From da35cdee2d99751c98b6fc483cb717ea3f88b364 Mon Sep 17 00:00:00 2001 From: bastien Date: Sun, 27 Sep 2026 21:26:55 +0200 Subject: [PATCH 1/3] =?UTF-8?q?chore(memory):=20case=204=20reticle=20parke?= =?UTF-8?q?d=20with=20a=20pilot=20recipe=20=E2=80=94=20TODO=20+=20journal?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .claude/memory/journal.md | 1 + .claude/tasks/TODO.md | 23 +++++++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md index d259d8e..40b77e9 100644 --- a/.claude/memory/journal.md +++ b/.claude/memory/journal.md @@ -518,3 +518,4 @@ rules: ## 2026-09-27 - bugfix/gitignore-diagram-allowlist merged into develop on user go, `gitflow finish` → facd26d, pushed, copies removed by the lib. Day 2026-09-25 lot fully on develop: BDR-101 default profile, full +4 gstack skills, gitignore allowlist. No working branch anywhere; `skills/diagram` ignored. +- Case 4 (reticle 898 stars, 3 months, FSL server): only repo of the six with a capability nothing local has (store state, verdict with file:line, replayable flows, CI gate). User go: parked with a 4-step pilot recipe in TODO (opt-in external, pinned, wrapper skill that never runs `init`, telemetry off, staging only). chore/six-repo-review-notes UNMERGED. diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md index 384daf7..7506855 100644 --- a/.claude/tasks/TODO.md +++ b/.claude/tasks/TODO.md @@ -1,5 +1,28 @@ # TODO +## 2026-09-27 — case 4 of the 6-repo review: reticle parked with a pilot recipe (chore/six-repo-review-notes) +User go "parquer avec la recette". Real gap (runtime store state, structured +verdicts with file:line, replayable flows, CI `gate --since`), no current project +needs it; cost = per-project build instrumentation in the client repo, ~4.9k +tokens of MCP schemas per session, PostHog telemetry on by default, a skill that +auto-runs `init` against "ask, don't guess". Trigger: first app-type project +(client state, forms, auth, cart). +- [ ] P1 external opt-in in lib/toggle-external.sh + profiles (off by default, + qa-class); `@reticlehq/server` pinned in plugins.lock.json (plugin v3.3.0 + seen 2026-09-27), never `@latest`. +- [ ] P2 local wrapper skill replacing theirs: `npx @reticlehq/server init + --dry-run` shown to the user, never run by the agent (runbook doctrine); + MCP env `DO_NOT_TRACK=1` `RETICLE_TELEMETRY=0`; verify only after the + user ran init. +- [ ] P3 pilot on staging only (secret redaction is name-based); flows + committed, evidence gitignored; `gate --since` in CI evaluated before + adoption. +- [ ] P4 measure tokens per verification loop vs gstack browse on one page. +Sources read 2026-09-27: docs/what-is-recorded.md, telemetry.md, +token-efficiency.md, enterprise.md (core verification free; SSO/SCIM/RBAC/ +policy gates under ee/), LICENSE split FSL-1.1-ALv2 server+init, Apache +adapters/core/engine. Stars 898, created 2026-06-11, 2 551 commits. + ## 2026-09-25 — full profile +4 gstack web/doc skills (bugfix/full-profile-web-doc-skills) User go after the "why is gstack off under full?" answer (it was not: unapplied default). `scrape`, `skillify`, `diagram`, `make-pdf` join full.profile; the rest From 197225ab465d9d0beca0efaaee3ada29d7d7fc68 Mon Sep 17 00:00:00 2001 From: bastien Date: Sun, 27 Sep 2026 21:34:10 +0200 Subject: [PATCH 2/3] =?UTF-8?q?chore(memory):=20case=205=20OmniRoute=20rej?= =?UTF-8?q?ected=20=E2=80=94=20TODO=20+=20journal,=20review=20complete?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .claude/memory/journal.md | 1 + .claude/tasks/TODO.md | 13 +++++++++++++ 2 files changed, 14 insertions(+) diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md index 40b77e9..77192f0 100644 --- a/.claude/memory/journal.md +++ b/.claude/memory/journal.md @@ -519,3 +519,4 @@ rules: ## 2026-09-27 - bugfix/gitignore-diagram-allowlist merged into develop on user go, `gitflow finish` → facd26d, pushed, copies removed by the lib. Day 2026-09-25 lot fully on develop: BDR-101 default profile, full +4 gstack skills, gitignore allowlist. No working branch anywhere; `skills/diagram` ignored. - Case 4 (reticle 898 stars, 3 months, FSL server): only repo of the six with a capability nothing local has (store state, verdict with file:line, replayable flows, CI gate). User go: parked with a 4-step pilot recipe in TODO (opt-in external, pinned, wrapper skill that never runs `init`, telemetry off, staging only). chore/six-repo-review-notes UNMERGED. +- Case 5 (OmniRoute 70.6k stars, 1 GB, 96 deps): rejected. Subscription cannot pass through a keyed gateway; fail-open guardrails, default JWT secret admin bypass, Socket.dev block on 3.8.5, TLS fingerprint spoofing + free-tier key pools. Zero gap for a Claude-only subscription workflow. 6-repo review complete: 4 branches UNMERGED (yagni-ladder, agent-skills-borrow, web-building-microrules, six-repo-review-notes). diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md index 7506855..dbb6ea5 100644 --- a/.claude/tasks/TODO.md +++ b/.claude/tasks/TODO.md @@ -1,5 +1,18 @@ # TODO +## 2026-09-27 — case 5 of the 6-repo review: OmniRoute rejected (chore/six-repo-review-notes) +Gateway to 357 providers via `ANTHROPIC_BASE_URL` → localhost:20128; needs provider +API keys, a Claude Pro/Max subscription cannot go through it. No gap here: Claude-only +workflow on subscription, codex second opinion already via gstack `codex` CLI, rtk +native, caveman purged. Against: sits in the path of every prompt with 96 deps and +a fail-open guardrail design (doctrine says fail closed); default JWT secret +`omniroute-default-secret-change-me` = admin bypass if unchanged; npm 3.8.5 blocked +by Socket.dev (May 2026, malware indicators), two real vulns closed in 3.8.6; JA3/JA4 +TLS fingerprint impersonation + 40 pooled free-tier keys = provider-ToS risk; no +audit, SBOM or signing. Stars 70.6k in 7 months. Not to be re-evaluated unless a +multi-provider need appears, and then a keyed gateway is still not the answer. +- [x] R1 verdict recorded, nothing installed, nothing built. + ## 2026-09-27 — case 4 of the 6-repo review: reticle parked with a pilot recipe (chore/six-repo-review-notes) User go "parquer avec la recette". Real gap (runtime store state, structured verdicts with file:line, replayable flows, CI `gate --since`), no current project From 7b0d4977ad1d3ff0bc9aa1f870a0491f4b4a4cf4 Mon Sep 17 00:00:00 2001 From: bastien Date: Sun, 27 Sep 2026 23:27:30 +0200 Subject: [PATCH 3/3] =?UTF-8?q?chore(memory):=20BDR-103=20=E2=80=94=206-re?= =?UTF-8?q?po=20review=20verdicts=20and=20criteria?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .claude/memory/decisions.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md index a2174db..0a00446 100644 --- a/.claude/memory/decisions.md +++ b/.claude/memory/decisions.md @@ -123,6 +123,7 @@ rules: | BDR-099 | 2026-09-24 | C2 coherence: 30 doctrine/skill tensions resolved, doctrine wins, BDR-068 kept as the written exception | accepted | | BDR-100 | 2026-09-24 | Guardrail evasion and partial rule changes get mechanisms, not lessons: refusal ends the attempt, citers census in make test | accepted | | BDR-101 | 2026-09-25 | `full` = default profile: no selection ⇒ full in force, `reset` applies it, install applies it | accepted | +| BDR-103 | 2026-09-27 | 6-repo review: 5 verdicts, 3 criteria (grep-verified coverage, per-session cost, doctrine conflict); stars decided nothing | accepted | --- @@ -1270,3 +1271,19 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate). - **Alternatives rejected**: label-only reset (lies about plugins/externals); additive reset (`gstack on` + `apply full`, state ⊇ full, label ambiguous); keep `none` sentinel + statusline `?` (request unmet); install display-only (fresh machine ≠ full, 21st pack parked); public `profile.sh default` verb for installer (reset already IS "go to default"); one shared cache parser (statusline must not spawn profile.sh → 3 copies kept, each commented). - **Caveats**: `make plugin` re-run re-applies selected profile → manual layering (`gstack on` over `dev`) trimmed back. Plugin legs of Step 11 install-immutable ([[BDR-028]] EXIT guard; committed enabledPlugins already match full). LOW security note: cache content not charset-checked before path use (pre-existing in `read_profile`) → follow-up. - **Reference**: commits e196328 (residue scrub), 0d035fc (profile), 1bbdad0 (install); contract/plan `2026-09-25-default-profile-full-1254`; `lib/tests/profile-default.test.sh` 29 checks. Links [[BDR-017]] [[BDR-018]] [[BDR-079]] [[BDR-093]] [[LRN-170]] [[EVAL-031]]. + +## BDR-103 — 6-repo review: 5 verdicts, 3 criteria; stars decided nothing +- **Date**: 2026-09-27 +- **Status**: accepted, chore/six-repo-review-notes, merge on user go 2026-09-27 +- **Decision** (user-approved case by case, order = layer touched per turn → orthogonal): + | repo | stars | verdict | one-line why | + |---|---|---|---| + | ponytail + chisle | 146.7k / 566 | no plugin; ordered YAGNI ladder + `shortcut:` marker into § Code style (feature/yagni-ladder) | per-turn + per-subagent injection, prose rules vs writing-style.md, caveman purge precedent, rtk covers the input axis | + | addyosmani/agent-skills | 99.4k | no plugin; vendor 3 skills, build floor-guard + routing census, distil rest-api rule ([[BDR-102]]) | 20/25 covered, 1.8k tok/session, /spec /review /ship collide, trunk-based + one-version vs doctrine, second router | + | ibelick/ui-skills | 9.2k | nothing installed; 14 micro-rule lines in rules/web-building.md | CLI/MCP = curl of raw SKILL.md, third router, baseline-ui stack mandates vs Astro-first; registry of 36 third-party skills (mengto motion pack) NOT evaluated | + | reticlehq/reticle | 898 | parked, 4-step pilot recipe in TODO | only real capability gap (store state, verdict with file:line, replayable flows, CI gate); FSL server, PostHog telemetry, per-project build instrumentation, skill auto-runs `init` | + | OmniRoute | 70.6k | rejected, no recipe | subscription cannot pass a keyed gateway; fail-open guardrails, default JWT secret, Socket.dev block on 3.8.5, JA3/JA4 spoofing + free-tier pools | +- **Criteria that decided every case**: (1) coverage verified by grep on local assets (skills, agents, rules, archetypes), never from the README; (2) permanent per-session cost (descriptions, hooks, MCP schemas) against the share of novelty; (3) conflict with doctrine (gitflow, versioned APIs, Astro-first, ask-don't-guess, fail-closed). Stars decided nothing: 566-star chisle beat 146.7k-star ponytail on method; 898-star reticle is the only real capability. +- **Alternatives rejected**: install-then-prune (sunk cost, [[BDR-047]] ECC lesson); one bulk verdict (user wanted one case per turn, each with a build-vs-install call); building reticle's engine (1 286 server files). +- **Caveats**: borrowed prompts change upstream with no diff, the pin is the review point; do not re-audit these six expecting more; mengto motion pack from the ui-skills registry is the open follow-up if site-level choreography (GSAP/ScrollTrigger, WebGL hero, masked reveals) proves thin locally. +- **Reference**: branches feature/yagni-ladder (9315c6c, de7371d), feature/agent-skills-borrow (d28c45e 2b25cb4 409db51 1a8e6de 7401383 6617889 d71f3a7), feature/web-building-microrules (a2e654d 5a27372), chore/six-repo-review-notes (da35cde 197225a). Links [[BDR-102]] [[LRN-172]] [[LRN-173]] [[EVAL-032]] [[BDR-047]] [[BDR-006]].