deliverable. * drain(#243): seven Copilot/Codex threads — recursive scan + name-attribution + exit-code alignment - Switch audit_archive_headers.sh from -maxdepth 1 to recursive find matching documented `docs/aurora/**/*.md` scope; exclude `references/` as bibliographic substrate. - Encode subdirectory in --out per-file JSON basename to avoid collisions under recursive scan. - Replace 'Aaron' with 'human-maintainer' role ref in script and FACTORY-HYGIENE row 60 (FACTORY-DISCIPLINE name-attribution rule). - Drop persona names (Aminata, Amara) from script comments and row 60 in favour of role references (threat-model reviewer, absorbing agent), per Otto-220 code-comments-explain-code rule. - Realign exit codes to sibling audit_*.sh convention: 1 = content-level signal under --enforce; 2 = script error / missing dependency / bad arg. Update header doc-block + row 60 wording to match. - Remove dead cross-reference to non-existent `docs/aurora/2026-04-23-amara-zeta-ksk-aurora-validation-5th-ferry.md` in row 60. Verified the aminata-threat-model-5th-ferry citation does exist on origin/main; kept that one. - Append docs/pr-preservation/243-drain-log.md per Otto-250. Smoke-tested: clean run exit 0 (16 files scanned), --enforce exit 1, bad --path exit 2, --json exit 0, --out has no basename collisions. * drain(#243): quote target_path inside parameter expansion (SC2295) Local shellcheck install only flagged this on the lint runner with --severity=style. Quote $target_path inside the ${file#...} prefix-strip so the prefix is not interpreted as a glob pattern. * drain: PR #243 round 2 — address 6 late-review threads Round 2 drain after round 1 closed all 7 threads. Copilot re-reviewed and opened 6 new P2 suggestion-shape threads; all 6 are FIX outcomes: - r2-1 (line 128): normalise --path to strip trailing slash so `docs/aurora/` matches the references/ exclusion. - r2-2 (line 172): make --out filename encoding injective by percent-encoding literal `_` to `_5F` before the `/` -> `__` swap. Was non-injective: `a/b__c.md` and `a__b/c.md` both became `a__b__c.json`. - r2-3 (line 26): fix stale Usage wording — `--enforce` exits 1 on gap (matches the dedicated Exit-codes section and round-1 Thread-7 realignment). - r2-4 (line 61): correct factual error about memory surface — in-repo `memory/` is canonical per GOVERNANCE.md §18 and `memory/README.md`; per-user path is staging. - r2-5 (line 128): force C-locale sort with `LC_ALL=C` for deterministic byte-order output regardless of caller env. - r2-6 (line 7): drop persona name "Amara" from header banner in favour of role/artifact references ("5th-ferry Artifact C" / "the 5th-ferry external- research absorb"). Round 1 caught "Aaron" but missed "Amara". Append-only drain-log update per Otto-229: prior round-1 sections untouched; new "Drain pass: 2026-04-24 (round 2 — 6 threads)" section appended. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * backlog+memory+roms: emulators on OS-interface + rewindable/retractable controls + safe-ROM substrate Maintainer 2026-04-24 directive — emulators are the canonical proof-out workload for the OS-interface (#399). Two related directives captured: (1) "emulators should run very nicely on this, let me know when you want some roms of any kind that are safe." (2) "rewindable/retractable os/emulator controls" Plus: maintainer requested a `roms/` folder with a gitignored-except-sentinels pattern (same as `drop/`) so binaries never enter git history but the directory exists on every clone. Why emulators compose perfectly with the OS-interface: - Emulator event loop = durable-async runtime workload - Save states FREE (every yield-point = checkpoint) - Cross-node migration FREE (state follows the function) - Multiplayer FREE (shared durable substrate) - DST guarantees speedrun/TAS bit-equal replay Rewindable/retractable controls — the killer generalization: - Z-set retraction-native semantics extend UP to OS surface - "Rewind 5 seconds" is a first-class OS primitive - rr / Pernosco architectural class, generalized - Otto-238 trust-vector: rewindable controls grant agency Activates 2026-04-22 ARC-3 adversarial-self-play absorption-scoring research (level-creator / adversary / player loop on durable-async + rewindable substrate). Phased: Phase 0 research (Game Boy / NES / SNES / Genesis; libretro; rr/Pernosco) → Phase 1 single emulator on durable-async → Phase 2 rewindable controls promoted to OS primitive → Phase 3 ARC-3 loop → Phase 4 cross-emulator composition. Safe-ROM offer captured durably; ask gated on Phase 1 landing first. Allowed classes enumerated in roms/README.md (public-domain / homebrew / official test suites / commercially-released-as-free / explicit-license). Otto-275 log-don't-implement applies. Composes with #399 OS-interface, Otto-73/238/272, Z-set retraction-native, #396/#397 closure-table+cross-DSL, request-play skill. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 25, 2026
…Otto-213 durable lesson Otto-214 implementation of the tooling-level enforcement I proposed Otto-213. Memory-alone was not sufficient to stop the "write a stale version number" recurrence pattern; this script adds a CI-fail gate. Behavior: - Walks .github/workflows/*.yml files - Extracts runs-on: + os: matrix lines - Fails (exit 2) if any line references a STALE runner version (ubuntu-22.04, macos-14, macos-15, windows-2022, ubuntu-20.04, macos-13, macos-15-intel, etc.) - Warns (exit 3) if the allow-list itself is stale (>30 days since LAST_VERIFIED) - Prints the canonical list of ALLOWED labels on failure + the authoritative GitHub docs URL for re-verification Allow-list verified 2026-04-24 via https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories exact quote "Use of the standard GitHub-hosted runners is free and unlimited on public repositories." First-run detects 13 stale-label hits across codeql.yml, gate.yml, github-settings-drift.yml (plus stale comment- block references in gate.yml from the pre-correction history). These will be cleaned up by PR #359 for gate.yml; codeql.yml + github-settings-drift.yml need separate follow-up PRs. Does NOT wire into gate.yml automatically — separate step to add the lint check after the baseline is green. Premature enforcement would block every current PR. Sequencing: (1) this PR ships the tool; (2) follow-up PRs clean up existing stale refs (gate.yml already covered by #359; others queued); (3) once baseline is clean, add to gate.yml lint job. Composes with: - Otto-213 version-numbers-require-websearch memory - Otto-212 use-latest-tags + security-hygiene directive - Otto-210/211 macOS-is-free + M1-not-Intel corrections - FACTORY-HYGIENE row #43 safe-pattern compliance - Analogous pattern to audit-cross-platform-parity.sh (detect-only-first, enforce-when-baseline-green) Test plan: - Runs clean when no stale labels present - Exits 2 with clear message when stale labels present - Warns when allow-list >30 days old - Shellcheck clean (SC2001 note acknowledged; the non-bash-4 sed-style substitution is intentional for macOS default-bash-3.x compatibility per FACTORY- HYGIENE row #51 cross-platform parity) - Portable: no mapfile (bash 4+ only); uses while-read loop pattern that works in bash 3.x Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
AceHack
added a commit
that referenced
this pull request
Apr 25, 2026
…Otto-213 stale-version lesson (#360) * tools: lint/runner-version-freshness.sh — structural enforcement for Otto-213 durable lesson Otto-214 implementation of the tooling-level enforcement I proposed Otto-213. Memory-alone was not sufficient to stop the "write a stale version number" recurrence pattern; this script adds a CI-fail gate. Behavior: - Walks .github/workflows/*.yml files - Extracts runs-on: + os: matrix lines - Fails (exit 2) if any line references a STALE runner version (ubuntu-22.04, macos-14, macos-15, windows-2022, ubuntu-20.04, macos-13, macos-15-intel, etc.) - Warns (exit 3) if the allow-list itself is stale (>30 days since LAST_VERIFIED) - Prints the canonical list of ALLOWED labels on failure + the authoritative GitHub docs URL for re-verification Allow-list verified 2026-04-24 via https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories exact quote "Use of the standard GitHub-hosted runners is free and unlimited on public repositories." First-run detects 13 stale-label hits across codeql.yml, gate.yml, github-settings-drift.yml (plus stale comment- block references in gate.yml from the pre-correction history). These will be cleaned up by PR #359 for gate.yml; codeql.yml + github-settings-drift.yml need separate follow-up PRs. Does NOT wire into gate.yml automatically — separate step to add the lint check after the baseline is green. Premature enforcement would block every current PR. Sequencing: (1) this PR ships the tool; (2) follow-up PRs clean up existing stale refs (gate.yml already covered by #359; others queued); (3) once baseline is clean, add to gate.yml lint job. Composes with: - Otto-213 version-numbers-require-websearch memory - Otto-212 use-latest-tags + security-hygiene directive - Otto-210/211 macOS-is-free + M1-not-Intel corrections - FACTORY-HYGIENE row #43 safe-pattern compliance - Analogous pattern to audit-cross-platform-parity.sh (detect-only-first, enforce-when-baseline-green) Test plan: - Runs clean when no stale labels present - Exits 2 with clear message when stale labels present - Warns when allow-list >30 days old - Shellcheck clean (SC2001 note acknowledged; the non-bash-4 sed-style substitution is intentional for macOS default-bash-3.x compatibility per FACTORY- HYGIENE row #51 cross-platform parity) - Portable: no mapfile (bash 4+ only); uses while-read loop pattern that works in bash 3.x Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * drain(#360 P0×2 + P1+P2+P1+P1 Codex): regex-escape + BSD-grep portable + comment-strip + rolling-alias forbidden + warn-only exit Six Codex findings on tools/lint/runner-version-freshness.sh: P0 (line 133) — regex-metachar escape: `stale_pattern` was built from raw label strings; `.` in ubuntu-22.04 was a regex wildcard, producing false matches/ misses. Added `escape_for_regex` helper that escapes . + * ? ( ) [ ] { } | \ / before alternation. P0 (line 149) — BSD-grep portability: `\b` word-boundary doesn't work in BSD grep (macOS default; treated as backspace per POSIX ERE). Replaced with explicit non-word boundaries: `([^A-Za-z0-9_]|^)` start + `([^A-Za-z0-9_]|$)` end, expressed without backrefs so it works in both GNU and BSD grep. P1 (line 149-1) — exclude comments: Stale-label-in-comment was triggering false positives. Added a comment-stripping pre-filter (`grep -vE '^[[:space:]]*#'`) so YAML comments are excluded from the scan. P1 (line 149-2) — explicit-file-not-found masking: `grep ... 2>/dev/null || true` silently swallowed missing- file errors and reported 'ok' for nothing-actually-linted. Added an explicit `[ ! -r "$file" ]` precheck that fails loud (exit 2) rather than passing silent. P1 (line 73) — rolling-aliases forbidden by convention: ALLOWED_LABELS included ubuntu-latest / windows-latest / macos-latest, contradicting the repo convention of pinned major-OS-version labels. Removed from ALLOWED_LABELS, added a separate ROLLING_ALIASES forbidden list, added a distinct error-class scan ('ROLLING-ALIAS RUNNER LABEL') so contributors get a different error message than for stale-version pins. Same fail=1 flag, different operator message. P2 (line 179) — warn-only exit on stale freshness: Header documents this as warning-only; code exited 3 (which some CI configurations treat as failure). Updated to exit 0 on stale-freshness-only path; warning is still printed to stderr. Stale-version-detection still exit 2 (a real failure). Smoke-test note: the new script now flags ubuntu-22.04 in gate.yml as stale (real finding) — exit 2 with the expected output. gate.yml's own runner-pin upgrade is out of scope for this PR; will land separately. * drain(#360 P1+P2 Codex): quoted-matrix-entries + inline-comment stripping Two more substantive Codex findings: P1 (line 183) — quoted matrix entries missed: The matrix-entry prefilter was `^[[:space:]]*-[[:space:]]+` which only matched bare `- <label>`. Common YAML syntax `- "ubuntu-22.04"` or `- 'macos-15'` was being missed. Updated prefilter to `^[[:space:]]*-[[:space:]]+(['\"]?)` which optionally consumes a leading single or double quote. Smoke-tested with mixed quoting + matrix block: catches both forms now. P2 (line 179) — trailing inline comments not stripped: `runs-on: ubuntu-24.04 # was ubuntu-22.04` was falsely flagging `ubuntu-22.04` in the trailing comment. Added a second sed pass: `sed -E 's/[[:space:]]+#.*$//'` strips everything after the first ` #` (YAML-spec comment-start sentinel with required leading space). Conservative: doesn't handle `#` inside quoted strings (rare in workflow YAML). Smoke-tested: trailing comments correctly stripped. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Aaron 2026-04-22 directive: "you mapped out the user surface under AceHack earlier and wrote down the github surface map, use lucent and figure out all the apis you missed for orgs/teams/enterprise and map all those out too — the entire github surface then you can backlog it if you want"
The existing `docs/AGENT-GITHUB-SURFACES.md` (pending land via speculative batch 4) covers only the ten repo-level surfaces on AceHack/Zeta. Post org-transfer to Lucent-Financial-Group, three whole scope families were unmapped: org (21 sub-surfaces), enterprise (C.1-C.5, currently 404 on Team plan but enumerated for upgrade scope), and platform / cross-cutting (D.1-D.10 — Copilot / Codespaces / Packages / Models / GHAS / Apps / OAuth).
New research doc: `docs/research/github-surface-map-complete-2026-04-22.md`. Organized by scope ladder (user → repo → org → enterprise → platform) with per-surface priority, skill candidate, cadence, and blocker.
Security finding from LFG snapshot: `two_factor_requirement_enabled: false`. Filed as P1 backlog row — flip before 3rd org member joins (needs Aaron sign-off).
Three P1 backlog rows filed:
Test plan