Regenerate the divergence ledger against the promoted main - #544
Merged
Conversation
The report reads each repo's ground-truth main, so it was measuring a hub main that predated the promotion and reporting the hub as not carrying a section it had authored. That resolves now the promotion has landed. Three movements, one of which was not predicted and was checked rather than assumed. ProjectTemplate drops off the Fleet Bootstrap not-carried row, since its own main now carries it. PhotoCleaner drops off five carried-section stale rows and off the Representative Data not-carried row, because that repo merged its own promotion today and its main now holds the section. And configure.sh falls only to eight rather than seven, because PhotoCleaner is genuinely stale on it now: landing the check-mode fix moved the canonical, so a copy that was current before is behind today. That last one is the intended consequence of changing a verbatim file, and it is worth reading as debt created deliberately rather than as a regression. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Regenerates the fleet divergence ledger (reports/divergences.md) against the newly promoted hub main, so the report reflects current ground truth (and removes pre-promotion artifacts in “not carried” / “stale copy” counts).
Changes:
- Updates the “Untriaged” section to include AGENTS.md > Fleet Bootstrap as “not carried” across the fleet.
- Adjusts “not carried” / “Mechanical re-vendor” rows to reflect current repo states (notably removing PhotoCleaner from several stale/not-carried entries).
- Updates
repo-config/configure.shstale-copy count/list to the new measured set.
ptr727
added a commit
that referenced
this pull request
Aug 3, 2026
Three commits. Merged as a **merge commit**, never squashed, per the branching model. | Commit | PR | What | | --- | --- | --- | | `e48d64d` | #544 | Regenerates the divergence ledger against the previously promoted `main` | | `90e3255` | #545 | Takes the ruleset bypass list out of the fleet config entirely | | `362aec8` | #546 | Queues the agent-isolation rule and the vendored-tooling surface | ## The one that matters **#545 is a behaviour change to `configure.sh`, not a doc edit.** All three ruleset payloads declared `bypass_actors: [{ actor_id: 5, actor_type: RepositoryRole, bypass_mode: always }]`, so applying them granted repository admins a standing exemption on `main` and `develop` in every repo. GitHub's documentation is explicit that a ruleset applies to administrators by default and that the bypass list starts empty. Admins are *eligible* for bypass and must be added. So the declaration was a real grant rather than a restatement of something inherent, and the fleet config was the thing handing it out. Removing the declaration alone would have been worse than leaving it. `apply` sends the payload as a `PUT`, which replaces the whole document, so a payload with no `bypass_actors` would have **cleared the live list on every run**. That is code deleting a bypass. `apply` now reads the live list and writes it back unchanged, and aborts rather than proceeding if that read fails. On create it sends none, so a new ruleset starts at GitHub's own empty default and nothing is deleted, because nothing existed. `check` reports the list on every run and asserts nothing, since no payload declares a value to compare against and inventing one would put code back in charge of a human decision. This does **not** remove the bypass entries already live on the fleet's rulesets. Removing those would itself be code deleting a bypass. They are now visible on every `check` run so they can be cleared deliberately, per repo, in the UI. ## Expected consequence, stated rather than discovered `repo-config/configure.sh` is carried `verbatim` with `appliesTo: "*"`, so this promotion makes every repo holding a copy stale against the hub. That is the third re-vendor this file has generated in one session, which is exactly the evidence the vendored-tooling entry added in #546 now records. The follow-up plan is to fold that re-vendor into the payload migration already owed by five repos, so each gets one visit that renames its `ruleset-*.json` payloads and takes the current script, rather than two. ## Verification `spec/validate.py` OK (21 cataloged), diff-scoped `prose_lint` clean, `markdownlint-cli2` clean, editorconfig clean, live read-only `check` against this repo passes with the bypass list reported and unasserted. The preserve path was proven by composing the `PUT` body against this repo's live ruleset without sending it: the payload declares nothing, the live list is `RepositoryRole 5 always`, and the composed body carries that same list back.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Generated output only, no hand edits.
reports/divergences.mdreads each repo's ground-truthmain, so before #542 promoted it was measuring a hubmainthat predated this session and reporting the hub as not carrying a section it had just authored.What moved, and how each was established
Predicted and correct.
AGENTS.md > Fleet Bootstrapno longer lists ProjectTemplate. The hub's ownmaincarries it now, so that row was pre-promotion state rather than fleet drift.Predicted and wrong. I expected
repo-config/configure.shto fall from 9 repos to 7. It fell to 8. ProjectTemplate dropped off correctly, but PhotoCleaner is genuinely stale rather than an artifact: #540 moved the canonical, so a copy that was current yesterday is behind today. That is the intended consequence of changing averbatimfile, flagged in #540 itself and then forgotten when predicting here.Not predicted, and checked rather than assumed. PhotoCleaner dropped off five carried-section stale rows and off the
GOVERNANCE.md > Representative Datanot-carried row. The cause is external to this work: that repo merged its own promotionc457ff3earlier today and itsmainnow carries the section. An unexplained improvement deserves the same scrutiny as an unexplained regression, so it was verified against that repo's commits rather than accepted.What the report now says about the fleet
AGENTS.md > Fleet Bootstrap. The bootstrap shipped and nothing downstream has it. That is the propagation job Give the fleet a bootstrap entry point that routes by repo state #536 exists to make possible, and it is the honest measure of where the fleet stands..markdownlint-cli2.jsoncstill lists 16 repos, because this session's fleet merges landed on each repo'sdevelopand have not promoted to their ownmain. The ledger readsmain, correctly, so these clear as those repos promote.repo-config/configure.shat 8, five of which additionally need theruleset-*.jsonpayload migration before they can take the canonical at all.Verification
Regenerated by
python3 spec/fidelity_honesty.py --reportfrom a live fleet pass after the promotion merged. editorconfig clean, CRLF preserved, diff-scopedprose_lintclean.