feat(distribution): Phase 4 fleet expansion — three new sync targets - #428
Merged
Merged
Conversation
Adds claude-code-proxy, claude-lane-sandbox, codex-plugins, cursor-plugins, knowledge-corpus, and songwriting as managed cloud-bootstrap targets. Each already carries an unmanaged copy of .claude/cloud-bootstrap.sh (2026-08-16 fleet audit) that would otherwise drift from the canonical component. The sync App's selected-repo grant was extended to all six on 2026-08-19 before these rows landed — attest derives its expected set from the target repositories and requires the installation's selected set to equal it, so grant-then-rows is the only order that keeps every target's sync green. Until this merges, the grant (14 repos) outnumbers the targets (8) and any sync run fails attest; this change restores equality at 14. TARGET_VISIBILITY gains the six entries (fail-closed map): the three public repos (claude-lane-sandbox, codex-plugins, cursor-plugins) and three private (claude-code-proxy, knowledge-corpus, songwriting), visibilities read live via gh at authoring time. The spawn-shim catalog-size assertion moves 8 -> 14 targets. cloud-bootstrap only for all six: no other component has been audited against them; further adoption is per-component and deliberate. The former agent-orientation follow-on from the fleet handoff is dropped — that component was retired by the standards sync audit and the test suite enforces its absence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 42s —— View job Claude finished reviewing this PR
SummaryClean, mechanical addition — no correctness or maintainability issues found. I checked the three consistency invariants this change depends on:
I also checked No inline comments were needed — I found nothing to anchor a finding to. Note: I wasn't able to execute |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95afd283a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count. |
Reworks the six-target addition to the standards-sync-audit plan's locked Phase 4 shape: claude-code-proxy, codex-plugins, and cursor-plugins only, each with the hygiene set (editorconfig-checker, gitleaks, lychee, markdownlint, repository-text, typos) plus cloud-bootstrap; ccproxy keeps ruff locally-owned per the plan line. Dropped from the roster, per the same plan: knowledge-corpus (deferred, structural LFS blocker), songwriting (dropped outright per github-iac ADR-0006; Phase 0.6 hand-fix already landed), claude-lane-sandbox (not a convergence target; rationale now mirrored into the manifest as the plan requires). TARGET_VISIBILITY and the spawn-shim arity assertion move to the 11-target set. The 2026-08-19 App grant covered all six candidate repos; the three non-adopted ones must be removed from the installation's selected set so attest equality holds at 11. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
kyle-sexton
changed the title
This was referenced Aug 19, 2026
kyle-sexton
added a commit
that referenced
this pull request
Aug 19, 2026
Closes #429 Phase 3.1 of the standards-sync-audit remediation (plan: `docs/topics/standards-sync-audit/PLAN.md`, Phase 3 approved 2026-08-19). ## What Deletes the manifest component defs for `concurrency-policy`, `dependabot-policy`, and `pin-comment-convention`, and records the approved Phase 3 plan. All three components have zero target references and zero downstream payloads anywhere in the fleet (verified live); their standards-internal enforcement — the ci.yml jobs, npm lint/test scripts, dependabot roots, and the repin-caller fixture corpus — references the component DIRECTORIES, which stay as producer-internal lint per the audit's locked decision. ## Verification - `sync-manifest.sh validate` → "Manifest valid: 34 components, 11 targets"; mjs validator green. - `grep -c "concurrency-policy|dependabot-policy|pin-comment-convention" distribution/sync-manifest.yml` → 0. - Note: the post-merge sync run currently fails at ATTEST for an unrelated pre-existing reason — the App installation covers 14 repos vs the manifest's 11 (PR #428 aftermath) — so the usual zero-new-PRs post-merge evidence is deferred until the installation set is reconciled. ## Related - Audit topic: docs/topics/standards-sync-audit/ (Phase 3.1) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_013NhxMDn7vZdbs7Cq32m56M --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Aug 19, 2026
…fthook bypass (#432) Closes #431 Phase 3.4 of the standards-sync-audit remediation (plan: `docs/topics/standards-sync-audit/PLAN.md`, Phase 3 approved 2026-08-19). ## What - `distribution/ESCAPE-HATCHES.md`: adds the engine target-filter section (`--targets` for matrix/plan only — `validate` hard-rejects all filters; `--target`/`--target-root` for mappings/dest-paths/apply with the origin-identity check noted) and the Lefthook section (durable `skip: true` per lefthook-base vs the one-off human `LEFTHOOK=0` bypass with the PowerShell `$env:LEFTHOOK = '0'` shape; agent deny floor stated for both shells). - `distribution/README.md` Commands: names the single-target flags and points at the index. - `components/claude-permissions/claude-permissions.json`: adds `PowerShell(*env:LEFTHOOK*)` — the three Bash LEFTHOOK denies anchor on the inline-env spelling (`LEFTHOOK=0 cmd`) that PowerShell lacks, so PowerShell agent sessions were not actually deny-floored from the bypass; one env-var-reference-anchored glob covers `$env:LEFTHOOK = '0'`, `Set-Item env:LEFTHOOK …`, and `${env:LEFTHOOK} = …` (whole-string globs, `*` only — precision costs coverage). Test asserts all four lefthook deny rows. ## Verification - `bash components/claude-permissions/claude-permissions.test.sh` green incl. the four new assertions. - lychee + markdownlint green locally via pre-commit; deny list stays ASCII-sorted. - Post-merge: the sync PR to dotfiles (sole claude-permissions target) should carry a claude-permissions.json-only diff — currently DEFERRED: sync runs fail at attest (App installation 14 repos vs manifest 11, PR #428 aftermath) until the installation set is reconciled. ## Related - Audit topic: docs/topics/standards-sync-audit/ (Phase 3.4) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_013NhxMDn7vZdbs7Cq32m56M --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Aug 19, 2026
Closes #439 ## Summary Adopt `melodic-software/agent-plugins` as the twelfth sync target. The repo was created 2026-08-17 — after the standards-sync-audit plan's Phase 4 roster locked — so its absence there is chronology, not a considered exclusion; the operator granted it to the melodic-standards-sync installation on 2026-08-19 and directed adoption. ## Fix Adds the `melodic-software/agent-plugins` target block (hygiene set: editorconfig-checker, gitleaks, lychee, markdownlint, repository-text, typos — plus cloud-bootstrap; `automerge: false`), its public fail-closed `TARGET_VISIBILITY` entry, and moves the spawn-shim arity assertion 11 → 12. The repo carries none of the payloads yet, so the first sync CREATES them — adoption from birth, no divergence to reconcile. With the operator's pending removal of knowledge-corpus and songwriting from the grant, attest equality lands at 12. ## Verification - `bash distribution/sync-manifest.sh validate` (staged) → `Manifest valid: 33 components, 12 targets` - `gh repo view melodic-software/agent-plugins --json visibility` → `PUBLIC` (matches the new TARGET_VISIBILITY entry) - Diff scoped to 3 files / 18 insertions; no component definitions touched ## Related - #428 (Phase 4 roster this extends) - melodic-software/github-iac#337 (roster mirror — follow-up bumps it to 12) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
24 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #427
What
Executes the standards-sync-audit plan's Phase 4 roster (Brief line 31): adds
claude-code-proxy,codex-plugins, andcursor-pluginsas targets (8 → 11), each with the hygiene set (editorconfig-checker, gitleaks, lychee, markdownlint, repository-text, typos) pluscloud-bootstrap; ccproxy keepsrufflocally-owned per the plan line. Adds the three fail-closedTARGET_VISIBILITYentries (codex-plugins/cursor-plugins public, claude-code-proxy private — read live viagh repo view), moves the spawn-shim arity assertion tocomponents, 11 targets, and mirrors the claude-lane-sandbox non-adoption rationale into the manifest as the plan requires.Deliberately NOT adopted, per the same locked plan: knowledge-corpus (deferred — structural LFS blocker, no extend mechanism), songwriting (dropped outright per github-iac ADR-0006; the Phase 0.6 hand-fix already landed), claude-lane-sandbox (not a convergence target).
History of this PR
The first commit added all six repos named by an older fleet handoff. The review lane correctly flagged the conflict with the newer, adversarially validated audit plan; the second commit reworks to the plan's Phase 4 shape. The App grant currently covers all six candidates (14 selected repos) — the operator must remove knowledge-corpus, songwriting, and claude-lane-sandbox from the installation's selected set so attest equality holds at 11. Grant-first ordering is preserved for the three real adoptions.
Remaining Phase 4 items NOT in this PR
github-iac README roster mirror (separate repo, follow-up PR).
Validation
distribution/sync-manifest.sh validate(staged):Manifest valid: 37 components, 11 targets.node --test runner-policy.test.mjs: pass.distribution/sync-manifest.test.sh: pass locally except the two known Windows-environmental symlink tests (MSYSln -scopies; CI on Linux exercises them properly).Related
🤖 Generated with Claude Code