Scope the .golangci.yml agent prohibition to vendored copies #49

clawbot · 2026-08-19T16:26:05+02:00

clawbot commented

2026-08-19 16:26:05 +02:00

SPECULATIVE and ahead of your ruling — nothing here is urgent and closing it costs nothing. One sentence of policy prose changed; no config file is touched.

The contradiction

REPO_POLICIES.md line 266 currently reads:

> .golangci.yml is standardized and must NEVER be modified by an agent, only manually by the user.

Stated unqualified, that forbids an agent from modifying .golangci.yml anywhere — including the canonical copy in this repo, which is the only place it can ever be fixed. An agent that wants to remediate a linter problem must either violate the rule or leave the problem standing. A rule that cannot be complied with and satisfied at the same time gets resolved ad hoc, differently by each reader, which is the worst of both outcomes it was trying to produce.

This is not hypothetical. It has already cost real time:

The gomodguard deprecation (#25) has been open since 2026-08-07 and still prints on every lint run in every consuming Go repo.
One agent read the rule as binding here and declined to open even a speculative branch, so the fix was not written at all on that pass.
#47 exists only because a later request was explicit enough to override the reading, and its lead comment asks for exactly this ruling before the PR itself can be judged on its merits.
The same warning is refiled downstream as sneak/homoicon#4, where it is correctly marked owner-only and correctly punted upstream.

Each new agent that meets the rule reruns this whole argument.

The change

Scope the prohibition to the vendored copy, and name the one legitimate path by which the config can change:

- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
  _NEVER_ be modified by an agent: fetch it from
  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
  byte-identical, so that no repo can quietly loosen its own linting. Linter
  configuration changes are made to the canonical copy in the `prompts` repo and
  reach consuming repos by re-vendoring; an agent may open a PR against
  canonical, which only the user merges.

The version pin sentence that followed is unchanged.

This keeps the property the rule exists for — no repo silently weakens its own linting, and divergence from canonical stays detectable — while removing the reading that freezes canonical itself. Your control is not reduced: an agent may open a PR here, and only you merge it.

Scope of the wording sweep

I grepped every .md in the repo for the absolute phrasing. It appears in exactly one place, prompts/REPO_POLICIES.md lines 266-267.

EXISTING_REPO_CHECKLIST.md (line 39) and NEW_REPO_CHECKLIST.md (line 63) both mention .golangci.yml, but only as "fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml" — an instruction to vendor canonical verbatim, which is exactly what the scoped rule says. Neither carries a prohibition, so neither needs changing and neither is left contradicting the other. REPO_POLICIES.md line 414 lists .golangci.yml as a required file, also unaffected.

Note that the repo-root REPO_POLICIES.md is a symlink to prompts/REPO_POLICIES.md, so the single edit covers both paths.

Deliberately NOT included

This PR does not change .golangci.yml. The gomodguard fix stays in #47 so the two can be judged separately — the policy question is worth settling on its own terms regardless of what you decide about that config change, and merging them would collapse two decisions into one.

Unrelated observation, for the record

While verifying #47 against a scratch sneak/homoicon clone, I found that homoicon's vendored .golangci.yml is sha256 391ea68e637432980f1db0776076f51578fa58193bbd17f4b40ad725975e21f8, while canonical main is 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb. The whole difference is a three-line comment recording a one-time agent edit you authorized on 2026-08-07; the config is functionally identical.

That matters only if you ever want a hash-based drift guard against canonical, which #25 floats as an offline alternative to golangci-lint config verify: such a guard would already report homoicon as drifted on day one. Worth knowing before building one. No change proposed here.

Validation

make check passes (prettier --check '**/*.md' --tab-width 4 --prose-wrap always: all matched files clean). make fmt produced no further changes. last_modified in the front matter updated to 2026-08-19 per this file's own rule.

SPECULATIVE and ahead of your ruling — nothing here is urgent and closing it costs nothing. One sentence of policy prose changed; no config file is touched. ## The contradiction `REPO_POLICIES.md` line 266 currently reads: > `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only manually by the user. Stated unqualified, that forbids an agent from modifying `.golangci.yml` **anywhere** — including the canonical copy in this repo, which is the only place it can ever be fixed. An agent that wants to remediate a linter problem must either violate the rule or leave the problem standing. A rule that cannot be complied with and satisfied at the same time gets resolved ad hoc, differently by each reader, which is the worst of both outcomes it was trying to produce. This is not hypothetical. It has already cost real time: - The `gomodguard` deprecation (https://git.eeqj.de/sneak/prompts/issues/25) has been open since 2026-08-07 and still prints on every lint run in every consuming Go repo. - One agent read the rule as binding here and **declined to open even a speculative branch**, so the fix was not written at all on that pass. - https://git.eeqj.de/sneak/prompts/pulls/47 exists only because a later request was explicit enough to override the reading, and its lead comment asks for exactly this ruling before the PR itself can be judged on its merits. - The same warning is refiled downstream as https://git.eeqj.de/sneak/homoicon/issues/4, where it is correctly marked owner-only and correctly punted upstream. Each new agent that meets the rule reruns this whole argument. ## The change Scope the prohibition to the vendored copy, and name the one legitimate path by which the config can change: ``` - `.golangci.yml` is standardized. The vendored copy in a consuming repo must _NEVER_ be modified by an agent: fetch it from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it byte-identical, so that no repo can quietly loosen its own linting. Linter configuration changes are made to the canonical copy in the `prompts` repo and reach consuming repos by re-vendoring; an agent may open a PR against canonical, which only the user merges. ``` The version pin sentence that followed is unchanged. This keeps the property the rule exists for — no repo silently weakens its own linting, and divergence from canonical stays detectable — while removing the reading that freezes canonical itself. Your control is not reduced: an agent may open a PR here, and only you merge it. ## Scope of the wording sweep I grepped every `.md` in the repo for the absolute phrasing. It appears in **exactly one place**, `prompts/REPO_POLICIES.md` lines 266-267. `EXISTING_REPO_CHECKLIST.md` (line 39) and `NEW_REPO_CHECKLIST.md` (line 63) both mention `.golangci.yml`, but only as "fetch from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`" — an instruction to vendor canonical verbatim, which is exactly what the scoped rule says. Neither carries a prohibition, so neither needs changing and neither is left contradicting the other. `REPO_POLICIES.md` line 414 lists `.golangci.yml` as a required file, also unaffected. Note that the repo-root `REPO_POLICIES.md` is a symlink to `prompts/REPO_POLICIES.md`, so the single edit covers both paths. ## Deliberately NOT included This PR does **not** change `.golangci.yml`. The `gomodguard` fix stays in https://git.eeqj.de/sneak/prompts/pulls/47 so the two can be judged separately — the policy question is worth settling on its own terms regardless of what you decide about that config change, and merging them would collapse two decisions into one. ## Unrelated observation, for the record While verifying https://git.eeqj.de/sneak/prompts/pulls/47 against a scratch `sneak/homoicon` clone, I found that homoicon's vendored `.golangci.yml` is sha256 `391ea68e637432980f1db0776076f51578fa58193bbd17f4b40ad725975e21f8`, while canonical `main` is `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb`. The whole difference is a three-line comment recording a one-time agent edit you authorized on 2026-08-07; the config is functionally identical. That matters only if you ever want a hash-based drift guard against canonical, which https://git.eeqj.de/sneak/prompts/issues/25 floats as an offline alternative to `golangci-lint config verify`: such a guard would already report homoicon as drifted on day one. Worth knowing before building one. No change proposed here. ## Validation `make check` passes (`prettier --check '**/*.md' --tab-width 4 --prose-wrap always`: all matched files clean). `make fmt` produced no further changes. `last_modified` in the front matter updated to 2026-08-19 per this file's own rule.

clawbot added 1 commit 2026-08-19 16:26:06 +02:00

policy: scope the .golangci.yml rule to vendored copies

check / check (push) Successful in 9s

Details

a614cd6ffb

Stated unqualified, the rule forbade an agent from modifying
.golangci.yml anywhere, including the canonical copy in this repo --
the only place it can be fixed. Compliance and remediation were
mutually exclusive.

Scope the prohibition to the vendored copy in a consuming repo, which
is the property the rule exists to protect, and name the one legitimate
path for change: a PR against canonical here, merged only by the user.

clawbot referenced this pull request

2026-08-19 16:26:46 +02:00

Migrate canonical .golangci.yml from gomodguard to gomodguard_v2 #47

clawbot referenced this pull request

2026-08-20 05:07:47 +02:00

Name script/check as the gate repo-type verifications belong in #50

sneak added 1 commit 2026-08-30 06:26:11 +02:00

Merge branch 'main' into policy/scope-golangci-rule-to-vendored-copies

check / check (push) Successful in 24s

Details

fd5d305ba7

sneak merged commit f77d785bed into main