Catalog Blog and record its first audit - #547
Merged
Merged
Conversation
Blog was stood up on 2026-08-01 and cut release 1.0.11 the same day, but it was never added to the registry, so no hub tool had ever measured it. `spec/audit.py` and `spec/fidelity_honesty.py` are both registry-driven, which means the divergence ledger was under-reporting the fleet by exactly one repo rather than reporting a clean one. The entry records reality rather than the prediction the conformance matrix carried. That row said `releaseTrigger` would be `none` with an empty `publish[]` until a deploy ran. What actually shipped is a dispatch-only publisher that cut a tag and a source archive, so the entry is `dispatch-only` with the GitHub release declared, and the matrix row is corrected to match. The VPS deploy still has not run, so the static-site type stays deferred to #456. ## What the first audit found Nine findings, no defects, verdict operational. Every one of them is the hub advancing after the carry rather than the repo regressing: - Eight verbatim units behind the canonical. Six are stale copies, and two never arrived at all: `AGENTS.md > Fleet Bootstrap` and `GOVERNANCE.md > Representative Data in Agent-Authored Text`. The distinction matters, because a stale copy still states the rule in an older form while an absent one states nothing. - One undeclared section, `AGENTS.md > Project Conventions`, whose four rules are genuinely repo-specific and duplicate no verbatim section. The report raises two spec questions rather than resolving them. The first is a contradiction in the hub: `AGENTS.md` sanctions a project keeping its own conventions section in its own `AGENTS.md`, while `spec/section-model.md` calls an undeclared section drift and lists four destinations that do not include `AGENTS.md`. A repo following the one is flagged for violating the other. The second is that the character-set tiers do not classify the COPYRIGHT SIGN, which any repo generating a feed will hit. The report directory is `reports/blog/`, lowercase, matching every existing report directory rather than the repo's CamelCase name. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Catalogs the Blog repository in the fleet registry and records its first audit so registry-driven tooling (audit/fidelity reporting) includes it and fleet reports reflect the full set of cataloged repos.
Changes:
- Add
Blogtoregistry/repos.jsonwith its measured classification, workflow model, and publish surface. - Add the initial audit report at
reports/blog/audit.md. - Regenerate fleet reporting outputs to include Blog (
reports/divergences.md,reports/conformance-matrix.md).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| reports/divergences.md | Regenerated divergences report to include Blog in relevant drift buckets. |
| reports/conformance-matrix.md | Updates the source-only + release row for Blog with the audit date and measured release behavior. |
| reports/blog/audit.md | Adds the first audit report for Blog (verdict + drift findings + escalations). |
| registry/repos.json | Adds the Blog registry entry so spec tooling includes it in audits and reports. |
Suppressed comments (3)
reports/blog/audit.md:44
- This line references
issue-536, but the corresponding link target is a pull request (/pull/536). Rename the reference topr-536to match what it links to.
1. `AGENTS.md > Fleet Bootstrap` is **absent**. Added by [#536][issue-536] after this repo carried its baseline, so the repo holds no statement of where the canonical rules live or how to route by its own state.
reports/blog/audit.md:51
- These references are labeled as
issue-540/issue-543but link to pull request URLs. Rename them topr-540/pr-543for clarity and consistency.
8. `repo-config/configure.sh` is stale. It predates the payload-driven check mode ([#540][issue-540], [#543][issue-543]), so its check mode compares the pull-request merge methods and the required-status-check contexts by name rather than comparing every parameterized rule's whole parameters object in both directions. It passes clean over drift the current canonical would catch.
reports/blog/audit.md:81
- The external link reference definitions use
issue-*labels for pull request URLs. Since these are PRs, rename the reference labels topr-*and keep them consistent with in-text references.
[pr-545]: https://github.com/ptr727/ProjectTemplate/pull/545
[issue-456]: https://github.com/ptr727/ProjectTemplate/issues/456
[issue-536]: https://github.com/ptr727/ProjectTemplate/pull/536
[issue-540]: https://github.com/ptr727/ProjectTemplate/pull/540
[issue-543]: https://github.com/ptr727/ProjectTemplate/pull/543
The report cited #536, #540 and #543 through `issue-*` link labels while their definitions pointed at `/pull/` URLs, so the label contradicted what it resolved to. #456 is a real issue and keeps its label. The External group is alphabetized, which the ordering had drifted from once `pr-545` was appended. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 3, 2026
ptr727
added a commit
that referenced
this pull request
Aug 3, 2026
…551) Regression fix. #545 removed `bypass_actors` from the ruleset payloads, and **every repo in the fleet has been reporting two ruleset DEFECTs since it promoted**. ## What broke `spec/audit.py` compares the live ruleset against the payload over a fixed subset, and that subset included `bypass_actors`. A payload that deliberately declares no bypass list, against a live ruleset that still has one, is a normalized diff — so the audit called it divergence: ```text == Utilities (csharp, nuget; release) @ main@e179288 == DEFECT ruleset: develop diverges from repo-config/develop.json (normalized diff) DEFECT ruleset: main diverges from repo-config/main.json (normalized diff) ``` Reproduced on Utilities, PlexCleaner and Blog. It is every repo, because every live ruleset carries the entry the payloads stopped declaring. ## The fix, and why it is this way round The field is dropped from the compared subset rather than restored to the payloads. Who may bypass a ruleset is a per-repository human decision taken in the UI, and `configure.sh` already treats it that way after #545: `apply` writes the live list back unchanged, `check` reports it without asserting. The audit asserting the same field contradicted that directly. **The defect was two tools comparing one field under opposite policies, not the field's value.** The comment says so and records what happened when it was not, because the next person to look at that list will otherwise put it back. ## How it was found While reviewing the Blog registration in #547. That report claims nine drift and no defects, which was true when it was written against hub `main` at `3a7cc64`, and stopped being true an hour later when #545 promoted. The PR body had even predicted it: "The same four will appear against every fleet repo when that promotes." It did. This is the same staleness the audit's own run-stamp rule exists to expose, arriving from the hub's side rather than the repo's. ## Verification - Utilities: 2 ruleset DEFECTs before, **0** after. Its remaining two findings are LETTER results for absent `GOVERNANCE.md` and `OPERATIONS.md`, which are the real propagation gap rather than this regression. - PlexCleaner: same, 2 before and 0 after. - `spec/validate.py` OK, diff-scoped `prose_lint` clean, editorconfig clean, syntax checked. ## Follow-on #547's `reports/blog/audit.md` should be regenerated against this corrected tool before it merges, so the committed report matches what the audit now reports rather than what it reported an hour before the payload change landed. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 3, 2026
ptr727
added a commit
that referenced
this pull request
Aug 3, 2026
…555) Three commits, and the first two are repairs to defects this hub shipped earlier today. Merged as a **merge commit**, never squashed. | Commit | PR | What | | --- | --- | --- | | `71b7691` | #547 | Catalogs Blog and records its first audit | | `82e3658` | #551 | Stops the audit asserting a bypass list the config no longer manages | | `fe01060` | #553 | Defines `walk` in the filter rather than calling it, for jq 1.5 | ## Why this one should not wait **`main` is currently wrong about every repository in the fleet.** The previous promotion took `bypass_actors` out of the ruleset payloads, but `spec/audit.py` compares live-against-payload over a subset that still included that field. A payload deliberately declaring no bypass, against a live ruleset that has one, reads as a normalized diff, so every repo audits as two ruleset DEFECTs: ```text == Utilities (csharp, nuget; release) @ main@e179288 == DEFECT ruleset: develop diverges from repo-config/develop.json (normalized diff) DEFECT ruleset: main diverges from repo-config/main.json (normalized diff) ``` Anyone auditing against `main` today gets a false failure on every repository. #551 removes the field from the compared subset, because the defect was **two tools comparing one field under opposite policies**, not the field's value: after the bypass change, `apply` writes the live list back unchanged and `check` reports it without asserting, so the audit asserting it contradicted the config directly. Verified on `develop`: Utilities and PlexCleaner went from two ruleset DEFECTs each to none, and Utilities' remaining two findings are LETTER results for absent `GOVERNANCE.md` and `OPERATIONS.md`, which is the real propagation gap. ## The second repair #553 closes #549. The payload-driven comparison was built on `walk/1`, which arrived in **jq 1.6**. On jq 1.5 the filter does not degrade, it fails to compile, so `check_ruleset` would report drift on every parameterized rule it never compared. Reproduced on a genuine `jq-1.5-1-a5b5cbe` and confirmed fixed, with output byte-identical to jq 1.7. Both defects were found by review rather than by a gate: #551 while reviewing the Blog registration, #553 by a Copilot review on a downstream re-vendor of the same canonical. ## Blog #547 catalogs Blog, taking the registry to 22 repositories. Its committed report claims zero defects, which was true when written, briefly false while the audit regression stood, and is true again on this branch. Confirmed rather than assumed: `spec/audit.py Blog` reports **0 defect/letter/error** here. ## Verification `spec/validate.py` OK at 22 cataloged, diff-scoped `prose_lint` clean, editorconfig clean, live read-only `configure.sh check` against this repo passes, and the audit reports the corrected verdicts above.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Blog was stood up on 2026-08-01 and cut release
1.0.11the same day, but it was never added toregistry/repos.json. Every hub tool is registry-driven, sospec/audit.pyandspec/fidelity_honesty.pyhad never measured it, andreports/divergences.mdwas under-reporting the fleet by exactly one repo while reading as complete. This catalogs it and lands its first audit.The entry records what ran, not what was predicted
reports/conformance-matrix.mdalready named Blog as the reference repo for thesource-only+releaseshape, and predictedreleaseTrigger: nonewith an emptypublish[]until a deploy ran. What actually shipped is a dispatch-only publisher that cut a tag and a source archive, so the entry isdispatch-onlywith the GitHub release declared, and the matrix row is corrected to match. The VPS deploy still has not run, so the static-site type stays deferred to #456 andpublish[]gets revisited when it does.What the audit found
Nine findings, no defects, verdict operational. Every one is the hub advancing after the carry rather than the repo regressing:
AGENTS.md > Fleet BootstrapandGOVERNANCE.md > Representative Data in Agent-Authored Text, and that distinction matters because a stale copy still states the rule in an older form while an absent one states nothing.AGENTS.md > Project Conventions, whose four rules are genuinely repo-specific and duplicate no verbatim section.The convergence PRs against Blog follow separately, one per drift class per AUDIT.md section 10.
Measured against
main, withdeveloprecorded separatelyThe run reads hub
main(3a7cc64) per AUDIT.md section 1. A re-run from a tree atdevelop(362aec8) reports two more re-vendors and two DEFECTs, all four from #545 takingbypass_actorsout of the ruleset payloads an hour earlier. Those are recorded in the report rather than counted, because measuring against un-promoted hub content reports work in flight as a conformance failure. The same four will appear against every fleet repo when that promotes, and the live-ruleset half is a settings change on a protected branch, so it is yours to apply rather than an agent's.Two spec questions, raised rather than resolved
AGENTS.mdsection.AGENTS.mdsays a project's own conventions live in that project'sAGENTS.md.spec/section-model.mdsays an undeclared section is drift to reconcile and lists four destinations, none of themAGENTS.md. A repo following the one is flagged for violating the other, and Blog is exactly that case.A third, smaller one: the report directory here is
reports/blog/, lowercase, matching every existing report directory rather than the repo's CamelCase name. AUDIT.md section 8 writes it asreports/<repo>/audit.md, which reads as exact case, and the two have quietly disagreed since the first report. Worth settling in the wording, and worth settling before someone clones on a case-insensitive filesystem.Verification
python3 spec/validate.py: 22 cataloged, 0 backlog, classifying cleanly.python3 spec/audit.py Blogfrom a tree at hubmain: 9 drift, 0 defect/letter/error.python3 spec/fidelity_honesty.py --report: regenerated, and the whole diff is Blog appearing in the rows it belongs in.python3 scripts/prose_lint.py reports/blog/audit.md: clean.🤖 Generated with Claude Code