From c1f997eb024d538fb038c8d2067164a58137a020 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Wed, 26 Aug 2026 11:13:23 -0700 Subject: [PATCH 1/2] Fix Six Findings From the Promotion PR's Fresh Review Pass Per CodeRabbit's fresh review of PR #1027 (the develop -> main diff): 1. standup-a-repo/SKILL.md instructed apply before check, the opposite of resync-a-repo/SKILL.md's own correct check-then-apply order (an unreviewed configuration change before the planned result is known). Swapped to check-then-apply, pre-existing before this session's own edits but touched by the earlier |-quoting fix on this same line. 2. dotnet-codestyle/references/conventions.md's GetQuoteOfTheDayAsync example used Task.Delay(0, cancellationToken), which the .NET runtime completes immediately regardless of later cancellation (a documented zero-delay fast path), so the example did not actually demonstrate the cancellation contract its own XML doc promised. Added an explicit ThrowIfCancellationRequested() and switched to a non-zero delay, which does observe the token. 3. python-codestyle/references/testing.md's lint-only profile description read as if 'no uv.lock' were why pytest is unused, conflating two separate facts. Stated them separately. 4-5. resync-a-repo/SKILL.md and skill-lifecycle/SKILL.md: the earlier fix on PR #1026 (per a different reviewer's finding, restating the commit-authorization rule) trimmed the wording to a bare pointer, removing the conditionality itself from the instruction, not only the restated substance. Restored a minimal 'once authorized' gate word alongside the pointer, resolving both concerns. 6. spec/divergences.json's carrier-list sentence read as if the issue number ptr727/ProjectTemplate#669 were itself one of the carrier repos. Restructured so the carrier statement and tracking reference are distinct sentences. Regenerated reports/divergences.md. --- .agents/skills/dotnet-codestyle/references/conventions.md | 3 ++- .agents/skills/python-codestyle/references/testing.md | 6 +++--- .agents/skills/resync-a-repo/SKILL.md | 3 ++- .agents/skills/skill-lifecycle/SKILL.md | 2 +- .agents/skills/standup-a-repo/SKILL.md | 8 ++++---- .claude-plugin/fleet-skills/.source-digest | 2 +- .../skills/dotnet-codestyle/references/conventions.md | 3 ++- .../skills/python-codestyle/references/testing.md | 6 +++--- .claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md | 3 ++- .../fleet-skills/skills/skill-lifecycle/SKILL.md | 2 +- .../fleet-skills/skills/standup-a-repo/SKILL.md | 8 ++++---- .github/skills/dotnet-codestyle/references/conventions.md | 3 ++- .github/skills/python-codestyle/references/testing.md | 6 +++--- .github/skills/resync-a-repo/SKILL.md | 3 ++- .github/skills/skill-lifecycle/SKILL.md | 2 +- .github/skills/standup-a-repo/SKILL.md | 8 ++++---- reports/divergences.md | 2 +- spec/divergences.json | 2 +- 18 files changed, 39 insertions(+), 33 deletions(-) diff --git a/.agents/skills/dotnet-codestyle/references/conventions.md b/.agents/skills/dotnet-codestyle/references/conventions.md index 2421ab73..46897c81 100644 --- a/.agents/skills/dotnet-codestyle/references/conventions.md +++ b/.agents/skills/dotnet-codestyle/references/conventions.md @@ -129,7 +129,8 @@ public async Task GetQuoteOfTheDayAsync(string category, CancellationTok throw new ArgumentException($"Unsupported category: {category}", nameof(category)); } - await Task.Delay(0, cancellationToken); + cancellationToken.ThrowIfCancellationRequested(); + await Task.Delay(1, cancellationToken); return $"Quote for {category}"; } ``` diff --git a/.agents/skills/python-codestyle/references/testing.md b/.agents/skills/python-codestyle/references/testing.md index 54b756a8..0dae3fd4 100644 --- a/.agents/skills/python-codestyle/references/testing.md +++ b/.agents/skills/python-codestyle/references/testing.md @@ -1,8 +1,8 @@ # Python Testing Conventions -This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` to run pytest -against, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) are -in `references/profiles.md`. +This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` and does not +use pytest, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) +are in `references/profiles.md`. Use `pytest` with configuration in `[tool.pytest.ini_options]`. Default invocation: `uv run pytest`. diff --git a/.agents/skills/resync-a-repo/SKILL.md b/.agents/skills/resync-a-repo/SKILL.md index 83aea93d..019e45de 100644 --- a/.agents/skills/resync-a-repo/SKILL.md +++ b/.agents/skills/resync-a-repo/SKILL.md @@ -82,4 +82,5 @@ One focused pull request per drift class, branched from the target's `develop`, push to a protected branch and never a hand edit outside a pull request. Close the review loop, per the `pr-review-conduct` skill, before asking the maintainer for merge permission. The maintainer merges, the agent drives to green and stops. Re-run the audit after the merge and -commit the report per `git-commit-conventions`, done means measured, not applied. +commit the report once authorized, per `git-commit-conventions`, done means measured, not +applied. diff --git a/.agents/skills/skill-lifecycle/SKILL.md b/.agents/skills/skill-lifecycle/SKILL.md index f866746c..aa853916 100644 --- a/.agents/skills/skill-lifecycle/SKILL.md +++ b/.agents/skills/skill-lifecycle/SKILL.md @@ -28,7 +28,7 @@ A skill surfaces at a trigger moment. A rule that binds every action all the tim 3. **Author the body per the `comment-and-doc-style` skill**: LF (the repo default), present tense, ASCII tiers, no semicolon in prose. Name hub paths as plain code spans rather than repo-relative links, because an installed copy resolves no repo path, and say "from a hub checkout" for anything the reader must run. 4. **Split bulk into `references/`** when the source doc is large: the SKILL.md carries the summary and the binding rules, and each `references/*.md` carries one topic read on demand, the shape `comment-and-doc-style` uses. 5. **Apply the doc-packaging pattern below in the same change** when the skill packages a law doc or one of its sections. -6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself. +6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then, once authorized, commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself. 7. **Record the surfacing**: annotate the `AGENTS.md` "Where the Rules Live" row when the skill packages a GOVERNANCE section, or its closing paragraph when the skill is new content, so the map stays the one place coverage is read from. 8. **Refresh the machines after merge**: re-run `python3 scripts/skills_install.py` per machine, the cadence `docs/host-setup.md` "Fleet Skills Install" states. Until then every machine serves the previous skill set, which `--report` says. diff --git a/.agents/skills/standup-a-repo/SKILL.md b/.agents/skills/standup-a-repo/SKILL.md index 8269093d..c624bfe2 100644 --- a/.agents/skills/standup-a-repo/SKILL.md +++ b/.agents/skills/standup-a-repo/SKILL.md @@ -74,10 +74,10 @@ maintainer can supply what section 0A lists. inventing a shape. 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub - repository agree before running anything else here, then apply with - `repo-config/configure.sh apply owner/repo release` (substitute `operational` for an - operational repo) from the hub at `main` and check with the same command's `check` subcommand, - never from a hand-built or carried copy. + repository agree before running anything else here, then run + `repo-config/configure.sh check owner/repo release` (substitute `operational` for an + operational repo) from the hub at `main`, then apply only what it reports with the same + command's `apply` subcommand, never from a hand-built or carried copy. 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood up only when it passes for its type, or its residual deltas are tracked in diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest index 3952a619..f38bee2d 100644 --- a/.claude-plugin/fleet-skills/.source-digest +++ b/.claude-plugin/fleet-skills/.source-digest @@ -1 +1 @@ -9bf75d7cd0da2253 +9125c51873532502 diff --git a/.claude-plugin/fleet-skills/skills/dotnet-codestyle/references/conventions.md b/.claude-plugin/fleet-skills/skills/dotnet-codestyle/references/conventions.md index 2421ab73..46897c81 100644 --- a/.claude-plugin/fleet-skills/skills/dotnet-codestyle/references/conventions.md +++ b/.claude-plugin/fleet-skills/skills/dotnet-codestyle/references/conventions.md @@ -129,7 +129,8 @@ public async Task GetQuoteOfTheDayAsync(string category, CancellationTok throw new ArgumentException($"Unsupported category: {category}", nameof(category)); } - await Task.Delay(0, cancellationToken); + cancellationToken.ThrowIfCancellationRequested(); + await Task.Delay(1, cancellationToken); return $"Quote for {category}"; } ``` diff --git a/.claude-plugin/fleet-skills/skills/python-codestyle/references/testing.md b/.claude-plugin/fleet-skills/skills/python-codestyle/references/testing.md index 54b756a8..0dae3fd4 100644 --- a/.claude-plugin/fleet-skills/skills/python-codestyle/references/testing.md +++ b/.claude-plugin/fleet-skills/skills/python-codestyle/references/testing.md @@ -1,8 +1,8 @@ # Python Testing Conventions -This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` to run pytest -against, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) are -in `references/profiles.md`. +This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` and does not +use pytest, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) +are in `references/profiles.md`. Use `pytest` with configuration in `[tool.pytest.ini_options]`. Default invocation: `uv run pytest`. diff --git a/.claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md b/.claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md index 83aea93d..019e45de 100644 --- a/.claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md @@ -82,4 +82,5 @@ One focused pull request per drift class, branched from the target's `develop`, push to a protected branch and never a hand edit outside a pull request. Close the review loop, per the `pr-review-conduct` skill, before asking the maintainer for merge permission. The maintainer merges, the agent drives to green and stops. Re-run the audit after the merge and -commit the report per `git-commit-conventions`, done means measured, not applied. +commit the report once authorized, per `git-commit-conventions`, done means measured, not +applied. diff --git a/.claude-plugin/fleet-skills/skills/skill-lifecycle/SKILL.md b/.claude-plugin/fleet-skills/skills/skill-lifecycle/SKILL.md index f866746c..aa853916 100644 --- a/.claude-plugin/fleet-skills/skills/skill-lifecycle/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/skill-lifecycle/SKILL.md @@ -28,7 +28,7 @@ A skill surfaces at a trigger moment. A rule that binds every action all the tim 3. **Author the body per the `comment-and-doc-style` skill**: LF (the repo default), present tense, ASCII tiers, no semicolon in prose. Name hub paths as plain code spans rather than repo-relative links, because an installed copy resolves no repo path, and say "from a hub checkout" for anything the reader must run. 4. **Split bulk into `references/`** when the source doc is large: the SKILL.md carries the summary and the binding rules, and each `references/*.md` carries one topic read on demand, the shape `comment-and-doc-style` uses. 5. **Apply the doc-packaging pattern below in the same change** when the skill packages a law doc or one of its sections. -6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself. +6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then, once authorized, commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself. 7. **Record the surfacing**: annotate the `AGENTS.md` "Where the Rules Live" row when the skill packages a GOVERNANCE section, or its closing paragraph when the skill is new content, so the map stays the one place coverage is read from. 8. **Refresh the machines after merge**: re-run `python3 scripts/skills_install.py` per machine, the cadence `docs/host-setup.md` "Fleet Skills Install" states. Until then every machine serves the previous skill set, which `--report` says. diff --git a/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md b/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md index 8269093d..c624bfe2 100644 --- a/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md @@ -74,10 +74,10 @@ maintainer can supply what section 0A lists. inventing a shape. 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub - repository agree before running anything else here, then apply with - `repo-config/configure.sh apply owner/repo release` (substitute `operational` for an - operational repo) from the hub at `main` and check with the same command's `check` subcommand, - never from a hand-built or carried copy. + repository agree before running anything else here, then run + `repo-config/configure.sh check owner/repo release` (substitute `operational` for an + operational repo) from the hub at `main`, then apply only what it reports with the same + command's `apply` subcommand, never from a hand-built or carried copy. 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood up only when it passes for its type, or its residual deltas are tracked in diff --git a/.github/skills/dotnet-codestyle/references/conventions.md b/.github/skills/dotnet-codestyle/references/conventions.md index 2421ab73..46897c81 100644 --- a/.github/skills/dotnet-codestyle/references/conventions.md +++ b/.github/skills/dotnet-codestyle/references/conventions.md @@ -129,7 +129,8 @@ public async Task GetQuoteOfTheDayAsync(string category, CancellationTok throw new ArgumentException($"Unsupported category: {category}", nameof(category)); } - await Task.Delay(0, cancellationToken); + cancellationToken.ThrowIfCancellationRequested(); + await Task.Delay(1, cancellationToken); return $"Quote for {category}"; } ``` diff --git a/.github/skills/python-codestyle/references/testing.md b/.github/skills/python-codestyle/references/testing.md index 54b756a8..0dae3fd4 100644 --- a/.github/skills/python-codestyle/references/testing.md +++ b/.github/skills/python-codestyle/references/testing.md @@ -1,8 +1,8 @@ # Python Testing Conventions -This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` to run pytest -against, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) are -in `references/profiles.md`. +This covers the **build** profile. A **lint-only** Scripts profile has no `uv.lock` and does not +use pytest, its testing conventions (`unittest`, `uvx coverage@latest run -m unittest discover`) +are in `references/profiles.md`. Use `pytest` with configuration in `[tool.pytest.ini_options]`. Default invocation: `uv run pytest`. diff --git a/.github/skills/resync-a-repo/SKILL.md b/.github/skills/resync-a-repo/SKILL.md index 83aea93d..019e45de 100644 --- a/.github/skills/resync-a-repo/SKILL.md +++ b/.github/skills/resync-a-repo/SKILL.md @@ -82,4 +82,5 @@ One focused pull request per drift class, branched from the target's `develop`, push to a protected branch and never a hand edit outside a pull request. Close the review loop, per the `pr-review-conduct` skill, before asking the maintainer for merge permission. The maintainer merges, the agent drives to green and stops. Re-run the audit after the merge and -commit the report per `git-commit-conventions`, done means measured, not applied. +commit the report once authorized, per `git-commit-conventions`, done means measured, not +applied. diff --git a/.github/skills/skill-lifecycle/SKILL.md b/.github/skills/skill-lifecycle/SKILL.md index f866746c..aa853916 100644 --- a/.github/skills/skill-lifecycle/SKILL.md +++ b/.github/skills/skill-lifecycle/SKILL.md @@ -28,7 +28,7 @@ A skill surfaces at a trigger moment. A rule that binds every action all the tim 3. **Author the body per the `comment-and-doc-style` skill**: LF (the repo default), present tense, ASCII tiers, no semicolon in prose. Name hub paths as plain code spans rather than repo-relative links, because an installed copy resolves no repo path, and say "from a hub checkout" for anything the reader must run. 4. **Split bulk into `references/`** when the source doc is large: the SKILL.md carries the summary and the binding rules, and each `references/*.md` carries one topic read on demand, the shape `comment-and-doc-style` uses. 5. **Apply the doc-packaging pattern below in the same change** when the skill packages a law doc or one of its sections. -6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself. +6. **Regenerate and commit all trees together**: `python3 scripts/build_dist.py`, then, once authorized, commit the source and both generated trees in one commit, per `git-commit-conventions`. CI runs `--check` on every pull request and fails a desynced distribution. `python3 scripts/tests/test_build_dist.py` covers the generator itself. 7. **Record the surfacing**: annotate the `AGENTS.md` "Where the Rules Live" row when the skill packages a GOVERNANCE section, or its closing paragraph when the skill is new content, so the map stays the one place coverage is read from. 8. **Refresh the machines after merge**: re-run `python3 scripts/skills_install.py` per machine, the cadence `docs/host-setup.md` "Fleet Skills Install" states. Until then every machine serves the previous skill set, which `--report` says. diff --git a/.github/skills/standup-a-repo/SKILL.md b/.github/skills/standup-a-repo/SKILL.md index 8269093d..c624bfe2 100644 --- a/.github/skills/standup-a-repo/SKILL.md +++ b/.github/skills/standup-a-repo/SKILL.md @@ -74,10 +74,10 @@ maintainer can supply what section 0A lists. inventing a shape. 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub - repository agree before running anything else here, then apply with - `repo-config/configure.sh apply owner/repo release` (substitute `operational` for an - operational repo) from the hub at `main` and check with the same command's `check` subcommand, - never from a hand-built or carried copy. + repository agree before running anything else here, then run + `repo-config/configure.sh check owner/repo release` (substitute `operational` for an + operational repo) from the hub at `main`, then apply only what it reports with the same + command's `apply` subcommand, never from a hand-built or carried copy. 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood up only when it passes for its type, or its residual deltas are tracked in diff --git a/reports/divergences.md b/reports/divergences.md index 612d53e8..ca3ab12f 100644 --- a/reports/divergences.md +++ b/reports/divergences.md @@ -10,7 +10,7 @@ Generated by `python3 spec/fidelity_honesty.py --report` - do not hand-edit. Cur ### investigate -- **pyproject.toml** (manifest gap, carried by Financial-Modeling, aiopurpleair, homeassistant-purpleair) (tracking: ptr727/ProjectTemplate#669) - The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows carriers (ptr727/ProjectTemplate#669), so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's. +- **pyproject.toml** (manifest gap, carried by Financial-Modeling, aiopurpleair, homeassistant-purpleair) (tracking: ptr727/ProjectTemplate#669) - The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows the carriers. The decision is tracked in ptr727/ProjectTemplate#669, so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's. ### retire diff --git a/spec/divergences.json b/spec/divergences.json index c8aa8379..5a16e7fa 100644 --- a/spec/divergences.json +++ b/spec/divergences.json @@ -20,7 +20,7 @@ { "path": "scripts/README.md", "disposition": "accepted", "reason": "A path collision rather than a carry. KiCadLibrary's copy documents its own KiCad tooling (common.py, verify_library.py, build_library.py) beside the scripts it describes, and shares nothing with the hub's fleet-gate documentation. Verified by reading it on 2026-08-10. scripts/ is a generic path, so a repo with its own tooling directory matches this check without carrying anything of the hub's.", "tracking": null }, { "path": ".github/actionlint.yaml", "disposition": "accepted", "reason": "A path collision rather than a carry. HomeAutomation-Config's own copy declares self-hosted-runner labels (homelab, ubuntu-24.04) for its self-hosted CI runner, entirely different content from the hub's own file at this path, which configures $/ self-reference ignore rules for the hub's own workflows. Verified by reading both copies on 2026-08-25.", "tracking": null }, { "path": ".github/actions/validate/action.yml", "disposition": "accepted", "reason": "A path collision rather than a carry. HomeAutomation-Config's own copy overrides the interface-workflow validate hook, per RESYNC.md 'Apply, in This Order' item 4, 'Interface workflows': 'Honor the named contract... rather than copying bytes. The body is the repository's own.' It runs its CloudInit/ nested Python project through uv/ruff/pyright/pytest. The hub's own file at this same path is a different override, its own registry/spec self-test suite. A repo declaring its own .github/actions/validate/action.yml is the documented, intended override mechanism, not drift to reconcile. Verified by reading both copies on 2026-08-25.", "tracking": null }, - { "path": "pyproject.toml", "disposition": "investigate", "reason": "The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows carriers (ptr727/ProjectTemplate#669), so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's.", "tracking": "ptr727/ProjectTemplate#669" }, + { "path": "pyproject.toml", "disposition": "investigate", "reason": "The hub gained a config-only Scripts-profile pyproject.toml in #388. Decide whether to track it (intent, appliesTo python) after confirming the Python repos carry an equivalent. reports/divergences.md already shows the carriers. The decision is tracked in ptr727/ProjectTemplate#669, so the remaining call is the fleet-wide new-findings tradeoff, which stays the maintainer's.", "tracking": "ptr727/ProjectTemplate#669" }, { "path": ".github/workflows/get-version-task.yml", "disposition": "retire", "reason": "The task is hub-hosted rather than carried, per GOVERNANCE.md \"Hub-Hosted Tooling\", so it is no manifest entry and a downstream copy is retired rather than re-vendored. Every copy is the hub's own NBGV logic with nothing per-repo in it beyond the action pins Dependabot already owns. The carriers, read from the fleet on 2026-08-15, are ESPHome-NonRoot, NxWitness, PhotoCleaner, PlexCleaner, VSCode-Server-DotNetCore, KiCadLibrary, aiopurpleair, and homeassistant-purpleair. Delete the copy and reach the hub task by pin as each repo is next visited, per docs/reusable-workflows.md \"Adopting the Pure Functions\".", "tracking": null }, { "path": ".github/workflows/publish-plan-task.yml", "disposition": "retire", "reason": "The task is hub-hosted rather than carried, per GOVERNANCE.md \"Hub-Hosted Tooling\", so it is no manifest entry and a downstream copy is retired rather than re-vendored. The carriers, read from the fleet on 2026-08-15, are ESPHome-NonRoot, NxWitness, and Utilities, and all three carry a strict subset of the canonical, missing the -E in set -Eeuo pipefail and the ::warning:: branch for an unrecognized actor pushing to main (WORKFLOW.md D8.4). Delete the copy and reach the hub task by pin as each repo is next visited, per docs/reusable-workflows.md \"Adopting the Pure Functions\".", "tracking": null }, { "path": ".github/workflows/validate-task.yml", "disposition": "retire", "reason": "The file is hub-hosted as a workflow_call task rather than carried, per GOVERNANCE.md \"Hub-Hosted Tooling\" and docs/reusable-workflows.md \"Stage 2: The Gates\". The fleet doc-lint block, the language lint, the prose gate, and the repo gate move into the hub task, and a repo's own domain checks move into its own .github/actions/validate/action.yml hook instead, so a downstream copy is retired rather than re-vendored. The thirteen repos carrying a copy as of 2026-08-16 were PhotoCleaner, PlexCleaner, LanguageTags, Utilities, MediaTools, AudioCleaner, aiopurpleair, Financial-Modeling, Blog, ESPHome-NonRoot, NxWitness, VSCode-Server-DotNetCore, and HomeAutomation-Config, and the live current carrier list above may have moved on since. Delete the copy and adopt the caller stub in docs/reusable-workflows.md \"Adopting the Gates\" as each repo is next visited.", "tracking": null }, From b2c6a849d22a33d0e89358f3bb968c8654599646 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Wed, 26 Aug 2026 11:23:06 -0700 Subject: [PATCH 2/2] Describe configure.sh's Real check/apply Contract Accurately Per review on PR #1029 (CodeRabbit), verified against repo-config/configure.sh itself: 1. 'apply only what it reports' misdescribed apply's actual behavior. apply always writes the full committed configuration (settings + Dependabot security features + both rulesets), idempotently, regardless of what a prior check run found. There is no scoped-to-check's-findings apply mode. 2. cmd_check exits 1 specifically when it finds drift ('Configuration drift detected on $repo.' then exit 1), not only on a genuine command failure. A reader chaining check && apply, or reading a non-zero exit as an error to stop on, would never reach apply on the very case it exists to fix. Stated explicitly that a non-zero check exit means drift, not failure. --- .agents/skills/standup-a-repo/SKILL.md | 6 ++++-- .claude-plugin/fleet-skills/.source-digest | 2 +- .claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md | 6 ++++-- .github/skills/standup-a-repo/SKILL.md | 6 ++++-- 4 files changed, 13 insertions(+), 7 deletions(-) diff --git a/.agents/skills/standup-a-repo/SKILL.md b/.agents/skills/standup-a-repo/SKILL.md index c624bfe2..f9d2b4f5 100644 --- a/.agents/skills/standup-a-repo/SKILL.md +++ b/.agents/skills/standup-a-repo/SKILL.md @@ -76,8 +76,10 @@ maintainer can supply what section 0A lists. 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub repository agree before running anything else here, then run `repo-config/configure.sh check owner/repo release` (substitute `operational` for an - operational repo) from the hub at `main`, then apply only what it reports with the same - command's `apply` subcommand, never from a hand-built or carried copy. + operational repo) from the hub at `main`. A non-zero exit there means drift was found, not a + command failure. Review what it reports. Then run the same command's `apply` subcommand, which + idempotently reconciles the repo to the full committed configuration regardless of what `check` + reported, never from a hand-built or carried copy. 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood up only when it passes for its type, or its residual deltas are tracked in diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest index f38bee2d..ce2732c5 100644 --- a/.claude-plugin/fleet-skills/.source-digest +++ b/.claude-plugin/fleet-skills/.source-digest @@ -1 +1 @@ -9125c51873532502 +5ab0e6a26d537def diff --git a/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md b/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md index c624bfe2..f9d2b4f5 100644 --- a/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/standup-a-repo/SKILL.md @@ -76,8 +76,10 @@ maintainer can supply what section 0A lists. 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub repository agree before running anything else here, then run `repo-config/configure.sh check owner/repo release` (substitute `operational` for an - operational repo) from the hub at `main`, then apply only what it reports with the same - command's `apply` subcommand, never from a hand-built or carried copy. + operational repo) from the hub at `main`. A non-zero exit there means drift was found, not a + command failure. Review what it reports. Then run the same command's `apply` subcommand, which + idempotently reconciles the repo to the full committed configuration regardless of what `check` + reported, never from a hand-built or carried copy. 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood up only when it passes for its type, or its residual deltas are tracked in diff --git a/.github/skills/standup-a-repo/SKILL.md b/.github/skills/standup-a-repo/SKILL.md index c624bfe2..f9d2b4f5 100644 --- a/.github/skills/standup-a-repo/SKILL.md +++ b/.github/skills/standup-a-repo/SKILL.md @@ -76,8 +76,10 @@ maintainer can supply what section 0A lists. 8. **Settings, rulesets, and secrets.** STANDUP.md section 4: confirm the remote and the GitHub repository agree before running anything else here, then run `repo-config/configure.sh check owner/repo release` (substitute `operational` for an - operational repo) from the hub at `main`, then apply only what it reports with the same - command's `apply` subcommand, never from a hand-built or carried copy. + operational repo) from the hub at `main`. A non-zero exit there means drift was found, not a + command failure. Review what it reports. Then run the same command's `apply` subcommand, which + idempotently reconciles the repo to the full committed configuration regardless of what `check` + reported, never from a hand-built or carried copy. 9. **Verify with the audit.** STANDUP.md section 5: run `AUDIT.md` end to end. The repo is stood up only when it passes for its type, or its residual deltas are tracked in