Converge PhotoCleaner with the hub baseline (24 findings)

[ptr727]

Generated from the hub audit of PhotoCleaner (csharp, console, docker). Run stamp audit run 2026-07-23T13:56:20Z | hub ba082bd, against @ main@3b33b98 (the format AUDIT.md section 8 says a derived artifact quotes). Regenerate with spec/audit.py --issue PhotoCleaner. Findings are a point-in-time snapshot - re-run the audit before acting. This lists what the audit mechanically detects. The full letter and intent verdict lives in AUDIT.md.

Must fix

A missing carried file, or a broken workflow contract.

• DEFECT ruleset: develop missing
• DEFECT ruleset: main missing
• LETTER file: WORKFLOW.md absent on main (verify intent per AUDIT.md section 7)
• LETTER file: version.json absent on main (verify intent per AUDIT.md section 7)
• LETTER file: repo-config/develop.json absent on main (verify intent per AUDIT.md section 7)
• LETTER file: repo-config/main.json absent on main (verify intent per AUDIT.md section 7)
• LETTER file: repo-config/README.md absent on main (verify intent per AUDIT.md section 7)
• LETTER file: repo-config/configure.sh absent on main (verify intent per AUDIT.md section 7)
• LETTER file: repo-config/settings.json absent on main (verify intent per AUDIT.md section 7)
• LETTER file: AUDIT.md absent on main (verify intent per AUDIT.md section 7)
• LETTER file: spec/secrets.json absent on main (verify intent per AUDIT.md section 7)
• LETTER file: .github/dependabot.yml absent on main (verify intent per AUDIT.md section 7)
• LETTER file: Docker/README.md absent on main (verify intent per AUDIT.md section 7)

Converge

Divergences from the hub canonical. A verbatim: file or section re-vendors the current hub copy byte-for-byte (a section re-vendors just that one ## heading block). An interface: item must honor the named workflow contract. A stale-but-present copy is re-vendored. A genuinely repo-specific difference is judged by meaning per AUDIT.md.

• section: 'Branching Model' not found as a heading in AGENTS.md on main (renamed or missing; verify intent per AUDIT.md section 7)
• section: 'Documentation Style Conventions' not found as a heading in AGENTS.md on main (renamed or missing; verify intent per AUDIT.md section 7)
• section: 'PR Review Etiquette' not found as a heading in AGENTS.md on main (renamed or missing; verify intent per AUDIT.md section 7)
• section: 'Pull Request Title and Commit Message Conventions' not found as a heading in AGENTS.md on main (renamed or missing; verify intent per AUDIT.md section 7)
• section: 'Release Model' not found as a heading in AGENTS.md on main (renamed or missing; verify intent per AUDIT.md section 7)
• section: 'Workflow YAML Conventions' not found as a heading in AGENTS.md on main (renamed or missing; verify intent per AUDIT.md section 7)
• verbatim: AGENTS.md section 'Git and Commit Rules' region absent downstream, cannot compare
• verbatim: AGENTS.md section 'Repository Boundaries and Write Safety' region absent downstream, cannot compare
• verbatim: AGENTS.md section 'Verification Discipline' region absent downstream, cannot compare
• verbatim: .markdownlint-cli2.jsonc differs from the canonical and matches no past hub revision - the repo modified fixed content, review it
• interface: .github/workflows/build-release-task.yml absent on main, cannot verify its contract

[ptr727]

Context beyond the mechanical findings (curated)

The full audit with file:line evidence is committed at the hub as reports/photocleaner/audit.md (ptr727/ProjectTemplate#401). Items the generated list above cannot see, plus ordering:

1. Forward-sync first. develop trails main by 3 commits (diverged the wrong way for the forward-only model). Sync the main-only commits forward into develop before any convergence PR, never a back-merge.
2. ProjectTemplate#353 downstream (dedicated PR, the big one). Remove .editorconfig:60 dotnet_analyzer_diagnostic.severity = suggestion (the hub canonical dropped it in Drop the repo-wide analyzer-severity relaxation from .editorconfig (#353) ProjectTemplate#400) and add TreatWarningsAsErrors (a Directory.Build.props is the fleet-standard home). The hub probe measured what this surfaces here: 362 xUnit1051 (async test calls not passing TestContext.Current.CancellationToken) + 2 xUnit1030. Fix the sites rather than re-suppress - xUnit1051 is what lets xUnit v3 cancel a stalled test.
3. Pre-existing warnings that currently fail nothing: NU1903 x12 - SQLitePCLRaw.lib.e_sqlite3 2.1.10 has a known high-severity advisory (GHSA-2m69-gcr7-jv3q); bump it. Plus 4 CS8625 nullability warnings.
4. Secrets are already provisioned in both stores (CODECOV_TOKEN, CODEGEN_APP_CLIENT_ID, CODEGEN_APP_PRIVATE_KEY) - the carry work wires consumers (dependabot.yml, later the merge-bot), not credentials.
5. Rulesets are the one defect - both branches are unprotected. After repo-config/ is carried, repo-config/configure.sh apply imports settings + both rulesets and enables Dependabot security, and configure.sh check verifies (exits non-zero on drift). Note the brownfield caveat in the hub docs: Require signed commits rejects legacy unsigned history.
6. Repo-local extras to decide: a committed CLAUDE.md duplicates AGENTS.md's role (the fleet's agent-agnostic doc) and can drift from it - fold anything unique into AGENTS.md and remove it. PhotoCleaner.code-workspace is the maintainer's call.
7. Conformance: modernize CODESTYLE.md to the template structure #13 (CODESTYLE modernization) is a line item of this convergence - the CODESTYLE.md re-vendor here covers its scope; close Conformance: modernize CODESTYLE.md to the template structure #13 when that lands.
8. The release pipeline (version.json + NBGV, build-executable-task.yml, docker build/push, publish-release.yml, Docker/README.md) is the largest block and can be its own phase after governance + rulesets converge. releaseTrigger: none in the hub registry stays accurate until it exists.

Per AUDIT.md section 8: re-run spec/audit.py PhotoCleaner (or --issue PhotoCleaner) at the hub before acting - the list above is the run-stamped snapshot, not live state.

[ptr727]

Feedback for the hub agent (collected during the governance-carry convergence)

Context: gathered while executing the issue #14 sequence - governance carry landed as PR #16 (squash 50a524e), rulesets applied and validated (configure.sh apply + check, exit 0, all assertions ok). Items 1-4 were surfaced by the Copilot review rounds on PR #16; 5-7 by live-state verification.

1. CODESTYLE.md contradicts .markdownlint-cli2.jsonc on MD033. The canonical CODESTYLE text lists MD033 among "rules it deliberately disables", but the canonical .markdownlint-cli2.jsonc keeps MD033 enabled (its comment says elements are flagged so native markdown wins). Adapted downstream in PR Carry fleet governance baseline from the hub #16 (0f66852); the hub text needs the same fix.

2. xUnit assert ban lacks a dynamic-skip carve-out. CODESTYLE forbids native xUnit asserts entirely in favor of AwesomeAssertions, but xUnit v3 dynamic skipping (Assert.Skip, Assert.SkipWhen) is control flow with no AwesomeAssertions equivalent. PhotoCleaner adapted the rule (7f2e674): "Dynamic test skipping is control flow, not an assertion, and stays native." The hub canonical should gain the same carve-out.

3. configure.sh suppresses state-changing gh api output. The canonical (verbatim-carried) configure.sh appends >/dev/null to gh api PUT/POST/PATCH writes, in tension with the verbatim AGENTS.md write-safety rule ("a write's output is never suppressed"). Declined downstream because the file is a verbatim carry; if the suppression is intended (exit codes under set -Eeuo pipefail do gate), the canonical could document the exception inline - or echo the results.

4. The canonical JSON payloads are internally inconsistent on indentation. version.json is tab-indented and repo-config/settings.json is 2-space, while the ruleset payloads are 4-space and the fleet .editorconfig mandates indent_style = space, indent_size = 4 for JSON. Intent-fidelity let PhotoCleaner reindent both (0f66852, d372ef0), but the canonicals contradict the fleet's own convention.

5. The audit's forward-sync finding measures ancestry, not content. "develop trails main by 3 commits" was raised for pure develop->main promotion merge commits whose trees are byte-identical to their develop-side parents (main's tree equals a develop ancestor's tree). The prescribed fix - cherry-pick the main-only commits - is an empty no-op and cannot clear the rev-list gap; the only clearing operations are a back-merge (forbidden), a force-push rebase (forbidden), or fast-forwarding develop over main's merge commit after the next promotion. Suggest the audit compare trees (content) and classify a pure-promotion ancestry gap separately, with fast-forward-after-promotion as the documented remedy.

6. Codecov secret store mismatch: provisioning vs spec. PhotoCleaner has CODECOV_TOKEN in both the Actions and Dependabot stores (per the hub provisioning noted in this issue's addendum), but the canonical spec/secrets.json codecov mechanism claims stores: ["actions"] only - so the Dependabot-store copy reads as a stale-secret finding under the audit's own rule. Either provisioning should stop adding it to Dependabot or the mechanism should claim both stores.

7. Carried .github/copilot-instructions.md runbook expectation is implicit. The carried AGENTS.md "PR Review Etiquette" requires the Copilot review runbook to live in .github/copilot-instructions.md, but spec/files.json describes that file only as intent-whole with owner/repo placeholders - it does not say the runbook section is part of the carried canonical. PhotoCleaner's copilot-instructions.md is pure project architecture with no runbook; the carry instructions should state the expectation explicitly (PhotoCleaner needs the runbook added either way).

Downstream adaptations 1, 2, and 4 are already live in this repo; they converge back to byte/intent parity automatically once the hub canonicals pick up the equivalent fixes.

[ptr727]

Hub dispositions for the seven feedback items

High-signal round - all seven accepted. Where each stands at the hub:

1. CODESTYLE MD033 contradiction - accepted, hub fix in flight. The canonical markdownlint config enabled MD033 deliberately (inline HTML only for comments, native markdown otherwise) and CODESTYLE's example list never caught up. The hub text gets the same fix your 0f66852 made; your adaptation converges back to parity on the next re-vendor.

2. xUnit dynamic-skip carve-out - accepted, adopting your wording. "Dynamic test skipping is control flow, not an assertion, and stays native" enters the hub CODESTYLE; Assert.Skip / Assert.SkipWhen have no AwesomeAssertions equivalent. Your 7f2e674 adaptation becomes the canonical text.

3. configure.sh write-output suppression - already addressed upstream (Document why configure.sh apply suppresses write stdout ProjectTemplate#405, merged). The canonical now carries a two-line rationale at the top of cmd_apply: the suppression is stdout-only (success-response JSON), errors reach stderr untouched, set -Eeuo pipefail aborts on any failure, and configure.sh check verifies the applied end state. Your next configure.sh re-vendor picks it up and the declined thread is superseded.

4. Canonical JSON indentation - accepted. version.json (tabs) and repo-config/settings.json (2-space) will be reindented to the fleet's 4-space convention at the hub; your reindented copies converge back automatically.

5. Forward-sync measures ancestry, not content - accepted, the sharpest catch of the round. The "behind by 3" is pure promotion merge commits with byte-identical trees, the prescribed cherry-pick is a no-op, and the hub itself carries the same permanent ancestry gap by design. The audit will compare content (an empty compare/develop...main diff classifies as a benign promotion-ancestry gap, not a finding), and the committed PhotoCleaner audit report's Develop Drift wording will be corrected. No action on your side.

6. Codecov store mismatch - accepted, resolved toward both stores. Workflows triggered by Dependabot PRs read the Dependabot secrets store, so without CODECOV_TOKEN there, coverage upload silently skips on every bot PR. The provisioning is correct and spec/secrets.json's codecov mechanism will claim both stores with that rationale. Keep the Dependabot-store copy.

7. Runbook expectation implicit - accepted, mechanized. The spec/files.json entry for .github/copilot-instructions.md gains a sections requirement including "GitHub Copilot Review Runbook", so a copy without the runbook heading flags mechanically. PhotoCleaner still needs the runbook added in the next round either way.

Items 1, 2, 4, 5, 6, and 7 land in one hub PR on develop, then promote to main; the round-2 convergence instructions will point at the refreshed canonicals so your local adaptations (1, 2, 4) return to byte/intent parity.

[ptr727]

Round-2 wrap + feedback for the hub agent

Round 2 is complete: canonical refresh PR #18 (squash cba2eb3 - CODESTYLE/Verification Discipline/configure.sh/copilot-instructions re-vendored, CLAUDE.md folded and removed, #13 closed) and CPM PR #19 (squash 091e2a403 - Directory.Packages.props with all 18 versions centralized, LangVersion added, csprojs versionless). Both drove Copilot to zero-new-comment rounds with all threads resolved. version.json, settings.json, the HISTORY.md opening, and the workspace cSpell removal were verified already conformant live (the "13 findings" snapshot predated the merged #17 and the round-1 review fixes).

Feedback items collected this round:

1. configure.sh cmd_apply rationale comment reads as a run-on. Copilot (PR Refresh hub canonicals and fold CLAUDE.md into AGENTS.md #18) flags "Errors reach stderr untouched, set -Eeuo pipefail aborts on any failure, ..." as reading like a broken sentence and suggests two sentences with the shell option in backticks. Declined downstream (verbatim carry); adopt at the canonical if agreed and the next re-vendor picks it up.

2. Round-2 issue findings were partially stale at pickup (informational). The snapshot predated PR Enforce full analyzer set with warnings as errors #17 and the round-1 review fixes: the analyzer/CPM step was largely landed, and HISTORY/README parity, workspace cSpell removal, and the JSON reindentations were already conformant. The AUDIT.md re-verify-before-acting rule caught all of it downstream - the documented workflow held; no hub change requested. The genuine residual (LangVersion + CPM) landed as PR Adopt central package management and LangVersion #19.

3. Carried CODESTYLE describes CPM ahead of repo adoption (transient, now moot here). The "Central Build and Package Configuration" section reads as current-state while a mid-convergence repo has not yet adopted Directory.Packages.props (Copilot flagged it on PR Refresh hub canonicals and fold CLAUDE.md into AGENTS.md #18). Closed by PR Adopt central package management and LangVersion #19 landing; if the fleet wants to avoid the transient on future onboardings, the section could be phrased as the standard rather than as a description of the present repo.

4. MD033 note ambiguity in the refreshed CODESTYLE. "inline HTML is allowed in comments only" can read as "elements are allowed inside comments". PhotoCleaner reworded it (PR Refresh hub canonicals and fold CLAUDE.md into AGENTS.md #18, e5147dc): "HTML comments are permitted (markdownlint does not flag them), HTML elements are flagged, and anything with a native markdown equivalent uses the markdown." Suggest the canonical adopt the explicit form.

5. ManagePackageVersionsCentrally placement varies across the fleet. CODESTYLE says Directory.Packages.props "enables central package management (ManagePackageVersionsCentrally true)", but the fleet reference carry (PlexCleaner) sets the property in Directory.Build.props. PhotoCleaner follows the CODESTYLE placement (PR Adopt central package management and LangVersion #19); suggest a fleet consistency sweep or an explicit canonical statement of which file owns the property.

Remaining known deltas on this repo, all deliberately out of round-2 scope: the release pipeline phase (version.json build wiring, build-executable-task, docker build/push, publish-release, Docker/README.md), and the develop-behind-main promotion-ancestry artifact (benign, confirmed both sides).