From ad0e9bfc3c9628620da435a9c518f4bbda76abdb Mon Sep 17 00:00:00 2001 From: sneak Date: Sun, 4 Oct 2026 09:34:26 +0000 Subject: [PATCH] Fold the August fleet findings into the policies, or drop them (closes #62) Two findings from 2026-08-09 were rules a repository must follow that `prompts/REPO_POLICIES.md` did not yet state, and are now added where a reader would look: a new or changed check is proven by planting a defect it must catch; and a change to a separate workflow limited to `main` by a `branches` list is first run from the feature branch, added to that list and removed again before merging. The issue records why every other finding was dropped. The warning against `golangci-lint config verify` is dropped because sneak ruled on https://git.eeqj.de/sneak/prompts/issues/40 (2026-08-10) that there is no config check step and the config is assumed valid; a vendored `.golangci.yml` stays byte-identical to the canonical copy. Model: opus-5-5 --- TODO.md | 11 +++++++++++ prompts/REPO_POLICIES.md | 10 +++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/TODO.md b/TODO.md index 3f5d942..ae5d5aa 100644 --- a/TODO.md +++ b/TODO.md @@ -21,6 +21,17 @@ fmt-check, and commit. # Completed Steps +- 2026-10-04: Went through the fleet findings recorded on 2026-08-09 (issue 62) + and added the two rules `REPO_POLICIES.md` did not yet state: a new or changed + check is proven by planting a defect it must catch; and a change to a separate + workflow limited to `main` is first run from the feature branch, added to that + workflow's `branches` list and removed again before merging. The other + findings were already stated, replaced by `--no-cache`, about git worktrees, + or about how agents work together. The warning against + `golangci-lint config verify` is dropped because sneak ruled on + https://git.eeqj.de/sneak/prompts/issues/40 (2026-08-10) that there is no + config check step and the config is assumed valid; a vendored `.golangci.yml` + stays byte-identical to the canonical copy. The issue gives each reason. - 2026-10-04: The note under the canonical Go `Dockerfile` example in `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get` under their Debian package names (issue 83). The `golangci/golangci-lint` diff --git a/prompts/REPO_POLICIES.md b/prompts/REPO_POLICIES.md index c8d0566..1d2150f 100644 --- a/prompts/REPO_POLICIES.md +++ b/prompts/REPO_POLICIES.md @@ -156,6 +156,9 @@ style conventions are in separate documents: not evidence that anything ran: a sub-second build reporting success is a cache hit, not a result. Never invalidate by pruning — `docker builder prune` and friends destroy a build cache shared with every other build on the host. + When a check is added or changed, prove it works by planting a defect it must + catch and watching the run fail on it, then revert the defect. A green run + alone shows neither that the check ran nor that it covers what it should. - **The gate phases are separate stages, and the build stage depends on both.** The lint phase is based on the `golangci/golangci-lint` image (pinned by @@ -274,7 +277,12 @@ style conventions are in separate documents: carry the same guarantee, because its gate phases may come from the cache. The image build is uncached and so runs the gate phases a second time. That is the price of the rule above, and it is worth paying: the image that ships is built - from a run of its own gates rather than from a cache entry. + from a run of its own gates rather than from a cache entry. A separate + workflow limited to `main` by a `branches` list under `on: push` cannot be + checked by review: to try a change to it, add the feature branch to that list + and push, then remove the branch from the list again before merging. Keep any + job in it that publishes behind `if: github.ref_name == 'main'`, so the run + from the feature branch publishes nothing. - Use platform-standard formatters: `black` for Python, `prettier` for JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with