[acamarata]

D-0033 — partial: package-size and fan-in ratchet added

Verified against origin/main (309e2ed):

• Docker funnel: no longer missing. internal/repoqa/docker_funnel_test.go already freezes direct docker exec outside internal/docker (107 sites allowlisted, shrink-only). Folding those sites into internal/docker is not done here.
• Package-size / fan-in ratchet: was missing. This PR adds it (internal/repoqa/package_budget_test.go):
  • TestPackageSizeBudget: packages over 6000 non-test lines need a ceiling in testdata/package-size-allowlist.txt (8 today: cmd/commands, internal/{backup,build,config,database,deploy,doctor,plugin}).
  • TestPackageFanInBudget: packages imported by more than 20 other packages need a ceiling in testdata/package-fanin-allowlist.txt (5 today: compat, config, docker, errs, httptimeout).
  • Ceilings only shrink; -update lowers or drops lines, never adds or raises. Documented in Architecture-Guardrails.md.
• Not done: decomposing internal/plugin and internal/config along domain lines, and folding the ~107 ad-hoc docker exec sites into internal/docker. Those are large refactors; the ratchet now stops further growth. The row should stay open for them.

D-0122 — no change (already fixed in this repo)

• Default image is docker.io/pgsty/minio (fix(compose): pull MinIO from the maintained pgsty fork #476, ADR 0028), pinned by digest in internal/compose/images.lock.json (index sha256:b6bfe723…); I confirmed that digest returns 200 anonymously from Docker Hub.
• nself doctor images (cmd/commands/doctor_images.go) probes every locked image; .github/workflows/default-images-pullable.yml checks every default image daily.
• No minio/mc or quay.io/minio reference remains in cli non-test code. Remaining items are outside this repo: regenerate app repos' committed compose files and the production hosts (nself-web, ntask) still running the unpullable images.

D-0162 — no change (blocked)

Still true: nothing in build/start (internal/compose, internal/config, cmd build/start) reads .secrets/<env>.age; only secrets commands do. Wiring it in is the P7-TRUST / EPIC D24 work (cmd/commands/config_set_plan.go notes it is not wired) and needs a design decision on cascade precedence and where the age identity lives at start. Not done here.

Commands run

• go vet ./internal/repoqa, gofmt -l internal/repoqa, go build ./...: clean
• go test ./internal/repoqa: ok
• Negative check: lowering the internal/plugin ceiling made TestPackageSizeBudget fail; -update restored the list byte for byte.

🤖 Generated with Claude Code