Files
OwnCord/docs
J3vbandClaude Opus 5 7c286abed2 docs(plans): B1 execution plan, and accept HP-0 (#1410)
* docs(plans): add the B1 repository-foundation execution plan

B1 is the isolated layout/contributor phase. This records the execution
order, the proof for each step, and what is out of scope.

Two findings worth surfacing before any B1 work starts:

- HP-0 was never formally accepted. The roadmap's B1 entry gate requires
  it; no scorecard artifact exists, no commit or document records an
  acceptance, and the B0 baseline still lists "Step 10: HP-0 sign-off"
  under "Not yet done in B0". The plan lists the five gaps that closing
  it requires, including pinning required status checks on dev -- which
  are still unset, so a dev PR can currently merge red.

- Several layout-audit claims do not survive verification against HEAD,
  matching the B0 pattern. RL-09's "no single command verifies both
  protocol consumers" is false (make protocol-verify does, and is
  enforced in CI, the pre-commit hook, and a contract test). RL-10's
  test-discovery side effect never fires (no _test.go in Server/scripts).
  RL-06's regeneration concern is refuted locally. RL-08 grows a
  toolchain constraint instead. RL-05, RL-07, RL-20 and RL-21 are each
  worse than written -- RL-20 includes a live bug where a missing `make`
  is reported as stale protocol constants.

The riskiest item, RL-01 (flatten Client/tauri-client into Client), gets
a full reference inventory and a mechanical proof for both commits: tree-
object equality for the pure move, and scripted-substitution replay for
the path rewrite. Release asset names and updater contracts are verified
independent of the directory name, so the move cannot rename an artifact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(plans): correct the B1 status-check pin list from a live dev PR

The list was derived from ci.yml. Observing PR #1410's actual checks
found three that exist in no workflow file -- Analyze (go),
Analyze (javascript-typescript), Analyze (actions) -- because CodeQL
runs from GitHub default setup, configured in repository settings.
Reading .github/ alone misses them.

Also confirms the two negative predictions against a real dev-targeted
PR: Server Docker Build (verify) reports as "skipping", and Tauri Full
Build never appears in the check list at all. Neither may be pinned.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(plans): accept HP-0 and pin the dev required status checks

Closes B1's entry gate. All five B1-0 items are done.

The scorecard is the artifact the hold point asks for: one place that
answers its four questions, records what was accepted as a stated
limitation rather than claimed green, and part-closes R-08.

Required status checks are now pinned on dev -- ten of them. That was
B0's one outstanding step. Two things came out of doing it:

- The names cannot be inferred from ci.yml. Three of the ten (the
  Analyze jobs) exist in no workflow file, because CodeQL runs from
  GitHub default setup configured in repository settings. They were read
  off a live dev-targeted PR with `gh pr checks`.
- Server Docker Build, Tauri Full Build and the CodeQL aggregate are
  deliberately excluded. The first two report "skipping" on a dev PR --
  Tauri Full Build under its unexpanded matrix name, since the job is
  skipped before matrix expansion. Admin Panel E2E is excluded because
  continue-on-error makes it report success unconditionally.

Two prior claims are corrected rather than left to propagate:

- b0-dev-branch-protection.sh was written assuming repository-settings
  writes are blocked from the agent sandbox. They are not; the PUT
  succeeded. The script stays as the record of intent and the way to
  re-apply or undo.
- An earlier revision of the B1 plan said Tauri Full Build does not
  appear in a dev PR's check list at all. It does, as skipping.

Evidence closed out:

- Rust is no longer a carried row. Re-measured: 115 passed, cargo clippy
  --all-targets -- -D warnings at exit 0, confirming the carried figure.
- The 38 open ledger records are accepted as counted, non-stale and
  assigned: 11 medium / 27 low, zero high or critical, zero dead paths
  across all 348 re-verified at this commit, and none assigned to B1.
- The private security review is reconciled: 7 findings, 7 of 7 mapped
  to existing public rows, 0 unmapped. Summary is content-free; the
  detail stays in the untracked private reports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-25 19:29:31 +00:00
..
2026-08-15 21:37:20 +02:00