From d71f3a7d561db7f1370aa126fd6f12dd5576635f Mon Sep 17 00:00:00 2001 From: bastien Date: Sun, 27 Sep 2026 21:20:36 +0200 Subject: [PATCH] =?UTF-8?q?chore(memory):=20BDR-102=20amendment=20+=20jour?= =?UTF-8?q?nal=20=E2=80=94=20strict=20waiver=20policy?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .claude/memory/decisions.md | 1 + .claude/memory/journal.md | 1 + .claude/tasks/TODO.md | 4 ++-- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.claude/memory/decisions.md b/.claude/memory/decisions.md index d2c5361..d397c18 100644 --- a/.claude/memory/decisions.md +++ b/.claude/memory/decisions.md @@ -1280,3 +1280,4 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate). - **Alternatives rejected**: plugin install (1.8k tok/session for 20 % novelty, `/spec` `/review` `/ship` collide with gstack, `/code-simplify` vs `/simplify`, trunk-based git + one-version API contradict doctrine, second router); vendor api-and-interface-design whole (one-version rule vs § Web APIs → distilled); grouped `agent-skills` toggle pack (no shared installer, per-name like emil); web-full profile for the trio (design-class, allowlist wins over "lists bugfix"); Tier 2 prompt ranking (follow-up). - **Caveats**: vendored prompts = third-party content loaded into sessions, the pin is the review point (security-auditor scanned: benign, no hidden Unicode); floor-guard waiver is self-service, WAIVED informational → security MEDIUM, design decision pending with user (require CLARIFICATIONS ack outside test fixtures?); floor-guard prints raw diff snippets a verifier reads (LOW, framing follow-up); update-all 7.3 failure branch leaves `.tmp` like emil (parity, not fixed); `make link` after merge to symlink the trio (user). - **Reference**: commits d28c45e (trio), 2b25cb4 (floor-guard), 409db51 (census), 1a8e6de (rest-api); contracts `.claude/tasks/contracts/2026-09-27-{agent-skills-vendor,floor-guard,skill-routing-census,rest-api-rule}-1525.md`; gates MET ×4, verifiers CONFORME ×4 (2 re-dispatches), security PASS ×2. Links [[BDR-100]] [[LRN-172]] [[LRN-173]] [[EVAL-032]]. Case 1 of the same review: ladder in doctrine, feature/yagni-ladder 9315c6c. +- **Amendment 2026-09-27**: waiver policy strict, user go: `WAIVED` outside a test file = gap unless the contract's CLARIFICATIONS names file + reason (verifier STEP 3, loop doc). Commit 6617889. Closes the security MEDIUM caveat above. diff --git a/.claude/memory/journal.md b/.claude/memory/journal.md index bd4ba00..b25f684 100644 --- a/.claude/memory/journal.md +++ b/.claude/memory/journal.md @@ -520,3 +520,4 @@ rules: - bugfix/gitignore-diagram-allowlist merged into develop on user go, `gitflow finish` → facd26d, pushed, copies removed by the lib. Day 2026-09-25 lot fully on develop: BDR-101 default profile, full +4 gstack skills, gitignore allowlist. No working branch anywhere; `skills/diagram` ignored. - 6-repo review case 2 (agent-skills 99.4k stars): plugin rejected (1.8k tok/session, `/spec` `/review` `/ship` collide with gstack, trunk-based git + one-version API vs doctrine, second router, upstream says never stack routers). User go on 4 borrows → [[BDR-102]]: trio vendored emil-way at pinned 2686b620 (d28c45e), `lib/floor-guard.sh` + verifier STEP 3 (2b25cb4), `lib/tests/skill-routing-census.test.sh` 120 skills max 0.52 (409db51), `rules/rest-api.md` (1a8e6de). 4 feater executors in parallel, same tree; gates MET ×4, verifiers CONFORME ×4 after 2 re-dispatches (A3 vacuous N=2 fixture [[LRN-172]]; A1 tmp+mv + argv from security), security PASS ×2. My oracles wrong twice ([[LRN-173]]), [[EVAL-032]]. `make test` 35 suites green minus 2 pre-existing T16a (gitleaks), shellcheck clean. feature/agent-skills-borrow UNMERGED. Guardrails fired 3× on sub-agents, none evaded; `/tmp/tmp.AAyJzvufO6` scratch dir left for the user (rm -rf refused, correctly). - Case 3 (ui-skills 9.2k): 7 own skills + registry of 36 third-party + 47-lesson site playbook (React components, not agent files). Verdict given: extend rules/web-building.md with ~12 stack-agnostic micro-rules, install nothing (CLI/MCP = curl of raw SKILL.md, third router, baseline-ui stack mandates vs Astro doctrine). Awaiting user; case 4 reticle material prefetched. +- Waiver policy strict applied on feature/agent-skills-borrow (6617889): verifier STEP 3 counts non-test WAIVED lines as gaps unless CLARIFICATIONS names them; loop doc + CHANGELOG + BDR-102 amendment. The earlier journal line said "applied" one commit early, corrected here. diff --git a/.claude/tasks/TODO.md b/.claude/tasks/TODO.md index 60ceaf4..6d1b763 100644 --- a/.claude/tasks/TODO.md +++ b/.claude/tasks/TODO.md @@ -20,8 +20,8 @@ fresh verifier → fresh security-auditor). Case 1 lives on feature/yagni-ladder BDR-102 LRN-172 LRN-173 EVAL-032. UNMERGED — human gate. Follow-up (not started): per-skill positive/negative prompt ranking (Tier 2 second half); `make link` after merge to symlink the 3 skills (user runs it); -floor-guard waiver policy (security MEDIUM: self-service `floor-guard: allow` -→ require a CLARIFICATIONS ack outside test fixtures?) — user decision; +floor-guard waiver policy: user chose strict (CLARIFICATIONS ack outside +test files, else gap) → applied in agents/verifier.md STEP 3 + loop doc; frame floor-guard snippets as data in the verifier step (LOW); `/tmp/tmp.AAyJzvufO6` scratch dir from an executor proof, `rm -rf` refused → user removes; contract skeleton must carry `EVIDENCE: pending` (LRN-173, check /feat's template).