bmottin/claude_mac
1
0
Fork 0
forked from bchanot/claude
Code Pull Requests Activity

chore(memory): BDR-104 amendment, journal, TODO — LOW hardening closed

Browse Source
This commit is contained in:
bastien
2026-09-28 02:35:53 +02:00
parent 415b44ed25
commit 36f94b23e8
3 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude/memory/decisions.md
+1
View File
@@ -1307,3 +1307,4 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
- **Alternatives rejected**: vendor all 22 (bugs + duplicates + 17×~100 tok descriptions); distil only (loses the two deep workflows whose value is their full text); second inline curl loop (duplication; helper instead); `VENDOR_BASE_URL` gated by a companion var (file:// prefix check suffices); grouped toggle pack (per-name like emil).
- **Caveats**: vendored prompts change upstream with no diff, pin = review point; GSAP-first content vs [[BDR-005]] `motion` default, site-motion states the allowance; LOW hardening open: `re.match` `$` accepts a trailing newline, `source`/`path`/`sha` lock fields not charset-checked; `make link` + `bash lib/profile.sh apply full` after merge (user); sub-agent leftovers `/tmp/mengto-verify` (user removes).
- **Reference**: commits 2a1ad17 (helper + vendoring), ba14b5e (site-motion); contracts `.claude/tasks/contracts/2026-09-27-{mengto-vendor,site-motion-skill}-0002.md`; gates MET, verifiers CONFORME after 3 re-dispatches (frontmatter shape, refresh convention, security env override + traversal), security PASS ×2, `make test` 36 suites green minus 2 pre-existing T16a. Links [[BDR-103]] [[BDR-102]] [[LRN-141]] [[LRN-174]] [[EVAL-033]].
- **Amendment 2026-09-28**: the two LOW caveats closed on user ask (415b44e): `re.fullmatch` guard, `commit`/`source`/`path` validated before URL construction, 4 more hermetic cases (12). Security PASS, verifier CONFORME 9/9.
.claude/memory/journal.md
+1
View File
@@ -531,3 +531,4 @@ rules:
## 2026-09-28
- Case 7 (MengTo motion pack), user go "l'hybride" → [[BDR-104]]: `lib/vendor-skills.sh` shared helper (agent-skills moved onto it), 5 scroll skills vendored at a965851 (2a1ad17), `skills/site-motion` personal skill + routing (ba14b5e). Two analyzers read 22 skills first; 17 skipped (bugs, duplicates, covered, Codex/Xcode machinery). Gates MET, verifiers CONFORME after 3 re-dispatches (frontmatter shape, update-all refresh convention, security env override + traversal), security PASS ×2, `make test` 36 suites green minus 2 pre-existing T16a, shellcheck clean. [[LRN-174]] [[EVAL-033]]. feature/mengto-site-motion UNMERGED. Open for the user: `make link` + `bash lib/profile.sh apply full`, `rm -rf /tmp/mengto-verify`, LOW hardening (regex trailing newline, source/path/sha charset).
- User: "fais les deux low, et après on merge". Hardening by fresh executor (415b44e): fullmatch guard + lock field validation, 12-case suite; verifier CONFORME 9/9, security PASS 0 findings, full make test 36 suites green minus 2 pre-existing T16a. Merge of feature/mengto-site-motion into develop follows.
.claude/tasks/TODO.md
+2 -2
View File
@@ -15,8 +15,8 @@ executors in parallel, gates replayed (gates.sh → fresh verifier → security)
make test 36 suites green minus 2 pre-existing T16a, CHANGELOG, BDR-104 LRN-174
EVAL-033. UNMERGED — human gate. After merge: `make link` + `bash lib/profile.sh
apply full`; user removes `/tmp/mengto-verify`.
Follow-up LOW (security): `SAFE` regex `$` accepts a trailing newline (use `\Z`);
`source`/`path`/`commit` lock fields not charset-checked in lib/vendor-skills.sh.
- [x] M4 415b44e LOW hardening on user ask: `re.fullmatch` guard, `commit`/`source`/`path`
validated, 12-case suite; verifier CONFORME, security PASS.
Skipped on purpose (analysis 2026-09-27): cinematic-gsap-lenis (reduced-motion bug),
cinematic-scroll-storytelling (50 % duplicate), build-awwwards-quality-sites (0 code),
animation-systems, gsap, threejs (⊂ ui-ux-pro-max threejs.csv), cobejs, matterjs,