diff --git a/.quirk/evidence/portfolio-review-20261030-bc4d58257330.json b/.quirk/evidence/portfolio-review-20261030-bc4d58257330.json new file mode 100644 index 0000000..1222d74 --- /dev/null +++ b/.quirk/evidence/portfolio-review-20261030-bc4d58257330.json @@ -0,0 +1,66 @@ +{ + "schema_version": "evidence-receipt.v1", + "receipt_id": "qreceipt.portfolio-review-20261030.bc4d58257330", + "repository": "Quirk-Systems/.github", + "status": "verified", + "subject": { + "base_commit": "d320f775a1be9ca8f6becfc19c84165bed176d1d", + "commit": "bc4d582573306d076c3611f8463dce42d8be90ab", + "changed_paths": [ + "docs/reviews/2026-10-30-workspace-portfolio-evidence.json", + "docs/todos/2026-10-03-workspace-portfolio-plans.md" + ] + }, + "claims": [ + { + "claim_id": "qclaim.portfolio-review-20261030.bc4d58257330", + "claim_type": "evidence", + "authority_effect": "none", + "statement": "Revalidates the workspace planning document against dated public repository evidence, preserves the October 3 survey wording with only heading-depth changes, and refreshes its review checkpoint after substantive assessment. At this subject all 233 tests, strict living-document validation and subsequent executed validate.sh checks pass; ruff and actionlint were unavailable, 21 existing concept warnings and 20 existing zizmor ignores remain. Nonpublic assessment is retained separately. No classifications, owners, schemas, workflow pins, authority grants, or hosted execution success are established or changed.", + "evidence_paths": [ + "docs/reviews/2026-10-30-workspace-portfolio-evidence.json", + "docs/todos/2026-10-03-workspace-portfolio-plans.md" + ] + } + ], + "artifacts": [ + { + "path": "docs/reviews/2026-10-30-workspace-portfolio-evidence.json", + "state": "present", + "git_blob": "ab77f1120a8dca47e6f8c2d883e5a1c88feba203", + "sha256": "sha256:ee4a8cd50879ee1b79451452f8824bf4e9227cf874f049dd16d2d9ec85372d85" + }, + { + "path": "docs/todos/2026-10-03-workspace-portfolio-plans.md", + "state": "present", + "git_blob": "e9db47d1f1f5c5d2fe65d1bbe8001e84af28c0a1", + "sha256": "sha256:c7452114b9ad697ef7ff2d8e6a60d979d857cb10abd2f30530c24534b67b1d93" + } + ], + "verification": { + "commands": [ + { + "command": "scripts/validate.sh", + "result": "pass", + "exit_code": 0 + }, + { + "command": "python3 scripts/validate_living_docs.py --strict", + "result": "pass", + "exit_code": 0 + }, + { + "command": "git diff --check d320f775a1be9ca8f6becfc19c84165bed176d1d HEAD", + "result": "pass", + "exit_code": 0 + } + ], + "verified_at": "2026-10-30T14:14:20Z" + }, + "authority": { + "admission_effect": "none", + "authority_ref": null + }, + "correction": null, + "receipt_sha256": "sha256:a4c83014eb2167988c42603dc22c722f0a68157753d14af7a642e71b10968e02" +} diff --git a/docs/reviews/2026-10-30-workspace-portfolio-evidence.json b/docs/reviews/2026-10-30-workspace-portfolio-evidence.json new file mode 100644 index 0000000..ab77f11 --- /dev/null +++ b/docs/reviews/2026-10-30-workspace-portfolio-evidence.json @@ -0,0 +1,566 @@ +{ + "reviewed": "2026-10-30", + "timezone": "America/Chicago", + "observed_governance_head": "d320f775a1be9ca8f6becfc19c84165bed176d1d", + "authority_effect": "none", + "scope": "Seven public repositories only. No private-derived counts or findings. Nonpublic assessment is outside this public evidence artifact.", + "comparison_pin": "92e5b2d928f25d0fedae87aaad2ef764a806065d", + "comparison_pin_note": "Historical comparison only, not a newly selected common policy target.", + "pull_requests": [ + { + "repository": "quirk-feed", + "number": 28, + "title": "ci(semantic): pin governance caller to a reviewed .github commit", + "state": "closed", + "draft": false, + "merged": true, + "merged_at": "2026-10-04T02:42:33Z", + "merge_sha": "b945223e2247932bdbe45adea872fafb6252c07d", + "head": "ceb00e1095dedddd7f73636d62ace0bb639c7045", + "base": "d311c476f4505288ada45d77f3cb0e804e8ec51b", + "url": "https://github.com/Quirk-Systems/quirk-feed/pull/28" + }, + { + "repository": "quirk-generator", + "number": 5, + "title": "ci(semantic): pin governance caller to a reviewed .github commit", + "state": "closed", + "draft": false, + "merged": true, + "merged_at": "2026-10-04T05:31:56Z", + "merge_sha": "389b4980098057e6403ac967694a31fb6a3ae1a8", + "head": "45cebae8c0c27d9db79ada7e6beeed74e0c88283", + "base": "8610f07f24230d5fe666ba62f51ecb2866e4c3c8", + "url": "https://github.com/Quirk-Systems/quirk-generator/pull/5" + }, + { + "repository": ".github", + "number": 24, + "title": "Record `quirk-kitworks` candidate provisioning handoff in portfolio registry", + "state": "open", + "draft": true, + "merged": false, + "merged_at": null, + "merge_sha": null, + "head": "c1188e0924e55ff61f4a0998510d24368a361928", + "base": "33309409424bbece1149dc9d7a9b8b68ac361703", + "url": "https://github.com/Quirk-Systems/.github/pull/24" + }, + { + "repository": ".github", + "number": 44, + "title": "feat(workspace): add multi-repository scanner and per-repository plans; repair stranded receipt", + "state": "closed", + "draft": false, + "merged": true, + "merged_at": "2026-10-03T18:05:36Z", + "merge_sha": "c029a903c018e63633e4b2c8b4a83da54801e32f", + "head": "0ea03b57832b093f9a289a227d114a888253aa2c", + "base": "92e5b2d928f25d0fedae87aaad2ef764a806065d", + "url": "https://github.com/Quirk-Systems/.github/pull/44" + }, + { + "repository": ".github", + "number": 47, + "title": "fix(dependabot): remove unavailable label overrides", + "state": "closed", + "draft": false, + "merged": true, + "merged_at": "2026-10-30T04:44:52Z", + "merge_sha": "d320f775a1be9ca8f6becfc19c84165bed176d1d", + "head": "303d201e88f7622afe7bace65b6a4eeaa22b2c77", + "base": "eb889adf3009951de873890103199600f4aad20f", + "url": "https://github.com/Quirk-Systems/.github/pull/47" + }, + { + "repository": ".github", + "number": 51, + "title": "ci(validation): add bounded Ubuntu 26 migration preflight", + "state": "open", + "draft": true, + "merged": false, + "merged_at": null, + "merge_sha": "48bb6a0aad86a1110f915b1d52e1cdee09dbd331", + "head": "7f18e49a90b1b6d772ed7d80fc6bb48258a2cc77", + "base": "eb889adf3009951de873890103199600f4aad20f", + "url": "https://github.com/Quirk-Systems/.github/pull/51" + }, + { + "repository": ".github", + "number": 55, + "title": "docs(governance): define working defaults and sufficient completion scope", + "state": "open", + "draft": true, + "merged": false, + "merged_at": null, + "merge_sha": "132013ea968a1e24dbedb8fe5612354d8ef2336a", + "head": "35c3a05341de125f6466b663775105cb7307527b", + "base": "eb889adf3009951de873890103199600f4aad20f", + "url": "https://github.com/Quirk-Systems/.github/pull/55" + }, + { + "repository": ".github", + "number": 58, + "title": "chore(deps): bump the github-actions group across 1 directory with 9 updates", + "state": "closed", + "draft": false, + "merged": false, + "merged_at": null, + "merge_sha": "20e9ae06ada7c35523c13cced777006289f22873", + "head": "bfd53dc93485a6dce10e70827e45027aaff61bd8", + "base": "eb889adf3009951de873890103199600f4aad20f", + "url": "https://github.com/Quirk-Systems/.github/pull/58" + }, + { + "repository": "project-scaffold", + "number": 137, + "title": "Modernize CI with checkout v7, strategic caching, and least-privilege permissions", + "state": "open", + "draft": true, + "merged": false, + "head": "0440f2cb837d3e05efff832f6a0e0ea37e3560f1", + "base": "1e04dfc91941905fff7312403bf0817eb2768c0f", + "url": "https://github.com/Quirk-Systems/project-scaffold/pull/137" + }, + { + "repository": "project-scaffold", + "number": 149, + "title": "fix(testing): align dependency upgrades with supported Node runtimes", + "state": "open", + "draft": false, + "merged": false, + "head": "92d683a652c9ec21b47d7343db5b1c69988e43a3", + "base": "1e04dfc91941905fff7312403bf0817eb2768c0f", + "url": "https://github.com/Quirk-Systems/project-scaffold/pull/149" + }, + { + "repository": "project-scaffold", + "number": 152, + "title": "chore(ci)(deps): bump trufflesecurity/trufflehog from 3.97.9 to 3.99.7", + "state": "open", + "draft": false, + "merged": false, + "head": "be8958f41b4e0a2cdf66cec8940eb3b37af69567", + "base": "1e04dfc91941905fff7312403bf0817eb2768c0f", + "url": "https://github.com/Quirk-Systems/project-scaffold/pull/152" + }, + { + "repository": "quirk-feed", + "number": 48, + "title": "chore(deps-dev): bump the testing group across 1 directory with 8 updates", + "state": "open", + "draft": false, + "merged": false, + "head": "48b5560718605a313280a91569ba5991e236e229", + "base": "a338ea3e0158437167cd875bb4655b67c3b9dc68", + "url": "https://github.com/Quirk-Systems/quirk-feed/pull/48" + }, + { + "repository": ".github", + "number": 45, + "title": "feat(validation): require complete tool availability for agent handoffs", + "state": "open", + "draft": true, + "merged": false, + "head": "5de16a5979aa5cbb298f3e16b52984d38caaffba", + "base": "c029a903c018e63633e4b2c8b4a83da54801e32f", + "url": "https://github.com/Quirk-Systems/.github/pull/45" + }, + { + "repository": ".github", + "number": 59, + "title": "chore(deps): bump the github-actions group across 1 directory with 10 updates", + "state": "open", + "draft": false, + "merged": false, + "head": "3b5747734aee9eccf30c14f715150044e8fb840e", + "base": "d320f775a1be9ca8f6becfc19c84165bed176d1d", + "url": "https://github.com/Quirk-Systems/.github/pull/59" + } + ], + "limitations": [ + "Coverage is the seven listed public checkouts, not an exhaustive organization inventory.", + "No portfolio-wide install, validation, deployment, authority or usefulness claim.", + "Scanner ran on the seven actual public checkouts. Only public findings are retained in this evidence file.", + "Six public clones are shallow; commit counts were not compared with October 3.", + "Pin parser limitations in WORKSPACE_TOOLING.md apply." + ], + "local_scanner": { + "scan": [ + { + "repository": "Quirk-Systems/.github", + "github_identity": true, + "directory": ".github", + "state": "CODE", + "commits": 247, + "head": "d320f775a1be9ca8f6becfc19c84165bed176d1d", + "top_level_entries": 26, + "source_files": 31, + "toolchain": [ + "pyproject.toml" + ], + "manifest": true, + "agent_files": [ + "AGENTS.md", + "CLAUDE.md", + ".github/copilot-instructions.md" + ], + "workflows": [ + "agent-task-dispatch.yml", + "codeql.yml", + "dependency-review.yml", + "governance-contracts.yml", + "quirk-semantic-governance.yml", + "reusable-agent-task-contract.yml", + "reusable-codeql.yml", + "reusable-dependency-review.yml", + "reusable-evidence-binding.yml", + "reusable-pr-title-lint.yml", + "reusable-sbom-provenance.yml", + "reusable-stale-incubations.yml", + "reusable-validate.yml", + "reusable-workflow-lint.yml", + "scorecard.yml", + "workflow-lint.yml" + ], + "validation_command": "scripts/validate.sh" + }, + { + "repository": "Quirk-Systems/greenfield", + "github_identity": true, + "directory": "greenfield", + "state": "DOCS_ONLY", + "commits": 1, + "head": "6e6d4b425fe9082d469493d64a5b8e12b15dc9da", + "top_level_entries": 9, + "source_files": 0, + "toolchain": [], + "manifest": false, + "agent_files": [], + "workflows": [], + "validation_command": null + }, + { + "repository": "Quirk-Systems/project-scaffold", + "github_identity": true, + "directory": "project-scaffold", + "state": "CODE", + "commits": 1, + "head": "1e04dfc91941905fff7312403bf0817eb2768c0f", + "top_level_entries": 42, + "source_files": 181, + "toolchain": [ + "package.json" + ], + "manifest": true, + "agent_files": [ + "AGENTS.md", + "CLAUDE.md" + ], + "workflows": [ + "ci.yml", + "deps-audit.yml", + "evidence-binding.yml", + "quirk-semantic.yml" + ], + "validation_command": "bun run validate" + }, + { + "repository": "Quirk-Systems/quirk-core", + "github_identity": true, + "directory": "quirk-core", + "state": "CODE", + "commits": 1, + "head": "b3162b0cd6dcc6c07570f240ca33c711ed860f0b", + "top_level_entries": 5, + "source_files": 5, + "toolchain": [], + "manifest": false, + "agent_files": [], + "workflows": [ + "quirk-contracts-conformance.yml" + ], + "validation_command": null + }, + { + "repository": "Quirk-Systems/quirk-feed", + "github_identity": true, + "directory": "quirk-feed", + "state": "CODE", + "commits": 1, + "head": "a338ea3e0158437167cd875bb4655b67c3b9dc68", + "top_level_entries": 26, + "source_files": 35, + "toolchain": [ + "package.json" + ], + "manifest": true, + "agent_files": [ + "CLAUDE.md" + ], + "workflows": [ + "ci.yml", + "quirk-semantic.yml" + ], + "validation_command": "bun run validate" + }, + { + "repository": "Quirk-Systems/quirk-generator", + "github_identity": true, + "directory": "quirk-generator", + "state": "CODE", + "commits": 1, + "head": "8b5d979e3c4cb42f076d2bf5836267e290bf873f", + "top_level_entries": 25, + "source_files": 49, + "toolchain": [ + "package.json" + ], + "manifest": true, + "agent_files": [ + "CLAUDE.md" + ], + "workflows": [ + "ci.yml", + "quirk-semantic.yml" + ], + "validation_command": "bun run validate" + }, + { + "repository": "Quirk-Systems/quirk-os", + "github_identity": true, + "directory": "quirk-os", + "state": "CODE", + "commits": 1, + "head": "03f70e1a790bac09294fe0f31a3c5f0d0fb4418e", + "top_level_entries": 29, + "source_files": 98, + "toolchain": [], + "manifest": true, + "agent_files": [ + ".github/copilot-instructions.md" + ], + "workflows": [ + "agent-reliability.yml", + "applause-gate-conformance.yml", + "applause-gate-fixtures.yml", + "deck-grammar-conformance.yml", + "distill-loop-conformance.yml", + "evidence-binding.yml", + "furniture-brief-conformance.yml", + "golden-gates.yml", + "intent-shaper-conformance.yml", + "qis-agent-harness.yml", + "sync-control-plane-conformance.yml", + "validate-agents.yml", + "validate-skills.yml" + ], + "validation_command": null + } + ], + "drift": { + "findings": [ + { + "kind": "OBSERVED_UNCLASSIFIED", + "repository": "Quirk-Systems/greenfield", + "detail": "observed DOCS_ONLY with 1 commit; not in .quirk/repositories.json" + } + ], + "not_compared": [], + "public_projection_note": "Private/adjacent missing-checkout rows omitted from this public projection. They describe local coverage only." + }, + "pins": [ + { + "repository": "Quirk-Systems/project-scaffold", + "file": ".github/workflows/evidence-binding.yml:11", + "workflow": "reusable-evidence-binding.yml", + "ref": "ed2f2ff7caacdb7a148ac9811dce1e7cce48a7c8", + "status": "OFF_TARGET" + }, + { + "repository": "Quirk-Systems/project-scaffold", + "file": ".github/workflows/quirk-semantic.yml:14", + "workflow": "quirk-semantic-governance.yml", + "ref": "1263f5008838f743b16ee218046e26dac5c9edd8", + "status": "OFF_TARGET" + }, + { + "repository": "Quirk-Systems/quirk-feed", + "file": ".github/workflows/quirk-semantic.yml:14", + "workflow": "quirk-semantic-governance.yml", + "ref": "92e5b2d928f25d0fedae87aaad2ef764a806065d", + "status": "PINNED" + }, + { + "repository": "Quirk-Systems/quirk-generator", + "file": ".github/workflows/quirk-semantic.yml:14", + "workflow": "quirk-semantic-governance.yml", + "ref": "92e5b2d928f25d0fedae87aaad2ef764a806065d", + "status": "PINNED" + }, + { + "repository": "Quirk-Systems/quirk-os", + "file": ".github/workflows/evidence-binding.yml:11", + "workflow": "reusable-evidence-binding.yml", + "ref": "6136fa5fa77116abfbc103c822d9d244a0e870b3", + "status": "OFF_TARGET" + } + ], + "commands": [ + { + "repository": "Quirk-Systems/.github", + "command": "scripts/validate.sh" + }, + { + "repository": "Quirk-Systems/project-scaffold", + "command": "bun run validate" + }, + { + "repository": "Quirk-Systems/quirk-feed", + "command": "bun run validate" + }, + { + "repository": "Quirk-Systems/quirk-generator", + "command": "bun run validate" + } + ] + }, + "public_repositories": [ + { + "repository": "Quirk-Systems/project-scaffold", + "archived": false, + "visibility": "public", + "inventory_entry": true, + "head": "1e04dfc91941905fff7312403bf0817eb2768c0f", + "tree": "dd2ba5ff4d93e1dd87c4bddba7e9658ba743fc37", + "tree_truncated": false, + "observed_state": "CODE", + "source_files": 181, + "manifest": true, + "workflow_count": 4 + }, + { + "repository": "Quirk-Systems/quirk-generator", + "archived": false, + "visibility": "public", + "inventory_entry": true, + "head": "8b5d979e3c4cb42f076d2bf5836267e290bf873f", + "tree": "56403847ddb4728c540bd689de0fa54dc4d5f828", + "tree_truncated": false, + "observed_state": "CODE", + "source_files": 49, + "manifest": true, + "workflow_count": 2 + }, + { + "repository": "Quirk-Systems/.github", + "archived": false, + "visibility": "public", + "inventory_entry": true, + "head": "d320f775a1be9ca8f6becfc19c84165bed176d1d", + "tree": "8e96e6cc796a257c00323c94b9cda4e65962d6d7", + "tree_truncated": false, + "observed_state": "CODE", + "source_files": 31, + "manifest": true, + "workflow_count": 16 + }, + { + "repository": "Quirk-Systems/quirk-feed", + "archived": false, + "visibility": "public", + "inventory_entry": true, + "head": "a338ea3e0158437167cd875bb4655b67c3b9dc68", + "tree": "b3b4e2b2f3b291f73496e7fb9ffd5e4995f16991", + "tree_truncated": false, + "observed_state": "CODE", + "source_files": 35, + "manifest": true, + "workflow_count": 2 + }, + { + "repository": "Quirk-Systems/quirk-os", + "archived": false, + "visibility": "public", + "inventory_entry": true, + "head": "03f70e1a790bac09294fe0f31a3c5f0d0fb4418e", + "tree": "37c4d94d95b2e9b120ca31f38becd23880d101c2", + "tree_truncated": false, + "observed_state": "CODE", + "source_files": 98, + "manifest": true, + "workflow_count": 13 + }, + { + "repository": "Quirk-Systems/quirk-core", + "archived": false, + "visibility": "public", + "inventory_entry": true, + "head": "b3162b0cd6dcc6c07570f240ca33c711ed860f0b", + "tree": "3ada9098ed23230d19e0ad90984e6bbe37650a17", + "tree_truncated": false, + "observed_state": "CODE", + "source_files": 5, + "manifest": false, + "workflow_count": 1 + }, + { + "repository": "Quirk-Systems/greenfield", + "archived": false, + "visibility": "public", + "inventory_entry": false, + "head": "6e6d4b425fe9082d469493d64a5b8e12b15dc9da", + "tree": "f93bc2c1aa384e93900f5eb86a68d44ddd748766", + "tree_truncated": false, + "observed_state": "DOCS_ONLY", + "source_files": 0, + "manifest": false, + "workflow_count": 0 + } + ], + "public_reusable_workflow_callers": [ + { + "repository": "Quirk-Systems/project-scaffold", + "file": ".github/workflows/evidence-binding.yml:11", + "workflow": "reusable-evidence-binding.yml", + "ref": "ed2f2ff7caacdb7a148ac9811dce1e7cce48a7c8", + "status": "OFF_TARGET" + }, + { + "repository": "Quirk-Systems/project-scaffold", + "file": ".github/workflows/quirk-semantic.yml:14", + "workflow": "quirk-semantic-governance.yml", + "ref": "1263f5008838f743b16ee218046e26dac5c9edd8", + "status": "OFF_TARGET" + }, + { + "repository": "Quirk-Systems/quirk-feed", + "file": ".github/workflows/quirk-semantic.yml:14", + "workflow": "quirk-semantic-governance.yml", + "ref": "92e5b2d928f25d0fedae87aaad2ef764a806065d", + "status": "PINNED" + }, + { + "repository": "Quirk-Systems/quirk-generator", + "file": ".github/workflows/quirk-semantic.yml:14", + "workflow": "quirk-semantic-governance.yml", + "ref": "92e5b2d928f25d0fedae87aaad2ef764a806065d", + "status": "PINNED" + }, + { + "repository": "Quirk-Systems/quirk-os", + "file": ".github/workflows/evidence-binding.yml:11", + "workflow": "reusable-evidence-binding.yml", + "ref": "6136fa5fa77116abfbc103c822d9d244a0e870b3", + "status": "OFF_TARGET" + } + ], + "public_summary": { + "repositories": 7, + "CODE": 6, + "DOCS_ONLY": 1, + "reusable_calls": 5, + "distinct_policy_shas": 4, + "floating_in_parser_supported_forms": 0 + } +} diff --git a/docs/todos/2026-10-03-workspace-portfolio-plans.md b/docs/todos/2026-10-03-workspace-portfolio-plans.md index d87550e..e9db47d 100644 --- a/docs/todos/2026-10-03-workspace-portfolio-plans.md +++ b/docs/todos/2026-10-03-workspace-portfolio-plans.md @@ -4,12 +4,164 @@ Kind: todo Status: candidate Owner: @bryansayler Repository: `Quirk-Systems/.github` -Observed head: `92e5b2d928f25d0fedae87aaad2ef764a806065d` -Reviewed: 2026-10-03 -Review by: 2026-10-17 +Observed head: `d320f775a1be9ca8f6becfc19c84165bed176d1d` +Reviewed: 2026-10-30 +Review by: 2026-11-03 Derived from: `docs/roadmaps/2026-09-20-org-control-plane.md`, `docs/REPOSITORY_STRATEGY.md`, `docs/governance/WORKSPACE_TOOLING.md` Authority effect: **none** +## Review — 2026-10-30 + +**VERIFIED — substantive reassessment; authority effect remains none.** This +review supersedes the action queue below, not its historical observations. +Owner and candidate status remain unchanged. Repository classifications, +lifecycles, ownership, schemas, registry entries, workflow pins, and authority +are not changed. November 3 is the next portfolio review checkpoint, not a +newly configured automation. + +### Recovery, sources, and coverage + +No newer completed portfolio review was recovered from accessible document +history, repository planning paths, portfolio PR search, or saved-file search. +The latest document revision was October 3 commit +`c3af72ce28add3d5fffe9f382436fc5c03460a83`, included in merged [PR #44](https://github.com/Quirk-Systems/.github/pull/44). +This search does not establish absence from inaccessible conversations or files. + +The [public evidence inventory](../reviews/2026-10-30-workspace-portfolio-evidence.json) +records exact public repository heads, scanner output, and selected public PR +states. Detailed private-repository observations were assessed separately and +retained in a private review report; their source payloads, heads, per-repository +metadata, and review details are not added to this public correction. The +historical text below was already present publicly and is preserved. + +**VERIFIED — public subset.** This public evidence inventory covers seven public +repositories. Six are source-bearing (`CODE`) and one (`greenfield`) is +`DOCS_ONLY` under the scanner's rules. The public governed inventory still has +17 organization and two adjacent entries. `greenfield` is outside that inventory. +No new organization-wide count, private repository state, or private-derived +aggregate is disclosed here. The historical survey remains historical. + +Seven actual public checkouts were available: `.github`, `greenfield`, +`project-scaffold`, `quirk-core`, `quirk-feed`, `quirk-generator`, and `quirk-os`. +The existing scanner ran without modifications: + +```sh +python3 scripts/quirk_workspace.py scan --json +python3 scripts/quirk_workspace.py drift --json +python3 scripts/quirk_workspace.py pins --expect 92e5b2d928f25d0fedae87aaad2ef764a806065d --json +python3 scripts/quirk_workspace.py commands --json +``` + +Six public clones are shallow, so their commit counts were not compared with +October 3. Scanner `NOT_IN_WORKSPACE` means checkout coverage only; the public +evidence file omits rows about repositories outside this public subset. This is +not an exhaustive organization inventory, and it does not establish absence or +status for any repository outside the listed checkouts. + +`commands --run` was not used across the portfolio: dependency installations +and native/browser environments were not reconstructed. This correction reruns +only the governance repository's local checks. Application passes from October 3 +are not renewed. Detailed nonpublic review material is retained separately and +is not part of the evidence offered by this public patch. + +### Verified changes and remaining work + +| Area | Current public evidence | Disposition | +| --- | --- | --- | +| Original caller repairs | [Feed #28](https://github.com/Quirk-Systems/quirk-feed/pull/28) and [Generator #5](https://github.com/Quirk-Systems/quirk-generator/pull/5) merged; both current main callers retain `92e5b2d928f25d0fedae87aaad2ef764a806065d`. | Public caller merge tasks complete; remaining original caller review details stay in the private report. | +| Policy pins | The public subset has five calls with full SHA refs across four policy commits, with no floating ref in parser-supported forms. Caller detail is below. | Selecting a common target remains a review decision. A different full SHA is not automatically invalid or vulnerable. | +| `quirk-os` | Main `03f70e1a790bac09294fe0f31a3c5f0d0fb4418e` has 13 workflows, no `scripts/validate.sh`, and no scanner-recognized local validation command. | Single declared entrypoint remains open; individual workflow commands exist, but equivalence was not assessed. | +| `quirk-core` | Main remains `b3162b0cd6dcc6c07570f240ca33c711ed860f0b`; complete tree has no `.quirk/manifest.json`. | Manifest task remains open; preserve the existing doctrine-retention decision. | +| `quirk-feed` runtime | Main `a338ea3e0158437167cd875bb4655b67c3b9dc68` declares Node `>=24.21.0 <25`, Bun `>=1.4.2 <2`; CI reads `.node-version` = `24.21.0` and `.bun-version` = `1.4.2`. | Runtime declaration gap addressed. Full-install validation is not renewed by reading configuration. | +| `greenfield` | Main `6e6d4b425fe9082d469493d64a5b8e12b15dc9da` is `DOCS_ONLY` under scanner rules and is not in the governed inventory. | `OBSERVED_UNCLASSIFIED`; no inferred purpose or owner. | +| Governance improvements | #44 and #47 merged; #47 is main `d320f775a1be9ca8f6becfc19c84165bed176d1d`. #55 and Ubuntu preflight #51 remain drafts. #58 closed without merge; the current Actions dependency group is #59. | Keep review candidates separate from landed changes. | + +### Public workflow pins + +Caller heads and exact file locations are in the evidence inventory. The old +October 3 pin is a comparison value only, not a newly selected policy target. +Private caller details remain outside the new public evidence file. + +| Public caller | Reusable workflow | Full policy SHA | +| --- | --- | --- | +| Feed, Generator | `quirk-semantic-governance.yml` | `92e5b2d928f25d0fedae87aaad2ef764a806065d` | +| `project-scaffold` | semantic governance | `1263f5008838f743b16ee218046e26dac5c9edd8` | +| `project-scaffold` | evidence binding | `ed2f2ff7caacdb7a148ac9811dce1e7cce48a7c8` | +| `quirk-os` | evidence binding | `6136fa5fa77116abfbc103c822d9d244a0e870b3` | + +### Dependencies, existing decisions, and unknowns + +**VERIFIED — reuse existing candidates.** Scaffold #137 (CI modernization), #149 +(testing/runtime alignment), and #152 (TruffleHog update) remain open; none is +main. Reconcile their CI overlap at their recorded heads. Feed #48 remains open. +The shared Actions dependency group #59 is open at +`3b5747734aee9eccf30c14f715150044e8fb840e`. #55's current head is +`35c3a05341de125f6466b663775105cb7307527b`. These states establish pending +review, not readiness to merge. Private candidate dependencies are retained in +the private review rather than republished here. + +**VERIFIED — decisions retained.** The inventory and control-plane roadmap keep +Core separate for owning a distinct, versioned, enforceable contract; lack of a +consumer alone is not grounds to fold it. Scaffold remains a reference repository +and OS a candidate kernel. The 19 inventory owner fields remain open; this +planning document's owner does not become each repository's owner. No governed +decision JSON is committed on this main; the accessible open `label:decision` +issue query returned none. Neither observation rules out decisions elsewhere. +Public provisioning #24 and working defaults #55 remain drafts with no submitted +reviews. They do not replace merged decisions. + +**UNKNOWN / not established here.** Current owner-only ruleset/merge-method +settings, complete Core consumer graph, application install/test health, +private Actions credentials, deployment, and human usefulness. The main workflow +tree contains neither `portfolio-drift.yml` nor caller-bump automation. Session +read access does not establish Actions access. The receipt protocol already +requires merge commits; settings enforcement is a separate owner check. + +**Local versus hosted.** Baseline `scripts/validate.sh` ran 233 tests: 232 passed; +the sole failure was `test_repository_documents_are_fresh_today` because this +document was due October 17. The script stopped there; later stages were not +counted as passed. Exact-subject correction results are recorded in its evidence +receipt and PR. No validator, test, workflow, or unrelated document is changed. +Four other living documents still have October 31 deadlines and need substantive +review before November 1. + +At the baseline main SHA, [Governance Contracts run 41004601321](https://github.com/Quirk-Systems/.github/actions/runs/41004601321) +failed with one job and zero steps. CodeQL and Scorecard also failed; Dependabot +service runs succeeded. #47's earlier public validation record identifies a +billing lock; current check annotations were unavailable through this connection. +The current startup cause and successful hosted execution cannot be inferred +from a document-freshness repair. + +## Open + +- [ ] Add a declared `quirk-os` validation entrypoint derived from its existing workflows (owner: @bryansayler; proof: scanner `commands` lists it and that repository's applicable checks run successfully). +- [ ] Add the existing doctrine declaration's manifest in `quirk-core` through its own review (owner: @bryansayler; proof: complete tree contains the manifest and its applicable validator passes). +- [ ] Reconcile existing Scaffold #137/#149/#152, and review Feed #48 and shared Actions #59 independently (owner: @bryansayler; proof: current exact-head checks, compatibility assessment, and recorded disposition). +- [ ] Reassess this portfolio by November 3; first review the four other living documents due October 31 (owner: @bryansayler; proof: substantive reviews, observed heads, remaining unknowns, and strict freshness validation). + +## Blocked + +- [ ] Select a reviewed common policy target after comparing the four public policy commits and obtaining the remaining caller evidence within its access boundary; do not automatically downgrade newer evidence callers to the historical comparison SHA (blocked on: owner policy selection and per-repository review; who can unblock: @bryansayler; proof: complete `pins --expect ` has no unintended drift). +- [ ] Reconcile newly observed public inventory drift (`greenfield`) and assess the remaining portfolio within its access boundaries (blocked on: owner topology and schema decisions; who can unblock: @bryansayler). The inventory schema still fixes snapshot `2026-08-21`, 19 entries, and organization count 17. No additional private findings are disclosed here. +- [ ] Decide empty-repository retention/archive and adjacent commerce selection through the existing creation/retirement gates (blocked on: owner judgement; who can unblock: @bryansayler). +- [ ] Authorize scheduled drift reports or caller-bump automation only with a brief, scoped credentials, permissions, and kill switch (blocked on: owner-controlled Actions access and write grants; who can unblock: @bryansayler). +- [ ] Verify receipt-preserving merge-method enforcement and restore hosted validation access (blocked on: owner settings/account access; who can unblock: @bryansayler). Preserve the existing merge-commit protocol and receipts; local success cannot close this item. + +## Done + +- [x] Recovered the original survey and checked accessible history for a successor; reviewed the seven public checkouts on October 30 (evidence: public inventory, exact heads, and scanner output; nonpublic review retained separately). +- [x] Feed #28 and Generator #5 merged and their main callers retain the reviewed October 3 pin (evidence: merge SHAs and caller heads in the public evidence inventory). +- [x] Original scanner/receipt repair #44 and Dependabot label correction #47 merged (evidence: recorded merge SHAs; no hosted success claim). +- [x] Feed runtime declarations and CI version-file wiring are present (evidence: `a338ea3e0158437167cd875bb4655b67c3b9dc68`, `.node-version`, `.bun-version`, `package.json`, and `.github/workflows/ci.yml`; application tests not rerun here). + +## Historical survey — 2026-10-03 (preserved) + +Original observed head: `92e5b2d928f25d0fedae87aaad2ef764a806065d`. +Original review: October 3; original deadline: October 17. The following survey, +plans, checkboxes, and unknowns are historical evidence already present publicly. +Only section headings are demoted; original observations and wording remain. +Use the October 30 queue above for current action. + One plan per repository, written from what a 50-repository workspace showed on 2026-10-03, not from repository names. Counts, states, drift, pins, and validation exit codes are scanner output from these four invocations against @@ -27,7 +179,7 @@ request numbers were observed separately, not by the scanner. A plan here is a next bounded move, not a classification: classes, lifecycles, and owners change only through a reviewed inventory change. -## What the workspace showed +### What the workspace showed - **VERIFIED (scanner) — 50 checkouts**: 11 `CODE`, 9 `DOCS_ONLY`, 30 `EMPTY` (no commits at all). - **VERIFIED (scanner) — inventory drift**: 32 `OBSERVED_UNCLASSIFIED` (29 empty, plus @@ -61,7 +213,7 @@ in the 13 repositories with commits but no declared validation command, commands); the commerce repositories' own CI; anything in the 30 empty repositories. -## Per-repository plans +### Per-repository plans | Repository | Observed | Next bounded move | Gate | | --- | --- | --- | --- | @@ -79,7 +231,7 @@ repositories. | 29 empty repositories outside the inventory | EMPTY, no default branch | Record them; do not bootstrap. Each stays empty until it passes the creation gate in `REPOSITORY_STRATEGY.md` §5, or the owner archives it | owner | | `bryansayler/quirk-commerce` | CODE, one 2025-01-04 commit (a Medusa starter), no validation or test script | None until the owner selects a commerce candidate, as the inventory says | owner | -## Open +### Open - [ ] Merge the four caller-pin pull requests in `quirk-beauty`, `quirk-feed`, `quirk-generator`, and `quirk-town` (owner: @bryansayler; proof: `python scripts/quirk_workspace.py pins --fail-on-floating` exits 0) - [ ] Choose one reviewed `.github` commit and move every caller to it, `.github-private` and `project-scaffold` included (owner: @bryansayler; proof: `pins --expect ` reports no `OFF_TARGET`) @@ -87,7 +239,7 @@ repositories. - [ ] Add `.quirk/manifest.json` to `quirk-core` (owner: @bryansayler; proof: `scan` shows `Manifest yes` for `quirk-core`) - [ ] Re-run this survey at the twice-weekly portfolio review and bump this document (owner: @bryansayler; proof: Reviewed date and Observed head updated) -## Blocked +### Blocked - [ ] Admit the 32 `OBSERVED_UNCLASSIFIED` repositories to `.quirk/repositories.json` (blocked on: the inventory schema pins the snapshot `2026-08-21`, exactly 19 entries, and 17 organization repositories, so any admission is a schema version change, which `AGENTS.md` puts under Ask first; who can unblock: @bryansayler) - [ ] Build the scheduled `portfolio-drift.yml` report proposed in `docs/governance/WORKSPACE_TOOLING.md` (blocked on: read access to private repositories from Actions, which means a token or GitHub App the owner provisions, plus a brief naming its kill switch; who can unblock: @bryansayler) @@ -95,7 +247,7 @@ repositories. - [ ] Stop receipts being stranded by squash merges: the PR #14 squash is what broke the receipt check on `main`, and squashing this pull request would strand its own four subject commits the same way. Merge with a merge commit, as PRs #39 and #41 were, and either restrict the repository to merge commits or teach the receipt protocol to re-bind after a squash (blocked on: a repository merge-method setting or a protocol decision; who can unblock: @bryansayler) - [ ] Decide each empty repository: keep reserved, or archive (blocked on: owner judgement at the quarterly topology review; who can unblock: @bryansayler) -## Done +### Done - [x] Repaired the receipt that the PR #14 squash merge stranded: `qreceipt.pr-closure-harness-plan-followup.1010b25a9fe4` replaced by `qreceipt.pr-closure-harness-plan-followup.92e5b2d928f2`, bound to the squash commit whose two document blobs are byte-identical; the coverage check now excludes a subject equal to the range base and treats a deleted receipt JSON like a present one (evidence: the receipt that covers the validator subject commit; full-history validation passes) - [x] Workspace scanner with `scan`, `drift`, `pins`, and `commands`, with tests (evidence: `scripts/quirk_workspace.py`, `tests/test_quirk_workspace.py`, and the receipt that covers this document's subject commit)