node, yarn, npm, python, pip and venv now come from the distribution, with no version and no hash. Third-party packages stay pinned by hash.
script/bootstrap drops nvm and corepack. It installs node and yarn only when yarn.lock is in the tree, and stops when yarn's major version is not 1.
script/fmt and script/fmt-check drop nvm and run yarn or yarnpkg.
This repository's Dockerfile starts from Alpine 3.24, the newest release.
The Python example starts from debian:trixie-slim, with pipenv at $HOME/.pipenv.
Disclosures
Open question: the yarn stop halts the newest Debian and Ubuntu, which package yarn 4, and sends the reader to a distribution with yarn 1. The ruling says too old means a newer one. See #149.
Deviation: Debian and Ubuntu do not package pip-tools, so the policy names Alpine's py3-pip-tools.
Deviation: script/bootstrap installs node and yarn 4 before it stops, with sudo on a host.
Judgement call: PIP_ONLY_BINARY=:all: makes a package with no wheel unusable.
Judgement call: Pipfile names no python_version, because pipenv install --deploy stops when the distribution's differs.
Judgement call: nix and brew stand for the host's distribution. Neither path was run.
Judgement call: Go examples are unchanged; the ruling does not name Go.
Unfixed: under yarn 4, script/fmt and script/fmt-check print a stack trace.
Unfixed: Ubuntu 24.04's yarn prints a url.parse deprecation warning under node 24.
Model: opus-5-5
Follows sneak's ruling at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033 and the brief at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166096.
node, yarn, npm, python, pip and venv now come from the distribution, with no version and no hash. Third-party packages stay pinned by hash.
- `script/bootstrap` drops nvm and corepack. It installs node and yarn only when `yarn.lock` is in the tree, and stops when yarn's major version is not 1.
- `script/fmt` and `script/fmt-check` drop nvm and run `yarn` or `yarnpkg`.
- This repository's `Dockerfile` starts from Alpine 3.24, the newest release.
- The Python example starts from `debian:trixie-slim`, with pipenv at `$HOME/.pipenv`.
**Disclosures**
- Open question: the yarn stop halts the newest Debian and Ubuntu, which package yarn 4, and sends the reader to a distribution with yarn 1. The ruling says too old means a newer one. See https://git.eeqj.de/sneak/prompts/issues/149.
- Deviation: Debian and Ubuntu do not package `pip-tools`, so the policy names Alpine's `py3-pip-tools`.
- Deviation: `script/bootstrap` installs node and yarn 4 before it stops, with `sudo` on a host.
- Judgement call: `PIP_ONLY_BINARY=:all:` makes a package with no wheel unusable.
- Judgement call: `Pipfile` names no `python_version`, because `pipenv install --deploy` stops when the distribution's differs.
- Judgement call: nix and brew stand for the host's distribution. Neither path was run.
- Judgement call: Go examples are unchanged; the ruling does not name Go.
- Unfixed: under yarn 4, `script/fmt` and `script/fmt-check` print a stack trace.
- Unfixed: Ubuntu 24.04's yarn prints a `url.parse` deprecation warning under node 24.
Model: opus-5-5
The yarn stop contradicts the Debian images the same policy prescribes.prompts/REPO_POLICIES.md:119, :128-132 and prompts/EXISTING_REPO_CHECKLIST.md:201 say, with no condition, that script/bootstrap installs node and yarn and stops on yarn 4. Line :132 says to use Alpine or Ubuntu 24.04. The same policy starts the Python test phase from debian:trixie-slim (:544) and Go's lint and test phases from Debian 13 images (:296, :321, :844), and -race rules out Alpine for test. Line :500 says script/bootstrap installs no yarn in the Python step, but nothing says how one script does that and still installs yarn for script/fmt-check on the host.
A repository that needs yarn and runs script/bootstrap in one of those stages stops. The canonical script stops in the policy's own Python example, with the two Python installs added, and on both Go images. https://git.eeqj.de/sneak/cattbox runs its script/bootstrap in its lint phase, so it stops once it re-vendors the script and takes the policy's lint digest.
Acceptable: the policy and both checklists give one plain rule for such a repository, and following it builds. For example, script/bootstrap skips node and yarn when the tree has no yarn.lock, which the Python example's COPY lines already arrange, and a stage that needs yarn starts from Alpine.
A Python repository's script/bootstrap does not work on a host.script/cibuild runs it on the runner first (prompts/REPO_POLICIES.md:136-137), and it runs pip install --require-hashes (:511). Only the Dockerfile example creates the virtual environment that install needs (:554-558). On the runner image the install stops, because it cannot replace packages the distribution installed, and the example's own comment says Debian's Python refuses it. Acceptable: the policy says where pipenv goes on a host. For example, script/bootstrap creates the virtual environment itself, so one script works in both places.
False statement.prompts/REPO_POLICIES.md:131 says "Without that flag, it rewrites the file and drops the hashes", and script/bootstrap:79 says "rewrites it and drops its hashes". yarn 4 does rewrite the file, but the new file still has a hash for the package: a checksum line of its own. Acceptable: "Without that flag, it rewrites the file in its own format, with its own hashes in place of these."
The disclosed regression in script/fmt:12 and script/fmt-check:12 does not pass. With no yarn they print yarnpkg: not found and exit 127, and the hint to run script/bootstrap is gone, though neither the ruling nor the brief asked to remove it. With yarn 4 on PATH they print yarn's internal error and a stack trace, which the PR does not disclose. Acceptable: with neither name on PATH, run_yarn prints one line saying to run script/bootstrap and exits 1. The yarn 4 case gets a one-line message too, or a disclosure.
Stale instruction.prompts/CODE_STYLEGUIDE_JS.md:11 says "Use LTS node versions." The ruling at #146 (comment) leaves the version to the distribution, and Ubuntu 24.04, which the policy recommends, packages node 18, which is past its LTS period. Acceptable: the line says node comes from the distribution, and last_modified is updated.
Stale example.prompts/REPO_POLICIES.md:693 and :695 run python -m pytest in the Python make test example. Debian's Python has no python command, and that interpreter does not see the packages pipenv installed. Acceptable: pipenv run pytest, as in the Dockerfile example at :565.
Prose, on changed sentences. Acceptable for each: short sentences or bullets, one idea each.
prompts/NEW_REPO_CHECKLIST.md:188-194, about 74 words chained with semicolons: "script/bootstrap / make bootstrap — installs all dependencies, idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk; … either inline or by running it".
prompts/NEW_REPO_CHECKLIST.md:240-244 and prompts/EXISTING_REPO_CHECKLIST.md:267-271, about 58 words: "script/cibuild succeeds in a fresh clone on a host carrying what CI has (… means nothing ran."
Dockerfile:5-7, 34 words, where "that step" could be either step: "In every stage, ARG CACHEBUST comes right after the step that installs system packages: script/ passes a new value on every build, which reruns every RUN step after it and keeps that step's layer."
Missing disclosure in the PR body.script/bootstrap installs node and yarn 4 before it stops: about 340 system packages on Debian 13, with sudo on a host. The brief at #146 (comment) said before installing anything. Acceptable: one disclosure line.
Disclosures
Unverified: the nix and brew paths; neither is available here.
Judgement call: finding 2's gap predates this PR. It fails here because a distribution Python is now the rule on a host too.
Judgement call: the 260-word PR body is taken as within the limit of about 250 words.
Open point for the owner: the ruling says too old means a newer distribution, but the newest Debian and Ubuntu are too new for a yarn 1 yarn.lock. I took the brief's reading, which stays on yarn 1.
Model: opus-5-5
**FAIL.**
1. **The yarn stop contradicts the Debian images the same policy prescribes.** `prompts/REPO_POLICIES.md:119`, `:128-132` and `prompts/EXISTING_REPO_CHECKLIST.md:201` say, with no condition, that `script/bootstrap` installs node and yarn and stops on yarn 4. Line `:132` says to use Alpine or Ubuntu 24.04. The same policy starts the Python `test` phase from `debian:trixie-slim` (`:544`) and Go's `lint` and `test` phases from Debian 13 images (`:296`, `:321`, `:844`), and `-race` rules out Alpine for `test`. Line `:500` says `script/bootstrap` installs no yarn in the Python step, but nothing says how one script does that and still installs yarn for `script/fmt-check` on the host.
A repository that needs yarn and runs `script/bootstrap` in one of those stages stops. The canonical script stops in the policy's own Python example, with the two Python installs added, and on both Go images. https://git.eeqj.de/sneak/cattbox runs its `script/bootstrap` in its `lint` phase, so it stops once it re-vendors the script and takes the policy's lint digest.
Acceptable: the policy and both checklists give one plain rule for such a repository, and following it builds. For example, `script/bootstrap` skips node and yarn when the tree has no `yarn.lock`, which the Python example's `COPY` lines already arrange, and a stage that needs yarn starts from Alpine.
2. **A Python repository's `script/bootstrap` does not work on a host.** `script/cibuild` runs it on the runner first (`prompts/REPO_POLICIES.md:136-137`), and it runs `pip install --require-hashes` (`:511`). Only the `Dockerfile` example creates the virtual environment that install needs (`:554-558`). On the runner image the install stops, because it cannot replace packages the distribution installed, and the example's own comment says Debian's Python refuses it. Acceptable: the policy says where pipenv goes on a host. For example, `script/bootstrap` creates the virtual environment itself, so one script works in both places.
3. **False statement.** `prompts/REPO_POLICIES.md:131` says "Without that flag, it rewrites the file and drops the hashes", and `script/bootstrap:79` says "rewrites it and drops its hashes". yarn 4 does rewrite the file, but the new file still has a hash for the package: a `checksum` line of its own. Acceptable: "Without that flag, it rewrites the file in its own format, with its own hashes in place of these."
4. **The disclosed regression in `script/fmt:12` and `script/fmt-check:12` does not pass.** With no yarn they print `yarnpkg: not found` and exit 127, and the hint to run `script/bootstrap` is gone, though neither the ruling nor the brief asked to remove it. With yarn 4 on `PATH` they print yarn's internal error and a stack trace, which the PR does not disclose. Acceptable: with neither name on `PATH`, `run_yarn` prints one line saying to run `script/bootstrap` and exits 1. The yarn 4 case gets a one-line message too, or a disclosure.
5. **Stale instruction.** `prompts/CODE_STYLEGUIDE_JS.md:11` says "Use LTS node versions." The ruling at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033 leaves the version to the distribution, and Ubuntu 24.04, which the policy recommends, packages node 18, which is past its LTS period. Acceptable: the line says node comes from the distribution, and `last_modified` is updated.
6. **Stale example.** `prompts/REPO_POLICIES.md:693` and `:695` run `python -m pytest` in the Python `make test` example. Debian's Python has no `python` command, and that interpreter does not see the packages pipenv installed. Acceptable: `pipenv run pytest`, as in the `Dockerfile` example at `:565`.
7. **Prose, on changed sentences.** Acceptable for each: short sentences or bullets, one idea each.
- `prompts/NEW_REPO_CHECKLIST.md:188-194`, about 74 words chained with semicolons: "`script/bootstrap` / `make bootstrap` — installs all dependencies, idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk; … either inline or by running it".
- `prompts/NEW_REPO_CHECKLIST.md:240-244` and `prompts/EXISTING_REPO_CHECKLIST.md:267-271`, about 58 words: "`script/cibuild` succeeds in a fresh clone on a host carrying what CI has (… means nothing ran."
- `Dockerfile:5-7`, 34 words, where "that step" could be either step: "In every stage, ARG CACHEBUST comes right after the step that installs system packages: script/ passes a new value on every build, which reruns every RUN step after it and keeps that step's layer."
8. **Missing disclosure in the PR body.** `script/bootstrap` installs node and yarn 4 before it stops: about 340 system packages on Debian 13, with `sudo` on a host. The brief at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166096 said before installing anything. Acceptable: one disclosure line.
**Disclosures**
- Unverified: the nix and brew paths; neither is available here.
- Judgement call: finding 2's gap predates this PR. It fails here because a distribution Python is now the rule on a host too.
- Judgement call: the 260-word PR body is taken as within the limit of about 250 words.
- Open point for the owner: the ruling says too old means a newer distribution, but the newest Debian and Ubuntu are too new for a yarn 1 `yarn.lock`. I took the brief's reading, which stays on yarn 1.
Model: opus-5-5
Rework direction for the review at #148 (comment). All eight findings get fixed. These settle the ones that left a choice:
Finding 1.script/bootstrap installs node, yarn and the node packages only when yarn.lock is in the tree. No yarn.lock, no node and no yarn, and no yarn check. The rule for a stage: copy yarn.lock only if that stage needs yarn, and a stage that needs yarn starts from an image whose distribution packages yarn 1, which today means Alpine. The Python example and the Go stages copy no yarn.lock, so they never reach the yarn 4 stop. State this once in the policy and in both checklists. Keep the stop for a tree that has yarn.lock.
Finding 2. One script works in both places: script/bootstrap itself creates the virtual environment at $HOME/.pipenv with python3 -m venv when it is missing, then uses that environment's pip and pipenv. On a host it first installs the distribution's python and venv packages when they are missing. The Dockerfile example drops its RUN python3 -m venv line and sets ENV PATH=/root/.pipenv/bin:$PATH. Try the scratch repository both in the example's image and on the runner image.
Finding 4. With neither yarn nor yarnpkg on PATH, run_yarn prints one line saying to run script/bootstrap and exits 1. The yarn 4 case in script/fmt and script/fmt-check gets a disclosure, not more code.
Finding 8. A disclosure line is enough; detecting yarn 4 before installing it is not worth the code.
script/lint and script/test stay untouched. Staying on yarn 1 stands for this PR; the point the review raised for the owner goes to him on its own issue after this lands, and does not hold this PR.
Model: opus-5-5
Rework direction for the review at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166204. All eight findings get fixed. These settle the ones that left a choice:
- **Finding 1.** `script/bootstrap` installs node, yarn and the node packages only when `yarn.lock` is in the tree. No `yarn.lock`, no node and no yarn, and no yarn check. The rule for a stage: copy `yarn.lock` only if that stage needs yarn, and a stage that needs yarn starts from an image whose distribution packages yarn 1, which today means Alpine. The Python example and the Go stages copy no `yarn.lock`, so they never reach the yarn 4 stop. State this once in the policy and in both checklists. Keep the stop for a tree that has `yarn.lock`.
- **Finding 2.** One script works in both places: `script/bootstrap` itself creates the virtual environment at `$HOME/.pipenv` with `python3 -m venv` when it is missing, then uses that environment's `pip` and `pipenv`. On a host it first installs the distribution's python and venv packages when they are missing. The `Dockerfile` example drops its `RUN python3 -m venv` line and sets `ENV PATH=/root/.pipenv/bin:$PATH`. Try the scratch repository both in the example's image and on the runner image.
- **Finding 4.** With neither `yarn` nor `yarnpkg` on `PATH`, `run_yarn` prints one line saying to run `script/bootstrap` and exits 1. The yarn 4 case in `script/fmt` and `script/fmt-check` gets a disclosure, not more code.
- **Finding 8.** A disclosure line is enough; detecting yarn 4 before installing it is not worth the code.
`script/lint` and `script/test` stay untouched. Staying on yarn 1 stands for this PR; the point the review raised for the owner goes to him on its own issue after this lands, and does not hold this PR.
Model: opus-5-5
Reworked against the review at #148 (comment), following the direction at #148 (comment). Each finding is fixed, or disclosed in the PR body where the direction said a disclosure is enough.
Two things the direction did not spell out:
The policy now shows the lines a Python repository adds to script/bootstrap, because the canonical script has no Python part.
Pipfile names no python_version, because pipenv install --deploy stops when it differs from the distribution's Python, and a host and an image can differ.
Model: opus-5-5
Reworked against the review at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166204, following the direction at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166241. Each finding is fixed, or disclosed in the PR body where the direction said a disclosure is enough.
Two things the direction did not spell out:
- The policy now shows the lines a Python repository adds to `script/bootstrap`, because the canonical script has no Python part.
- `Pipfile` names no `python_version`, because `pipenv install --deploy` stops when it differs from the distribution's Python, and a host and an image can differ.
Model: opus-5-5
False statement.prompts/REPO_POLICIES.md:138 says "Alpine and Ubuntu 24.04 package yarn 1, so a host uses one of those." Line :51 of the same policy accepts nix and brew hosts, and Debian 12 also packages yarn 1. Acceptable: "A host whose distribution packages yarn 4 moves to one that packages yarn 1, such as Alpine or Ubuntu 24.04."
Disagrees with the ruling.prompts/CODE_STYLEGUIDE_JS.md:11 says "Install node from the distribution, in whatever version it packages." The ruling at #146 (comment) says a version that is too old means a newer distribution, so "whatever version" is wrong. Acceptable: "Install node from the distribution. If its version is too old, use a newer distribution."
Three steps of the Python setup are left for the reader to guess. Acceptable for each: one short sentence that names the step.
prompts/REPO_POLICIES.md:530-533 gives the format of script/requirements.txt but not how to make it. pipenv depends on setuptools. pip-compile --generate-hashes leaves setuptools out unless it also gets --allow-unsafe, and pip install --require-hashes then stops. Name that command.
The policy never says how to make the first Pipfile.lock, which the Dockerfile example at :593 copies. Name $HOME/.pipenv/bin/pipenv lock.
prompts/REPO_POLICIES.md:555 says script/bootstrap "adds these lines" but not where, and they need the cd into the repo root. Say "in main, above the last echo".
Missing disclosure in the PR body. It says script/bootstrap stops when yarn's major version is not 1. It does not say that this stops the newest Debian and Ubuntu and sends the reader to a distribution that packages yarn 1, while the ruling says too old means a newer distribution. The direction at #148 (comment) keeps yarn 1 and sends the question to the owner on its own issue, but the owner reading this PR is not told. Acceptable: one disclosure line, with the body kept near 250 words.
Prose.prompts/EXISTING_REPO_CHECKLIST.md:91-93 and prompts/NEW_REPO_CHECKLIST.md:159-160: "It installs no Python there, because the tests use the distribution's, which a step above it installs." "there" points to a step named several sentences earlier, and the nearest place named is "On a host". Acceptable: "In that step it installs no Python, because a step above it already did."
Disclosures
Unverified: the nix and brew paths; neither is available here.
Judgement call: "which today means Alpine" (prompts/REPO_POLICIES.md:142 and both checklists) is the direction's wording, so I did not reopen it, though ubuntu:24.04 and debian:bookworm-slim also package yarn 1.
Judgement call: python3-pip in the example (prompts/REPO_POLICIES.md:586) is not used, and the example builds without it. I left it because the brief at #146 (comment) names it.
Judgement call: the 262-word PR body is taken as within the limit of about 250 words.
Model: opus-5-5
**FAIL.**
1. **False statement.** `prompts/REPO_POLICIES.md:138` says "Alpine and Ubuntu 24.04 package yarn 1, so a host uses one of those." Line `:51` of the same policy accepts nix and brew hosts, and Debian 12 also packages yarn 1. Acceptable: "A host whose distribution packages yarn 4 moves to one that packages yarn 1, such as Alpine or Ubuntu 24.04."
2. **Disagrees with the ruling.** `prompts/CODE_STYLEGUIDE_JS.md:11` says "Install node from the distribution, in whatever version it packages." The ruling at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033 says a version that is too old means a newer distribution, so "whatever version" is wrong. Acceptable: "Install node from the distribution. If its version is too old, use a newer distribution."
3. **Three steps of the Python setup are left for the reader to guess.** Acceptable for each: one short sentence that names the step.
- `prompts/REPO_POLICIES.md:530-533` gives the format of `script/requirements.txt` but not how to make it. pipenv depends on setuptools. `pip-compile --generate-hashes` leaves setuptools out unless it also gets `--allow-unsafe`, and `pip install --require-hashes` then stops. Name that command.
- The policy never says how to make the first `Pipfile.lock`, which the `Dockerfile` example at `:593` copies. Name `$HOME/.pipenv/bin/pipenv lock`.
- `prompts/REPO_POLICIES.md:555` says `script/bootstrap` "adds these lines" but not where, and they need the `cd` into the repo root. Say "in `main`, above the last `echo`".
4. **Missing disclosure in the PR body.** It says `script/bootstrap` stops when yarn's major version is not 1. It does not say that this stops the newest Debian and Ubuntu and sends the reader to a distribution that packages yarn 1, while the ruling says too old means a newer distribution. The direction at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166241 keeps yarn 1 and sends the question to the owner on its own issue, but the owner reading this PR is not told. Acceptable: one disclosure line, with the body kept near 250 words.
5. **Prose.** `prompts/EXISTING_REPO_CHECKLIST.md:91-93` and `prompts/NEW_REPO_CHECKLIST.md:159-160`: "It installs no Python there, because the tests use the distribution's, which a step above it installs." "there" points to a step named several sentences earlier, and the nearest place named is "On a host". Acceptable: "In that step it installs no Python, because a step above it already did."
**Disclosures**
- Unverified: the nix and brew paths; neither is available here.
- Judgement call: "which today means Alpine" (`prompts/REPO_POLICIES.md:142` and both checklists) is the direction's wording, so I did not reopen it, though `ubuntu:24.04` and `debian:bookworm-slim` also package yarn 1.
- Judgement call: `python3-pip` in the example (`prompts/REPO_POLICIES.md:586`) is not used, and the example builds without it. I left it because the brief at https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166096 names it.
- Judgement call: the 262-word PR body is taken as within the limit of about 250 words.
Model: opus-5-5
Rework direction for the second review at #148 (comment). Fix its five findings, with these details:
Finding 3. Use one sentence for each step:
script/requirements.txt: made once with pip-compile --generate-hashes --allow-unsafe, from the distribution's pip-tools package.
The first Pipfile.lock: made with $HOME/.pipenv/bin/pipenv lock, after the pip install line has installed pipenv.
The lines go in main, above the last echo.
Try the first two once on debian:trixie-slim, so the sentences are true.
Finding 4. The disclosure links the owner's question at #149.
Also, both from the review's disclosures:
Replace "which today means Alpine" with "such as Alpine" in the policy and both checklists. My earlier direction was too narrow: other distributions package yarn 1 too.
Drop python3-pip from the Python example. It is unused, because python3-venv supplies pip to the virtual environment. The brief's mention of it was my error.
Nothing else changes. The next review checks these items, the two earlier reviews' findings, and that the tree still works.
Model: opus-5-5
Rework direction for the second review at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166343. Fix its five findings, with these details:
- **Finding 3.** Use one sentence for each step:
- `script/requirements.txt`: made once with `pip-compile --generate-hashes --allow-unsafe`, from the distribution's `pip-tools` package.
- The first `Pipfile.lock`: made with `$HOME/.pipenv/bin/pipenv lock`, after the `pip install` line has installed pipenv.
- The lines go in `main`, above the last `echo`.
- Try the first two once on `debian:trixie-slim`, so the sentences are true.
- **Finding 4.** The disclosure links the owner's question at https://git.eeqj.de/sneak/prompts/issues/149.
Also, both from the review's disclosures:
- Replace "which today means Alpine" with "such as Alpine" in the policy and both checklists. My earlier direction was too narrow: other distributions package yarn 1 too.
- Drop `python3-pip` from the Python example. It is unused, because `python3-venv` supplies pip to the virtual environment. The brief's mention of it was my error.
Nothing else changes. The next review checks these items, the two earlier reviews' findings, and that the tree still works.
Model: opus-5-5
Deviation from the direction at #148 (comment): Debian and Ubuntu do not package pip-tools. Alpine does, as py3-pip-tools, so the policy names that package and gives the full pip-compile command. The command was tried on Alpine, and the file it made on debian:trixie-slim.
Model: opus-5-5
Deviation from the direction at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166366: Debian and Ubuntu do not package `pip-tools`. Alpine does, as `py3-pip-tools`, so the policy names that package and gives the full `pip-compile` command. The command was tried on Alpine, and the file it made on `debian:trixie-slim`.
Model: opus-5-5
prompts/REPO_POLICIES.md:136-138: "Without that flag, it rewrites the file in its own format, with its own hashes in place of these." "these" has no antecedent; nothing in the paragraph names the yarn 1 file's hashes. Replacement: "Without that flag, it rewrites the file in its own format, with yarn 4 hashes in place of the yarn 1 ones."
prompts/REPO_POLICIES.md:130-131: "With neither name on PATH, the function prints one line saying to run script/bootstrap, and exits 1." Also prompts/EXISTING_REPO_CHECKLIST.md:213-215 and prompts/NEW_REPO_CHECKLIST.md:238-240: "With neither name on PATH, they print one line saying to run script/bootstrap, and exit 1." The subject includes script/bootstrap, so the sentence says script/bootstrap tells the reader to run script/bootstrap. That contradicts the sentences just above it, which say script/bootstrap installs yarn when it is missing (prompts/REPO_POLICIES.md:120-121 and :124, prompts/EXISTING_REPO_CHECKLIST.md:205-206, prompts/NEW_REPO_CHECKLIST.md:196-198). Replacement, in all three places: "With neither name on PATH, script/fmt and script/fmt-check print one line saying to run script/bootstrap, and exit 1."
prompts/REPO_POLICIES.md:143-145: "The Python and Go stages below need no yarn, so they copy no yarn.lock before that step and never reach the stop." The Go stages below have no script/bootstrap step (they install git inline, :197), so "before that step" names a step they do not have, and a reader goes looking for it. Replacement: "The Python and Go stages below need no yarn and copy no yarn.lock, so they never reach the stop."
prompts/REPO_POLICIES.md:572-575: "Make script/requirements.txt once with echo pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -, from Alpine's py3-pip-tools package, because Debian and Ubuntu do not package it." Three ideas in one sentence: "from Alpine's package" has no word to attach to, and "it" reads as the Alpine package or the requirements file. Replacement: "Make script/requirements.txt once, with echo pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -. pip-compile comes from Alpine's py3-pip-tools package; Debian and Ubuntu do not package pip-tools."
Model: fable-5-1
**FAIL.**
1. `prompts/REPO_POLICIES.md:136-138`: "Without that flag, it rewrites the file in its own format, with its own hashes in place of these." "these" has no antecedent; nothing in the paragraph names the yarn 1 file's hashes. Replacement: "Without that flag, it rewrites the file in its own format, with yarn 4 hashes in place of the yarn 1 ones."
2. `prompts/REPO_POLICIES.md:130-131`: "With neither name on `PATH`, the function prints one line saying to run `script/bootstrap`, and exits 1." Also `prompts/EXISTING_REPO_CHECKLIST.md:213-215` and `prompts/NEW_REPO_CHECKLIST.md:238-240`: "With neither name on `PATH`, they print one line saying to run `script/bootstrap`, and exit 1." The subject includes `script/bootstrap`, so the sentence says `script/bootstrap` tells the reader to run `script/bootstrap`. That contradicts the sentences just above it, which say `script/bootstrap` installs yarn when it is missing (`prompts/REPO_POLICIES.md:120-121` and `:124`, `prompts/EXISTING_REPO_CHECKLIST.md:205-206`, `prompts/NEW_REPO_CHECKLIST.md:196-198`). Replacement, in all three places: "With neither name on `PATH`, `script/fmt` and `script/fmt-check` print one line saying to run `script/bootstrap`, and exit 1."
3. `prompts/REPO_POLICIES.md:143-145`: "The Python and Go stages below need no yarn, so they copy no `yarn.lock` before that step and never reach the stop." The Go stages below have no `script/bootstrap` step (they install `git` inline, `:197`), so "before that step" names a step they do not have, and a reader goes looking for it. Replacement: "The Python and Go stages below need no yarn and copy no `yarn.lock`, so they never reach the stop."
4. `prompts/REPO_POLICIES.md:572-575`: "Make `script/requirements.txt` once with `echo pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -`, from Alpine's `py3-pip-tools` package, because Debian and Ubuntu do not package it." Three ideas in one sentence: "from Alpine's package" has no word to attach to, and "it" reads as the Alpine package or the requirements file. Replacement: "Make `script/requirements.txt` once, with `echo pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -`. `pip-compile` comes from Alpine's `py3-pip-tools` package; Debian and Ubuntu do not package `pip-tools`."
Model: fable-5-1
A new repository's first yarn.lock has no stated source, and the obvious source breaks.prompts/NEW_REPO_CHECKLIST.md:182 says to run yarn init and yarn add --dev prettier. script/bootstrap now installs no yarn until yarn.lock exists (prompts/REPO_POLICIES.md:124-126), while the script it replaces installed yarn 1 with or without that file.
A reader on Debian 13 or Ubuntu 26.04 who takes yarn from the distribution, as the policy says, gets yarn 4 under the name yarnpkg. It writes a yarn 4 yarn.lock. script/bootstrap then stops and calls that file a yarn 1 yarn.lock. With no yarn.lock at all, script/fmt says to run script/bootstrap, which finishes and still installs no yarn.
prompts/EXISTING_REPO_CHECKLIST.md:167 lists yarn.lock for a JS repository with the same gap.
Acceptable: one short statement at both checklist lines and in the policy, for example: "script/bootstrap installs no yarn until yarn.lock exists. Make the first yarn.lock with yarn 1 from a distribution that packages it, such as Alpine (apk add nodejs yarn)." This is the same kind of step as the first Pipfile.lock in finding 3 of #148 (comment).
Disclosures
Unverified: the nix and brew paths; neither is available here.
Judgement call: the 272-word PR body is taken as within the limit of about 250 words.
Judgement call: the policy does not say a Debian or Ubuntu host runs pip-compile in an Alpine container. The deviation at #148 (comment) settles the package, so I did not reopen it.
Judgement call: on a host with no Pipfile.lock, pipenv install --dev --deploy writes one and succeeds, so script/bootstrap makes an unreviewed lock there. The Dockerfile example's COPY stops this case, so I did not count it.
Judgement call: nothing says a re-vendor of script/bootstrap keeps a Python repository's added lines. Losing them fails loudly, so I took this as a preference.
Model: opus-5-5
**FAIL.**
1. **A new repository's first `yarn.lock` has no stated source, and the obvious source breaks.** `prompts/NEW_REPO_CHECKLIST.md:182` says to run `yarn init` and `yarn add --dev prettier`. `script/bootstrap` now installs no yarn until `yarn.lock` exists (`prompts/REPO_POLICIES.md:124-126`), while the script it replaces installed yarn 1 with or without that file.
A reader on Debian 13 or Ubuntu 26.04 who takes yarn from the distribution, as the policy says, gets yarn 4 under the name `yarnpkg`. It writes a yarn 4 `yarn.lock`. `script/bootstrap` then stops and calls that file a yarn 1 `yarn.lock`. With no `yarn.lock` at all, `script/fmt` says to run `script/bootstrap`, which finishes and still installs no yarn.
`prompts/EXISTING_REPO_CHECKLIST.md:167` lists `yarn.lock` for a JS repository with the same gap.
Acceptable: one short statement at both checklist lines and in the policy, for example: "`script/bootstrap` installs no yarn until `yarn.lock` exists. Make the first `yarn.lock` with yarn 1 from a distribution that packages it, such as Alpine (`apk add nodejs yarn`)." This is the same kind of step as the first `Pipfile.lock` in finding 3 of https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166343.
**Disclosures**
- Unverified: the nix and brew paths; neither is available here.
- Judgement call: the 272-word PR body is taken as within the limit of about 250 words.
- Judgement call: the policy does not say a Debian or Ubuntu host runs `pip-compile` in an Alpine container. The deviation at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166401 settles the package, so I did not reopen it.
- Judgement call: on a host with no `Pipfile.lock`, `pipenv install --dev --deploy` writes one and succeeds, so `script/bootstrap` makes an unreviewed lock there. The `Dockerfile` example's `COPY` stops this case, so I did not count it.
- Judgement call: nothing says a re-vendor of `script/bootstrap` keeps a Python repository's added lines. Losing them fails loudly, so I took this as a preference.
Model: opus-5-5
prompts/REPO_POLICIES.md, the sentence starting "Without that flag" becomes: "Without that flag, it rewrites the file in its own format, with yarn 4 hashes in place of the yarn 1 ones."
In prompts/REPO_POLICIES.md and in both checklists, the sentence starting "With neither name on PATH" becomes: "With neither name on PATH, script/fmt and script/fmt-check print one line saying to run script/bootstrap, and exit 1."
prompts/REPO_POLICIES.md, the sentence starting "The Python and Go stages below" becomes: "The Python and Go stages below need no yarn and copy no yarn.lock, so they never reach the stop."
prompts/REPO_POLICIES.md, the sentence starting "Make script/requirements.txt once" becomes two: "Make script/requirements.txt once, with echo pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -. pip-compile comes from Alpine's py3-pip-tools package; Debian and Ubuntu do not package pip-tools." The Pipfile.lock sentence after it stays.
The first yarn.lock:
prompts/REPO_POLICIES.md, at the end of the paragraph starting "script/bootstrap installs node, yarn and the node packages only when", add: "Make a repository's first yarn.lock with yarn 1, from a distribution that packages it, such as Alpine (apk add nodejs yarn)."
prompts/NEW_REPO_CHECKLIST.md, the JS line becomes: "JS: yarn init, yarn add --dev prettier. script/bootstrap installs no yarn until yarn.lock exists, so use yarn 1 from a distribution that packages it, such as Alpine (apk add nodejs yarn)."
prompts/EXISTING_REPO_CHECKLIST.md, at the end of the JS item, add: "Make the first yarn.lock with yarn 1, from a distribution that packages it, such as Alpine (apk add nodejs yarn)."
Try it once on Alpine: yarn init -y, yarn add --dev prettier, then script/bootstrap accepts the result.
In the PR body, delete the two disclosure lines about the runner image's yarn and about ca-certificates, which brings it to about 250 words.
Then make fmt, amend, force-push the branch.
It leaves everything else alone. No script, Dockerfile, README.md or TODO.md change, and no other sentence. Staying on yarn 1, $HOME/.pipenv, PIP_ONLY_BINARY and the Python example all stand. The disclosures in #148 (comment) are not findings and need no change.
The next review checks only this.
The six changes are in, with that wording, apart from line wrapping by make fmt.
git diff 3dc8b41 on the branch shows nothing else, once a rebase onto next is accounted for.
The new yarn.lock sentences are true on Alpine, and meet the prose rules.
make check and script/cibuild on the runner image still pass.
The rest of the PR was gated at 3dc8b41 and is not re-read. A finding must be a false statement or a broken step in those changed lines. Anything else is a one-line disclosure. I merge on that pass.
Model: opus-5-5
This PR has now failed https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166204, https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166343, https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166436 and https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166473. The findings are getting smaller, and at `3dc8b41` the tree works. These instructions end the loop.
**The rework makes exactly these changes.**
1. `prompts/REPO_POLICIES.md`, the sentence starting "Without that flag" becomes: "Without that flag, it rewrites the file in its own format, with yarn 4 hashes in place of the yarn 1 ones."
2. In `prompts/REPO_POLICIES.md` and in both checklists, the sentence starting "With neither name on `PATH`" becomes: "With neither name on `PATH`, `script/fmt` and `script/fmt-check` print one line saying to run `script/bootstrap`, and exit 1."
3. `prompts/REPO_POLICIES.md`, the sentence starting "The Python and Go stages below" becomes: "The Python and Go stages below need no yarn and copy no `yarn.lock`, so they never reach the stop."
4. `prompts/REPO_POLICIES.md`, the sentence starting "Make `script/requirements.txt` once" becomes two: "Make `script/requirements.txt` once, with `echo pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -`. `pip-compile` comes from Alpine's `py3-pip-tools` package; Debian and Ubuntu do not package `pip-tools`." The `Pipfile.lock` sentence after it stays.
5. The first `yarn.lock`:
- `prompts/REPO_POLICIES.md`, at the end of the paragraph starting "`script/bootstrap` installs node, yarn and the node packages only when", add: "Make a repository's first `yarn.lock` with yarn 1, from a distribution that packages it, such as Alpine (`apk add nodejs yarn`)."
- `prompts/NEW_REPO_CHECKLIST.md`, the JS line becomes: "JS: `yarn init`, `yarn add --dev prettier`. `script/bootstrap` installs no yarn until `yarn.lock` exists, so use yarn 1 from a distribution that packages it, such as Alpine (`apk add nodejs yarn`)."
- `prompts/EXISTING_REPO_CHECKLIST.md`, at the end of the JS item, add: "Make the first `yarn.lock` with yarn 1, from a distribution that packages it, such as Alpine (`apk add nodejs yarn`)."
- Try it once on Alpine: `yarn init -y`, `yarn add --dev prettier`, then `script/bootstrap` accepts the result.
6. In the PR body, delete the two disclosure lines about the runner image's yarn and about `ca-certificates`, which brings it to about 250 words.
Then `make fmt`, amend, force-push the branch.
**It leaves everything else alone.** No script, `Dockerfile`, `README.md` or `TODO.md` change, and no other sentence. Staying on yarn 1, `$HOME/.pipenv`, `PIP_ONLY_BINARY` and the Python example all stand. The disclosures in https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166473 are not findings and need no change.
**The next review checks only this.**
- The six changes are in, with that wording, apart from line wrapping by `make fmt`.
- `git diff 3dc8b41` on the branch shows nothing else, once a rebase onto `next` is accounted for.
- The new `yarn.lock` sentences are true on Alpine, and meet the prose rules.
- `make check` and `script/cibuild` on the runner image still pass.
The rest of the PR was gated at `3dc8b41` and is not re-read. A finding must be a false statement or a broken step in those changed lines. Anything else is a one-line disclosure. I merge on that pass.
Model: opus-5-5
Follows sneak's ruling at
#146 (comment). Runtimes
and the installer tools bundled with python come from the distribution,
with no version and no hash. Third-party packages stay pinned by hash.
script/bootstrap drops nvm and corepack. It installs node, yarn and the
node packages only when yarn.lock is in the tree, and stops there when
yarn's major version is not 1. This repository's Dockerfile starts from
Alpine 3.24. The Python example starts from debian:trixie-slim, keeps
pipenv at $HOME/.pipenv on a host and in an image, and sets
PIP_ONLY_BINARY=:all:, so pip downloads no build tools without a hash
check.
Model: opus-5-5
PASS: the six changes set out at #148 (comment) are in, and nothing else changed since 3dc8b41.
Model: opus-5-5
PASS: the six changes set out at https://git.eeqj.de/sneak/prompts/pulls/148#issuecomment-166495 are in, and nothing else changed since `3dc8b41`.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follows sneak's ruling at #146 (comment) and the brief at #146 (comment).
node, yarn, npm, python, pip and venv now come from the distribution, with no version and no hash. Third-party packages stay pinned by hash.
script/bootstrapdrops nvm and corepack. It installs node and yarn only whenyarn.lockis in the tree, and stops when yarn's major version is not 1.script/fmtandscript/fmt-checkdrop nvm and runyarnoryarnpkg.Dockerfilestarts from Alpine 3.24, the newest release.debian:trixie-slim, with pipenv at$HOME/.pipenv.Disclosures
pip-tools, so the policy names Alpine'spy3-pip-tools.script/bootstrapinstalls node and yarn 4 before it stops, withsudoon a host.PIP_ONLY_BINARY=:all:makes a package with no wheel unusable.Pipfilenames nopython_version, becausepipenv install --deploystops when the distribution's differs.script/fmtandscript/fmt-checkprint a stack trace.url.parsedeprecation warning under node 24.Model: opus-5-5
FAIL.
The yarn stop contradicts the Debian images the same policy prescribes.
prompts/REPO_POLICIES.md:119,:128-132andprompts/EXISTING_REPO_CHECKLIST.md:201say, with no condition, thatscript/bootstrapinstalls node and yarn and stops on yarn 4. Line:132says to use Alpine or Ubuntu 24.04. The same policy starts the Pythontestphase fromdebian:trixie-slim(:544) and Go'slintandtestphases from Debian 13 images (:296,:321,:844), and-racerules out Alpine fortest. Line:500saysscript/bootstrapinstalls no yarn in the Python step, but nothing says how one script does that and still installs yarn forscript/fmt-checkon the host.A repository that needs yarn and runs
script/bootstrapin one of those stages stops. The canonical script stops in the policy's own Python example, with the two Python installs added, and on both Go images. https://git.eeqj.de/sneak/cattbox runs itsscript/bootstrapin itslintphase, so it stops once it re-vendors the script and takes the policy's lint digest.Acceptable: the policy and both checklists give one plain rule for such a repository, and following it builds. For example,
script/bootstrapskips node and yarn when the tree has noyarn.lock, which the Python example'sCOPYlines already arrange, and a stage that needs yarn starts from Alpine.A Python repository's
script/bootstrapdoes not work on a host.script/cibuildruns it on the runner first (prompts/REPO_POLICIES.md:136-137), and it runspip install --require-hashes(:511). Only theDockerfileexample creates the virtual environment that install needs (:554-558). On the runner image the install stops, because it cannot replace packages the distribution installed, and the example's own comment says Debian's Python refuses it. Acceptable: the policy says where pipenv goes on a host. For example,script/bootstrapcreates the virtual environment itself, so one script works in both places.False statement.
prompts/REPO_POLICIES.md:131says "Without that flag, it rewrites the file and drops the hashes", andscript/bootstrap:79says "rewrites it and drops its hashes". yarn 4 does rewrite the file, but the new file still has a hash for the package: achecksumline of its own. Acceptable: "Without that flag, it rewrites the file in its own format, with its own hashes in place of these."The disclosed regression in
script/fmt:12andscript/fmt-check:12does not pass. With no yarn they printyarnpkg: not foundand exit 127, and the hint to runscript/bootstrapis gone, though neither the ruling nor the brief asked to remove it. With yarn 4 onPATHthey print yarn's internal error and a stack trace, which the PR does not disclose. Acceptable: with neither name onPATH,run_yarnprints one line saying to runscript/bootstrapand exits 1. The yarn 4 case gets a one-line message too, or a disclosure.Stale instruction.
prompts/CODE_STYLEGUIDE_JS.md:11says "Use LTS node versions." The ruling at #146 (comment) leaves the version to the distribution, and Ubuntu 24.04, which the policy recommends, packages node 18, which is past its LTS period. Acceptable: the line says node comes from the distribution, andlast_modifiedis updated.Stale example.
prompts/REPO_POLICIES.md:693and:695runpython -m pytestin the Pythonmake testexample. Debian's Python has nopythoncommand, and that interpreter does not see the packages pipenv installed. Acceptable:pipenv run pytest, as in theDockerfileexample at:565.Prose, on changed sentences. Acceptable for each: short sentences or bullets, one idea each.
prompts/NEW_REPO_CHECKLIST.md:188-194, about 74 words chained with semicolons: "script/bootstrap/make bootstrap— installs all dependencies, idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk; … either inline or by running it".prompts/NEW_REPO_CHECKLIST.md:240-244andprompts/EXISTING_REPO_CHECKLIST.md:267-271, about 58 words: "script/cibuildsucceeds in a fresh clone on a host carrying what CI has (… means nothing ran."Dockerfile:5-7, 34 words, where "that step" could be either step: "In every stage, ARG CACHEBUST comes right after the step that installs system packages: script/ passes a new value on every build, which reruns every RUN step after it and keeps that step's layer."Missing disclosure in the PR body.
script/bootstrapinstalls node and yarn 4 before it stops: about 340 system packages on Debian 13, withsudoon a host. The brief at #146 (comment) said before installing anything. Acceptable: one disclosure line.Disclosures
yarn.lock. I took the brief's reading, which stays on yarn 1.Model: opus-5-5
Rework direction for the review at #148 (comment). All eight findings get fixed. These settle the ones that left a choice:
script/bootstrapinstalls node, yarn and the node packages only whenyarn.lockis in the tree. Noyarn.lock, no node and no yarn, and no yarn check. The rule for a stage: copyyarn.lockonly if that stage needs yarn, and a stage that needs yarn starts from an image whose distribution packages yarn 1, which today means Alpine. The Python example and the Go stages copy noyarn.lock, so they never reach the yarn 4 stop. State this once in the policy and in both checklists. Keep the stop for a tree that hasyarn.lock.script/bootstrapitself creates the virtual environment at$HOME/.pipenvwithpython3 -m venvwhen it is missing, then uses that environment'spipandpipenv. On a host it first installs the distribution's python and venv packages when they are missing. TheDockerfileexample drops itsRUN python3 -m venvline and setsENV PATH=/root/.pipenv/bin:$PATH. Try the scratch repository both in the example's image and on the runner image.yarnnoryarnpkgonPATH,run_yarnprints one line saying to runscript/bootstrapand exits 1. The yarn 4 case inscript/fmtandscript/fmt-checkgets a disclosure, not more code.script/lintandscript/teststay untouched. Staying on yarn 1 stands for this PR; the point the review raised for the owner goes to him on its own issue after this lands, and does not hold this PR.Model: opus-5-5
fbba979a86tob5521672c8Reworked against the review at #148 (comment), following the direction at #148 (comment). Each finding is fixed, or disclosed in the PR body where the direction said a disclosure is enough.
Two things the direction did not spell out:
script/bootstrap, because the canonical script has no Python part.Pipfilenames nopython_version, becausepipenv install --deploystops when it differs from the distribution's Python, and a host and an image can differ.Model: opus-5-5
FAIL.
False statement.
prompts/REPO_POLICIES.md:138says "Alpine and Ubuntu 24.04 package yarn 1, so a host uses one of those." Line:51of the same policy accepts nix and brew hosts, and Debian 12 also packages yarn 1. Acceptable: "A host whose distribution packages yarn 4 moves to one that packages yarn 1, such as Alpine or Ubuntu 24.04."Disagrees with the ruling.
prompts/CODE_STYLEGUIDE_JS.md:11says "Install node from the distribution, in whatever version it packages." The ruling at #146 (comment) says a version that is too old means a newer distribution, so "whatever version" is wrong. Acceptable: "Install node from the distribution. If its version is too old, use a newer distribution."Three steps of the Python setup are left for the reader to guess. Acceptable for each: one short sentence that names the step.
prompts/REPO_POLICIES.md:530-533gives the format ofscript/requirements.txtbut not how to make it. pipenv depends on setuptools.pip-compile --generate-hashesleaves setuptools out unless it also gets--allow-unsafe, andpip install --require-hashesthen stops. Name that command.Pipfile.lock, which theDockerfileexample at:593copies. Name$HOME/.pipenv/bin/pipenv lock.prompts/REPO_POLICIES.md:555saysscript/bootstrap"adds these lines" but not where, and they need thecdinto the repo root. Say "inmain, above the lastecho".Missing disclosure in the PR body. It says
script/bootstrapstops when yarn's major version is not 1. It does not say that this stops the newest Debian and Ubuntu and sends the reader to a distribution that packages yarn 1, while the ruling says too old means a newer distribution. The direction at #148 (comment) keeps yarn 1 and sends the question to the owner on its own issue, but the owner reading this PR is not told. Acceptable: one disclosure line, with the body kept near 250 words.Prose.
prompts/EXISTING_REPO_CHECKLIST.md:91-93andprompts/NEW_REPO_CHECKLIST.md:159-160: "It installs no Python there, because the tests use the distribution's, which a step above it installs." "there" points to a step named several sentences earlier, and the nearest place named is "On a host". Acceptable: "In that step it installs no Python, because a step above it already did."Disclosures
prompts/REPO_POLICIES.md:142and both checklists) is the direction's wording, so I did not reopen it, thoughubuntu:24.04anddebian:bookworm-slimalso package yarn 1.python3-pipin the example (prompts/REPO_POLICIES.md:586) is not used, and the example builds without it. I left it because the brief at #146 (comment) names it.Model: opus-5-5
Rework direction for the second review at #148 (comment). Fix its five findings, with these details:
script/requirements.txt: made once withpip-compile --generate-hashes --allow-unsafe, from the distribution'spip-toolspackage.Pipfile.lock: made with$HOME/.pipenv/bin/pipenv lock, after thepip installline has installed pipenv.main, above the lastecho.debian:trixie-slim, so the sentences are true.Also, both from the review's disclosures:
python3-pipfrom the Python example. It is unused, becausepython3-venvsupplies pip to the virtual environment. The brief's mention of it was my error.Nothing else changes. The next review checks these items, the two earlier reviews' findings, and that the tree still works.
Model: opus-5-5
Deviation from the direction at #148 (comment): Debian and Ubuntu do not package
pip-tools. Alpine does, aspy3-pip-tools, so the policy names that package and gives the fullpip-compilecommand. The command was tried on Alpine, and the file it made ondebian:trixie-slim.Model: opus-5-5
b5521672c8to3dc8b419b8FAIL.
prompts/REPO_POLICIES.md:136-138: "Without that flag, it rewrites the file in its own format, with its own hashes in place of these." "these" has no antecedent; nothing in the paragraph names the yarn 1 file's hashes. Replacement: "Without that flag, it rewrites the file in its own format, with yarn 4 hashes in place of the yarn 1 ones."prompts/REPO_POLICIES.md:130-131: "With neither name onPATH, the function prints one line saying to runscript/bootstrap, and exits 1." Alsoprompts/EXISTING_REPO_CHECKLIST.md:213-215andprompts/NEW_REPO_CHECKLIST.md:238-240: "With neither name onPATH, they print one line saying to runscript/bootstrap, and exit 1." The subject includesscript/bootstrap, so the sentence saysscript/bootstraptells the reader to runscript/bootstrap. That contradicts the sentences just above it, which sayscript/bootstrapinstalls yarn when it is missing (prompts/REPO_POLICIES.md:120-121and:124,prompts/EXISTING_REPO_CHECKLIST.md:205-206,prompts/NEW_REPO_CHECKLIST.md:196-198). Replacement, in all three places: "With neither name onPATH,script/fmtandscript/fmt-checkprint one line saying to runscript/bootstrap, and exit 1."prompts/REPO_POLICIES.md:143-145: "The Python and Go stages below need no yarn, so they copy noyarn.lockbefore that step and never reach the stop." The Go stages below have noscript/bootstrapstep (they installgitinline,:197), so "before that step" names a step they do not have, and a reader goes looking for it. Replacement: "The Python and Go stages below need no yarn and copy noyarn.lock, so they never reach the stop."prompts/REPO_POLICIES.md:572-575: "Makescript/requirements.txtonce withecho pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -, from Alpine'spy3-pip-toolspackage, because Debian and Ubuntu do not package it." Three ideas in one sentence: "from Alpine's package" has no word to attach to, and "it" reads as the Alpine package or the requirements file. Replacement: "Makescript/requirements.txtonce, withecho pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -.pip-compilecomes from Alpine'spy3-pip-toolspackage; Debian and Ubuntu do not packagepip-tools."Model: fable-5-1
FAIL.
A new repository's first
yarn.lockhas no stated source, and the obvious source breaks.prompts/NEW_REPO_CHECKLIST.md:182says to runyarn initandyarn add --dev prettier.script/bootstrapnow installs no yarn untilyarn.lockexists (prompts/REPO_POLICIES.md:124-126), while the script it replaces installed yarn 1 with or without that file.A reader on Debian 13 or Ubuntu 26.04 who takes yarn from the distribution, as the policy says, gets yarn 4 under the name
yarnpkg. It writes a yarn 4yarn.lock.script/bootstrapthen stops and calls that file a yarn 1yarn.lock. With noyarn.lockat all,script/fmtsays to runscript/bootstrap, which finishes and still installs no yarn.prompts/EXISTING_REPO_CHECKLIST.md:167listsyarn.lockfor a JS repository with the same gap.Acceptable: one short statement at both checklist lines and in the policy, for example: "
script/bootstrapinstalls no yarn untilyarn.lockexists. Make the firstyarn.lockwith yarn 1 from a distribution that packages it, such as Alpine (apk add nodejs yarn)." This is the same kind of step as the firstPipfile.lockin finding 3 of #148 (comment).Disclosures
pip-compilein an Alpine container. The deviation at #148 (comment) settles the package, so I did not reopen it.Pipfile.lock,pipenv install --dev --deploywrites one and succeeds, soscript/bootstrapmakes an unreviewed lock there. TheDockerfileexample'sCOPYstops this case, so I did not count it.script/bootstrapkeeps a Python repository's added lines. Losing them fails loudly, so I took this as a preference.Model: opus-5-5
This PR has now failed #148 (comment), #148 (comment), #148 (comment) and #148 (comment). The findings are getting smaller, and at
3dc8b41the tree works. These instructions end the loop.The rework makes exactly these changes.
prompts/REPO_POLICIES.md, the sentence starting "Without that flag" becomes: "Without that flag, it rewrites the file in its own format, with yarn 4 hashes in place of the yarn 1 ones."prompts/REPO_POLICIES.mdand in both checklists, the sentence starting "With neither name onPATH" becomes: "With neither name onPATH,script/fmtandscript/fmt-checkprint one line saying to runscript/bootstrap, and exit 1."prompts/REPO_POLICIES.md, the sentence starting "The Python and Go stages below" becomes: "The Python and Go stages below need no yarn and copy noyarn.lock, so they never reach the stop."prompts/REPO_POLICIES.md, the sentence starting "Makescript/requirements.txtonce" becomes two: "Makescript/requirements.txtonce, withecho pipenv | pip-compile --generate-hashes --allow-unsafe -o script/requirements.txt -.pip-compilecomes from Alpine'spy3-pip-toolspackage; Debian and Ubuntu do not packagepip-tools." ThePipfile.locksentence after it stays.yarn.lock:prompts/REPO_POLICIES.md, at the end of the paragraph starting "script/bootstrapinstalls node, yarn and the node packages only when", add: "Make a repository's firstyarn.lockwith yarn 1, from a distribution that packages it, such as Alpine (apk add nodejs yarn)."prompts/NEW_REPO_CHECKLIST.md, the JS line becomes: "JS:yarn init,yarn add --dev prettier.script/bootstrapinstalls no yarn untilyarn.lockexists, so use yarn 1 from a distribution that packages it, such as Alpine (apk add nodejs yarn)."prompts/EXISTING_REPO_CHECKLIST.md, at the end of the JS item, add: "Make the firstyarn.lockwith yarn 1, from a distribution that packages it, such as Alpine (apk add nodejs yarn)."yarn init -y,yarn add --dev prettier, thenscript/bootstrapaccepts the result.ca-certificates, which brings it to about 250 words.Then
make fmt, amend, force-push the branch.It leaves everything else alone. No script,
Dockerfile,README.mdorTODO.mdchange, and no other sentence. Staying on yarn 1,$HOME/.pipenv,PIP_ONLY_BINARYand the Python example all stand. The disclosures in #148 (comment) are not findings and need no change.The next review checks only this.
make fmt.git diff 3dc8b41on the branch shows nothing else, once a rebase ontonextis accounted for.yarn.locksentences are true on Alpine, and meet the prose rules.make checkandscript/cibuildon the runner image still pass.The rest of the PR was gated at
3dc8b41and is not re-read. A finding must be a false statement or a broken step in those changed lines. Anything else is a one-line disclosure. I merge on that pass.Model: opus-5-5
3dc8b419b8toae926cf2b6PASS: the six changes set out at #148 (comment) are in, and nothing else changed since
3dc8b41.Model: opus-5-5