diff --git a/.quirk/evidence/governance-integration-20261031-f6ca3b255f95.json b/.quirk/evidence/governance-integration-20261031-f6ca3b255f95.json new file mode 100644 index 0000000..81ed1f2 --- /dev/null +++ b/.quirk/evidence/governance-integration-20261031-f6ca3b255f95.json @@ -0,0 +1,92 @@ +{ + "schema_version": "evidence-receipt.v1", + "receipt_id": "qreceipt.governance-integration-20261031.f6ca3b255f95", + "repository": "Quirk-Systems/.github", + "status": "verified", + "subject": { + "base_commit": "76d828239136dd13189c024843ad85ab269fcf49", + "commit": "f6ca3b255f95839abe4bdcab25dcb38396fd556a", + "changed_paths": [ + ".quirk/evidence/governance-review-20261031-f2deb14f0d9c.json", + "docs/intentions/2026-09-20-evidence-first-planning.md", + "docs/roadmaps/2026-09-20-org-control-plane.md", + "docs/todos/2026-09-20-living-document-rollout.md" + ] + }, + "claims": [ + { + "claim_id": "qclaim.governance-integration-20261031.f6ca3b255f95", + "claim_type": "evidence", + "authority_effect": "none", + "statement": "Integrates main after PR 60 using a merge commit whose tree is byte-identical to original PR 61 head 7bad94833a84413683f186756cedf8b96fe58dad. Preserves all original subject commits, receipts, documentation, and historical evidence. Binds the three existing governance corrections and their original receipt to the retargeted main base. At this exact integration subject, 233 tests and all executed validate.sh stages pass, including offline pedantic zizmor 1.31.1; ruff and actionlint are unavailable, 21 existing concept warnings and 20 existing zizmor ignores remain. Strict freshness passes for November 1 and November 3. This receipt does not establish hosted validation success, authority, settings activation, completed cadence/enforcement decisions, or final main integration.", + "evidence_paths": [ + ".quirk/evidence/governance-review-20261031-f2deb14f0d9c.json", + "docs/intentions/2026-09-20-evidence-first-planning.md", + "docs/roadmaps/2026-09-20-org-control-plane.md", + "docs/todos/2026-09-20-living-document-rollout.md" + ] + } + ], + "artifacts": [ + { + "path": ".quirk/evidence/governance-review-20261031-f2deb14f0d9c.json", + "state": "present", + "git_blob": "5346a21eaccba6a7d4da8bcbc471e219337ee7ed", + "sha256": "sha256:93f4a6ed3aa8e1fc270f7f0e70cef703e1051f9a10f9f8b09035584dad5c479c" + }, + { + "path": "docs/intentions/2026-09-20-evidence-first-planning.md", + "state": "present", + "git_blob": "bb61570bdd67db145f9004eaa4133ddd3f122bde", + "sha256": "sha256:7cf940bc9be2d8c2ede289af4be8902ed09304aca0db6a563c8692aa2214fcac" + }, + { + "path": "docs/roadmaps/2026-09-20-org-control-plane.md", + "state": "present", + "git_blob": "0ead9cce75f95c71b58e8a4507aa2e1307a9fee4", + "sha256": "sha256:97710fc8875e88bc9df0a8b2e4fc5b57f89428fbab71283a2b5260427411850e" + }, + { + "path": "docs/todos/2026-09-20-living-document-rollout.md", + "state": "present", + "git_blob": "04898c4455be7524c20c5e29e9478e35d7ef5518", + "sha256": "sha256:7c72db425bce9a53a47ca74c8e3dd51c07592c0c4f869c52d4effaa62bce6d8d" + } + ], + "verification": { + "commands": [ + { + "command": "scripts/validate.sh", + "result": "pass", + "exit_code": 0 + }, + { + "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-01", + "result": "pass", + "exit_code": 0 + }, + { + "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-03", + "result": "pass", + "exit_code": 0 + }, + { + "command": "git diff --exit-code 7bad94833a84413683f186756cedf8b96fe58dad HEAD", + "result": "pass", + "exit_code": 0 + }, + { + "command": "git diff --check 76d828239136dd13189c024843ad85ab269fcf49 HEAD", + "result": "pass", + "exit_code": 0 + } + ], + "verified_at": "2026-10-31T20:54:57Z" + }, + "authority": { + "admission_effect": "none", + "authority_ref": null + }, + "correction": null, + "receipt_sha256": "sha256:d7aa6bdc7070dc963cf9d6228095a73c9fb28ffa9819b1c05f2d879cfb324281" +} diff --git a/.quirk/evidence/governance-review-20261031-f2deb14f0d9c.json b/.quirk/evidence/governance-review-20261031-f2deb14f0d9c.json new file mode 100644 index 0000000..5346a21 --- /dev/null +++ b/.quirk/evidence/governance-review-20261031-f2deb14f0d9c.json @@ -0,0 +1,94 @@ +{ + "schema_version": "evidence-receipt.v1", + "receipt_id": "qreceipt.governance-review-20261031.f2deb14f0d9c", + "repository": "Quirk-Systems/.github", + "status": "verified", + "subject": { + "base_commit": "7c52c0407ea2fa6d3fa99cf13d86492a74733259", + "commit": "f2deb14f0d9c9eb3a1608cde49c72f2ffa572abf", + "changed_paths": [ + "docs/intentions/2026-09-20-evidence-first-planning.md", + "docs/roadmaps/2026-09-20-org-control-plane.md", + "docs/todos/2026-09-20-living-document-rollout.md" + ] + }, + "claims": [ + { + "claim_id": "qclaim.governance-review-20261031.f2deb14f0d9c", + "claim_type": "evidence", + "authority_effect": "none", + "statement": "Substantively revalidates three existing active governance documents against main d320f775a1be9ca8f6becfc19c84165bed176d1d and preserved PR 60 head 7c52c0407ea2fa6d3fa99cf13d86492a74733259. Records recovered review history, five-plan opt-in scope, landed work, draft dependencies, and pending owner decisions; sets November 3 checkpoints without changing status or enforcement. Historical sections, the done goal, and all three portfolio-review files are preserved. At this subject 233 tests and all executed validate.sh stages pass, including offline pedantic zizmor 1.31.1; Ruff and actionlint are unavailable, 21 concept warnings and 20 zizmor ignores remain. Strict validation passes on October 31 and simulated November 1 and November 3. This does not establish hosted success, implemented cadence/enforcement decisions, merge, settings activation, consumer adoption, or freshness on main before integration.", + "evidence_paths": [ + "docs/intentions/2026-09-20-evidence-first-planning.md", + "docs/roadmaps/2026-09-20-org-control-plane.md", + "docs/todos/2026-09-20-living-document-rollout.md" + ] + } + ], + "artifacts": [ + { + "path": "docs/intentions/2026-09-20-evidence-first-planning.md", + "state": "present", + "git_blob": "bb61570bdd67db145f9004eaa4133ddd3f122bde", + "sha256": "sha256:7cf940bc9be2d8c2ede289af4be8902ed09304aca0db6a563c8692aa2214fcac" + }, + { + "path": "docs/roadmaps/2026-09-20-org-control-plane.md", + "state": "present", + "git_blob": "0ead9cce75f95c71b58e8a4507aa2e1307a9fee4", + "sha256": "sha256:97710fc8875e88bc9df0a8b2e4fc5b57f89428fbab71283a2b5260427411850e" + }, + { + "path": "docs/todos/2026-09-20-living-document-rollout.md", + "state": "present", + "git_blob": "04898c4455be7524c20c5e29e9478e35d7ef5518", + "sha256": "sha256:7c72db425bce9a53a47ca74c8e3dd51c07592c0c4f869c52d4effaa62bce6d8d" + } + ], + "verification": { + "commands": [ + { + "command": "scripts/validate.sh", + "result": "pass", + "exit_code": 0 + }, + { + "command": "python3 scripts/validate_living_docs.py --strict", + "result": "pass", + "exit_code": 0 + }, + { + "command": "python3 scripts/validate_living_docs.py --strict --today 2026-10-31", + "result": "pass", + "exit_code": 0 + }, + { + "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-01", + "result": "pass", + "exit_code": 0 + }, + { + "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-03", + "result": "pass", + "exit_code": 0 + }, + { + "command": "git diff --exit-code 7c52c0407ea2fa6d3fa99cf13d86492a74733259 -- docs/goals/2026-09-20-living-documents-validated.md docs/todos/2026-10-03-workspace-portfolio-plans.md docs/reviews/2026-10-30-workspace-portfolio-evidence.json .quirk/evidence/portfolio-review-20261030-bc4d58257330.json", + "result": "pass", + "exit_code": 0 + }, + { + "command": "git diff --check 7c52c0407ea2fa6d3fa99cf13d86492a74733259 HEAD", + "result": "pass", + "exit_code": 0 + } + ], + "verified_at": "2026-10-31T14:59:31Z" + }, + "authority": { + "admission_effect": "none", + "authority_ref": null + }, + "correction": null, + "receipt_sha256": "sha256:13fbccb097aca11117a1c4159b1788941f7c9d0cbea9edeb9a0f26e4687ed6b2" +} diff --git a/docs/intentions/2026-09-20-evidence-first-planning.md b/docs/intentions/2026-09-20-evidence-first-planning.md index 2ecc768..bb61570 100644 --- a/docs/intentions/2026-09-20-evidence-first-planning.md +++ b/docs/intentions/2026-09-20-evidence-first-planning.md @@ -4,14 +4,38 @@ Kind: intention Status: active Owner: @bryansayler Repository: `Quirk-Systems/.github` -Observed head: `7c1061ba8867fdce4d903adc7c9589016e3ab002` -Reviewed: 2026-10-03 -Review by: 2026-10-31 +Observed head: `7c52c0407ea2fa6d3fa99cf13d86492a74733259` +Reviewed: 2026-10-31 +Review by: 2026-11-03 Derived from: `.quirk/evidence/dependency-review-trigger-9925b20c1393.json`, `docs/governance/EVIDENCE_BINDING.md`, `docs/governance/TRUTHFUL_TOPOLOGY_CUT_SPEC.md` Authority effect: **none** ## Strength +**VERIFIED at the observed head:** main +`d320f775a1be9ca8f6becfc19c84165bed176d1d` retains exact-range receipt +validation and the living-document contract. The observed PR #60 head adds a +substantive portfolio re-read at `bc4d582573306d076c3611f8463dce42d8be90ab` +and a separate receipt, with exact source heads, incomplete work, and a +November 3 checkpoint. That is evidence of a completed review, not an owner +approval or a durable cadence. The [rollout review](../todos/2026-09-20-living-document-rollout.md) +and [roadmap review](../roadmaps/2026-09-20-org-control-plane.md) separate +landed work from overlapping drafts and pending human decisions. + +**VERIFIED limitation:** the workflow defines checks on pull requests, but +successful execution is not assured. The PR #60 head's Governance Contracts, +Dependency Review, and CodeQL runs are recorded as failed, so their historical +successes below are not a claim about current hosted health. The October 31 +branch response reported main unprotected and the repository ruleset list was +empty; activation and merge-method settings remain separate owner work. + +### Historical strength — October 3 (preserved) + +The following observations, counts, present-tense statements, and reference to +"the observed head" belong to the original review at +`7c1061ba8867fdce4d903adc7c9589016e3ab002`. They are preserved as history, +not promoted to October 31 evidence. + The organization already binds claims to exact bytes, and the binding is checked on every pull request — though nothing yet makes it *block*, which is the correction below. VERIFIED at the observed head: `governance-contracts.yml` @@ -67,10 +91,10 @@ checks. Planning inherits the receipt discipline instead of escaping it. ## Goals -- **Done** 2026-10-03: `docs/goals/2026-09-20-living-documents-validated.md`. Every document under the four contract directories carries a validated header and the validator runs in `scripts/validate.sh`. The brief-and-plan opt-in path exists and is tested, but no brief or plan has used it yet; that is a task in the rollout todo, not part of the goal's measure. -- Goal to write, now the urgent one: the twice-weekly portfolio review in `docs/governance/AUTONOMOUS_OPERATIONS.md` reads the roadmap and to-do documents and bumps their review dates, so freshness is produced by the existing cadence rather than by a separate ritual. On 2026-10-03 nothing produced it: the rollout todo was one day from its review date and the roadmap two — two and three days from any stale result, since the validator fires on `review_by < today` — after thirteen days unread, and only an unrelated drift check caught them. -- Goal to write: decide where freshness is enforced. This intention says a validator "reports it stale the day it lapses"; what shipped fails the gate instead, and because the `validate` check runs the whole test suite, one stale planning document fails the `validate` check on any pull request whose checks run or re-run while the document is stale, including pull requests that changed nothing related. The intention's own wording is the weaker claim and the implementation is the stronger one — the gap was never written down until now, and closing it is a decision about blast radius, not about whether staleness matters. -- Goal to write: consumer repositories can run the living-document validator against their own `docs/` through a reusable workflow, once two repositories carry such documents. +- **Done, preserved:** `docs/goals/2026-09-20-living-documents-validated.md`. PR #42 corrected the measure and recorded the actual unit-test enforcement path. This review leaves that file, its status, and its historical evidence byte-identical. Its October 31 date is exempt from staleness because status is done. +- **Pending owner disposition and implementation:** integrate living-document review into the existing twice-weekly portfolio agenda. Proposed scope: run strict validation, inspect open documents due by the next checkpoint, re-read against exact evidence, and record continued work or retirement. `AUTONOMOUS_OPERATIONS.md` and `REPOSITORY_STRATEGY.md` §8.10 still do not name that work. Proof of completion would be an accepted checklist change plus a dated review demonstrating its use; neither is claimed here. +- **Pending owner decision:** select where freshness is enforced. The current real-date test can fail an unrelated PR's next run; changing it, adding a scheduled report, or adding merge-time enforcement requires an explicit disposition with its tradeoffs. The roadmap's owner-decision section holds this question. The October 5 owner follow-up on #42 repeated it without selecting an option. +- **Blocked on evidence:** identify a second repository carrying living documents before proposing `reusable-living-docs.yml`. Such adoption was not established by this review. The absence of a reusable workflow in this repository does not prove that no external adopter exists. ## Not this @@ -87,6 +111,42 @@ checks. Planning inherits the receipt discipline instead of escaping it. ## Review +**Reviewed October 31; still active.** One goal remains done, and cadence, +enforcement disposition, and consumer rollout remain incomplete. The shorter +November 3 review date aligns with PR #60's existing portfolio checkpoint and +keeps these unresolved decisions visible before another lapse; it is not a +newly configured automation. At that checkpoint, record the owner disposition +or the explicit continuing dependency, and re-read the source heads before +renewing. Re-observe earlier if dependencies, the evidence gate, templates, or +validator entrypoint change. Retire only if the goals are met or the owner +chooses a different planning home. + +**Recovery and scope.** The rollout review records the all-ref history search, +current source files, and candidate heads. The latest intention edit recovered +was `ceb13f171620028db3c9e015ac22aad2a98be1c0` in merged PR #42; its +header still recorded October 3. The newer October 30 portfolio review in +PR #60 is preserved at `7c52c0407ea2fa6d3fa99cf13d86492a74733259`, not +mistaken for a review of this intention or for a merge. No newer completed +review of these three documents was found in the inspected history and PRs; +inaccessible work remains outside that claim. + +**Freshness and authority.** The pre-correction PR #60 tree fails strict +validation on simulated November 1 with exactly these three active records +stale. The done goal is exempt. The correction keeps all three active and +changes no validator, test, workflow, settings, owner, schema, or authority. +Post-correction local commands and exact subject are recorded by the receipt. +Hosted execution and human approval remain separate evidence. If no further +review occurs, these three records become stale on November 4, not November 3. + +### Historical goals — October 3 (preserved) + +- **Done** 2026-10-03: `docs/goals/2026-09-20-living-documents-validated.md`. Every document under the four contract directories carries a validated header and the validator runs in `scripts/validate.sh`. The brief-and-plan opt-in path exists and is tested, but no brief or plan has used it yet; that is a task in the rollout todo, not part of the goal's measure. +- Goal to write, now the urgent one: the twice-weekly portfolio review in `docs/governance/AUTONOMOUS_OPERATIONS.md` reads the roadmap and to-do documents and bumps their review dates, so freshness is produced by the existing cadence rather than by a separate ritual. On 2026-10-03 nothing produced it: the rollout todo was one day from its review date and the roadmap two — two and three days from any stale result, since the validator fires on `review_by < today` — after thirteen days unread, and only an unrelated drift check caught them. +- Goal to write: decide where freshness is enforced. This intention says a validator "reports it stale the day it lapses"; what shipped fails the gate instead, and because the `validate` check runs the whole test suite, one stale planning document fails the `validate` check on any pull request whose checks run or re-run while the document is stale, including pull requests that changed nothing related. The intention's own wording is the weaker claim and the implementation is the stronger one — the gap was never written down until now, and closing it is a decision about blast radius, not about whether staleness matters. +- Goal to write: consumer repositories can run the living-document validator against their own `docs/` through a reusable workflow, once two repositories carry such documents. + +### Historical review — October 3 (preserved) + Retire this intention when its goals are done or when the owner decides planning should live outside the repository. Re-observe it whenever the evidence gate, the templates, or the validator entrypoint changes, and at diff --git a/docs/roadmaps/2026-09-20-org-control-plane.md b/docs/roadmaps/2026-09-20-org-control-plane.md index 5023b0e..0ead9cc 100644 --- a/docs/roadmaps/2026-09-20-org-control-plane.md +++ b/docs/roadmaps/2026-09-20-org-control-plane.md @@ -4,9 +4,9 @@ Kind: roadmap Status: active Owner: @bryansayler Repository: `Quirk-Systems/.github` -Observed head: `7c1061ba8867fdce4d903adc7c9589016e3ab002` -Reviewed: 2026-10-04 -Review by: 2026-10-31 +Observed head: `7c52c0407ea2fa6d3fa99cf13d86492a74733259` +Reviewed: 2026-10-31 +Review by: 2026-11-03 Derived from: `docs/intentions/2026-09-20-evidence-first-planning.md`, `docs/superpowers/plans/2026-09-20-org-control-plane.md`, `docs/governance/TRUTHFUL_TOPOLOGY_CUT_SPEC.md` Authority effect: **none** @@ -14,16 +14,82 @@ The running order for `Quirk-Systems/.github` and `.github-private` as the organization's agent-ready control plane. Items move between sections; they are never deleted. Each Done item names the evidence that closed it. +## Review — 2026-10-31 + +**VERIFIED — active, with owner decisions outstanding.** Main was +`d320f775a1be9ca8f6becfc19c84165bed176d1d`; the observed head is +[PR #60](https://github.com/Quirk-Systems/.github/pull/60)'s unmerged portfolio +review. Its November 3 checkpoint and three files are preserved, as is the done +living-documents goal. The [rollout review](../todos/2026-09-20-living-document-rollout.md) +records the recovery search, exact candidate heads, task proofs, and five-plan +inventory. No newer completed review of these three records was recovered. + +The cadence gap remains: the two existing portfolio checklists do not name +living-document review. The freshness decision remains: `validate.sh` invokes +the strict validator locally, while `governance-contracts.yml` invokes the unit +suite, whose real-date freshness test can fail an unrelated PR's next run. +There is no schedule in that workflow and no merge-time freshness mechanism +added here. A completed check is not retroactively changed by the calendar. +The two items are now explicitly separated into pending owner dispositions +and their implementation work below. + +**Current settings observation, not activation.** On October 31 the GitHub +`branches/main` response reported `protected: false` and required status checks +disabled; the repository `rulesets` list was empty. These are dated API reads, +not an exhaustive audit of organization settings or permission to change them. +Receipt-preserving merge-method settings were not verified. The +[owner's October 5 follow-up](https://github.com/Quirk-Systems/.github/issues/42#issuecomment-5994668559) +names the same settings and merge-time freshness as unresolved; no owner +decision closing them was found in the inspected sources. + +**Dependencies.** #51 at `7f18e49a90b1b6d772ed7d80fc6bb48258a2cc77` is +still a draft: its Bun pin, runner preflight, lockfile repair, and proposed +semantic-lint job are not on main. It retains the legacy exemptions and does +not add the maintenance-validator check. #45 at +`5de16a5979aa5cbb298f3e16b52984d38caaffba` adds optional strict tool +availability/handoff guidance; it does not integrate the review cadence. +#55 at `35c3a05341de125f6466b663775105cb7307527b` is also still a draft. +None is marked Done here. `workflow-lint.yml` retains path filters, the +self-applied harden-runner jobs retain audit mode, and no workflow references +the labeler or release-drafter configuration. + +**Core boundary.** `quirk-core/main` was read at +`b3162b0cd6dcc6c07570f240ca33c711ed860f0b`, unchanged from the recorded +contract head. The portfolio review leaves its manifest task open. The complete +current consumer graph was not re-established; the September absence remains a +dated observation, not renewed proof of universal absence. The existing +doctrine-retention decision stands. + +**Next review: November 3.** This short checkpoint aligns with the recovered +portfolio review and asks the owner to disposition cadence, enforcement, and +overlapping candidates before another lapse. It does not promise those decisions +will be complete or configure a new automation. Earlier dependency-head changes +also trigger a re-read. The three active records are fresh through November 3 +after correction and become stale November 4 if still unreviewed. The goal's +done status exempts it. Hosted success remains separate: the observed PR #60 +head's Governance Contracts run `41070255937`, Dependency Review +`41070255939`, and CodeQL `41070255837` failed; this review does not turn those +failures into passes. + +### Historical context retained + +The prior header observed `7c1061ba8867fdce4d903adc7c9589016e3ab002`, +reviewed October 4, due October 31. On October 3 the rollout todo was one day +from its October 4 review date and this roadmap two days from October 5: two +and three days from any stale result, since `review_by < today`. The rollout's +full near-lapse/correction record remains unchanged. The inherited Done entries +below retain their original evidence; references in them to "this head" or +"the observed head" mean that historical head, not this October 31 observation. + ## Now -- [ ] Fold the living-document review into the twice-weekly portfolio review in `docs/governance/AUTONOMOUS_OPERATIONS.md` so review dates are bumped by an existing cadence. Now the most urgent item here: on 2026-10-03 the rollout todo was one day from its 2026-10-04 review date and this roadmap two days from its 2026-10-05 one — two and three days from any red, since the validator fires on `review_by < today` — and a stale document fails the `validate` check on any pull request whose checks run or re-run while the document is stale, including pull requests that changed nothing related -- [ ] Decide where living-document freshness should be enforced. `tests/test_living_docs.py` checks it against the real date and the `validate` check runs the whole suite, so the calendar can fail pull requests that changed nothing. `governance-contracts.yml` has no scheduled trigger, so nothing turns red on its own and completed checks stay green; it is the next push or re-run that fails. The contract is right that staleness must bite; the open question is whether it should bite the stale document's own change, or a scheduled report, rather than whichever unrelated pull request happens to run its checks while the document is stale (owner: @bryansayler) -- [ ] Add the living-document header to `docs/briefs/2026-09-20-poster-claim-binding.md` and the three plans under `docs/superpowers/plans/` in their next substantive edit +- [ ] Prepare cadence integration for the owner disposition below, then apply the accepted wording to `docs/governance/AUTONOMOUS_OPERATIONS.md` and record one actual review using it (owner: @bryansayler; current proposal and closure proof are in the rollout todo). This replaces the previous instruction to bump dates with substantive re-reading. +- [ ] Add the living-document header to `docs/briefs/2026-09-20-poster-claim-binding.md` and the five plans named in the rollout review in their next substantive edits; the prior three-plan count is superseded - [ ] Close the two-check gap between `scripts/validate.sh` and the pull-request gate. No workflow runs `validate.sh`; the gate runs the unit suite, and eleven of the thirteen checks in that script reach it anyway because a test applies each validator to this repository's own files. The two that do not are `scripts/quirk_concept.py lint` and `scripts/validate-copilot-maintenance.py`, neither of which has a test module. The first is the sharper one: this repository offers the registry linter to other repositories through `quirk-semantic-governance.yml`, which is `workflow_call`/`workflow_dispatch` only, and has no self-caller — so the one repository that never lints its own registry on a pull request is the one that owns it (owner: @bryansayler) ## Next -- [ ] Harden `reusable-validate.yml` (pins, permissions, no interpolation inside `run:`), the last legacy workflow with exemptions; unblocked now that PR #20 is decided +- [ ] Harden `reusable-validate.yml` (pins, permissions, no interpolation inside `run:`) and remove its exemptions after reconciling draft #51. PR #20 is decided, but four workflows still occur in `LEGACY`; the prior "last legacy workflow" description was inaccurate - [ ] Decide whether `workflow-lint.yml` drops its `paths:` filters so `zizmor` becomes requireable, per `docs/governance/OWNER_ACTIVATION_INPUTS.md` - [ ] Switch self-applied `harden-runner` jobs from egress `audit` to `block`, one workflow at a time, from the observed allowlist in `docs/governance/OWNER_ACTIVATION_INPUTS.md` @@ -31,7 +97,7 @@ are never deleted. Each Done item names the evidence that closed it. - [ ] Offer the living-document validator to consumer repositories as a reusable workflow once two repositories carry such documents - [ ] Give the org-default `labeler.yml` and `release-drafter.yml` the workflows that read them, once a `pull-requests: write` and `contents: write` job is agreed -- [ ] Build or name the first consumer of quirk-core's `contracts/v0.2` tranche, so the recorded consumer gap closes on evidence rather than lapsing (owner: @bryansayler) +- [ ] Verify whether a first consumer of quirk-core's `contracts/v0.2` tranche now exists; if none is established, build or name one through its own review (owner: @bryansayler; proof: exact consumer head and contract-use evidence). Preserve the recorded September gap without asserting a fresh exhaustive search ## Done @@ -50,4 +116,24 @@ are never deleted. Each Done item names the evidence that closed it. ## Decisions awaiting an owner +- [ ] Integrate review into the existing twice-weekly portfolio cadence: accept or revise the rollout's proposal to inspect documents due by the next checkpoint and record substantive findings, including unresolved decisions. No date-only renewal and no new scheduler are proposed (owner: @bryansayler; proof: explicit disposition and a reviewed checklist change) +- [ ] Decide where living-document freshness should be enforced: retain all-PR real-date failure, scope it to relevant changes with scheduled reporting, and/or add merge-time rechecking. Each option needs its coverage, unrelated-PR cost, and missed-review behavior stated before implementation. This item moved from Now because it requires an owner decision; current enforcement is unchanged (owner: @bryansayler) - [ ] Required-checks ruleset activation: owner-only, and the exact contexts to require are in `docs/governance/OWNER_ACTIVATION_INPUTS.md`. `zizmor` must not be required until its `paths:` filters go, or it pends forever (owner: @bryansayler) +- [ ] Verify and enforce receipt-preserving merge methods in repository settings. The existing protocol requires Create a merge commit; whether the squash/rebase buttons are restricted is UNKNOWN here (owner: @bryansayler; proof: settings readback) + +## Completed work recovered in the October 31 review + +These are landed changes, distinct from the open decisions above. The historical +Done section is preserved rather than rewritten as new evidence. + +| Work | Evidence on observed main | Limit | +| --- | --- | --- | +| Living-document goal closure and review corrections | #42 merge `ed2f2ff7caacdb7a148ac9811dce1e7cce48a7c8`; the goal remains done. | Cadence and freshness-placement decisions stayed open. | +| Workspace scanner, portfolio plan, receipt-range repairs | #44 merge `c029a903c018e63633e4b2c8b4a83da54801e32f`. | Does not configure scheduled portfolio review. | +| Evidence-bound code-review skill | #48 merge `eb889adf3009951de873890103199600f4aad20f`. | Does not establish execution or usefulness in consumers. | +| Dependabot label correction | #47 merge `d320f775a1be9ca8f6becfc19c84165bed176d1d`. | Does not resolve hosted execution failures. | + +The October 30 portfolio review is separately completed as review work in +`bc4d582573306d076c3611f8463dce42d8be90ab` with receipt-only successor +`7c52c0407ea2fa6d3fa99cf13d86492a74733259`; its PR #60 is still an open +draft, so adoption on main is pending. Its content is not changed here. diff --git a/docs/todos/2026-09-20-living-document-rollout.md b/docs/todos/2026-09-20-living-document-rollout.md index dc4e837..04898c4 100644 --- a/docs/todos/2026-09-20-living-document-rollout.md +++ b/docs/todos/2026-09-20-living-document-rollout.md @@ -4,9 +4,9 @@ Kind: todo Status: active Owner: @bryansayler Repository: `Quirk-Systems/.github` -Observed head: `7c1061ba8867fdce4d903adc7c9589016e3ab002` -Reviewed: 2026-10-04 -Review by: 2026-10-31 +Observed head: `7c52c0407ea2fa6d3fa99cf13d86492a74733259` +Reviewed: 2026-10-31 +Review by: 2026-11-03 Derived from: `docs/goals/2026-09-20-living-documents-validated.md` Authority effect: **none** @@ -14,16 +14,68 @@ Tasks that reach the goal, each small enough for one receipt, plus the items only the owner can move. Proof is the command or observation that closes the task, recorded in the receipt that ships it. +## Review — 2026-10-31 + +**VERIFIED — active work remains.** Read against main +`d320f775a1be9ca8f6becfc19c84165bed176d1d` and the observed head above, +which adds only [PR #60](https://github.com/Quirk-Systems/.github/pull/60)'s +portfolio review and evidence. That review is prepared, not merged. This +correction depends on its exact head and preserves its three files byte for +byte; the completed goal also stays unchanged. November 3 aligns with the +portfolio's next checkpoint because cadence integration and enforcement still +need an owner disposition. This is a review deadline, not a configured schedule +or a claim that those decisions have been made. Re-read sooner if a dependency +head or the validation mechanism changes. + +**Recovery.** Accessible all-ref document history and recent repository PRs +were checked for later work. The latest rollout/roadmap edit is +`5c1d3520294cbd3cc3264cfd027031ac9a74e24b`; the latest intention edit is +`ceb13f171620028db3c9e015ac22aad2a98be1c0`, both in merged +[PR #42](https://github.com/Quirk-Systems/.github/pull/42). Its corrections +already survive in these files. The owner's +[October 5 follow-up](https://github.com/Quirk-Systems/.github/issues/42#issuecomment-5994668559) +still names required checks, merge methods, and merge-time freshness as pending. +PR #60 is the newer portfolio review, not a review of these three records. No +later completed review of them was recovered in this bounded search; this says +nothing about inaccessible work. + +| Task or dependency | October 31 observation | Disposition | +| --- | --- | --- | +| Brief and plan opt-in | The poster brief and all five Markdown plans in `docs/superpowers/plans/` lack a living-document header. The previous queue said three plans. | Still open at each next substantive edit; counts corrected, no opt-in invented. | +| Review cadence | `AUTONOMOUS_OPERATIONS.md` and `REPOSITORY_STRATEGY.md` §8.10 still have six portfolio agenda items and no living-document validator/review item. Draft #45 adds handoff guidance, not this agenda change. | Owner disposition and implementation remain pending. | +| Reusable validator hardening | `reusable-validate.yml` still has `oven-sh/setup-bun@v2`, expressions in `run:`, and exemptions in `.github/zizmor.yml` and `tests/test_workflow_pins.py`. Four workflows remain in `LEGACY`, so this is not the only legacy workflow. | Open; reconcile draft #51 before touching the same file. | +| Two-check PR gate gap | Main's unit suite has no invocation of `quirk_concept.py lint` or `validate-copilot-maintenance.py`; no self-caller invokes semantic governance. | Open. #51 proposes a semantic-lint job but is not merged and does not close the maintenance-validator gap. | +| Consumer rollout | No `reusable-living-docs.yml` exists here; a second adopting repository was not established by this bounded review. | Blocked on adoption evidence, not a claim that no adopter exists anywhere. | + +The five plans are `2026-08-21-truthful-topology-cut.md`, +`2026-08-28-exact-range-decision-spine.md`, +`2026-08-28-portfolio-truth-repair.md`, `2026-08-28-pr-closure-harness.md`, and +`2026-09-20-org-control-plane.md`. Source files and tests above were read at the +observed head. Related draft heads were read as candidates: #45 +`5de16a5979aa5cbb298f3e16b52984d38caaffba`, #51 +`7f18e49a90b1b6d772ed7d80fc6bb48258a2cc77`, and #55 +`35c3a05341de125f6466b663775105cb7307527b`. #55 adds working defaults, not +evidence that the missing cadence or gate work is complete. + +**Freshness boundary.** Before this correction, strict validation at the PR #60 +head with `--today 2026-11-01` exited 1: five documents, exactly these three +active records stale. `Status: done` excludes the goal from staleness; its +October 31 date does not require repair. The portfolio is due November 3. +The validator still uses `review_by < today`; no enforcement code is changed. +Correction checks and their exact tested subject belong in the separate receipt +and PR, not in an assertion of successful hosted execution. The historical +near-lapse account below is retained verbatim. + ## Open - [ ] Add the living-document header to the poster claim-binding brief in its next substantive edit (owner: @bryansayler; proof: `python scripts/validate_living_docs.py --strict` counts one brief) -- [ ] Add the living-document header to the three plans under `docs/superpowers/plans/` in their next substantive edits (owner: @bryansayler; proof: the validator counts three plans) -- [ ] Extend the twice-weekly portfolio review checklist with "read every stale living document and bump or retire it" (owner: @bryansayler; proof: `docs/governance/AUTONOMOUS_OPERATIONS.md` names the validator). This is the mitigation for the near-lapse recorded below, so it is the first of these to do -- [ ] Harden `reusable-validate.yml` and remove its zizmor and pin-test exemptions, now that the PR #20 decision that owned that file is made (owner: @bryansayler; proof: the file leaves `.github/zizmor.yml` and the `LEGACY` set in `tests/test_workflow_pins.py`) +- [ ] Add the living-document header to the five plans named in the October 31 review in their next substantive edits (owner: @bryansayler; proof: the validator counts each opted-in plan; prior count of three is superseded) +- [ ] Harden `reusable-validate.yml` and remove its zizmor and pin-test exemptions, reconciling draft #51's runner, Bun-pin, and lockfile repairs first (owner: @bryansayler; proof: reviewed file leaves `.github/zizmor.yml` and the `LEGACY` set in `tests/test_workflow_pins.py`; #51's existence alone does not close this task) - [ ] Give `scripts/quirk_concept.py lint` and `scripts/validate-copilot-maintenance.py` a route into this repository's own pull-request gate: either a test that applies each to this repository's files, as every other validator in `scripts/validate.sh` already has, or a self-caller for `quirk-semantic-governance.yml`. Prefer the test — the gate runs the suite, and a second check context is one more thing an owner must require (owner: @bryansayler; proof: `python -m unittest discover -s tests` fails when `.quirk/registry.json` or a `docs/copilot-maintenance/` link is broken) ## Blocked +- [ ] Integrate living-document review into the existing twice-weekly portfolio agenda after the owner records its scope. Proposed wording: run the strict validator, inspect active/candidate/paused documents due by the next checkpoint, substantively re-read or explicitly retire them, and record evidence and unresolved decisions; never just bump dates (blocked on: @bryansayler's cadence disposition; proof: `docs/governance/AUTONOMOUS_OPERATIONS.md` names the validator and one dated review demonstrates use). This moves the previous Open item here without claiming completion. - [ ] Offer the validator to consumer repositories as `reusable-living-docs.yml` (blocked on: a second repository carrying living documents; who can unblock: @bryansayler) ## Done