RI-3-001 (SDLC-D-037 first half, PRD RI-N4): adds docs/release-integrity/probe-inventory.md — a code-read inventory of every quality-rail probe in the repo. 54 probe rows (ts / shell / pipeline-step) across 8 surfaces: pnpm/turbo gate tasks, framework quality shell probes (sanitization, resident budget, #1017 enumeration guard + signed exclusions, #791 upgrade-guard family, legacy verify.sh installers), agent-runtime hooks and harnesses, TS quality logic (@mosaicstack/quality-rails presence check/doctor/init, #869 C1/C2/C5 lease guards, doctor family), git hooks, Woodpecker CI/publish steps, root installer tooling, and the pending RI-1-001 verify-release additions on feat/ri-050-publish-gate. Each row maps to one of 21 canonical checks (QC-1..QC-21) with mechanism read from the code, enforcement point, and disposition. Tallies: 43 preserve, 2 strengthen (quality-rails check/doctor — the RI-N4 evaluator seed, presence-only today), 9 strengthen (review) (verify.sh/verify.ps1, scaffold-path install.sh+init convergence, unwired test-roster-schema.py, qa hooks, unwired e2e-install-test), 0 retire — RI-N4 requires absorption before retirement. 12 coverage gaps recorded, incl. publication not yet bound to verification on next at this base (verify-release pending merge), Playwright e2e and gitleaks/npm-audit/coverage-thresholds unwired for this repo, and the 47-command && chain reachability residual.
RI-3-001 (SDLC-D-037 first half, PRD RI-N4): adds docs/release-integrity/probe-inventory.md — a code-read inventory of every quality-rail probe in the repo. 54 probe rows (ts / shell / pipeline-step) across 8 surfaces: pnpm/turbo gate tasks, framework quality shell probes (sanitization, resident budget, #1017 enumeration guard + signed exclusions, #791 upgrade-guard family, legacy verify.sh installers), agent-runtime hooks and harnesses, TS quality logic (@mosaicstack/quality-rails presence check/doctor/init, #869 C1/C2/C5 lease guards, doctor family), git hooks, Woodpecker CI/publish steps, root installer tooling, and the pending RI-1-001 verify-release additions on feat/ri-050-publish-gate. Each row maps to one of 21 canonical checks (QC-1..QC-21) with mechanism read from the code, enforcement point, and disposition. Tallies: 43 preserve, 2 strengthen (quality-rails check/doctor — the RI-N4 evaluator seed, presence-only today), 9 strengthen (review) (verify.sh/verify.ps1, scaffold-path install.sh+init convergence, unwired test-roster-schema.py, qa hooks, unwired e2e-install-test), 0 retire — RI-N4 requires absorption before retirement. 12 coverage gaps recorded, incl. publication not yet bound to verification on next at this base (verify-release pending merge), Playwright e2e and gitleaks/npm-audit/coverage-thresholds unwired for this repo, and the 47-command && chain reachability residual.
APPROVED — reviewed by the fargo seat (independent of the producer; topher dispatched it). Head pinned: e06a47fac5.
What I verified myself (not relayed)
Structure complete as specified by RI-3-001: 186-line inventory, 54 probe rows (verified by row-count over the disposition column: 43 preserve + 2 strengthen + 9 strengthen-review + 0 retire = 54), 21 canonical checks QC-1..QC-21 with stable IDs for RI-3-002 to consume. Zero retire — correctly so: RI-N4 requires absorption before retirement and no absorption exists yet; the 9 strengthen (review) rows are named as the retirement candidates. That is the exact disposition discipline the PRD demands.
Spot-checked claims against the code, not the doc:
Gap 6 (test-roster-schema.py invisible): the file exists at framework/tools/quality/scripts/, is referenced by zero lines in packages/mosaic/package.json and zero in check-test-enumeration.sh (whose population is *.sh, so a .py suite is guard-blind). Verified — and it is a genuine instance of the #1017 defect shape, correctly named.
Gap 2 (Playwright unwired): apps/web has test:e2e, zero e2e/playwright references in .woodpecker/ci.yml. Verified.
Row QC-20 (verify.sh/verify.ps1 strengthen-review): both files exist as described.
The "written from code, not names" method is visible in the rows — e.g. the enumeration-guard row states it proves naming, not reachability, matching the documented chain-ordering residual (gap 8); the verify.sh row describes the actual planted-commit mechanism. This is the inventory quality RI-3-002's absorption work depends on.
CI green at the pinned head: Woodpecker 2484 success (pull_request, this commit). Base 8199261 confirmed in-file; only this one commit differs from next, as expected for a docs card.
Non-blocking: gap 1 (publication not yet bound on next at this base) is time-stamped to base 8199261 — by review time #1277/#1305 have landed, so that gap's phrasing "at this base" is the honest form. No correction needed.
APPROVED — reviewed by the fargo seat (independent of the producer; topher dispatched it). Head pinned: e06a47fac5913f8c6ac95ee1564a2296d5d7d35d.
## What I verified myself (not relayed)
1. **Structure complete as specified by RI-3-001**: 186-line inventory, 54 probe rows (verified by row-count over the disposition column: 43 preserve + 2 strengthen + 9 strengthen-review + 0 retire = 54), 21 canonical checks QC-1..QC-21 with stable IDs for RI-3-002 to consume. Zero `retire` — correctly so: RI-N4 requires absorption before retirement and no absorption exists yet; the 9 `strengthen (review)` rows are named as the retirement candidates. That is the exact disposition discipline the PRD demands.
2. **Spot-checked claims against the code, not the doc**:
- Gap 6 (`test-roster-schema.py` invisible): the file exists at `framework/tools/quality/scripts/`, is referenced by zero lines in `packages/mosaic/package.json` and zero in `check-test-enumeration.sh` (whose population is `*.sh`, so a `.py` suite is guard-blind). Verified — and it is a genuine instance of the #1017 defect shape, correctly named.
- Gap 2 (Playwright unwired): `apps/web` has `test:e2e`, zero e2e/playwright references in `.woodpecker/ci.yml`. Verified.
- Row QC-20 (`verify.sh`/`verify.ps1` strengthen-review): both files exist as described.
3. **The "written from code, not names" method is visible in the rows** — e.g. the enumeration-guard row states it proves *naming, not reachability*, matching the documented chain-ordering residual (gap 8); the verify.sh row describes the actual planted-commit mechanism. This is the inventory quality RI-3-002's absorption work depends on.
4. **CI green at the pinned head**: Woodpecker 2484 success (pull_request, this commit). Base 8199261 confirmed in-file; only this one commit differs from next, as expected for a docs card.
Non-blocking: gap 1 (publication not yet bound on next at this base) is time-stamped to base 8199261 — by review time #1277/#1305 have landed, so that gap's phrasing "at this base" is the honest form. No correction needed.
fargo
merged commit 64350892e7 into next2026-08-18 15:59:35 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
RI-3-001 (SDLC-D-037 first half, PRD RI-N4): adds docs/release-integrity/probe-inventory.md — a code-read inventory of every quality-rail probe in the repo. 54 probe rows (ts / shell / pipeline-step) across 8 surfaces: pnpm/turbo gate tasks, framework quality shell probes (sanitization, resident budget, #1017 enumeration guard + signed exclusions, #791 upgrade-guard family, legacy verify.sh installers), agent-runtime hooks and harnesses, TS quality logic (@mosaicstack/quality-rails presence check/doctor/init, #869 C1/C2/C5 lease guards, doctor family), git hooks, Woodpecker CI/publish steps, root installer tooling, and the pending RI-1-001 verify-release additions on feat/ri-050-publish-gate. Each row maps to one of 21 canonical checks (QC-1..QC-21) with mechanism read from the code, enforcement point, and disposition. Tallies: 43 preserve, 2 strengthen (quality-rails check/doctor — the RI-N4 evaluator seed, presence-only today), 9 strengthen (review) (verify.sh/verify.ps1, scaffold-path install.sh+init convergence, unwired test-roster-schema.py, qa hooks, unwired e2e-install-test), 0 retire — RI-N4 requires absorption before retirement. 12 coverage gaps recorded, incl. publication not yet bound to verification on next at this base (verify-release pending merge), Playwright e2e and gitleaks/npm-audit/coverage-thresholds unwired for this repo, and the 47-command && chain reachability residual.
APPROVED — reviewed by the fargo seat (independent of the producer; topher dispatched it). Head pinned:
e06a47fac5.What I verified myself (not relayed)
retire— correctly so: RI-N4 requires absorption before retirement and no absorption exists yet; the 9strengthen (review)rows are named as the retirement candidates. That is the exact disposition discipline the PRD demands.test-roster-schema.pyinvisible): the file exists atframework/tools/quality/scripts/, is referenced by zero lines inpackages/mosaic/package.jsonand zero incheck-test-enumeration.sh(whose population is*.sh, so a.pysuite is guard-blind). Verified — and it is a genuine instance of the #1017 defect shape, correctly named.apps/webhastest:e2e, zero e2e/playwright references in.woodpecker/ci.yml. Verified.verify.sh/verify.ps1strengthen-review): both files exist as described.8199261confirmed in-file; only this one commit differs from next, as expected for a docs card.Non-blocking: gap 1 (publication not yet bound on next at this base) is time-stamped to base
8199261— by review time #1277/#1305 have landed, so that gap's phrasing "at this base" is the honest form. No correction needed.