docs(adr-0076): ratify Amendment A (note row kind); Amendment B stays proposed - #87
Merged
Conversation
Owner ratified the `note` row kind on 2026-07-30. Amendment A is now ACCEPTED and in force: 3's enum includes `note` (and `diagnostic`, which had shipped under ADR 0106 without an amendment), and 4's ladder gains `note` as a sibling of the typed rows. This supersedes an owner-ratified decision. ADR 0106 5 (L) called the projection of an inserted Comment as a read-only `code` row an "honest degrade"; that no longer holds, and the ADR says so where a reader of 0106 will look. Amendment B is deliberately NOT ratified and is called out as such in three places, because a reader skimming "the ADR 0076 amendment was ratified" would otherwise reasonably conclude both were. Phase D's yield is unmeasured and may be negative, and its B.4 preconditions are unmet. BACKLOG #248's banner flips from "do not build ahead of the ruling" to unblocked, and carries two things forward so ratification is not read as a blank cheque: A.4's invariants are build gates rather than caveats, and A.6's two known-wrong behaviours -- comment re-attachment on move/delete, and the parent-nesting of a comment at the end of an if/for body -- are NOT fixed by this work and must not be reported as fixed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
wshallwshall
force-pushed
the
adr0076-ratify-a
branch
from
July 31, 2026 00:08
fc3c650 to
21b72db
Compare
wshallwshall
enabled auto-merge (squash)
July 31, 2026 00:09
wshallwshall
added a commit
that referenced
this pull request
Aug 5, 2026
#193) * fix(ci): dependabot auto-merge decided by exclusion — invert #3 to an allow-set (BACKLOG #336) Guardrail #3 was a 16-name Python deny-list with no ecosystem qualifier: anything not named auto-merged if it was a patch, on every ecosystem. Inverted to HOLD-UNLESS-NAMED. Only `actions/`, `github/` and `dependabot/` are eligible, and only on github-actions; the uv, pip and npm rows ship EMPTY, an unrecognised ecosystem token holds, and the fail-safe whole-group denial is preserved. Measured against the live PR #75, not recalled: its body carries five `Updates` entries — four on the allow row (actions/checkout and three github/codeql-action/*) and pypa/gh-action-pypi-publish, which is not — so that batch would HOLD as a whole. Expect auto-merge to fire RARELY; that is the intent of hold-unless-named, not a regression. Hardening, not an incident. There is no evidence of exploitation, the attacker must already own an upstream publisher account, and merging to main is not publication (PyPI release is gated on an owner tag push). MessageFoundry is a not-deployed beta with zero production instances, so this is stated as what the shipped code WOULD allow on first deployment, never as a present exposure. §4 RELEASE AGE, with an honest account of its reach. A new `id: age` step holds a SECURITY-track PR whose candidate version was published under MIN_RELEASE_AGE_HOURS (24), failing closed on an API error, an absent or unparseable upload timestamp, an unexpected name or version shape, or an ecosystem with no publish-date source wired. It is INERT with respect to the merge decision as shipped: age_ok=true is reachable only for uv/pip, eligible=true only for github-actions, and the merge `if` requires both — disjoint sets. Confirmed by executing the shipped allow-set body over exactly the ecosystems the age gate can pass (uv and pip both return eligible=false; only github_actions returns true). The header and the BACKLOG banner now say exactly that instead of presenting it as an operating control; recording an unreachable control as operative is the false-premise class docs/Secure_Development_Standards.md §3 forbids. The step is gated on `steps.allowset.outputs.eligible == 'true'`, which changes no merge outcome — the merge `if` already requires that conjunct — but removes an unauthenticated outbound GET made from a job holding `contents: write` for a PR that was going to be held anyway. §5 the header's backstop claim, corrected without over-claiming in the other direction. Dropped: "the only gate that inspects a dependency's shipped bytes at all is security.yml's trivy step". security.yml:265 marks trivy `continue-on-error: true` and :271 restricts it to schedule/dispatch, so it is advisory AND never runs on a Dependabot PR. The replacement is the weaker true form: no REQUIRED check reads a dependency's shipped bytes. The sentence describes what semgrep cannot SEE rather than where it looks, so the unmerged plan-semgrep-scope widening (BACKLOG #334) cannot falsify it. Provenance made honest. The header cited DEPENDENCY-POSTURE-REVIEW.md as the numbered source for guardrails it does not carry: #3 is INVERTED from the deny-list that document describes, and #4 is introduced here. The block is retitled AUTO-MERGE GUARDRAILS, #3 is moved out from under the security-track framing (it gates every PR), and the test docstring carries the same correction. Amending the vault copy stays the owner's separate obligation — the repo simply stops asserting it has already happened. Restated facts removed. The header repeated three cooldown values that live in .github/dependabot.yml; only two had a test bound, and that file records github-actions' window as approximate because it ages off the tag's commit date. The header now points at the source instead (CLAUDE.md §11 — state a load-bearing fact once and link to it). .github/dependabot.yml comments corrected. The uv block told a maintainer "routine patches auto-merge AFTER aging; security patches auto-merge now" — both halves false once uv's allow row ships empty. The github-actions block's "an advisory fix is unaffected" now says it opens as a PR unaffected but reaches main by human review, because the advisory gate is pip-keyed and never confirms an action. docs/testing/master-test-plan/01-environments-data-and-tooling.md:350 still advertised the deleted auth/token/crypto deny-list as a live control of this workflow. No test pinned that doc, so it drifted silently; the row now describes what ships. TESTS - The behavioural harness runs the shipped bodies under `bash -e`, which is what Actions applies by default on Linux (no `shell:` is declared anywhere). Plain bash keeps going where CI aborts the step, and `assert proc.returncode == 0` was exactly the assertion that would mask that class. No shipped row changes its decision: ten rows were compared head-to-head under plain bash and under `bash -e` and agreed on both exit code and emitted output, and the full 20-row parametrised set passes under `-e`. So this is a fidelity fix, not a behaviour change — but `_run_step_body` now RETURNS the returncode rather than asserting it, so an abort path can be expressed as an expected outcome instead of being indistinguishable from a harness bug. test_no_step_overrides_the_default_shell is the tripwire for a future `shell:` silently invalidating the premise that `bash -e` is what CI runs. - _load_dependabot's skip is deleted. It skipped on the premise that .github/dependabot.yml is "private-only, deny-listed on the OSS mirror". .gitignore names that file under DELIBERATELY NOT LISTED as content meant to ship; `git ls-files --error-unmatch` resolves it and `git check-ignore` exits 1. The refactor had routed THREE tests through that skip, including the cooldown test whose entire reason for existing is that a missing cooldown was invisible to CI. It now asserts presence. - The jq skip reason claimed the test "runs on the ubuntu CI leg and skips locally". The windows-2022 and windows-2025 images ship jq and Git Bash, and both are REQUIRED contexts in .github/required-contexts.txt, so it runs there too. The reason now says so — a maintainer reading it after a Windows-only red should not be told to expect ubuntu. ADR 0034 CONSEQUENCE, recorded because leaving it unrecorded is what that ADR warns against: this file grew 190 -> 403 lines and the `Why pull_request` anchor moved from line 42 to 76. Under the ADR's convergence rule, dismissed alert #87 re-fires as a new alert number and needs re-dismissing after merge. VERIFICATION - ruff check . -> All checks passed! - ruff format --check . -> 1042 files already formatted - mypy messagefoundry -> 21 errors, ALL PRE-EXISTING and NOT from this change: absent [fhir]/[dicom]/[webauthn] extras (fhirpathpy, fhir, pynetdicom, pydicom and webauthn are all ABSENT from this venv; 12 import-not-found plus their 7 no-any-return / 2 unused-ignore consequences). This change touches no file under messagefoundry/, so mypy's inputs are byte-identical to HEAD. CI installs the extras and is the authority. The quartet is NOT green locally and this commit does not claim it is. - pytest -q -> 10291 passed, 841 skipped, 22 warnings in 1282.01s (0:21:22). The pre-change baseline measured on this tree was 10289 passed / 841 skipped, so the delta is exactly the two tests added here. Run on a byte-frozen tree (sha256 of all five changed files recorded before the run and unchanged after), because two comment edits had landed after an earlier run started and six tests read docs/BACKLOG.md. - Falsification: 18 mutations of the workflow and dependabot.yml, plus deleting dependabot.yml outright, each confirmed to turn the matching test RED and then restored byte-identically (sha256 checked after every case). Among them: the allow-set admitting `pypa/`, losing its trailing slash, matching by substring, treating an empty name list as eligible, and failing open on an unrecognised ecosystem; the age step failing open on an undatable ecosystem, hard-coding a PASS on the version-track exit, re-deriving the security track, and losing its allow-set gate; a step declaring `shell:`; the merge `if` dropping either the age_ok or the allow-set conjunct; and each cooldown being removed or shortened. The four jq-gated rows were falsified separately (threshold deleted, missing-timestamp failing open, curl error failing open, and the discriminating PASS removed) against a purpose-built jq stand-in implementing the two shipped filters, because this box has no jq at all; execution against real jq happens on CI. * docs(backlog): flip #336 to SHIPPED and supersede one clause of its 2026-08-03 amendment Banner lines of item #336 ONLY. VERIFIED BY NUMBER, not by banner text — a byte-identical banner pasted under the wrong item survives every well-formedness check. `git diff -U0 -- docs/BACKLOG.md` is two hunks, @@ -3353 +3353 @@ and @@ -3358,0 +3359,2 @@; the enclosing `## ` heading computed backwards from each of the three changed lines (3353, 3359, 3360) is `## 336. Dependabot auto-merge shields review with a deny-list` in all three cases. The ranked table and the four census distribution lines are untouched. THE CENSUS WAS NOT RECOMPUTED. This commit flips one item's banner and deliberately does not touch the distribution lines. The banner records guardrail #4 as a FORWARD guard that is inert with respect to the merge decision as shipped, rather than as an operating control: age_ok=true is reachable only for uv/pip, eligible=true only for github-actions, and the merge `if` requires both. Recording an unreachable control as operative is the false-premise class docs/Secure_Development_Standards.md §3 forbids. The added blockquote uses the glyph-free `**AMENDED 2026-08-04 — ...**` convention. It supersedes ONE clause of the dated 2026-08-03 note — "The deny-list itself is untouched, so the rest of the item stands ... §§1, 3, 4, 5 and 6 are unaffected" — which was accurate when measured and is deliberately left as written rather than rewritten. The deny-list no longer exists, so §6 is discharged by deletion rather than annotation, and the 16 names survive only as a PROPERTY under test (`_DENY_PACKAGES` asserts none of them reaches any allow row). scripts/docs/backlog_status_check.py exits 0 ("290 backlog items, each declaring exactly one status") — reported as corroboration only. That gate validates that one banner is present and self-consistent, never that it belongs to this item, so it cannot see the corruption class this commit had to avoid. The by-number check above is the evidence; the green gate is not.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner ratified the
noterow kind on 2026-07-30.What is now in force
Amendment A — ACCEPTED. §3's row enum includes
note(anddiagnostic, which had shipped under ADR 0106 without an amendment); §4's ladder gainsnoteas a sibling of the typed rows. BACKLOG #248 is the build and is unblocked.This supersedes an owner-ratified decision: ADR 0106 §5 (L) called projecting an inserted Comment as a read-only
coderow an "honest degrade". That no longer holds, and the ADR now says so where a reader of 0106 would look.What is explicitly NOT ratified
Amendment B (ADR 0089 Phase D, "helper descent") remains PROPOSED and not buildable. This is called out in three places — the ADR status line, Amendment B's own status block, and the ADR index row — because "the ADR 0076 amendment was ratified" would otherwise reasonably be read as covering both.
Phase D's yield is unmeasured and may be negative: the shipped sample helper writes
msg["X"] = v, which the lens does not recognize, so descending it would yield six opaque rows and zero editable ones. Its §B.4 preconditions are unmet.Ratification is not a blank cheque
BACKLOG #248's banner flips to unblocked but carries two things forward:
# fmt: offand breakruff format --check), the docstring exclusion in_merge_code_rows, and the rule that a note edit takes its indentation and#prefix form from the existing line rather than the insert normalizer.if/forbody. The second is why v1 must either land the extent fix or render notes as explicitly positional — anoterow makes an existing misattribution legible, which is worse than a grey box if left silent.Verification
Docs-only, +14/−6 across three files. No code, no behaviour change.
🤖 Generated with Claude Code