S0267-cli-drift-check-phase-2: close the four package-baseline drifts - #55
Merged
Merged
Conversation
…cises `engines.node` said `>=22.0.0` while the test matrix ran 22 and 24 only. Node 26 is supported upstream, sat inside that range, and was exercised by nothing, so an install on Node 26 was a combination nobody here had run and the manifest said nothing about it. The claim narrows to the tested set rather than the tested set widening to the claim. Each matrix cell emits a required status-check context named in a GitHub ruleset with no bypass actors, and no commit in this repository can edit it: a cell added without its context arrives NOT REQUIRED (a red X that blocks nothing) and a cell removed leaves a required context nothing emits, which makes every pull request unmergeable by anyone. Widening starts outside this repository: ruleset first, matrix second, range third. - `engines.node` becomes `>=22.0.0 <26.0.0`: the minimal narrowing that excludes the offending line and nothing more, since a published range is corrected only by another publish. - `.github/workflows/ci.yml` passes `node-versions: '["22", "24"]'` explicitly. Same two values the shared workflow already defaults to, so the runs and every context name are unchanged; what changes is that the tested set is a fact stated in this repository rather than an input default resolved in another one. - `test/node-release-schedule.json` carries the upstream release schedule with its source URL, accessed date and sha256, so the guard derives support from a primary record instead of a number typed into a test. - `test/node-support.test.ts` reds when the range and the matrix disagree in either direction, when the range admits a major the schedule does not carry, when the range has no upper bound, and when the contributor guide or the installation page restates either one differently. It refuses to report agreement over an absent, empty or provenance-less record, and every failure direction is proved over a constructed input at an injected run date. - `CLAUDE.md` and `docs-content/installation.md` state the bound too, so no surface still promises a runtime the suite never runs. No `src/` change: no runtime version check, no startup diagnostic, no new exit code. `fuzz.yml` and `release.yml` keep their own `node-version: 22` pins.
- The js-yaml pnpm override moves to the advisory's extended range: "js-yaml@>=4.0.0 <4.3.0": "4.3.0". The esbuild override is untouched and the lockfile records the new pin. - pnpm-workspace.yaml declares minimumReleaseAge 1440 and trustPolicy no-downgrade, and packageManager moves to a pnpm 10 release that honours both keys rather than ignoring them. - The PHI scanner refuses a target it enumerated and never read. Hits are reported FIRST so a refusal cannot swallow a finding, the question is a set difference and never a count, and the refusal exits with a status distinct from clean (0) and from hits (1). - CLAUDE.md is inside its declared line ceiling, with every rule left as a one-line imperative and the narrative relocated verbatim into documentation/agent-notes.md.
The default branch moved under this branch when the previous item landed as a squash merge: 906d050 on `main` is the squash of c33a5f2, which is this branch's own parent, and the two commits carry a byte-identical tree. Git could not see that they are the same change, so the two files this branch also edits conflicted against a copy of themselves. Both conflicts resolved by keeping this branch's content, which already contains the incoming change in full: - `CHANGELOG.md`: the incoming side of the conflict region was EMPTY. The `### Changed` bullet the default branch added sits below the region and is untouched; this branch's three bullets go above it. - `CLAUDE.md`: the conflict is the `## Tech Stack` section, incoming in its original form and here in its trimmed form. The trimmed form already states the incoming Node bound (`>= 22, < 26`, matrix 22 + 24, the guard test, and the widen-the-ruleset-first rule), and the incoming section is reproduced byte-for-byte under `### Tech Stack, before the trim` in `documentation/agent-notes.md`. Nothing from either side was dropped. `package.json` merged with no conflict and matches this branch exactly. The merged tree is byte-identical to the pre-merge branch tip, which is the arithmetic the squash implies and is checkable with `git diff`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the four package-baseline drifts
config/drift-manifest.jsonrecords againstcli, sonode config/scripts/drift-check.jsreportscli: matches the package baselineand names noclientry in its worklist.
Spec:
work/specs/S0267-cli-drift-check-phase-2/spec.mdin the umbrella repo.What changed
package.json: the superseded"js-yaml@>=4.0.0 <4.2.0": "4.2.0"pnpm override is replaced by"js-yaml@>=4.0.0 <4.3.0": "4.3.0". Theesbuildoverride is untouched.pnpm-lock.yamlfollows.pnpm-workspace.yaml(new):minimumReleaseAge: 1440(a number) andtrustPolicy: "no-downgrade", in the plain block-mapping YAML subset the standard's parseraccepts.
packageManagermoves frompnpm@10.0.0topnpm@10.34.5, becauseminimumReleaseAgelanded in pnpm 10.16.0 andtrustPolicyin 10.21.0: the old pin would haveignored both keys, which is a settings file that decorates rather than defends.
scripts/phi-scan.ts: a target the run enumerated and never read now refuses the scan. Therun tracks the enumerated set against the actually-read set and refuses on the set difference
(never a count, because a count counts the targets that DID get read). Hits are reported first,
so a refusal can never swallow a finding, and the refusal exits 2, this scanner's existing
refusal status, which is distinct from clean (
0) and from hits (1). Five new cases intest/scripts/phi-scan.test.tscover the refusal, the hits-plus-unread ordering, naming everyunread path, an untouched honest run, and the whole-repo sweep still at exit 0.
CLAUDE.md: 438 lines to 298, under the declared 300 ceiling. Every rule, trap and imperativeremains as at least a one-line imperative with a qualified pointer; the narrative that left is in
documentation/agent-notes.mdverbatim, under a new section that reproduces each trimmed sectionas it stood. That file grew from 1163 to 1615 lines.
pnpm check:agent-notesis green.CHANGELOG.md: onepatchchangeset and[Unreleased]entries underChangedand
Fixed.Gates
pnpm run prepublishOnlyexits 0 (clean, typecheck, lint at--max-warnings=0, 777 tests, build,attw).
pnpm check:no-emdash,pnpm check:no-internal-refs,pnpm check:agent-notesandpnpm format:checkare all green, andpnpm phi-scanover the tree exits 0.