docs(releases): replace one-way leak check with triple-diff verification - #45
Merged
Conversation
Step 4 of the release-branch flow previously ran a single direction
diff (origin/main..HEAD) to catch guarded-path leaks. That covered docs
commits accidentally cherry-picked onto a release, but missed the
inverse failure mode: cherry-picks that should have happened but didn't.
Replace it with a proper three-way diff:
A. main..release what users will see
B. release..dev should be empty pre-bump; lists release-prep
files post-bump; anything else is a missed
cherry-pick
C. dev..main sanity (phantom commits from cherry-pick SHAs)
Plus an explicit re-confirmation that no guarded paths leaked into the
release branch.
Discovered during v0.3.0 prep: the triple-diff caught 4
.github/ISSUE_TEMPLATE/*.yml files that had drifted on main since the
v0.1.1 squash but were correct on dev — they would have shipped broken
otherwise. Sibling repos in this family have hit the same class of miss
before; codifying the check here so it doesn't depend on operator memory.
Augments the file-level triple-diff with a patch-id-aware check that catches commits existing on dev with no patch-id equivalent on the release branch — a class the file-level diff in step B misses when the same content happens to land via a different commit. Per discussion in the session: file-level diffs answer 'is the end-state correct?'; patch-id cherry answers 'is every dev commit either intentionally skipped or actually picked?'. Together they catch both file content drift and commit-level drift.
brettdavies
added a commit
that referenced
this pull request
May 1, 2026
…ion (#45) ## Summary Hardens the release-prep flow against missed cherry-picks by replacing a single-direction `git diff origin/main --stat` (which only catches docs leaking IN) with a proper triple-diff plus a patch-id-aware `git cherry` check (which catches commits that should ship but were missed). The new step 4 runs three diffs (A: main→release, B: release→dev, C: dev→main), re-confirms no guarded paths leaked, and finally runs `git cherry HEAD origin/dev | grep '^+'` to surface any commits on `dev` that have no patch-id equivalent on the release branch — a class the file-level diff in B misses when the same content happens to land via a different commit. Discovered during v0.3.0 prep: the triple-diff caught 4 `.github/ISSUE_TEMPLATE/*.yml` files that had drifted on `main` since the v0.1.1 squash but were correct on `dev` — they would have shipped broken otherwise. Sibling repos in this family have hit the same class of miss before; codifying the check here so it doesn't depend on operator memory. ## Changelog <!-- Operator-facing process doc only. Affects how releases are cut, not what end users see in the binary. Per the changelog rules, empty subsections are omitted. --> ## Type of Change - [x] `docs`: Documentation update ## Related Issues/Stories - Story: discovered during v0.3.0 release prep when an ad-hoc triple-diff surfaced 4-file URL drift on `.github/ISSUE_TEMPLATE/` that the prior single-direction check would have missed entirely. The `git cherry` augmentation was added after a follow-up review surfaced the patch-id blind spot in pure file-level diffs. - Issue: n/a — caught during release ceremony. - Architecture: `RELEASES.md` § "Releasing dev to main" step 4 — operator-facing flow, not runtime behavior. Same edit applied to all sibling brettdavies repos with a `RELEASES.md` (agentnative-skill, xurl-rs, bird, agentnative-spec, agentnative-site, agent-skills/agentnative, agent-skills/github-repo-setup) — those land via separate per-repo PRs. - Related PRs: this release (v0.3.0) cherry-picks this PR after merge so the new convention ships in the same release that exposed the gap. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — operator-facing markdown only - Integration tests: n/a - Coverage: n/a. Manual: every diff command in the new step was run live during v0.3.0 release prep and produced the documented outcomes (A: 54 files / 4948 insertions; B: empty pre-bump, then `CHANGELOG.md` + `Cargo.toml` + `Cargo.lock` + `completions/` post-bump; C: cherry-pick-SHA phantoms only). The `git cherry HEAD origin/dev | grep '^+'` invocation was tested locally against the v0.3.0 release branch; output is the expected docs/plans commits (intentional skips), confirming the check distinguishes "missed cherry-pick" from "intentionally not picked" through operator review of each '+' line. ## Files Modified **Modified:** - `RELEASES.md` — step 4 replaced with the triple-diff verification block; `git cherry` patch-id check added below the guarded-paths recheck. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes Operator process change. The pre-existing single-direction check is subsumed by the new triple-diff; anyone following the old flow still catches what they used to catch — just more. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)
This was referenced May 1, 2026
Merged
brettdavies
added a commit
that referenced
this pull request
May 1, 2026
) ## Summary The `git cherry HEAD origin/dev` check added in #45 is noisier than its comment implied. In a squash-merge workflow, every historical commit ever consolidated into a release squash shows as `+` forever — the squash commit's patch-id never matches the individual dev commits it absorbed. During v0.3.0 release prep this check produced **55 `+` lines**. All audited; zero real misses. Sources: - **Historical squash patch-id mismatch** — pre-v0.2.0 commits squashed into prior release tags - **Conflict-resolution drift** — e.g. `#35`'s cherry-pick stripped `docs/plans` files; same intent, different patch-id - **Intentional skips** — docs-only commits, the `abf1c6a` v0.2.0 backport, the `70fc42c` URL-revert prep step This PR expands the comment to (a) name the three expected noise sources, (b) define what a real miss actually looks like, and (c) give the two-command triage recipe (`git show --stat <sha>` then `git diff origin/main..HEAD -- <those-files>`). The check is now correctly framed as "review me, don't autoblock." Same edit applied to all 7 sibling brettdavies repos with `RELEASES.md` (working-tree only, no commits) — those land via separate per-repo PRs. ## Changelog ### Documentation - `RELEASES.md` § "Releasing dev to main" step 4 — expanded the `git cherry` patch-id check comment with squash-merge triage guidance (three expected noise sources, what a real miss looks like, and a two-command triage recipe). Discovered during v0.3.0 prep when the check produced 55 noisy `+` lines that all turned out to be expected; the original comment didn't explain that this is normal in a squash-merge workflow. ## Type of Change - [x] `docs`: Documentation update ## Related Issues/Stories - Story: discovered immediately after merging #45 — the new `git cherry` step produced 55 `+` lines on the v0.3.0 release branch, all of which audited as expected (squash-merge patch-id mismatch, conflict-resolution drift, intentional skips). The original comment didn't make this clear, so a future operator could read the output as a release-blocker when it isn't. - Issue: n/a — caught during release ceremony. - Architecture: `RELEASES.md` § "Releasing dev to main" step 4 — operator-facing flow, not runtime behavior. - Related PRs: builds on #45 (which introduced the `git cherry` check). This release (v0.3.0) cherry-picks this PR after merge so both the check and its triage guidance ship together. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — operator-facing markdown only - Integration tests: n/a - Coverage: n/a. Manual: ran `git cherry HEAD origin/dev | grep '^+'` against the v0.3.0 release branch live; output produced exactly the noise classes described in the new comment (historical squash + conflict-resolution + intentional skips). The triage recipe (`git show --stat <sha>` + `git diff origin/main..HEAD -- <files>`) was used to validate every flagged line; zero real misses. ## Files Modified **Modified:** - `RELEASES.md` — `git cherry` patch-id check comment expanded with squash-merge triage guidance. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes Pure comment-prose expansion; the command is unchanged. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)
brettdavies
added a commit
that referenced
this pull request
May 1, 2026
) ## Summary The `git cherry HEAD origin/dev` check added in #45 is noisier than its comment implied. In a squash-merge workflow, every historical commit ever consolidated into a release squash shows as `+` forever — the squash commit's patch-id never matches the individual dev commits it absorbed. During v0.3.0 release prep this check produced **55 `+` lines**. All audited; zero real misses. Sources: - **Historical squash patch-id mismatch** — pre-v0.2.0 commits squashed into prior release tags - **Conflict-resolution drift** — e.g. `#35`'s cherry-pick stripped `docs/plans` files; same intent, different patch-id - **Intentional skips** — docs-only commits, the `abf1c6a` v0.2.0 backport, the `70fc42c` URL-revert prep step This PR expands the comment to (a) name the three expected noise sources, (b) define what a real miss actually looks like, and (c) give the two-command triage recipe (`git show --stat <sha>` then `git diff origin/main..HEAD -- <those-files>`). The check is now correctly framed as "review me, don't autoblock." Same edit applied to all 7 sibling brettdavies repos with `RELEASES.md` (working-tree only, no commits) — those land via separate per-repo PRs. ## Changelog ### Documentation - `RELEASES.md` § "Releasing dev to main" step 4 — expanded the `git cherry` patch-id check comment with squash-merge triage guidance (three expected noise sources, what a real miss looks like, and a two-command triage recipe). Discovered during v0.3.0 prep when the check produced 55 noisy `+` lines that all turned out to be expected; the original comment didn't explain that this is normal in a squash-merge workflow. ## Type of Change - [x] `docs`: Documentation update ## Related Issues/Stories - Story: discovered immediately after merging #45 — the new `git cherry` step produced 55 `+` lines on the v0.3.0 release branch, all of which audited as expected (squash-merge patch-id mismatch, conflict-resolution drift, intentional skips). The original comment didn't make this clear, so a future operator could read the output as a release-blocker when it isn't. - Issue: n/a — caught during release ceremony. - Architecture: `RELEASES.md` § "Releasing dev to main" step 4 — operator-facing flow, not runtime behavior. - Related PRs: builds on #45 (which introduced the `git cherry` check). This release (v0.3.0) cherry-picks this PR after merge so both the check and its triage guidance ship together. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: n/a — operator-facing markdown only - Integration tests: n/a - Coverage: n/a. Manual: ran `git cherry HEAD origin/dev | grep '^+'` against the v0.3.0 release branch live; output produced exactly the noise classes described in the new comment (historical squash + conflict-resolution + intentional skips). The triage recipe (`git show --stat <sha>` + `git diff origin/main..HEAD -- <files>`) was used to validate every flagged line; zero real misses. ## Files Modified **Modified:** - `RELEASES.md` — `git cherry` patch-id check comment expanded with squash-merge triage guidance. **Created:** - None. **Renamed:** - None. **Deleted:** - None. ## Breaking Changes - [x] No breaking changes Pure comment-prose expansion; the command is unchanged. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)
13 tasks
brettdavies
added a commit
that referenced
this pull request
May 1, 2026
## Summary Removes per-build Git SHA capture from `build.rs` and the corresponding `anc.commit` field from the scorecard JSON. The version pin in `anc.version` is sufficient build identity for scorecard consumers, and the `cargo:rerun-if-changed` watches on `.git/HEAD`, `.git/refs/heads/<branch>`, `.git/packed-refs` made cached-build SHAs fragile across local commits without solving the underlying staleness problem cleanly. **Schema impact**: `anc.commit` was added in scorecard 0.4 (v0.2.0). Schema 0.5 (the `badge` block, on dev now) has not yet tagged to `main` — the v0.3.0 tag will ship 0.5 without `anc.commit` baked in. No public consumer of the field exists pre-launch. Net change: 6 files, +19/-101 lines. Code path simpler; one less moving part in the build. ## Changelog ### Changed - `--output json` scorecard `anc` block no longer includes a `commit` field. `anc.version` (the crate version pin) remains as the build identity. Removed because the per-build Git SHA capture made cached builds fragile (stale SHAs across local commits) without solving any consumer-facing problem — `anc.version` already identifies the released binary unambiguously, and pre-launch no public consumer of `anc.commit` exists. ## Type of Change - [x] `chore`: Maintenance tasks (dependencies, config, etc.) ## Related Issues/Stories - Story: removed during v0.3.0 release prep — the SHA capture was added in 0.4 but the value was never consumed downstream (site doesn't archive per-run, leaderboard pins `tool.version` not `anc.commit`), and the `.git/`-watching `cargo:rerun-if-changed` directives made cached `cargo build` outputs embed stale SHAs unless the operator did a full rebuild after every commit. The version pin is enough. - Issue: n/a — pre-launch cleanup. - Architecture: `build.rs::emit_build_info` simplified (drops the git rev-parse branch, the three `cargo:rerun-if-changed` watches, and the `std::process::Command` import). `src/scorecard/mod.rs::AncInfo` now has just the `version` field. CLAUDE.md `## Scorecard v0.5 Fields` updated to document the removal. - Related PRs: rides the v0.3.0 release alongside #45 (triple-diff RELEASES.md edit) and #46 (cherry-triage guidance) — all merged to `dev`, all cherry-picked into `release/v0.3.0`. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: 535+ passing — `cargo test --quiet` green across all 80 test binaries. - Integration tests: 51 passing in `tests/integration.rs`; 10/11 (1 ignored) in `tests/skill_install.rs`; 51 schema-drift tests in `tests/scorecard_schema_v05.rs` (one less than before — `anc.commit` removed from the key-existence assertion list); 6 in `tests/scorecard_metadata_security.rs`. - Coverage: `cargo clippy --all-targets -- -Dwarnings` green; `cargo test` green. - Removed tests: `anc_commit_when_present_looks_like_short_sha` (no longer applicable — `ANC_COMMIT` doesn't exist). ## Files Modified **Modified:** - `build.rs` — `emit_build_info` simplified to write only `ANC_VERSION`. Drops the git `rev-parse --short HEAD` branch, three `cargo:rerun-if-changed` directives on `.git/`, and the `std::process::Command` import (now unused). - `src/build_info.rs` — module doc updated; dropped the `anc_commit_when_present_looks_like_short_sha` test. - `src/main.rs` — drops `ANC_COMMIT` import and the `commit: ANC_COMMIT` initializer in the `AncInfo` literal. - `src/scorecard/mod.rs` — `AncInfo` shrinks to just `version: &'static str`. Test fixtures and the `schema_v05_emits_every_documented_key` assertion list drop `anc.commit`. - `tests/scorecard_schema_v05.rs` — same drop from this binary's key list. - `CLAUDE.md` — `## Scorecard v0.5 Fields` `anc` bullet rewritten to describe the simpler shape and reference the removal rationale. **Created:** - None. **Renamed:** - None. **Deleted:** - None (no files removed; only fields/code/tests/doc lines). ## Breaking Changes - [x] No breaking changes `anc.commit` shipped first in scorecard 0.4 (v0.2.0). Schema 0.5 (with `badge`) is on `dev` but has not been tagged to `main` — the v0.3.0 tag will ship 0.5 without `anc.commit`. There is no public consumer of the field today (the `agentnative-site` registry doesn't reference it; the site's leaderboard pins `tool.version`). Pre-launch field removal is within the documented `0.x` flexibility. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)
brettdavies
added a commit
that referenced
this pull request
May 1, 2026
## Summary Removes per-build Git SHA capture from `build.rs` and the corresponding `anc.commit` field from the scorecard JSON. The version pin in `anc.version` is sufficient build identity for scorecard consumers, and the `cargo:rerun-if-changed` watches on `.git/HEAD`, `.git/refs/heads/<branch>`, `.git/packed-refs` made cached-build SHAs fragile across local commits without solving the underlying staleness problem cleanly. **Schema impact**: `anc.commit` was added in scorecard 0.4 (v0.2.0). Schema 0.5 (the `badge` block, on dev now) has not yet tagged to `main` — the v0.3.0 tag will ship 0.5 without `anc.commit` baked in. No public consumer of the field exists pre-launch. Net change: 6 files, +19/-101 lines. Code path simpler; one less moving part in the build. ## Changelog ### Changed - `--output json` scorecard `anc` block no longer includes a `commit` field. `anc.version` (the crate version pin) remains as the build identity. Removed because the per-build Git SHA capture made cached builds fragile (stale SHAs across local commits) without solving any consumer-facing problem — `anc.version` already identifies the released binary unambiguously, and pre-launch no public consumer of `anc.commit` exists. ## Type of Change - [x] `chore`: Maintenance tasks (dependencies, config, etc.) ## Related Issues/Stories - Story: removed during v0.3.0 release prep — the SHA capture was added in 0.4 but the value was never consumed downstream (site doesn't archive per-run, leaderboard pins `tool.version` not `anc.commit`), and the `.git/`-watching `cargo:rerun-if-changed` directives made cached `cargo build` outputs embed stale SHAs unless the operator did a full rebuild after every commit. The version pin is enough. - Issue: n/a — pre-launch cleanup. - Architecture: `build.rs::emit_build_info` simplified (drops the git rev-parse branch, the three `cargo:rerun-if-changed` watches, and the `std::process::Command` import). `src/scorecard/mod.rs::AncInfo` now has just the `version` field. CLAUDE.md `## Scorecard v0.5 Fields` updated to document the removal. - Related PRs: rides the v0.3.0 release alongside #45 (triple-diff RELEASES.md edit) and #46 (cherry-triage guidance) — all merged to `dev`, all cherry-picked into `release/v0.3.0`. ## Testing - [ ] Unit tests added/updated - [ ] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: 535+ passing — `cargo test --quiet` green across all 80 test binaries. - Integration tests: 51 passing in `tests/integration.rs`; 10/11 (1 ignored) in `tests/skill_install.rs`; 51 schema-drift tests in `tests/scorecard_schema_v05.rs` (one less than before — `anc.commit` removed from the key-existence assertion list); 6 in `tests/scorecard_metadata_security.rs`. - Coverage: `cargo clippy --all-targets -- -Dwarnings` green; `cargo test` green. - Removed tests: `anc_commit_when_present_looks_like_short_sha` (no longer applicable — `ANC_COMMIT` doesn't exist). ## Files Modified **Modified:** - `build.rs` — `emit_build_info` simplified to write only `ANC_VERSION`. Drops the git `rev-parse --short HEAD` branch, three `cargo:rerun-if-changed` directives on `.git/`, and the `std::process::Command` import (now unused). - `src/build_info.rs` — module doc updated; dropped the `anc_commit_when_present_looks_like_short_sha` test. - `src/main.rs` — drops `ANC_COMMIT` import and the `commit: ANC_COMMIT` initializer in the `AncInfo` literal. - `src/scorecard/mod.rs` — `AncInfo` shrinks to just `version: &'static str`. Test fixtures and the `schema_v05_emits_every_documented_key` assertion list drop `anc.commit`. - `tests/scorecard_schema_v05.rs` — same drop from this binary's key list. - `CLAUDE.md` — `## Scorecard v0.5 Fields` `anc` bullet rewritten to describe the simpler shape and reference the removal rationale. **Created:** - None. **Renamed:** - None. **Deleted:** - None (no files removed; only fields/code/tests/doc lines). ## Breaking Changes - [x] No breaking changes `anc.commit` shipped first in scorecard 0.4 (v0.2.0). Schema 0.5 (with `badge`) is on `dev` but has not been tagged to `main` — the v0.3.0 tag will ship 0.5 without `anc.commit`. There is no public consumer of the field today (the `agentnative-site` registry doesn't reference it; the site's leaderboard pins `tool.version`). Pre-launch field removal is within the documented `0.x` flexibility. ## Deployment Notes - [x] No special deployment steps required ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)
brettdavies
added a commit
that referenced
this pull request
May 1, 2026
## Summary v0.3.0 promotes 15 PRs from `dev` to `main`. Headline: scorecard schema bumps `0.3` → `0.5` (cumulative — `anc.commit` removed before tag), a new `anc skill install <host>` subcommand with hardened `git clone` + build-time host-map codegen, and a published agent-native badge surface (text-mode hint + JSON `badge` block) gated on a 80% eligibility floor. Plus PII fix on `target.path`, source-quality cleanup, README refresh, cross-repo sync map, and tooling-side hardening (PR template `**Renamed:**` subsection, `sync-spec` modernization, `sync-skill-fixture` drift gate, triple-diff release-flow check with squash-merge triage guidance). The release-prep also surfaced four corrections that came in via the canonical PR-to-dev flow during this ship: `#43` resynced the `skill.json` build-time fixture against upstream `agentnative-site/dev` (drift was blocking every open PR); `#42` corrected cross-repo URLs in `.github/ISSUE_TEMPLATE/` (broken since the v0.1.1 squash on `main`); `#45` replaced the release-flow's single-direction leak check with a triple-diff plus `git cherry` patch-id check (the latter caught the URL drift that motivated the change); `#46` added squash-merge-noise triage guidance to the `git cherry` step (the check produced 55 noisy `+` lines on first run, all expected, but the original comment didn't explain that). `#47` dropped the `anc.commit` field from the scorecard JSON before the v0.3.0 tag, since the `cargo:rerun-if-changed` `.git/` watches made cached builds fragile and `anc.version` is sufficient build identity. ## Changelog <!-- Per the changelog generation rules, the canonical changelog is in CHANGELOG.md. This release section reflects the same content; generate-changelog.sh extracts from each contributing PR's ## Changelog block. The bullets below are a curated highlight set for the PR body itself. --> ### Added - `anc skill install <host>` subcommand for six hosts (`claude_code`, `codex`, `cursor`, `factory`, `kiro`, `opencode`) with `--dry-run` and `--output {text,json}` flags and a uniform JSON envelope across success, error, and dry-run paths (#35). - Scorecard `--output json` self-describing metadata: four top-level blocks (`tool`, `anc`, `run`, `target`) + a `badge` block with `eligible`, `score_pct`, `embed_markdown`, `scorecard_url`, `badge_url`, `convention_url` (#34, #36). - `--output text` post-summary agent-native badge embed hint when the tool clears the 80% eligibility floor; "do not nag" rule below (#36). ### Changed - Scorecard `schema_version` bumped `0.3` → `0.4` → `0.5` (cumulative — `anc.commit` field removed before the v0.3.0 tag, see #47) (#34, #36). - `sync-spec.sh` modernized — remote-first tag resolution, `SPEC_REF` env override removed (#33). - `p7-naked-println` source check now exempts `build.rs` at any crate root (#38). - README refreshed for current state (schema 0.5, badge block, `--audit-profile`, basename `target.path`); `rust-version` bumped `1.87` → `1.88` (#34, #40). - `--output json` scorecard `anc` block no longer includes a `commit` field — `anc.version` is the build identity (#47). ### Fixed - `target.path` in `--output json` now emits the basename of the resolved target instead of the canonicalized absolute path — eliminates a home-dir / username PII leak that flowed into committed scorecards, badge URLs, and agent-posted artifacts (#39). - Eliminated four `.unwrap()` calls on infallible paths across `src/skill_install.rs` and `build.rs`, replaced with `.expect("…")` naming the contract (#38). - Cross-repo URLs in `.github/ISSUE_TEMPLATE/` corrected: spec → `agentnative`, site → `agentnative-site`, double-`cli` typo → `agentnative-cli` (#42). ### Documentation - `scripts/SYNCS.md` cross-repo sync map (#41). - `RELEASES.md` § "After publish — sync `dev` with the release" + new `sync-dev-after-release.sh` script formalizing the post-publish backport convention (#37). - `RELEASES.md` § "Releasing dev to main" step 4 replaced with a triple-diff verification block (A: main→release, B: release→dev, C: dev→main) plus a `git cherry` patch-id check (#45), with squash-merge-noise triage guidance added in #46. - README `## Install the skill` section + `[![agent-native]]` badge row (#35, #40). ## Type of Change - [x] `feat`: New feature (non-breaking change which adds functionality) - [x] `fix`: Bug fix (non-breaking change which fixes an issue) - [x] `chore`: Maintenance tasks (dependencies, config, etc.) - [x] `docs`: Documentation update ## Related Issues/Stories - Story: v0.3.0 release — twelve PRs across two days of work post-v0.2.0 plus four release-prep PRs (#42, #43, #45, #46) opened during the release ceremony to fix issues caught by the new triple-diff verification, plus #47 dropping `anc.commit` before the tag. - Issue: n/a - Architecture: scorecard schema evolution (`0.3 → 0.4 → 0.5`) covered in CLAUDE.md `## Scorecard v0.5 Fields`; skill-install architecture covered in CLAUDE.md `## Skill Install Verb`; release ceremony in `RELEASES.md`. - Related PRs: #30, #33, #34, #35, #36, #37, #38, #39, #40, #41, #42, #43, #45, #46, #47 — all merged to `dev` and cherry-picked here in chronological order. ## Testing - [x] Unit tests added/updated - [x] Integration tests added/updated - [x] Manual testing completed - [x] All tests passing **Test Summary:** - Unit tests: 535+ passing across all #34, #35, #36, #38, #39 PRs (counts varied as PRs landed). #47 simplified to ~520+ after dropping the `anc_commit_when_present_looks_like_short_sha` test. - Integration tests: full suite green at every cherry-pick step. New tests added: `tests/scorecard_metadata_security.rs` (red-team regressions for hostile binaries), `tests/scorecard_schema_v05.rs` (schema drift guard with `target.path` regression test), `tests/skill_install.rs` (10 active + 1 ignored e2e), `tests/dogfood.rs` (p2/p5 dogfood guards). - Coverage: pre-push hook (CI mirror) green at every step — fmt, clippy `-Dwarnings`, full test suite, cargo-deny, Windows compat (libc grep + cross-target clippy). - Triple-diff verification (the new step from #45) confirmed only `docs/plans/`, `docs/brainstorms/`, `docs/ideation/` (guarded paths) and the `docs/solutions` symlink remain on dev. Release-prep files (`CHANGELOG.md`, `Cargo.{toml,lock}`, `completions/*`) will backport to dev via `scripts/sync-dev-after-release.sh` post-publish per the convention from #37. The `git cherry` patch-id check produced 55 `+` lines on first run; all audited as expected (squash-merge patch-id mismatch + conflict-resolution drift + intentional skips), zero real misses — motivated #46's triage guidance. ## Files Modified **Modified:** - `Cargo.toml`, `Cargo.lock` — version `0.2.0 → 0.3.0`; `time = "=0.3.47"` added; `rust-version` bumped. - `CHANGELOG.md` — v0.3.0 release notes prepended. - `README.md`, `AGENTS.md`, `CLAUDE.md` — updated for schema 0.4/0.5, skill-install architecture, audit-profile, basename `target.path`, badge surface, `anc.commit` removal. - `RELEASES.md` — post-publish backport step (#37); skill-fixture sync step; step 4 replaced with triple-diff + `git cherry` check (#45); squash-merge triage guidance added (#46). - `build.rs` — `emit_skill_hosts` codegen, `ANC_VERSION` emission (no longer Git-SHA-aware after #47). - `src/build_info.rs` — `ANC_VERSION` re-export; `ANC_COMMIT` and its test removed in #47. - `src/main.rs`, `src/cli.rs`, `src/error.rs`, `src/scorecard/mod.rs`, `src/argv.rs` — schema 0.4/0.5 metadata, skill-install dispatch, badge computation, basename helper. `AncInfo` shrinks to one field after #47. - `src/checks/source/rust/naked_println.rs` — build.rs exemption. - `src/skill_install/skill.json` — fixture refresh (`source.commit` pin and `verify` block removed by upstream). - `scripts/sync-spec.sh` — remote-first, `SPEC_REF` removed. - `scripts/hooks/pre-push` — Windows cross-clippy step. - `.github/pull_request_template.md` — `**Renamed:**` sub-header. - `.github/ISSUE_TEMPLATE/{config,false-positive,feature-request,scoring-bug}.yml` — corrected cross-repo URLs. - `completions/anc.{bash,zsh,fish,elvish,powershell}` — regenerated. **Created:** - `src/output.rs`, `src/skill_install.rs`, `src/skill_install/skill.json`. - `tests/dogfood.rs`, `tests/scorecard_metadata_security.rs`, `tests/scorecard_schema_v05.rs`, `tests/skill_install.rs`, `tests/fixtures/hostile-{hang,nonzero-exit,stdout-flood}/probe.sh`. - `scripts/sync-skill-fixture.sh`, `scripts/sync-dev-after-release.sh`, `scripts/SYNCS.md`. - `.github/workflows/skill-fixture-drift.yml`. - `.github/ISSUE_TEMPLATE/00-blank.yml`. **Renamed:** - `tests/scorecard_schema_v04.rs` → `tests/scorecard_schema_v05.rs` (drift guard now covers `badge.*` keys). - `tests/fixtures/skill.json` → `src/skill_install/skill.json` (codegen needs to read from a path inside cargo's package). **Deleted:** - `.github/ISSUE_TEMPLATE/grade-a-cli.yml`, `pressure-test.yml`, `spec-question.yml` — duplicates of the spec repo's set; routed via `config.yml`. - `src/build_info.rs::ANC_COMMIT` const (and its test) — dropped before tag, see #47. ## Breaking Changes - [x] No breaking changes The scorecard `schema_version` bumps (`0.3` → `0.4` → `0.5`) are additive within the documented `0.x` pre-launch policy. Pre-`0.4` consumers feature-detect the four metadata blocks; pre-`0.5` consumers feature-detect the `badge` key. `target.path` value semantics changed (basename instead of absolute path) — schema shape is unchanged, so consumers reading the field at all will continue to parse it; consumers using it for cross-host correlation should already have migrated to `tool.name`. `anc.commit` was added in 0.4 but removed before the v0.3.0 tag (#47); no public consumer of the field exists pre-launch. ## Deployment Notes - [x] No special deployment steps required Standard pipeline: tag push triggers crates.io publish (Trusted Publishing, OIDC), GitHub Release with all 5 platform archives + sha256sums, then dispatch to `brettdavies/homebrew-tap` for formula update. After `finalize-release.yml` flips `make_latest: true`, run `./scripts/sync-dev-after-release.sh v0.3.0` to backport `Cargo.toml`, `Cargo.lock`, `CHANGELOG.md` to dev (new convention from #37). ## Checklist - [x] Code follows project conventions and style guidelines - [x] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/) - [x] Self-review of code completed - [x] Tests added/updated and passing - [x] No new warnings or errors introduced - [x] Changes are backward compatible (or breaking changes documented)
4 tasks
brettdavies
added a commit
that referenced
this pull request
May 31, 2026
…ve (#69) ## Summary Repositions the Vale prose-check stack (`styles/`, `.vale.ini`, `scripts/prose-check.sh`) as dev-only contributor tooling, mirroring `agentnative-spec` PR #45 (ed066b6). This is the evergreen half: workflow guard, doc reference updates, and dev-direct exception note. The actual file deletions on `main` happen in a follow-up performed directly on the `release/v0.5.0` branch so that one release cycle removes the files from `main`; from then on the workflow guard keeps them out. Bundles two small release-doc polish items that surfaced during the same review pass: a guarded-path leak-check entry in `RELEASES-PREFLIGHT.md`, and a version-neutral rename of `CLAUDE.md` § "Scorecard v0.5 Fields" to § "Scorecard JSON fields" so the heading stops aging out as schema versions move. ## Changelog ### Changed - `.github/workflows/guard-main-docs.yml`: pass `extra_paths: 'styles/,.vale.ini,scripts/prose-check.sh'` to the reusable guard workflow. Future PRs to `main` that add or modify those paths fail the check. Mirrors the path values used by `agentnative-spec`. - `BRAND.md`: refreshed verbatim from `agentnative-spec` to pick up the "narrative is authoritative for both the why and the what" reframing and the `(dev-only)` annotation on the Vale-rule-pack column of the Channel-artifacts table. As a vendored mirror, BRAND.md should match the spec word for word. - `PRODUCT.md`: Inheritance and Register sections retune to "authoritative voice contract" framing; explicitly names the rule pack as dev-only tooling that does not ship to `main`. Removes the dead `styles/brand/README.md` / `styles/brand/*.yml` / `styles/config/vocabularies/cli/` links. - `AGENTS.md`: rewrites the "Voice and prose rules" section to drop the `scripts/prose-check.sh` invocation example and the rule-pack vendoring prose; mirrors the spec's AGENTS.md voice-contract paragraph. - `scripts/SYNCS.md`: drops the `sync-prose-tooling.sh` row from the upstream sync table, the matching mermaid arrow, and the Reference section entry. - `RELEASES.md`: prose-scrubbing intro no longer promises a future vendoring; explicitly names the spec checkout as the Vale config source. - `CLAUDE.md`: § "Scorecard v0.5 Fields" renamed to § "Scorecard JSON fields"; the cross-link in `RELEASES-PREFLIGHT.md` updates to match. ### Added - `RELEASES.md` gains a `### Dev-direct exception` subsection under Daily development, mirroring the spec's same insertion point and content. Names the two path categories (engineering docs and prose-check stack) that may be committed directly to `dev` without a feature branch. - `RELEASES-PREFLIGHT.md` gains a "Release mechanics sanity" item that runs the same guarded-path leak check `RELEASES.md` step 4 runs, so operators catch leaks before the release PR opens. Points at the new `RELEASES.md` § Cherry-pick conflicts on guarded paths subsection for resolution. ## Type of Change - [x] `ci`: CI/CD configuration changes ## Related Issues/Stories - Story: n/a - Issue: n/a - Architecture: Mirrors `agentnative-spec` PR #45 (ed066b6) "feat(prose-check): move stack to dev-only". The spec's follow-up release PR (#46, 20b9deb) performed the corresponding file deletions on `main`; this repo's equivalent deletions happen on `release/v0.5.0` after this PR merges. - Related PRs: agentnative-spec#45, agentnative-spec#46 ## Testing - [x] All tests passing **Test Summary:** - `cargo test`: 793 passed, 2 ignored. - `cargo build`: clean. - `bash scripts/prose-check.sh --vale-only` on dev: stack still present, runs as expected. ## Files Modified **Modified:** - `.github/workflows/guard-main-docs.yml` - `AGENTS.md`, `BRAND.md`, `CLAUDE.md`, `PRODUCT.md`, `RELEASES.md`, `RELEASES-PREFLIGHT.md`, `scripts/SYNCS.md` **Created:** - None. **Renamed:** - None. **Deleted:** - None on this branch. The actual prose-check stack deletions (`.vale.ini`, `styles/`, `scripts/prose-check.sh`, plus the orphaned helpers `scripts/sync-prose-tooling.sh`, `scripts/test-prose-check.mjs`, `scripts/generate-pack-readme.mjs`) ship on the release branch. ## Breaking Changes - [x] No breaking changes ## Deployment Notes - [x] No special deployment steps required
brettdavies
added a commit
that referenced
this pull request
May 31, 2026
…ve (#69) ## Summary Repositions the Vale prose-check stack (`styles/`, `.vale.ini`, `scripts/prose-check.sh`) as dev-only contributor tooling, mirroring `agentnative-spec` PR #45 (ed066b6). This is the evergreen half: workflow guard, doc reference updates, and dev-direct exception note. The actual file deletions on `main` happen in a follow-up performed directly on the `release/v0.5.0` branch so that one release cycle removes the files from `main`; from then on the workflow guard keeps them out. Bundles two small release-doc polish items that surfaced during the same review pass: a guarded-path leak-check entry in `RELEASES-PREFLIGHT.md`, and a version-neutral rename of `CLAUDE.md` § "Scorecard v0.5 Fields" to § "Scorecard JSON fields" so the heading stops aging out as schema versions move. ## Changelog ### Changed - `.github/workflows/guard-main-docs.yml`: pass `extra_paths: 'styles/,.vale.ini,scripts/prose-check.sh'` to the reusable guard workflow. Future PRs to `main` that add or modify those paths fail the check. Mirrors the path values used by `agentnative-spec`. - `BRAND.md`: refreshed verbatim from `agentnative-spec` to pick up the "narrative is authoritative for both the why and the what" reframing and the `(dev-only)` annotation on the Vale-rule-pack column of the Channel-artifacts table. As a vendored mirror, BRAND.md should match the spec word for word. - `PRODUCT.md`: Inheritance and Register sections retune to "authoritative voice contract" framing; explicitly names the rule pack as dev-only tooling that does not ship to `main`. Removes the dead `styles/brand/README.md` / `styles/brand/*.yml` / `styles/config/vocabularies/cli/` links. - `AGENTS.md`: rewrites the "Voice and prose rules" section to drop the `scripts/prose-check.sh` invocation example and the rule-pack vendoring prose; mirrors the spec's AGENTS.md voice-contract paragraph. - `scripts/SYNCS.md`: drops the `sync-prose-tooling.sh` row from the upstream sync table, the matching mermaid arrow, and the Reference section entry. - `RELEASES.md`: prose-scrubbing intro no longer promises a future vendoring; explicitly names the spec checkout as the Vale config source. - `CLAUDE.md`: § "Scorecard v0.5 Fields" renamed to § "Scorecard JSON fields"; the cross-link in `RELEASES-PREFLIGHT.md` updates to match. ### Added - `RELEASES.md` gains a `### Dev-direct exception` subsection under Daily development, mirroring the spec's same insertion point and content. Names the two path categories (engineering docs and prose-check stack) that may be committed directly to `dev` without a feature branch. - `RELEASES-PREFLIGHT.md` gains a "Release mechanics sanity" item that runs the same guarded-path leak check `RELEASES.md` step 4 runs, so operators catch leaks before the release PR opens. Points at the new `RELEASES.md` § Cherry-pick conflicts on guarded paths subsection for resolution. ## Type of Change - [x] `ci`: CI/CD configuration changes ## Related Issues/Stories - Story: n/a - Issue: n/a - Architecture: Mirrors `agentnative-spec` PR #45 (ed066b6) "feat(prose-check): move stack to dev-only". The spec's follow-up release PR (#46, 20b9deb) performed the corresponding file deletions on `main`; this repo's equivalent deletions happen on `release/v0.5.0` after this PR merges. - Related PRs: agentnative-spec#45, agentnative-spec#46 ## Testing - [x] All tests passing **Test Summary:** - `cargo test`: 793 passed, 2 ignored. - `cargo build`: clean. - `bash scripts/prose-check.sh --vale-only` on dev: stack still present, runs as expected. ## Files Modified **Modified:** - `.github/workflows/guard-main-docs.yml` - `AGENTS.md`, `BRAND.md`, `CLAUDE.md`, `PRODUCT.md`, `RELEASES.md`, `RELEASES-PREFLIGHT.md`, `scripts/SYNCS.md` **Created:** - None. **Renamed:** - None. **Deleted:** - None on this branch. The actual prose-check stack deletions (`.vale.ini`, `styles/`, `scripts/prose-check.sh`, plus the orphaned helpers `scripts/sync-prose-tooling.sh`, `scripts/test-prose-check.mjs`, `scripts/generate-pack-readme.mjs`) ship on the release branch. ## Breaking Changes - [x] No breaking changes ## Deployment Notes - [x] No special deployment steps required
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens the release-prep flow against missed cherry-picks by replacing a single-direction
git diff origin/main --stat(which only catches docs leaking IN) with a proper triple-diff plus a patch-id-awaregit cherrycheck (which catches commits that should ship but were missed).The new step 4 runs three diffs (A: main→release, B: release→dev, C: dev→main), re-confirms no guarded paths leaked, and finally runs
git cherry HEAD origin/dev | grep '^+'to surface any commits ondevthat have no patch-id equivalent on the release branch (a class the file-level diff in B misses when the same content happens to land via a different commit).Discovered during v0.3.0 prep: the triple-diff caught 4
.github/ISSUE_TEMPLATE/*.ymlfiles that had drifted onmainsince the v0.1.1 squash but were correct ondev; they would have shipped broken otherwise. Sibling repos in this family have hit the same class of miss before; codifying the check here so it doesn't depend on operator memory.Changelog
Documentation
RELEASES.md§ "Releasing dev to main" step 4 replaced with a triple-diff verification block (A: main→release, B: release→dev, C: dev→main) plus agit cherry HEAD origin/devpatch-id check. The new flow catches both directions of drift before the release tag goes out: guarded paths leaking IN (the original concern) and missed cherry-picks that should have shipped (the new concern). Discovered during v0.3.0 prep when an ad-hoc triple-diff caught 4.github/ISSUE_TEMPLATE/*.ymlfiles that had drifted onmainsince the v0.1.1 squash.Type of Change
docs: Documentation updateRelated Issues/Stories
.github/ISSUE_TEMPLATE/that the prior single-direction check would have missed entirely. Thegit cherryaugmentation was added after a follow-up review surfaced the patch-id blind spot in pure file-level diffs.RELEASES.md§ "Releasing dev to main" step 4, operator-facing flow, not runtime behavior. Same edit applied to all sibling brettdavies repos with aRELEASES.md(agentnative-skill, xurl-rs, bird, agentnative-spec, agentnative-site, agent-skills/agentnative, agent-skills/github-repo-setup); those land via separate per-repo PRs.Testing
Test Summary:
CHANGELOG.md+Cargo.toml+Cargo.lock+completions/post-bump; C: cherry-pick-SHA phantoms only). Thegit cherry HEAD origin/dev | grep '^+'invocation was tested locally against the v0.3.0 release branch; output is the expected docs/plans commits (intentional skips), confirming the check distinguishes "missed cherry-pick" from "intentionally not picked" through operator review of each '+' line.Files Modified
Modified:
RELEASES.md: step 4 replaced with the triple-diff verification block;git cherrypatch-id check added below the guarded-paths recheck.Created:
Renamed:
Deleted:
Breaking Changes
Operator process change. The pre-existing single-direction check is subsumed by the new triple-diff; anyone following the old flow still catches what they used to catch, plus more.
Deployment Notes
Checklist