From 484e98ca408a44dd84f912f75de1a5130267ccac Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 3 Aug 2026 15:50:07 -0700 Subject: [PATCH 1/3] Stop the audit asserting a bypass list the config no longer manages Removing bypass_actors from the ruleset payloads made every repo in the fleet report two ruleset DEFECTs. spec/audit.py compares the live ruleset against the payload over a fixed subset that included bypass_actors, so a payload that deliberately declares none against a live ruleset that has one is a normalized diff, and the audit called that divergence. The field is dropped from the compared subset rather than the payloads being changed back. Who may bypass a ruleset is a per-repository human decision taken in the UI, and configure.sh already treats it that way: apply writes the live list back unchanged, check reports it without asserting. The audit asserting it contradicted that directly. The defect was two tools comparing one field under opposite policies, not the field's value, so the comment says why the field is absent and what happened when it was not. The next person to add it back needs to know that. Found while reviewing the Blog registration in #547, whose report claimed nine drift and no defects. That was true when it was written and stopped being true an hour later when the payload change promoted, which is the same staleness the audit's own run-stamp rule exists to expose. Verified against two repos: Utilities and PlexCleaner both reported two ruleset DEFECTs before and neither does now. Utilities' remaining two findings are LETTER results for absent GOVERNANCE.md and OPERATIONS.md, which are the real propagation gap rather than this regression. Co-Authored-By: Claude Opus 5 (1M context) --- spec/audit.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/spec/audit.py b/spec/audit.py index fd8e889b..75129428 100644 --- a/spec/audit.py +++ b/spec/audit.py @@ -39,7 +39,13 @@ "has_wiki", "has_projects", "allow_merge_commit", "allow_squash_merge", "allow_rebase_merge", "allow_auto_merge", "allow_update_branch", "delete_branch_on_merge", ] -RULESET_SUBSET = ["name", "target", "enforcement", "bypass_actors", "conditions", "rules"] +# bypass_actors is deliberately absent. Who may bypass a ruleset is a per-repository human decision +# taken in the UI, and repo-config/configure.sh neither grants nor revokes it: apply writes the live +# list back unchanged and check reports it without asserting. Comparing it here would contradict that, +# and did: once the payloads stopped declaring a bypass list, every repo whose live ruleset still had +# one reported a ruleset DEFECT for a field the fleet config had deliberately stopped managing. +# Two tools comparing one field under opposite policies is the defect, not the field's value. +RULESET_SUBSET = ["name", "target", "enforcement", "conditions", "rules"] # Phrases in a registry driftNote that assert work still outstanding. Deliberately specific: a note # recording a permanent deviation ("no get-version-task; relies on validate-task") must not match. PENDING_MARKERS = ["pending", "not yet", "owed", "todo", "still", "behind", "missing", "absent"] @@ -102,8 +108,6 @@ def normalize_ruleset(payload): sub = {k: payload.get(k) for k in RULESET_SUBSET} if isinstance(sub.get("rules"), list): sub["rules"] = sorted(sub["rules"], key=lambda r: json.dumps(r, sort_keys=True)) - if isinstance(sub.get("bypass_actors"), list): - sub["bypass_actors"] = sorted(sub["bypass_actors"], key=lambda a: (str(a.get("actor_type")), str(a.get("actor_id")))) return json.dumps(sub, sort_keys=True) From 9d0f1044fbaf43cfc6865041511736fabffcbf9f Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 3 Aug 2026 15:51:34 -0700 Subject: [PATCH 2/3] Split the comment block to one sentence per line The explanatory comment landed as wrapped prose and tripped the gate this repo ships. Same content, one sentence per line, and it no longer opens on a lowercase path. Co-Authored-By: Claude Opus 5 (1M context) --- spec/audit.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/spec/audit.py b/spec/audit.py index 75129428..f14dcdee 100644 --- a/spec/audit.py +++ b/spec/audit.py @@ -39,12 +39,13 @@ "has_wiki", "has_projects", "allow_merge_commit", "allow_squash_merge", "allow_rebase_merge", "allow_auto_merge", "allow_update_branch", "delete_branch_on_merge", ] -# bypass_actors is deliberately absent. Who may bypass a ruleset is a per-repository human decision -# taken in the UI, and repo-config/configure.sh neither grants nor revokes it: apply writes the live -# list back unchanged and check reports it without asserting. Comparing it here would contradict that, -# and did: once the payloads stopped declaring a bypass list, every repo whose live ruleset still had -# one reported a ruleset DEFECT for a field the fleet config had deliberately stopped managing. -# Two tools comparing one field under opposite policies is the defect, not the field's value. +# The bypass_actors field is deliberately absent from this list. +# Who may bypass a ruleset is a per-repository human decision taken in the UI. +# The configure.sh script in repo-config treats it that way, since apply writes the live list back unchanged and check reports it without asserting. +# Comparing it here would contradict that, and did. +# Once the payloads stopped declaring a bypass list, every repo whose live ruleset still had one reported a ruleset DEFECT. +# That was a field the fleet config had deliberately stopped managing. +# Two tools comparing one field under opposite policies is the defect, rather than the field's value. RULESET_SUBSET = ["name", "target", "enforcement", "conditions", "rules"] # Phrases in a registry driftNote that assert work still outstanding. Deliberately specific: a note # recording a permanent deviation ("no get-version-task; relies on validate-task") must not match. From ab5bc37bd17e8286a4cfe1de9906b94c2610c33c Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 3 Aug 2026 15:58:48 -0700 Subject: [PATCH 3/3] Say that work is still outstanding, and drop the semicolon example The PENDING_MARKERS comment read 'assert work still outstanding', which is missing a verb and is the kind of line someone later greps for. It also carried a parenthetical example joined by a semicolon, which the character-set rules ban in agent-authored prose, so the example is now its own sentence without one. Pre-existing rather than introduced here, and adjacent to the change, so it is fixed in place rather than stepped around. Co-Authored-By: Claude Opus 5 (1M context) --- spec/audit.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/spec/audit.py b/spec/audit.py index f14dcdee..c7f99966 100644 --- a/spec/audit.py +++ b/spec/audit.py @@ -47,8 +47,9 @@ # That was a field the fleet config had deliberately stopped managing. # Two tools comparing one field under opposite policies is the defect, rather than the field's value. RULESET_SUBSET = ["name", "target", "enforcement", "conditions", "rules"] -# Phrases in a registry driftNote that assert work still outstanding. Deliberately specific: a note -# recording a permanent deviation ("no get-version-task; relies on validate-task") must not match. +# Phrases in a registry driftNote that assert work is still outstanding. +# Deliberately specific, so a note recording a permanent deviation must not match. +# An example of one that must not match is a note reading that there is no get-version-task and validate-task is relied on instead. PENDING_MARKERS = ["pending", "not yet", "owed", "todo", "still", "behind", "missing", "absent"]