From 16df6dd65396aa5255d975e8edc8a0e49670a0b2 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Fri, 16 Oct 2026 16:37:05 +0200 Subject: [PATCH] :page_facing_up: docs(spec): archive developer-toolchain-pins Fill the Verification rows from the evidence files (DTP-1..DTP-7) and the PR row (PR #465 head 6f5dc8e55: 39 checks green, 3 skipped; cold review REQUEST_CHANGES with 2 non-blocking P2 findings deferred to the backlog; main post-merge CI by headSha 7ced03a7e: all workflows success), tick 5.1, close the loop hand-off, and archive the change. The living spec lands in openspec/specs/developer-toolchain/. Refs #442 --- .../evidence/G3.md | 0 .../evidence/G4.md | 0 .../evidence/G6.md | 0 .../evidence/G7.md | 0 .../evidence/T1.1.md | 0 .../evidence/T1.2.md | 0 .../evidence/T2.1.md | 0 .../evidence/T2.2.md | 0 .../evidence/T2.3.md | 0 .../loop.md | 4 +- .../pr-description.md | 0 .../proposal.md | 0 .../reviews/B-branch/round-1/brief.md | 0 .../reviews/B-branch/round-1/holistic.md | 0 .../B-branch/round-1/leg-astra-adversarial.md | 0 .../B-branch/round-1/leg-claude-opus-spec.md | 0 .../reviews/B-branch/round-1/verification.md | 0 .../reviews/B-branch/round-2/brief.md | 0 .../reviews/B-branch/round-2/holistic.md | 0 .../B-branch/round-2/leg-astra-adversarial.md | 0 .../B-branch/round-2/leg-claude-opus-spec.md | 0 .../reviews/B-branch/round-2/verification.md | 0 .../reviews/L-tasks/G3/leg-astra-diff.md | 0 .../L-tasks/G3/leg-claude-opus-diff.md | 0 .../L-tasks/G3/round-2/leg-astra-diff.md | 0 .../reviews/L-tasks/G4/leg-astra-diff.md | 0 .../L-tasks/G4/leg-claude-opus-diff.md | 0 .../reviews/L-tasks/G6/brief.md | 0 .../reviews/L-tasks/G6/leg-astra-diff.md | 0 .../L-tasks/G6/leg-claude-opus-diff.md | 0 .../reviews/L-tasks/G6/round-2/brief.md | 0 .../L-tasks/G6/round-2/leg-astra-diff.md | 0 .../reviews/L-tasks/T1.1/leg-astra-diff.md | 0 .../L-tasks/T1.1/leg-claude-opus-diff.md | 0 .../L-tasks/T1.1/round-2/leg-astra-diff.md | 0 .../T1.1/round-2/leg-claude-opus-diff.md | 0 .../reviews/L-tasks/T1.2/brief.md | 0 .../reviews/L-tasks/T1.2/leg-astra-diff.md | 0 .../L-tasks/T1.2/leg-claude-opus-diff.md | 0 .../reviews/L-tasks/T2.1/brief.md | 0 .../reviews/L-tasks/T2.1/leg-astra-diff.md | 0 .../L-tasks/T2.1/leg-claude-opus-diff.md | 0 .../reviews/L-tasks/T2.2/brief.md | 0 .../reviews/L-tasks/T2.2/leg-astra-diff.md | 0 .../L-tasks/T2.2/leg-claude-opus-diff.md | 0 .../reviews/L-tasks/T2.2/round-2/brief.md | 0 .../L-tasks/T2.2/round-2/leg-astra-diff.md | 0 .../reviews/L-tasks/T2.3/brief.md | 0 .../reviews/L-tasks/T2.3/leg-astra-diff.md | 0 .../L-tasks/T2.3/leg-claude-opus-diff.md | 0 .../reviews/L-tasks/T2.3/round-2/brief.md | 0 .../L-tasks/T2.3/round-2/leg-astra-diff.md | 0 .../reviews/R-spec-set/leg-astra-spec.md | 0 .../R-spec-set/leg-claude-opus-spec.md | 0 .../reviews/R-spec-set/verification.md | 0 .../specs/developer-toolchain/spec.md | 0 .../task-prompt.md | 0 .../tasks.md | 21 +- openspec/specs/developer-toolchain/spec.md | 249 ++++++++++++++++++ 59 files changed, 262 insertions(+), 12 deletions(-) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/G3.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/G4.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/G6.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/G7.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/T1.1.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/T1.2.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/T2.1.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/T2.2.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/evidence/T2.3.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/loop.md (99%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/pr-description.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/proposal.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-1/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-1/holistic.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-1/leg-astra-adversarial.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-1/leg-claude-opus-spec.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-1/verification.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-2/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-2/holistic.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-2/leg-astra-adversarial.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-2/leg-claude-opus-spec.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/B-branch/round-2/verification.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G3/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G3/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G3/round-2/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G4/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G4/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G6/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G6/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G6/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G6/round-2/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/G6/round-2/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T1.1/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T1.1/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T1.1/round-2/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T1.1/round-2/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T1.2/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T1.2/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T1.2/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.1/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.1/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.1/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.2/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.2/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.2/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.2/round-2/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.2/round-2/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.3/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.3/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.3/leg-claude-opus-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.3/round-2/brief.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/L-tasks/T2.3/round-2/leg-astra-diff.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/R-spec-set/leg-astra-spec.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/R-spec-set/leg-claude-opus-spec.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/reviews/R-spec-set/verification.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/specs/developer-toolchain/spec.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/task-prompt.md (100%) rename openspec/changes/{developer-toolchain-pins => archive/2026-10-16-developer-toolchain-pins}/tasks.md (93%) create mode 100644 openspec/specs/developer-toolchain/spec.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/G3.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G3.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/G3.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G3.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/G4.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G4.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/G4.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G4.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/G6.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G6.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/G6.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G6.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/G7.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G7.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/G7.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/G7.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/T1.1.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T1.1.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/T1.1.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T1.1.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/T1.2.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T1.2.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/T1.2.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T1.2.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/T2.1.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T2.1.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/T2.1.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T2.1.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/T2.2.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T2.2.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/T2.2.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T2.2.md diff --git a/openspec/changes/developer-toolchain-pins/evidence/T2.3.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T2.3.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/evidence/T2.3.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/evidence/T2.3.md diff --git a/openspec/changes/developer-toolchain-pins/loop.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/loop.md similarity index 99% rename from openspec/changes/developer-toolchain-pins/loop.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/loop.md index f1b8a93a..05969de9 100644 --- a/openspec/changes/developer-toolchain-pins/loop.md +++ b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/loop.md @@ -1,7 +1,7 @@ # Loop — developer-toolchain-pins (spec-loop-duo run state) Repo: `/home/koni/Projects/PlatformRelay/worktrees/kollect/developer-toolchain-pins` · Branch: `feat/developer-toolchain-pins` · Base: `origin/main` @ `966e17e10` (change 4 merged) · Started: 2026-10-16 · Reviewers: astra + claude (duo) -Next: hand-off — integrator: pr-description.md, scrub, push, ready PR, all checks green by headSha, rebase-merge, close #442; then archive PR +Next: none Budget: Claude review legs uncapped (operator goal 2026-10-16) · run under GOAL-2026-10-16-announcement-ready (decisions by model alignment, logged in agent-context/decisions.md) Change 5 of 10 (issue #442). Spec set: proposal.md, specs/developer-toolchain/spec.md, tasks.md. @@ -13,7 +13,7 @@ Change 5 of 10 (issue #442). Spec set: proposal.md, specs/developer-toolchain/sp - [x] R spec-set review — `reviews/R-spec-set/` (b3fd2d944) on 9621c98aa: astra REQUEST CHANGES, claude/opus CONCERNS; no CRITICAL; 11 WARNING + 6 NOTE all verified; fixes applied faa6754fd (R2 placement deviation: lint wiring lands with 1.1 because CFC-6 reds an unwired consistency_* guard; R9 mutants in 2.2) - [x] L task loop — 1.1–4.3 closed (5.1 archive is post-merge) - [x] B branch review — round 1 `reviews/B-branch/round-1/` (650d7c765): task check exit 0 (1528 s), vulncheck 0; astra REQUEST_CHANGES (B1 P1), opus CONCERNS; no spec row contradicted/absent; fixes → G6; round 2 `reviews/B-branch/round-2/` (b1b54080f): task check exit 0 (1224 s); all 11 G6 commits pass per-commit gate; astra BLOCK, opus CONCERNS (DTP-1..7 hold). Rounds 2/2 -- [ ] Hand-off +- [x] Hand-off — PR #465 merged (rebase, merge 7ced03a7e); #442 closed; Verification rows filled and change archived in a follow-up evidence PR ## Fitness functions diff --git a/openspec/changes/developer-toolchain-pins/pr-description.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/pr-description.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/pr-description.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/pr-description.md diff --git a/openspec/changes/developer-toolchain-pins/proposal.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/proposal.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/proposal.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/proposal.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/holistic.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/holistic.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/holistic.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/holistic.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/leg-astra-adversarial.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/leg-astra-adversarial.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/leg-astra-adversarial.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/leg-astra-adversarial.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/leg-claude-opus-spec.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/leg-claude-opus-spec.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/leg-claude-opus-spec.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/leg-claude-opus-spec.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/verification.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/verification.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-1/verification.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-1/verification.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/holistic.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/holistic.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/holistic.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/holistic.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/leg-astra-adversarial.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/leg-astra-adversarial.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/leg-astra-adversarial.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/leg-astra-adversarial.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/leg-claude-opus-spec.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/leg-claude-opus-spec.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/leg-claude-opus-spec.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/leg-claude-opus-spec.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/verification.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/verification.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/B-branch/round-2/verification.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/B-branch/round-2/verification.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G3/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G3/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G3/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G3/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G3/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G3/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G3/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G3/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G3/round-2/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G3/round-2/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G3/round-2/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G3/round-2/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G4/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G4/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G4/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G4/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G4/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G4/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G4/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G4/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/round-2/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/round-2/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/round-2/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/round-2/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/round-2/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/round-2/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/G6/round-2/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/G6/round-2/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.1/round-2/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.2/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.2/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.2/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.2/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.2/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.2/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.2/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.2/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.2/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.2/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T1.2/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T1.2/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.1/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.1/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.1/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.1/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.1/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.1/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.1/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.1/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.1/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.1/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.1/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.1/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.2/round-2/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/leg-claude-opus-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/leg-claude-opus-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/leg-claude-opus-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/leg-claude-opus-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/brief.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/brief.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/brief.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/brief.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/leg-astra-diff.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/leg-astra-diff.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/leg-astra-diff.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/L-tasks/T2.3/round-2/leg-astra-diff.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/R-spec-set/leg-astra-spec.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/R-spec-set/leg-astra-spec.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/R-spec-set/leg-astra-spec.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/R-spec-set/leg-astra-spec.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/R-spec-set/leg-claude-opus-spec.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/R-spec-set/leg-claude-opus-spec.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/R-spec-set/leg-claude-opus-spec.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/R-spec-set/leg-claude-opus-spec.md diff --git a/openspec/changes/developer-toolchain-pins/reviews/R-spec-set/verification.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/R-spec-set/verification.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/reviews/R-spec-set/verification.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/reviews/R-spec-set/verification.md diff --git a/openspec/changes/developer-toolchain-pins/specs/developer-toolchain/spec.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/specs/developer-toolchain/spec.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/specs/developer-toolchain/spec.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/specs/developer-toolchain/spec.md diff --git a/openspec/changes/developer-toolchain-pins/task-prompt.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/task-prompt.md similarity index 100% rename from openspec/changes/developer-toolchain-pins/task-prompt.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/task-prompt.md diff --git a/openspec/changes/developer-toolchain-pins/tasks.md b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/tasks.md similarity index 93% rename from openspec/changes/developer-toolchain-pins/tasks.md rename to openspec/changes/archive/2026-10-16-developer-toolchain-pins/tasks.md index 37f12db2..a735b81d 100644 --- a/openspec/changes/developer-toolchain-pins/tasks.md +++ b/openspec/changes/archive/2026-10-16-developer-toolchain-pins/tasks.md @@ -183,18 +183,19 @@ tests with 4.3. ## 5. Land -- [ ] 5.1 Archive the change as the last commit of the PR, after review and green CI; the review - record names the reviewed and the archive revision +- [x] 5.1 Archive the change as the last commit of the PR, after review and green CI; the review + record names the reviewed and the archive revision — closed 2026-10-16: merged in PR #465 (head + 6f5dc8e55, merge 7ced03a7e); Verification rows filled below; archived in a follow-up evidence PR ## Verification | Req | Check | Expected | Status | Evidence | | --- | --- | --- | --- | --- | -| DTP-1 | guard: one-site and below-floor mutants red; newer set passes; today's tree red before 2.1 | as stated | not-run | | -| DTP-2 | inline-govulncheck, dropped-annotation, other-variable and missing-definition mutants; CFC-2 self-test after re-anchoring; `task vulncheck` real run | red; CFC-2 green; run result recorded | not-run | | -| DTP-3 | gitleaks, git-cliff and shellcheck drift, below-floor and empty-scan mutants; shellcheck missing-digest mutant; four-component rev passes | red; rev case green | not-run | | -| DTP-4 | dead-manager, rotted-pattern, uncovered-site, split-group and shared-shellcheck-group fixtures; gitleaks pin forms rewritten correctly | red; forms recorded | not-run | | -| DTP-5 | ported go/node/python/task mutants; stale, detached, other-tool and site-count comment mutants; Node, Python and Taskfile attached comments pass | red; positives green | not-run | | -| DTP-6 | valid, tampered and missing-checksum cases per installer; verification-removed copy; grown-exceptions mutant before and after the list empties | valid installs; others fail, nothing installed; red | not-run | | -| DTP-7 | all mutants plus no-op by exit status; old-to-new mutant mapping; one step removed; both steps removed | mutants red, no-op green, mapping complete, CWS-6 red, CFC-6 red | not-run | | -| all | independent review; CI on the PR head | APPROVE, green; both revisions recorded | not-run | | +| DTP-1 | guard: one-site and below-floor mutants red; newer set passes; today's tree red before 2.1 | as stated | pass | evidence/T2.1.md, G6.md | +| DTP-2 | inline-govulncheck, dropped-annotation, other-variable and missing-definition mutants; CFC-2 self-test after re-anchoring; `task vulncheck` real run | red; CFC-2 green; run result recorded | pass | evidence/T2.2.md | +| DTP-3 | gitleaks, git-cliff and shellcheck drift, below-floor and empty-scan mutants; shellcheck missing-digest mutant; four-component rev passes | red; rev case green | pass | evidence/T1.1.md, G3.md | +| DTP-4 | dead-manager, rotted-pattern, uncovered-site, split-group and shared-shellcheck-group fixtures; gitleaks pin forms rewritten correctly | red; forms recorded | pass | evidence/G3.md, G6.md, G7.md | +| DTP-5 | ported go/node/python/task mutants; stale, detached, other-tool and site-count comment mutants; Node, Python and Taskfile attached comments pass | red; positives green | pass | evidence/T2.3.md, T1.2.md | +| DTP-6 | valid, tampered and missing-checksum cases per installer; verification-removed copy; grown-exceptions mutant before and after the list empties | valid installs; others fail, nothing installed; red | pass | evidence/G4.md, G6.md | +| DTP-7 | all mutants plus no-op by exit status; old-to-new mutant mapping; one step removed; both steps removed | mutants red, no-op green, mapping complete, CWS-6 red, CFC-6 red | pass | evidence/T1.1.md, T1.2.md, G6.md | +| all | independent review; CI on the PR head | APPROVE, green; both revisions recorded | pass | PR #465 head 6f5dc8e55: 39 checks green, 3 skipped; independent cold review: REQUEST_CHANGES with 2 P2 findings, non-blocking, deferred to the backlog; main post-merge CI by headSha 7ced03a7e: all 8 workflows success (CI, Preflight, Docs, E2E smoke, CodeQL, CodeQL - Code Quality, OpenSSF Scorecard, changelog-sync); reviews in loop.md (R, L, B rounds 1–2) | diff --git a/openspec/specs/developer-toolchain/spec.md b/openspec/specs/developer-toolchain/spec.md new file mode 100644 index 00000000..9538c490 --- /dev/null +++ b/openspec/specs/developer-toolchain/spec.md @@ -0,0 +1,249 @@ +# developer-toolchain Specification + +## Purpose +Defines the pinned tool floors, where each version lives, how repeated sites are kept equal, and +that downloaded tool binaries are verified. Whether golangci-lint and govulncheck pins work with +the repository's Go is owned by change 4's CFC-2, not by this capability. + +## Requirements + +### Requirement: DTP-1 Task sites agree and meet the floor + +Every `go-task/setup-task` `version:` input under `.github/workflows/` and `.github/actions/`, and +`mise.toml` `task`, SHALL be equal to each other and at least `3.52.0`. + +#### Scenario: One site missed + +- **WHEN** all sites but one say the floor and one says `3.51.1` +- **THEN** the guard SHALL fail and name the site + +#### Scenario: Whole set moves to a newer version + +- **WHEN** a bot PR moves every site to a newer release +- **THEN** the guard passes + +#### Scenario: Whole set below the floor + +- **WHEN** every site says `3.51.1` +- **THEN** the guard SHALL fail + +### Requirement: DTP-2 govulncheck is pinned once + +`Taskfile.yml` SHALL define `GOVULNCHECK_VERSION` with a Renovate annotation on the Go module +datasource (`datasource=go depName=golang.org/x/vuln`) and `task vulncheck` SHALL use it. No floor is set here: CFC-2 (change 4) checks that the pinned govulncheck builds and +runs under `go.mod`'s Go. + +#### Scenario: Inline version returns + +- **WHEN** `task vulncheck` contains a literal `govulncheck@v...` +- **THEN** the guard SHALL fail + +#### Scenario: Annotation dropped + +- **WHEN** `GOVULNCHECK_VERSION` has no `# renovate:` line above it +- **THEN** the guard SHALL fail + +#### Scenario: vulncheck reads another variable + +- **WHEN** `task vulncheck` references a different variable holding the same version while the + annotated `GOVULNCHECK_VERSION` stays defined +- **THEN** the guard SHALL fail and name the missing `GOVULNCHECK_VERSION` reference + +#### Scenario: Variable definition removed + +- **WHEN** `GOVULNCHECK_VERSION` is no longer defined +- **THEN** the guard SHALL fail with a missing-definition message + +### Requirement: DTP-3 gitleaks, git-cliff and shellcheck sites agree + +gitleaks (`ci.yaml:164` env, `hack/install-gitleaks.sh:14`, `.pre-commit-config.yaml:5` `rev`) +SHALL be equal and at least `8.30.1`. git-cliff (`Taskfile.yml:22` `GIT_CLIFF_VERSION`, +`.github/workflows/release.yaml:420` git-cliff-action `version:`, `hack/verify-changelog.sh:11` +fallback install) SHALL be equal and at least `v2.13.1`. shellcheck (`ci.yaml:299` env, +`hack/install-shellcheck.sh:15` default, `.pre-commit-config.yaml:56` shellcheck-py `rev`, compared +on its first three components) SHALL be equal, and `hack/install-shellcheck.sh`'s digest table SHALL +have an entry for the pinned version on every platform it supports. Versions compare with any +leading `v` stripped. golangci-lint is not checked here: CFC-2 checks `.custom-gcl.yml` against +`Makefile` and smoke-runs the tool. + +#### Scenario: Pre-commit rev drifts + +- **WHEN** `.pre-commit-config.yaml` names a different gitleaks release than the others +- **THEN** the guard SHALL fail + +#### Scenario: git-cliff release pin drifts + +- **WHEN** `release.yaml` or `hack/verify-changelog.sh` names a different git-cliff release than + `Taskfile.yml` +- **THEN** the guard SHALL fail and name the file + +#### Scenario: shellcheck bumped without a digest + +- **WHEN** every shellcheck site says a release that `hack/install-shellcheck.sh`'s digest table + has no entry for +- **THEN** the guard SHALL fail and name the missing table entry + +#### Scenario: Empty scan + +- **WHEN** the scan for any tool finds no site +- **THEN** the guard SHALL fail; an empty scan never passes + +### Requirement: DTP-4 The update bot can find every pin + +Every `customManagers` entry in `renovate.json` SHALL match at least one tracked file, where +"matches" is the definition settled by the task 3.1 probe (a file pattern alone is not enough when +the match strings find nothing in that file), and every pin site of DTP-1 to DTP-3 (including the +three git-cliff and three shellcheck sites), plus golangci-lint in `Makefile` and +`hack/tooling/.custom-gcl.yml`, SHALL be covered by a manager. All sites of one tool SHALL land in +one group, and shellcheck and golangci-lint SHALL each have a group of their own, so a shellcheck +bump that is red until its digests are added, or a golangci-lint bump red on new findings, holds +back no other tool. Stronger than the first sentence, one file pattern that matches no tracked file +fails its manager even when the manager's other patterns are alive (a rotted pattern is reported, +not averaged away). The check's mechanism (Renovate run in `lint` at a +pinned version, or a bash copy of the managers' regexes and `packageRules` order) is the one task +3.1 records. + +#### Scenario: Dead manager + +- **WHEN** a manager matches no file, as the gitleaks (`renovate.json:37-47`) and shellcheck + (`renovate.json:48-58`) download-URL managers do today +- **THEN** the guard SHALL fail and name the manager + +#### Scenario: Uncovered pin site + +- **WHEN** a tool's pin (for example `Makefile` `GOLANGCI_LINT_VERSION`) is matched by no manager +- **THEN** the guard SHALL fail and name the file + +#### Scenario: shellcheck shares a group + +- **WHEN** a shellcheck site resolves to the same group as another tool +- **THEN** the guard SHALL fail and name the group + +#### Scenario: golangci-lint shares a group + +- **WHEN** the golangci-lint group rule is removed, so its sites fall back to "pinned build tools" +- **THEN** the guard SHALL fail and name the group + +### Requirement: DTP-5 mise mirrors CI, reads Go from go.mod and states no stale versions + +`mise.toml` SHALL NOT list `go` under `[tools]` and SHALL enable `idiomatic_version_file_enable_tools += ["go"]`, with `go.mod` carrying a `go` line; this half is already satisfied and checked by +DEV-MISE-01 and is carried over unchanged. `mise.toml` `node` and `python` SHALL equal the CI +`node-version` and `python-version` inputs, which SHALL agree with each other. + +A version-bearing comment in `mise.toml` or `Taskfile.yml` is allowed only in the contiguous +comment block directly above its pin (no blank line between), or inline on the pin's line, and only +when it names that pin's tool (the pin key or its CI input name, such as `node-version` for `node` +or setup-task `version:` for `task`) at a value equal to the pin's, with any leading `v` stripped. +Any other tool-version restatement in a comment, and any count of pin sites (a number followed by +`occurrences`, `sites`, `places` or `workflows`), SHALL fail the guard. Stronger than that: any +dotted or quoted number in such a comment is read as a version, so a prose number away from a pin +fails closed too. + +#### Scenario: Go listed in mise + +- **WHEN** `go` appears under `[tools]` +- **THEN** the guard SHALL fail + +#### Scenario: Node drifts from CI + +- **WHEN** `mise.toml` says `node = "20"` while CI says `22` +- **THEN** the guard SHALL fail and name both values + +#### Scenario: Stale version comment + +- **WHEN** a comment says `helm (v3.21.4)` while `Taskfile.yml` pins another version +- **THEN** the guard SHALL fail + +#### Scenario: Attached comment names another value + +- **WHEN** the comment block directly above `task = "3.52.0"` says `version: 3.51.1` +- **THEN** the guard SHALL fail + +#### Scenario: Attached comment names the pin + +- **WHEN** the comment block directly above `node = "22"` says `node-version: "22"`, or the one + above `python = "3.12"` says `python-version: "3.12"` +- **THEN** the guard passes + +#### Scenario: Restated site count + +- **WHEN** a comment says "all 17 occurrences in .github/workflows/" +- **THEN** the guard SHALL fail + +### Requirement: DTP-6 Downloaded tool binaries are checksum-verified + +Every `hack/install-*.sh` that downloads a binary SHALL verify a published checksum before installing +it. git-cliff SHALL be verified against its per-asset `.sha512` with `sha512sum`; helm-docs against +its `checksums.txt` with `sha256sum`. Where those are absent, as on stock macOS, `shasum -a 512` / +`shasum -a 256` SHALL stand in; with neither, the installer SHALL fail and install nothing. A +checksum line whose digest is not a full lower-case hex digest SHALL be refused before any +comparison. The only exceptions list is `UNVERIFIED_BY_DESIGN` in +`hack/test/ci_fetch_lib_hardening_test.sh`; it SHALL only shrink, this change removes both of its +entries, and once they are gone any entry SHALL fail the guard. + +#### Scenario: Installer without verification + +- **WHEN** `install-git-cliff.sh` downloads a tarball and does not compare a checksum +- **THEN** `hack/test/ci_fetch_lib_hardening_test.sh` SHALL fail and name the script + +#### Scenario: Valid download + +- **WHEN** the downloaded archive matches the published checksum +- **THEN** the installer SHALL succeed and the expected executable SHALL exist at the output path + +#### Scenario: Tampered download + +- **WHEN** the downloaded file's checksum does not match +- **THEN** the installer SHALL fail and leave nothing installed + +#### Scenario: Checksum file missing upstream + +- **WHEN** the checksum file cannot be fetched +- **THEN** the installer SHALL fail; it never installs unverified + +#### Scenario: No hash tool + +- **WHEN** neither the coreutils tool nor `shasum` is on `PATH` +- **THEN** the installer SHALL fail, say so, and leave nothing installed + +#### Scenario: Exception added + +- **WHEN** an installer name is added to `UNVERIFIED_BY_DESIGN`, including after the list is empty +- **THEN** the guard SHALL fail + +### Requirement: DTP-7 The guards can fail + +The checks of DTP-1 to DTP-6 SHALL live in `hack/test/consistency_toolchain_pins_test.sh`, with +one exception: the static installer-checksum scan of DTP-6 stays in +`hack/test/ci_fetch_lib_hardening_test.sh`, which owns it and which this change widens to accept +`sha512sum`. The new guard SHALL carry throwaway-copy mutants for each requirement, every mutant of +the folded `hack/test/dev_mise_pin_drift_test.sh`, the installer execution tests of DTP-6 (valid, +tampered and missing-checksum downloads) in its `--self-test`, and a no-op copy that passes. It SHALL +run in required jobs, plain and `--self-test` as separate steps, which CWS-6 and CFC-6 in +`hack/test/ci_workflow_security_test.sh` enforce; the `--self-test` runs in the +`tool-pins-selftest` job, out of `lint`, like the CFC-2 self-test. The self-test SHALL also bump +every pin Renovate extracts to the next release of its own value in a copy, as one group pull +request would, and pass both modes on it. + +#### Scenario: Mutant survives + +- **WHEN** editing one site in a copy does not make the guard fail +- **THEN** the self-test SHALL fail + +#### Scenario: One step unwired + +- **WHEN** one of the new guard's two steps is removed from the required job +- **THEN** `hack/test/ci_workflow_security_test.sh` SHALL fail, naming the guard and the mode that + no required step runs (CWS-6 fires first) + +#### Scenario: Correct bump + +- **WHEN** every extracted pin moves to its next patch release at all its sites, with the + shellcheck digests added +- **THEN** the guard and its `--self-test` SHALL pass on that copy + +#### Scenario: Guard unwired + +- **WHEN** both steps of the new guard are removed from the required job +- **THEN** CFC-6 SHALL fail and name the guard