docs: close CLAUDE.md compliance drift (D1, D2, R1–R8) - #65
Merged
Conversation
The build spec was renamed from docs/PLAN.md to docs/ARCHIVE.md, leaving ~100 dead cross-references in backend docstrings, frontend comments, and the Dockerfile. Sweep them all to docs/ARCHIVE.md; section anchors are unchanged since ARCHIVE.md kept the original section numbering. Comments/docstrings only, no logic change.
docker/Dockerfile and docker/docker-compose.yml still described the original local-build-only distribution model and cited 'no registry publishing'. Locked decision §6 has since been revised to publish images to GHCR (ghcr.io/tyler-rich/scrye) via the release and nightly workflows. Correct the three comments to match current reality. Comments only.
…motion-title convention Add two dated §14 (§ Deviations) entries so the CLAUDE.md rules amended in the same docs-compliance pass are backed by the deviation log like the others: - Squash-merge authorship reflects the merging account's GitHub profile display name (git config user.name cannot override it) — the doc-side counterpart to compliance finding D4. - dev→main promotion PRs use a plain 'Promote dev to main: …' title instead of a Conventional-Commit prefix, per CONTRIBUTING.md § Releasing.
Amend eight operating-contract rules the code has knowingly outgrown, each backed by a dated docs/ARCHIVE.md § Deviations entry, so a future session does not 'fix' compliant code back toward the abandoned plan: - R1: hand-written typed API client in frontend/src/api/ (not OpenAPI-generated) — FE-2. - R2: dogfood gate is fixable HIGH/CRITICAL, not all-severities — INF-10. - R3: frontend uses Vitest (npm test) covering the lib/ polling/url/arrays/latest helpers. - R4: OIDC client secret and other stored secrets live field-encrypted in the DB, not as .env.example placeholders. - R5: list the additional maintained deliverables (CHANGELOG, SECURITY.md, CODEOWNERS, ROADMAP, dependabot.yml, ci/ allowlists). - R7: note that squash-merge authorship uses the GitHub profile display name. - R8: promotion PRs use a plain 'Promote dev to main: …' title (exception to Conventional Commits). Also add a § Dependency hygiene pointer to the requirements.lock workflow (regenerate with the pinned 'uv pip compile --generate-hashes' on any pyproject dependency change; CI fails on drift) per CONTRIBUTING.md § Backend dependency lock.
tyler-rich
added a commit
that referenced
this pull request
Jul 13, 2026
Read-only verification of PRs #50-#65 against the current merged state of dev. Confirms 10/11 HIGH, 26/26 MEDIUM (as addressed), and 24/25 LOW findings resolved with covering tests, and that the five mid-batch decisions (M2, M11, M23, H11, CON-11) landed as decided. Flags the one genuine miss (H5/CON-4, scanner JSON parse still on the event loop, with no deviation entry), triages the two Dependabot default-branch alerts as already-fixed-on-dev-pending-promotion, and notes the L24/SC-11 and M19-untested residuals.
tyler-rich
added a commit
that referenced
this pull request
Jul 20, 2026
…w-remediation batch (#74) Re-verifies every finding across all six original code-review reports (including findings never carried into 00-summary.md) against the current state of dev, after the H5/CON-4 follow-up (#67) and the dev->main promotion (#70). Records the current STILL-OPEN backlog (frontend Priority-3 batch, SC-12/SC-14, D5b, test debt), deferred-by-decision items with their tracking refs, a resolved index, and the ARCHIVE.md section-14 entry gaps (#53 H1/SEC-1, #57 H9+H10, #65 D1/D2/R1-R6, #59).
tyler-rich
added a commit
that referenced
this pull request
Jul 20, 2026
…r-strip rule (#76) Back-fill four docs/ARCHIVE.md §14 entries for merged fixes that landed without a dated entry, using docs/reviews/STATUS.md § "ARCHIVE.md §14 gaps" and the actual PR history as the source of truth: - #53 — H1/SEC-1: repository scan targets must be remote clone URLs (local-path arbitrary-read closed). Notes explicitly that this SEC-1 is distinct from the older webhook-URL "SEC-1" already in §14. - #57 — H9/SC-2 + H10/SC-3: SHA-pin all Actions, expand Dependabot to pip/npm/docker/docker-compose + composite-action dir, harden publish checkouts, converge D3/SC-10/L25 version skew. - #65 — D1/D2/R1–R6 compliance-drift closure pointing at already-logged deviations. - #59 — backend dev-dependency bumps (pytest, pytest-asyncio, black; ruff held at 0.8.6). Each entry is dated to its merge date (2026-07-13) and marked as a back-fill written 2026-07-20. Also add a CLAUDE.md § Git & PR conventions rule: after opening any PR, re-check the live PR body and strip any auto-appended attribution footer, so PR bodies carry no Claude/Anthropic identity — with a matching dated §14 entry (2026-07-20) recording the addition. Docs only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation-only pass closing the drift flagged in
docs/reviews/claude-md-compliance.mdanddocs/reviews/00-summary.md. No application code, tests, Dockerfile logic, or CI behavior changed — comments, docstrings, and the operating-contract docs only.What changed
D1 — dead
docs/PLAN.mdreferences (a279b33)The build spec was renamed
docs/PLAN.md→docs/ARCHIVE.md, leaving ~100 dead cross-references. Swept all of them across the backend, frontend, and Dockerfile: 86 files, 106 references. Section anchors are unchanged (ARCHIVE.md kept the original numbering). Historical files (docs/ARCHIVE.md,docs/reviews/*) intentionally retain their PLAN.md references as build-history record.D2 — stale "no registry publishing" comments (
cc404e7)docker/Dockerfileanddocker/docker-compose.ymlstill described the original local-build-only model and cited "no registry publishing". Locked decision §6 now mandates GHCR publishing via the release/nightly workflows — corrected the three comments to match.R1–R8 — CLAUDE.md rules the code has correctly outgrown (
ce6db4c,bb71112)Each amendment makes CLAUDE.md describe current reality, backed by a dated
docs/ARCHIVE.md§ Deviations entry, so a future session doesn't "fix" compliant code back toward the abandoned plan:frontend/src/api/, not OpenAPI-generated (FE-2).npm test) covering thelib/polling/url/arrays/latesthelpers..env.exampleplaceholders.CHANGELOG.md,SECURITY.md,.github/CODEOWNERS,docs/ROADMAP.md,.github/dependabot.yml,ci/allowlists).docs/PLAN.mdsweep and publishing comments (= D1/D2 above; CLAUDE.md itself already referenceddocs/ARCHIVE.md).dev→mainpromotion PRs use a plainPromote dev to main: …title, an explicit exception to Conventional Commits (new §14 entry).Also added a CLAUDE.md § Dependency hygiene pointer to the H11/SC-1 lockfile workflow (regenerate
backend/requirements.lockwith the pinneduv pip compile --generate-hasheson anypyproject.tomldependency change; CI fails on drift), which is fully documented inCONTRIBUTING.md§ Backend dependency lock.Deferred-work tracking (verified, no change needed)
docs/ROADMAP.md→ Backend structural cleanup.Notes
blackclean;ruffclean under the pinned 0.8.6 (the single I001 a newer ruff flags is the pre-existingtests/test_migrations.py:11, untouched by this PR). Frontend changes are comment-text-only.See
docs/ARCHIVE.md§ Deviations for the R7/R8 entries added in this pass.