Merge chore/six-repo-review-notes into develop

# Conflicts: # .claude/memory/decisions.md # .claude/memory/journal.md # .claude/tasks/TODO.md
2026-09-27 23:29:05 +02:00
parent 68fcdaf4d0 7b0d4977ad
commit 39d5b159f4
3 changed files with 53 additions and 0 deletions
@@ -1,5 +1,40 @@
 # TODO

+## 2026-09-27 — case 5 of the 6-repo review: OmniRoute rejected (chore/six-repo-review-notes)
+Gateway to 357 providers via `ANTHROPIC_BASE_URL` → localhost:20128; needs provider
+API keys, a Claude Pro/Max subscription cannot go through it. No gap here: Claude-only
+workflow on subscription, codex second opinion already via gstack `codex` CLI, rtk
+native, caveman purged. Against: sits in the path of every prompt with 96 deps and
+a fail-open guardrail design (doctrine says fail closed); default JWT secret
+`omniroute-default-secret-change-me` = admin bypass if unchanged; npm 3.8.5 blocked
+by Socket.dev (May 2026, malware indicators), two real vulns closed in 3.8.6; JA3/JA4
+TLS fingerprint impersonation + 40 pooled free-tier keys = provider-ToS risk; no
+audit, SBOM or signing. Stars 70.6k in 7 months. Not to be re-evaluated unless a
+multi-provider need appears, and then a keyed gateway is still not the answer.
+- [x] R1 verdict recorded, nothing installed, nothing built.
+
+## 2026-09-27 — case 4 of the 6-repo review: reticle parked with a pilot recipe (chore/six-repo-review-notes)
+User go "parquer avec la recette". Real gap (runtime store state, structured
+verdicts with file:line, replayable flows, CI `gate --since`), no current project
+needs it; cost = per-project build instrumentation in the client repo, ~4.9k
+tokens of MCP schemas per session, PostHog telemetry on by default, a skill that
+auto-runs `init` against "ask, don't guess". Trigger: first app-type project
+(client state, forms, auth, cart).
+- [ ] P1 external opt-in in lib/toggle-external.sh + profiles (off by default,
+      qa-class); `@reticlehq/server` pinned in plugins.lock.json (plugin v3.3.0
+      seen 2026-09-27), never `@latest`.
+- [ ] P2 local wrapper skill replacing theirs: `npx @reticlehq/server init
+      --dry-run` shown to the user, never run by the agent (runbook doctrine);
+      MCP env `DO_NOT_TRACK=1` `RETICLE_TELEMETRY=0`; verify only after the
+      user ran init.
+- [ ] P3 pilot on staging only (secret redaction is name-based); flows
+      committed, evidence gitignored; `gate --since` in CI evaluated before
+      adoption.
+- [ ] P4 measure tokens per verification loop vs gstack browse on one page.
+Sources read 2026-09-27: docs/what-is-recorded.md, telemetry.md,
+token-efficiency.md, enterprise.md (core verification free; SSO/SCIM/RBAC/
+policy gates under ee/), LICENSE split FSL-1.1-ALv2 server+init, Apache
+adapters/core/engine. Stars 898, created 2026-06-11, 2 551 commits.
 ## 2026-09-27 — case 3 of the 6-repo review: ui-skills → web-building micro-rules (feature/web-building-microrules)
 User go after the analysis: 7 own skills + 36 third-party registry entries, all
 covered locally (impeccable, web-validate, /seo, emil, brightdata design-mirror)