Update: adopt SpecSync 5 and Trust 1 - #5
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adopts SpecSync 5.0.1 and Trust 1.0.0 governance for the deps Fledge plugin, introducing configuration files, editor commands, skills, and canonical specification files for the deps module. The review feedback identifies minor formatting issues, such as empty 'Companion files' headers in the skill markdown files, and a configuration mismatch in the scaffolding instructions where 'Requirements' is referenced instead of the configured 'Invariants' section.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c9e70e39b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "meaningful_paths": [ | ||
| "src/", | ||
| "tests/", | ||
| "site/", |
There was a problem hiding this comment.
This SDD gate is configured to watch site/, but this repository's Pages workflow deploys docs/ (.github/workflows/pages.yml uses path: docs). With require_change_for_meaningful_files enabled, public documentation changes under docs/ will bypass the SpecSync change lifecycle while a non-existent site/ directory is guarded, allowing the published docs to drift from the specs/trust gate.
Useful? React with 👍 / 👎.
| 1. Lockfile detection uses a deterministic precedence: Cargo, Bun, pnpm, npm, Yarn, Poetry, then uv. | ||
| 2. No action flag defaults to outdated. | ||
| 3. Licenses fails before detecting an ecosystem or running a tool. | ||
| 4. Missing required backing tools report installation guidance and exit 127. |
There was a problem hiding this comment.
This invariant is stricter than the current implementation for projects whose Bun, pnpm, npm, Yarn, Poetry, or uv backing tool is absent: those branches execute the tool directly, so Bash reports a generic command not found rather than the installation guidance promised here. Because this new spec becomes the contract for the plugin, generated checks/docs will assert behavior the CLI does not provide unless those tool checks are added or the invariant is narrowed.
Useful? React with 👍 / 👎.
|
|
||
| ### REQ-deps-004 | ||
|
|
||
| JSON mode SHALL emit the detected ecosystem and safely escaped command output. |
There was a problem hiding this comment.
--json is promised to emit safely escaped command output, but the wrapper only escapes backslashes, quotes, and newlines; when any backing tool emits another JSON control character such as a tab or carriage return, the envelope contains raw control characters and cannot be parsed. Because this new requirement becomes the contract for automation consumers, either the contract needs to exclude those outputs or the JSON wrapper needs to escape the full string.
Useful? React with 👍 / 👎.
| "pyproject.toml", | ||
| "uv.lock", | ||
| "requirements.txt", | ||
| "fledge.toml", |
There was a problem hiding this comment.
With require_change_for_meaningful_files enabled, changes to plugin.toml still bypass the lifecycle because the manifest is not in meaningful_paths. That file defines the published plugin name/version and command-to-binary mapping, so a future change that renames deps, points at a different binary, or changes install metadata could avoid the trust/spec review while still changing what users install.
Useful? React with 👍 / 👎.
| prompt = """ | ||
| Arguments: {{args}} | ||
| 1. Run `specsync change new "$ARGUMENTS" --json`. |
There was a problem hiding this comment.
In this Gemini TOML command, invocation arguments are rendered into the prompt as {{args}} above, but the actual command to run still uses the Claude/Cursor-style $ARGUMENTS placeholder. When a Gemini user invokes this custom command, following step 1 literally creates a change with an empty or shell-dependent description instead of the requested change text.
Useful? React with 👍 / 👎.
| 1. Parse the arguments above: the first whitespace-separated token is the | ||
| module name. If the arguments also contain `--minimal` (in any position), |
There was a problem hiding this comment.
The command advertises that a natural-language feature description is accepted, but this parsing step first treats the initial word as the module name before deciding whether the input is a bare name or prose. For inputs like I want a feature that exports CSV, agents can scaffold an invalid I module or drop the leading word from the description; strip flags first, then classify the whole remaining argument as either a bare identifier or a description.
Useful? React with 👍 / 👎.
| "base_commit": "b8b902ceda32936bf43ffb4cdf19fb59340c1dbc", | ||
| "created_at": 1783876498, | ||
| "updated_at": 1783951457, | ||
| "affected_specs": [], |
There was a problem hiding this comment.
This accepted change adds specs/deps/deps.spec.md and its REQ-deps-* requirements, but the lifecycle state records no affected specs. That leaves the spec adoption with empty requirement linkage/evidence, so future SpecSync or trust audits can treat this rollout as config-only rather than the change that introduced the active Deps contract.
Useful? React with 👍 / 👎.
1 participant
Summary
Test Plan