Track repo-config/configure.sh + settings.json in the manifest (#379 follow-up) - #382
Merged
Conversation
repo-config/configure.sh and repo-config/settings.json are carried by every repo (configure.sh applies the rulesets; settings.json holds the values it applies) but were absent from spec/files.json. So they drifted unaudited: re-vendoring the now-tracked repo-config/README.md alone shipped a doc describing configure.sh behavior a repo's stale script did not have (surfaced from Financial-Modeling). - configure.sh -> verbatim: a repo-agnostic tool with nothing legitimate to diverge, where byte-drift is a functional bug. The audit now catches a stale copy directly (a live run flags Financial-Modeling's old script as stale -> re-vendor, exactly the case the gap was hiding). - settings.json -> intent: its values are already audited by the settings diff, and formatting varies harmlessly, so presence + intent is the right check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the spec baseline manifest to ensure the repo-config ruleset tooling is audited consistently across downstream repos, closing a gap where repo-config/configure.sh and repo-config/settings.json could drift without being detected.
Changes:
- Add
repo-config/configure.shtospec/files.jsonwithfidelity: verbatimto detect stale/modified copies. - Add
repo-config/settings.jsontospec/files.jsonwithfidelity: intentto require presence without enforcing byte-identical formatting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up from #379, surfaced by the Financial-Modeling agent while applying the item-2 re-vendor (Financial-Modeling#28).
The gap
repo-config/configure.shandrepo-config/settings.jsonare carried by every repo (configure.shapplies the rulesets;settings.jsonholds the values it applies), but neither was inspec/files.json. So they drifted unaudited — re-vendoring the now-trackedrepo-config/README.mdalone shipped a doc describingconfigure.shbehavior (sole-arg model, payload inference) that a repo's stale script did not have. The README and the script are a matched pair; only the README was tracked.Fix
configure.sh→verbatim— a repo-agnostic tool (no hardcoded owner/repo) with nothing legitimate to diverge, where byte-drift is a functional bug. Presence-only (intent) would miss a stale-but-present script, which is exactly the gap here. A live audit now flags Financial-Modeling's old copy as stale (matches a past hub revision → re-vendor) — correctly, not "modified".settings.json→intent— its values are already audited by the settings diff, and its formatting varies harmlessly (2-space vs 4-space), so a byte check would false-flag; presence + intent is the right check.Verification
spec/validate.pygreen;spec/audit.py --selftestpass; live audit surfaces the staleconfigure.shand stays silent on the presentsettings.json. CRLF preserved.Note:
configure.shasverbatimmeans downstreams on an older script now show verbatim DRIFT (stale → re-vendor) — the intended detection.🤖 Generated with Claude Code