From e05530d0c0e2c76247090726402b7d917133f97b Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 15 Aug 2026 08:02:40 -0700 Subject: [PATCH 1/4] Add the HomeAutomation-Config audit report and reconcile its registry entry First committed report for the repository, graded at main and at the develop convergence in flight after its 2026-08-15 resync. The stale driftNote about a README that self-flagged committed secrets is deleted, since the secrets left the checkout and the README no longer mentions them, and the conformance matrix gains the repository as the reference for the operational config shape. --- registry/repos.json | 2 +- reports/conformance-matrix.md | 2 +- reports/homeautomation-config/audit.md | 57 ++++++++++++++++++++++++++ 3 files changed, 59 insertions(+), 2 deletions(-) create mode 100644 reports/homeautomation-config/audit.md diff --git a/registry/repos.json b/registry/repos.json index 10b90d77..c9e2c8a2 100644 --- a/registry/repos.json +++ b/registry/repos.json @@ -170,7 +170,7 @@ "requiredSecrets": [], "consumerModel": "pull", "releaseTrigger": "dispatch-only", - "driftNotes": ["Maintainer config/ops repo (docker-compose stacks, lifecycle scripts, Firewalla configs); Linux-consumed on the Proxmox host, so lineEndings lf.", "Renamed from HomeAutomation for fleet naming consistency (config repos are *-Config). The Vantage controller config is split out to its own Windows/CRLF Vantage-Config repo, not carried here; the legacy Vantage/ subtree is stripped.", "Private; README self-flags previously-committed secrets - secrets-hygiene concern."] + "driftNotes": ["Maintainer config/ops repo (docker-compose stacks, lifecycle scripts, Firewalla configs); Linux-consumed on the Proxmox host, so lineEndings lf.", "Renamed from HomeAutomation for fleet naming consistency (config repos are *-Config). The Vantage controller config is split out to its own Windows/CRLF Vantage-Config repo, not carried here; the legacy Vantage/ subtree is stripped."] }, { "name": "KiCadLibrary", diff --git a/reports/conformance-matrix.md b/reports/conformance-matrix.md index 4be38a37..6b93346b 100644 --- a/reports/conformance-matrix.md +++ b/reports/conformance-matrix.md @@ -20,7 +20,7 @@ The primary shapes are stood up as whole repos. The **composable targets** (`nug | `upstream-wrapper` | - | not-tested | - | Tag from a committed state file, not SemVer2. | | `codegen` | - | not-tested | - | Deterministic matrix over both branches. | | `docs` | ProjectTemplate | not-tested | - | Governance hub, and CI is lint-only. | -| `operational` config | - | not-tested | - | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. Its `develop` ruleset carries no `pull_request` rule, so the branch discipline rests on the instruction rather than the gate. | +| `operational` config | HomeAutomation-Config | not-tested | 2026-08-15 | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. Its `develop` ruleset carries no `pull_request` rule, so the branch discipline rests on the instruction rather than the gate. HomeAutomation-Config is the first operational repository with a committed report (`reports/homeautomation-config/audit.md`): `source-only` plus `operational`, `develop` clean on every mechanized check after its 2026-08-15 resync, with the promotion to `main` open at the time of the report. Its `.editorconfig` and `.gitattributes` are an LF adaptation that the intent advisory keeps flagging by construction. | ## Composable Targets diff --git a/reports/homeautomation-config/audit.md b/reports/homeautomation-config/audit.md new file mode 100644 index 00000000..ccdd7838 --- /dev/null +++ b/reports/homeautomation-config/audit.md @@ -0,0 +1,57 @@ +# Audit: HomeAutomation-Config + +- **Audited branch:** main (`e10a2cf`), with the convergence in flight read at `develop` (`c8252c7`) +- **Types:** source-only (from registry), operational workflow model +- **Verdict:** main not operational (stale carried content), `develop` operational on every mechanized check +- **Date:** 2026-08-15 +- **Run stamps:** `audit run 2026-08-15T14:58:02Z | hub d54862a` (main) and `audit run 2026-08-15T14:58:25Z | hub d54862a | branch override develop` + +First committed report for this repository. It was resynced against the hub's `main` (`0e84805`) on this date per `RESYNC.md`, the resync landed on `develop` as ptr727/HomeAutomation-Config#51, and the promotion to `main` is open as ptr727/HomeAutomation-Config#52. So `main` at the time of writing still reads the pre-resync findings, and `develop` is the state `main` takes when that promotion merges. This report grades the two apart rather than letting either stand for the other. + +## Develop Drift + +`develop` vs `main`: `develop` is ahead by 15 content commits since the last promotion (#36), and `main` carries no content `develop` lacks (the trial `git merge-tree` of the two is conflict-free). The commit-count gap in the other direction is the promotion-merge ancestry artifact and is **benign**. The content drift is real and is the resync itself, closed by the promotion. + +## Dimensions + +| Dimension | Letter | Intent | Verdict | Evidence (file:line) | +| --- | --- | --- | --- | --- | +| source-only (`sourceonly.release.tagonly`) | pass | pass | pass | `.github/workflows/publish-release.yml:61-69` inlines `softprops/action-gh-release` (SHA-pinned) with `LICENSE` and `README.md` as the only files, so the release is the tag, GitHub's source archive, README, and LICENSE. No `build-*-task.yml` and no `expect_release_assets` | +| source-only (`sourceonly.nbgv.retained`) | pass | pass | pass | `version.json` retained (hub byte form after #51), and `dotnet/nbgv@master` computes the tag inline at `publish-release.yml:55`, the same unpinned form the hub's own publisher and catalog snippet use by design | +| branch-model | pass | pass | pass | Both rulesets live and matching the carried payloads by normalized diff (`repo-config/main.json`, `repo-config/operational/develop.json`), confirmed by `repo-config/configure.sh check ptr727/HomeAutomation-Config operational` from this checkout and by the repository's own `AUDIT.md` snippets, all reporting in sync | +| carried-scope | pass | pass | pass | `repo-config/configure.sh` deleted in #40, no `retire`-dispositioned hub path remains. Two `investigate`-dispositioned hits stand (`.github/workflows/publish-release.yml`, `validate-task.yml`), which is a hub triage rather than a repository finding, see Escalations | +| repo-setup | pass | pass | pass | `spec/secrets.json` carries `baseline` plus `note` only, the shape `docs/repo-config-carry.md` states for a source-only repository whose only publish target maps to no mechanism (the dead `targetMechanisms` map dropped in #51). `configure.sh check` reports the Dependabot security features enabled | +| linter-parity | pass | pass | pass | `.github/workflows/validate-task.yml:30-50` runs markdownlint-cli2, cspell (README and HISTORY scope), actionlint, and editorconfig-checker as pinned action wrappers or Docker, one config per linter at the root. `test-pull-request.yml:31` carries the ruleset-bound `Check pull request workflow status job` | +| recurring-violations | pass | pass | pass | Hub prose lint over the resync diff is clean. LF throughout, per the registry `lineEndings: lf` and the repository's `.editorconfig`. Three pre-existing whole-tree `dead-path` mentions remain (`GOVERNANCE.md:29`, `GOVERNANCE.md:282`, `OPERATIONS.md:306`), the first two inside carried text and all three left for the files' next edit per the fix-as-edited policy | +| readme-structure | pass on `develop` | pass | pass | The seven README letters the `main` run reports (license shield placement, `-link` suffixes, `github-link` naming, group membership) are all closed on `develop` since #40, where the run reports none | +| agent-instruction-set | pass on `develop` | pass | pass | Every `AGENTS.md` and `GOVERNANCE.md` verbatim section matches the current canonical after #51. Before the re-vendor, each differing line in every stale region was traced to a past hub commit, so no repository-local rule sat inside a verbatim region. `CODESTYLE.md` carries the hub's skill-pointer form with the repository's own shell rules kept as a subsection of Shell. `.github/copilot-instructions.md` carries the current runbook with an empty Disproved Claims ledger | +| workflow (WORKFLOW.md 5A/5B) | pass | pass | pass | Operational model: `test-pull-request.yml:9-12` runs on `push` to `develop` (advisory) and `pull_request` into `main` (the enforced gate). `publish-release.yml:4` is `workflow_dispatch` only, matching `releaseTrigger: dispatch-only`. `merge-bot-pull-request.yml` uses `actions/create-github-app-token` (SHA-pinned) with the client-id input, matching the baseline mechanism note. `dependabot.yml` declares `github-actions` for both `main` and `develop` | + +csharp, nuget, pypi, python, console, docker, hugo: N/A (no packaging, no application code, no site). + +## Defects (most severe first) + +None on `develop`. On `main`, the whole class of stale carried content (2 `AGENTS.md` and 13 `GOVERNANCE.md` verbatim sections, `.markdownlint-cli2.jsonc`, the carried `configure.sh`, and the README letters) is what #40, #43, #50, and #51 already closed, and it is a defect only until #52 merges. + +## Drift Findings + +- `.editorconfig` and `.gitattributes` carry an intent advisory on both branches. Both are the repository's LF adaptation (registry `lineEndings: lf`), and every hub change since the copies' last commit is CRLF-model or hub-tree specific (Python and Dockerfile pins this tree has no files for). Judged current by meaning, and the advisory will keep firing until the hub's `.editorconfig` stops moving, which is a property of the intent tier rather than of this repository. +- `.github/workflows/publish-release.yml` and `.github/workflows/validate-task.yml` report `hub-only` with an `investigate` disposition in `spec/divergences.json`. Both are the repository's own interface workflows honoring the named contract, and neither can be acted on until the hub settles the fidelity and `appliesTo` call the ledger records as pending. + +## Convergence in Flight + +- ptr727/HomeAutomation-Config#51 (merged into `develop` at `c8252c7`): the resync, one commit per drift class, driven to a Copilot review on its head, one finding fixed and resolved. Coverage read 9 of 11 files on both rounds, which the maintainer accepted at merge. +- ptr727/HomeAutomation-Config#52 (open): the `develop` to `main` promotion. Copilot reviewed the head, one finding deferred to ptr727/HomeAutomation-Config#53 (Duplicacy credentials on a command line in `Duplicacy/init-storage.sh`, content from #45 rather than from the resync), thread resolved, checks 6/6, coverage 72 of 76 files, left for the maintainer to merge. + +## Proposed Registry / Spec Updates + +- Delete the third `driftNote` ("README self-flags previously-committed secrets"): the README no longer mentions secrets, and #46 and #49 moved every real secret out of the checkout to `~/.secrets/`, so the note describes finished work. Applied in the same change. +- Fill the `operational` config row of `reports/conformance-matrix.md` with this repository as its reference, since it is now the first operational repository with a committed report. Applied in the same change. + +## Escalations + +Raised rather than resolved, per AUDIT.md section 9. Each was already on file from a sibling resync the same day, so this run corroborates rather than opens them. + +1. **The hub's canonical `.github/copilot-instructions.md` names `ptr727/ProjectTemplate` in intent-fidelity prose**, in "A Shape Nothing Recognizes Blocks the Loop and Earns an Issue" ("File an issue on the hub, `ptr727/ProjectTemplate`"). The template-reference scan exempts only verbatim sections and the hub itself, so every downstream carry of the current canonical trips `carried:` on its next audit. #51 reworded the line to name the hub through `AGENTS.md` "Fleet Bootstrap", and PlexCleaner's carry holds the same line. The fix belongs in the canonical wording. Tracked as #720. +2. **`spec/divergences.json` still dispositions `publish-release.yml` and `validate-task.yml` as `investigate` with no tracking**, so every repository carrying either reports two `hub-only` findings that no repository can act on. The fidelity and `appliesTo` decision the ledger records as pending is the remedy. Tracked as #669. +3. **The `dead-path` prose check flags a carried mention of the hub-hosted `repo-config/configure.sh`** (`GOVERNANCE.md` "Repository Boundaries and Write Safety" is verbatim carried text) in any repository that has deleted its copy, which is now every converged repository. The mention is a pointer to a hub-hosted file, the shape "Documentation Style Conventions" permits, so the check wants the same hub-hosted exemption the template-reference scan gained. Tracked as #721, where it has already failed a downstream promotion gate. From 5b84f7ac7eda5031f7c7f87df3d6c6473b8e76aa Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 15 Aug 2026 08:04:49 -0700 Subject: [PATCH 2/4] Name the second workflow path in full in the carried-scope row --- reports/homeautomation-config/audit.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reports/homeautomation-config/audit.md b/reports/homeautomation-config/audit.md index ccdd7838..41682fc8 100644 --- a/reports/homeautomation-config/audit.md +++ b/reports/homeautomation-config/audit.md @@ -19,7 +19,7 @@ First committed report for this repository. It was resynced against the hub's `m | source-only (`sourceonly.release.tagonly`) | pass | pass | pass | `.github/workflows/publish-release.yml:61-69` inlines `softprops/action-gh-release` (SHA-pinned) with `LICENSE` and `README.md` as the only files, so the release is the tag, GitHub's source archive, README, and LICENSE. No `build-*-task.yml` and no `expect_release_assets` | | source-only (`sourceonly.nbgv.retained`) | pass | pass | pass | `version.json` retained (hub byte form after #51), and `dotnet/nbgv@master` computes the tag inline at `publish-release.yml:55`, the same unpinned form the hub's own publisher and catalog snippet use by design | | branch-model | pass | pass | pass | Both rulesets live and matching the carried payloads by normalized diff (`repo-config/main.json`, `repo-config/operational/develop.json`), confirmed by `repo-config/configure.sh check ptr727/HomeAutomation-Config operational` from this checkout and by the repository's own `AUDIT.md` snippets, all reporting in sync | -| carried-scope | pass | pass | pass | `repo-config/configure.sh` deleted in #40, no `retire`-dispositioned hub path remains. Two `investigate`-dispositioned hits stand (`.github/workflows/publish-release.yml`, `validate-task.yml`), which is a hub triage rather than a repository finding, see Escalations | +| carried-scope | pass | pass | pass | `repo-config/configure.sh` deleted in #40, no `retire`-dispositioned hub path remains. Two `investigate`-dispositioned hits stand (`.github/workflows/publish-release.yml`, `.github/workflows/validate-task.yml`), which is a hub triage rather than a repository finding, see Escalations | | repo-setup | pass | pass | pass | `spec/secrets.json` carries `baseline` plus `note` only, the shape `docs/repo-config-carry.md` states for a source-only repository whose only publish target maps to no mechanism (the dead `targetMechanisms` map dropped in #51). `configure.sh check` reports the Dependabot security features enabled | | linter-parity | pass | pass | pass | `.github/workflows/validate-task.yml:30-50` runs markdownlint-cli2, cspell (README and HISTORY scope), actionlint, and editorconfig-checker as pinned action wrappers or Docker, one config per linter at the root. `test-pull-request.yml:31` carries the ruleset-bound `Check pull request workflow status job` | | recurring-violations | pass | pass | pass | Hub prose lint over the resync diff is clean. LF throughout, per the registry `lineEndings: lf` and the repository's `.editorconfig`. Three pre-existing whole-tree `dead-path` mentions remain (`GOVERNANCE.md:29`, `GOVERNANCE.md:282`, `OPERATIONS.md:306`), the first two inside carried text and all three left for the files' next edit per the fix-as-edited policy | From 704223aad1721d20a2b2334652a8b99d13c9e3be Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 15 Aug 2026 08:08:14 -0700 Subject: [PATCH 3/4] Qualify every workflow path in the report's evidence pointers --- reports/homeautomation-config/audit.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/reports/homeautomation-config/audit.md b/reports/homeautomation-config/audit.md index 41682fc8..e9c8cd7b 100644 --- a/reports/homeautomation-config/audit.md +++ b/reports/homeautomation-config/audit.md @@ -17,15 +17,15 @@ First committed report for this repository. It was resynced against the hub's `m | Dimension | Letter | Intent | Verdict | Evidence (file:line) | | --- | --- | --- | --- | --- | | source-only (`sourceonly.release.tagonly`) | pass | pass | pass | `.github/workflows/publish-release.yml:61-69` inlines `softprops/action-gh-release` (SHA-pinned) with `LICENSE` and `README.md` as the only files, so the release is the tag, GitHub's source archive, README, and LICENSE. No `build-*-task.yml` and no `expect_release_assets` | -| source-only (`sourceonly.nbgv.retained`) | pass | pass | pass | `version.json` retained (hub byte form after #51), and `dotnet/nbgv@master` computes the tag inline at `publish-release.yml:55`, the same unpinned form the hub's own publisher and catalog snippet use by design | +| source-only (`sourceonly.nbgv.retained`) | pass | pass | pass | `version.json` retained (hub byte form after #51), and `dotnet/nbgv@master` computes the tag inline at `.github/workflows/publish-release.yml:55`, the same unpinned form the hub's own publisher and catalog snippet use by design | | branch-model | pass | pass | pass | Both rulesets live and matching the carried payloads by normalized diff (`repo-config/main.json`, `repo-config/operational/develop.json`), confirmed by `repo-config/configure.sh check ptr727/HomeAutomation-Config operational` from this checkout and by the repository's own `AUDIT.md` snippets, all reporting in sync | | carried-scope | pass | pass | pass | `repo-config/configure.sh` deleted in #40, no `retire`-dispositioned hub path remains. Two `investigate`-dispositioned hits stand (`.github/workflows/publish-release.yml`, `.github/workflows/validate-task.yml`), which is a hub triage rather than a repository finding, see Escalations | | repo-setup | pass | pass | pass | `spec/secrets.json` carries `baseline` plus `note` only, the shape `docs/repo-config-carry.md` states for a source-only repository whose only publish target maps to no mechanism (the dead `targetMechanisms` map dropped in #51). `configure.sh check` reports the Dependabot security features enabled | -| linter-parity | pass | pass | pass | `.github/workflows/validate-task.yml:30-50` runs markdownlint-cli2, cspell (README and HISTORY scope), actionlint, and editorconfig-checker as pinned action wrappers or Docker, one config per linter at the root. `test-pull-request.yml:31` carries the ruleset-bound `Check pull request workflow status job` | +| linter-parity | pass | pass | pass | `.github/workflows/validate-task.yml:30-50` runs markdownlint-cli2, cspell (README and HISTORY scope), actionlint, and editorconfig-checker as pinned action wrappers or Docker, one config per linter at the root. `.github/workflows/test-pull-request.yml:31` carries the ruleset-bound `Check pull request workflow status job` | | recurring-violations | pass | pass | pass | Hub prose lint over the resync diff is clean. LF throughout, per the registry `lineEndings: lf` and the repository's `.editorconfig`. Three pre-existing whole-tree `dead-path` mentions remain (`GOVERNANCE.md:29`, `GOVERNANCE.md:282`, `OPERATIONS.md:306`), the first two inside carried text and all three left for the files' next edit per the fix-as-edited policy | | readme-structure | pass on `develop` | pass | pass | The seven README letters the `main` run reports (license shield placement, `-link` suffixes, `github-link` naming, group membership) are all closed on `develop` since #40, where the run reports none | | agent-instruction-set | pass on `develop` | pass | pass | Every `AGENTS.md` and `GOVERNANCE.md` verbatim section matches the current canonical after #51. Before the re-vendor, each differing line in every stale region was traced to a past hub commit, so no repository-local rule sat inside a verbatim region. `CODESTYLE.md` carries the hub's skill-pointer form with the repository's own shell rules kept as a subsection of Shell. `.github/copilot-instructions.md` carries the current runbook with an empty Disproved Claims ledger | -| workflow (WORKFLOW.md 5A/5B) | pass | pass | pass | Operational model: `test-pull-request.yml:9-12` runs on `push` to `develop` (advisory) and `pull_request` into `main` (the enforced gate). `publish-release.yml:4` is `workflow_dispatch` only, matching `releaseTrigger: dispatch-only`. `merge-bot-pull-request.yml` uses `actions/create-github-app-token` (SHA-pinned) with the client-id input, matching the baseline mechanism note. `dependabot.yml` declares `github-actions` for both `main` and `develop` | +| workflow (WORKFLOW.md 5A/5B) | pass | pass | pass | Operational model: `.github/workflows/test-pull-request.yml:9-12` runs on `push` to `develop` (advisory) and `pull_request` into `main` (the enforced gate). `.github/workflows/publish-release.yml:4` is `workflow_dispatch` only, matching `releaseTrigger: dispatch-only`. `.github/workflows/merge-bot-pull-request.yml` uses `actions/create-github-app-token` (SHA-pinned) with the client-id input, matching the baseline mechanism note. `.github/dependabot.yml` declares `github-actions` for both `main` and `develop` | csharp, nuget, pypi, python, console, docker, hugo: N/A (no packaging, no application code, no site). @@ -53,5 +53,5 @@ None on `develop`. On `main`, the whole class of stale carried content (2 `AGENT Raised rather than resolved, per AUDIT.md section 9. Each was already on file from a sibling resync the same day, so this run corroborates rather than opens them. 1. **The hub's canonical `.github/copilot-instructions.md` names `ptr727/ProjectTemplate` in intent-fidelity prose**, in "A Shape Nothing Recognizes Blocks the Loop and Earns an Issue" ("File an issue on the hub, `ptr727/ProjectTemplate`"). The template-reference scan exempts only verbatim sections and the hub itself, so every downstream carry of the current canonical trips `carried:` on its next audit. #51 reworded the line to name the hub through `AGENTS.md` "Fleet Bootstrap", and PlexCleaner's carry holds the same line. The fix belongs in the canonical wording. Tracked as #720. -2. **`spec/divergences.json` still dispositions `publish-release.yml` and `validate-task.yml` as `investigate` with no tracking**, so every repository carrying either reports two `hub-only` findings that no repository can act on. The fidelity and `appliesTo` decision the ledger records as pending is the remedy. Tracked as #669. +2. **`spec/divergences.json` still dispositions `.github/workflows/publish-release.yml` and `.github/workflows/validate-task.yml` as `investigate` with no tracking**, so every repository carrying either reports two `hub-only` findings that no repository can act on. The fidelity and `appliesTo` decision the ledger records as pending is the remedy. Tracked as #669. 3. **The `dead-path` prose check flags a carried mention of the hub-hosted `repo-config/configure.sh`** (`GOVERNANCE.md` "Repository Boundaries and Write Safety" is verbatim carried text) in any repository that has deleted its copy, which is now every converged repository. The mention is a pointer to a hub-hosted file, the shape "Documentation Style Conventions" permits, so the check wants the same hub-hosted exemption the template-reference scan gained. Tracked as #721, where it has already failed a downstream promotion gate. From 5b36c08ce7b27fd2d90c4ea48198c9e41f818540 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 15 Aug 2026 08:20:17 -0700 Subject: [PATCH 4/4] Refresh the report to the post-promotion state of main The develop to main promotion merged, and the re-run at main reads what develop read, so the report grades one state rather than two. --- reports/conformance-matrix.md | 2 +- reports/homeautomation-config/audit.md | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/reports/conformance-matrix.md b/reports/conformance-matrix.md index 6b93346b..3e939643 100644 --- a/reports/conformance-matrix.md +++ b/reports/conformance-matrix.md @@ -20,7 +20,7 @@ The primary shapes are stood up as whole repos. The **composable targets** (`nug | `upstream-wrapper` | - | not-tested | - | Tag from a committed state file, not SemVer2. | | `codegen` | - | not-tested | - | Deterministic matrix over both branches. | | `docs` | ProjectTemplate | not-tested | - | Governance hub, and CI is lint-only. | -| `operational` config | HomeAutomation-Config | not-tested | 2026-08-15 | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. Its `develop` ruleset carries no `pull_request` rule, so the branch discipline rests on the instruction rather than the gate. HomeAutomation-Config is the first operational repository with a committed report (`reports/homeautomation-config/audit.md`): `source-only` plus `operational`, `develop` clean on every mechanized check after its 2026-08-15 resync, with the promotion to `main` open at the time of the report. Its `.editorconfig` and `.gitattributes` are an LF adaptation that the intent advisory keeps flagging by construction. | +| `operational` config | HomeAutomation-Config | not-tested | 2026-08-15 | `workflowModel: operational`, direct signed commits to `develop`, promotion-PR gate. Its `develop` ruleset carries no `pull_request` rule, so the branch discipline rests on the instruction rather than the gate. HomeAutomation-Config is the first operational repository with a committed report (`reports/homeautomation-config/audit.md`): `source-only` plus `operational`, clean on every mechanized check on `main` after its 2026-08-15 resync and promotion. Its `.editorconfig` and `.gitattributes` are an LF adaptation that the intent advisory keeps flagging by construction. | ## Composable Targets diff --git a/reports/homeautomation-config/audit.md b/reports/homeautomation-config/audit.md index e9c8cd7b..a705896a 100644 --- a/reports/homeautomation-config/audit.md +++ b/reports/homeautomation-config/audit.md @@ -1,16 +1,16 @@ # Audit: HomeAutomation-Config -- **Audited branch:** main (`e10a2cf`), with the convergence in flight read at `develop` (`c8252c7`) +- **Audited branch:** main (`22ed137`), after the promotion of `develop` (`c8252c7`) - **Types:** source-only (from registry), operational workflow model -- **Verdict:** main not operational (stale carried content), `develop` operational on every mechanized check +- **Verdict:** operational on every mechanized check and every hand-judged dimension - **Date:** 2026-08-15 -- **Run stamps:** `audit run 2026-08-15T14:58:02Z | hub d54862a` (main) and `audit run 2026-08-15T14:58:25Z | hub d54862a | branch override develop` +- **Run stamp:** `audit run 2026-08-15T15:19:01Z | hub 704223a`, with the pre-promotion pair `audit run 2026-08-15T14:58:02Z | hub d54862a` (main at `e10a2cf`) and `audit run 2026-08-15T14:58:25Z | hub d54862a | branch override develop` kept for the record -First committed report for this repository. It was resynced against the hub's `main` (`0e84805`) on this date per `RESYNC.md`, the resync landed on `develop` as ptr727/HomeAutomation-Config#51, and the promotion to `main` is open as ptr727/HomeAutomation-Config#52. So `main` at the time of writing still reads the pre-resync findings, and `develop` is the state `main` takes when that promotion merges. This report grades the two apart rather than letting either stand for the other. +First committed report for this repository. It was resynced against the hub's `main` (`0e84805`) on this date per `RESYNC.md`, the resync landed on `develop` as ptr727/HomeAutomation-Config#51, and the promotion to `main` merged as ptr727/HomeAutomation-Config#52. The pre-promotion runs read `main` at `e10a2cf` with the whole stale-carried-content class open and `develop` clean, and the post-promotion run at `22ed137` reads what `develop` read, so the two branches now grade the same. ## Develop Drift -`develop` vs `main`: `develop` is ahead by 15 content commits since the last promotion (#36), and `main` carries no content `develop` lacks (the trial `git merge-tree` of the two is conflict-free). The commit-count gap in the other direction is the promotion-merge ancestry artifact and is **benign**. The content drift is real and is the resync itself, closed by the promotion. +`develop` vs `main`: identical trees after the #52 promotion merge (15 content commits since #36, conflict-free). The commit-count gap in `main`'s favor is the promotion-merge ancestry artifact and is **benign**. No action. ## Dimensions @@ -23,15 +23,15 @@ First committed report for this repository. It was resynced against the hub's `m | repo-setup | pass | pass | pass | `spec/secrets.json` carries `baseline` plus `note` only, the shape `docs/repo-config-carry.md` states for a source-only repository whose only publish target maps to no mechanism (the dead `targetMechanisms` map dropped in #51). `configure.sh check` reports the Dependabot security features enabled | | linter-parity | pass | pass | pass | `.github/workflows/validate-task.yml:30-50` runs markdownlint-cli2, cspell (README and HISTORY scope), actionlint, and editorconfig-checker as pinned action wrappers or Docker, one config per linter at the root. `.github/workflows/test-pull-request.yml:31` carries the ruleset-bound `Check pull request workflow status job` | | recurring-violations | pass | pass | pass | Hub prose lint over the resync diff is clean. LF throughout, per the registry `lineEndings: lf` and the repository's `.editorconfig`. Three pre-existing whole-tree `dead-path` mentions remain (`GOVERNANCE.md:29`, `GOVERNANCE.md:282`, `OPERATIONS.md:306`), the first two inside carried text and all three left for the files' next edit per the fix-as-edited policy | -| readme-structure | pass on `develop` | pass | pass | The seven README letters the `main` run reports (license shield placement, `-link` suffixes, `github-link` naming, group membership) are all closed on `develop` since #40, where the run reports none | -| agent-instruction-set | pass on `develop` | pass | pass | Every `AGENTS.md` and `GOVERNANCE.md` verbatim section matches the current canonical after #51. Before the re-vendor, each differing line in every stale region was traced to a past hub commit, so no repository-local rule sat inside a verbatim region. `CODESTYLE.md` carries the hub's skill-pointer form with the repository's own shell rules kept as a subsection of Shell. `.github/copilot-instructions.md` carries the current runbook with an empty Disproved Claims ledger | +| readme-structure | pass | pass | pass | The seven README letters the pre-promotion `main` run reported (license shield placement, `-link` suffixes, `github-link` naming, group membership) were closed in #40 and the post-promotion run reports none | +| agent-instruction-set | pass | pass | pass | Every `AGENTS.md` and `GOVERNANCE.md` verbatim section matches the current canonical after #51. Before the re-vendor, each differing line in every stale region was traced to a past hub commit, so no repository-local rule sat inside a verbatim region. `CODESTYLE.md` carries the hub's skill-pointer form with the repository's own shell rules kept as a subsection of Shell. `.github/copilot-instructions.md` carries the current runbook with an empty Disproved Claims ledger | | workflow (WORKFLOW.md 5A/5B) | pass | pass | pass | Operational model: `.github/workflows/test-pull-request.yml:9-12` runs on `push` to `develop` (advisory) and `pull_request` into `main` (the enforced gate). `.github/workflows/publish-release.yml:4` is `workflow_dispatch` only, matching `releaseTrigger: dispatch-only`. `.github/workflows/merge-bot-pull-request.yml` uses `actions/create-github-app-token` (SHA-pinned) with the client-id input, matching the baseline mechanism note. `.github/dependabot.yml` declares `github-actions` for both `main` and `develop` | csharp, nuget, pypi, python, console, docker, hugo: N/A (no packaging, no application code, no site). ## Defects (most severe first) -None on `develop`. On `main`, the whole class of stale carried content (2 `AGENTS.md` and 13 `GOVERNANCE.md` verbatim sections, `.markdownlint-cli2.jsonc`, the carried `configure.sh`, and the README letters) is what #40, #43, #50, and #51 already closed, and it is a defect only until #52 merges. +None. The whole class of stale carried content the pre-promotion `main` run reported (2 `AGENTS.md` and 13 `GOVERNANCE.md` verbatim sections, `.markdownlint-cli2.jsonc`, the carried `configure.sh`, and the README letters) was closed by #40, #43, #50, and #51 and reached `main` with #52. ## Drift Findings @@ -41,7 +41,7 @@ None on `develop`. On `main`, the whole class of stale carried content (2 `AGENT ## Convergence in Flight - ptr727/HomeAutomation-Config#51 (merged into `develop` at `c8252c7`): the resync, one commit per drift class, driven to a Copilot review on its head, one finding fixed and resolved. Coverage read 9 of 11 files on both rounds, which the maintainer accepted at merge. -- ptr727/HomeAutomation-Config#52 (open): the `develop` to `main` promotion. Copilot reviewed the head, one finding deferred to ptr727/HomeAutomation-Config#53 (Duplicacy credentials on a command line in `Duplicacy/init-storage.sh`, content from #45 rather than from the resync), thread resolved, checks 6/6, coverage 72 of 76 files, left for the maintainer to merge. +- ptr727/HomeAutomation-Config#52 (merged as `22ed137`): the `develop` to `main` promotion. Copilot reviewed the head, one finding deferred to ptr727/HomeAutomation-Config#53 (Duplicacy credentials on a command line in `Duplicacy/init-storage.sh`, content from #45 rather than from the resync), thread resolved, checks 6/6, coverage 72 of 76 files, which the maintainer accepted at merge. ## Proposed Registry / Spec Updates