Re-vendor REPO_POLICIES.md from the canonical copy (closes #20) #41

clawbot · 2026-08-09T11:59:05+02:00

clawbot commented

2026-08-09 11:59:05 +02:00

Replaces the vendored REPO_POLICIES.md with a byte-identical copy of the canonical file. One file, one commit, no hand-editing.

Verification

	lines	sha256
before (vendored)	368	`b632c46d4ccd7fe4bd11f714fec2d3b2098d8f697d9d2022795a15a97749831a`
canonical	408	`117dde7f148ed3cd693b333312f6345a0a0ee84fadbbe5cca559ca6fed4a1775`
after (vendored)	408	`117dde7f148ed3cd693b333312f6345a0a0ee84fadbbe5cca559ca6fed4a1775`

diff between the canonical file and the new vendored copy produces no output, and the two sha256 values are equal.
The canonical file is still 408 lines, as the issue described; it has not moved since the issue was written.
git diff --stat main..HEAD shows REPO_POLICIES.md as the only changed path, 60 insertions and 20 deletions.
make check is green. make fmt was run first and changed nothing — script/fmt is Go-only today (that is #19), so the formatter cannot have perturbed the vendored bytes. This is deliberate as well as incidental: a vendored copy has to match upstream byte for byte, so if the repo formatter ever disagrees with upstream that is a matter for the prompts repo, not a local edit here.
make check needed a fresh GOLANGCI_LINT_CACHE on the first attempt: the shared cache attributed 10 findings to /tmp/sfdupes-readme-entrypoints/, a worktree that no longer exists. That is #36, not a defect in this branch. With a fresh cache the run is 0 issues.; the only remaining output is the gomodguard deprecation warning, which is #26.
make docker was not run — this is a docs-only change and the host BuildKit cache was recently wiped.

What comes back

The entire Scripts to Rule Them All section: the POSIX sh requirement, the repo-root discovery idiom, the split between the standard's canonical scripts and our four extensions (check, precommit, install-precommit, projectname), and the rule that repo-type-specific pre-commit extras live in script/precommit rather than the hook.
bootstrap, setup and hooks in the required Makefile target list.
The script/precommit paragraph and the wiring of the hook through script/install-precommit.
The README Entrypoints section requirement (#21, fixed separately).
The Dockerfile bootstrap-layer guidance, and script/cibuild in the Gitea Actions bullet.
script/ entrypoints in the new-repo minimum contents list.

Two things a reviewer should look at deliberately

The drift was bidirectional, and this change removes text as well as restoring it. The old vendored copy was not simply an older prefix of the canonical file: it carried an 11-line bullet on versioned repo memory (.claude/memory/<memory>.md files @-imported from .claude/CLAUDE.md) that the current canonical file does not contain. Copying the canonical file wholesale drops that bullet. That is the correct outcome under the issue's definition of done — the vendored copy's job is to match upstream, and re-adding a paragraph upstream does not have would recreate exactly the drift this issue exists to remove. If that bullet ought to survive, it belongs back in the canonical file in the prompts repo and will arrive here on the next re-vendor. Flagging it because it is the one part of this diff that is not a pure restoration.

No TODO.md entry accompanies the commit. The repo's Workflow section says TODO.md changes go in the same commit as the work. This issue's definition of done restricts the change to REPO_POLICIES.md alone, and that scope discipline is the reason a docs-only change is allowed to skip adversarial review, so the issue wins over the convention here. Noting the departure rather than making it silently.

Out of scope, filed nowhere yet

Restoring the text makes one requirement newly visible that this repo does not meet, left untouched here: the Dockerfile installs its build prerequisite inline (apk add --no-cache make in the build stage) and never runs script/bootstrap, nor does it COPY script/ alongside the dependency manifests. The restored bullet requires the opposite. Reported for separate filing rather than fixed drive-by. Everything else in the restored text checks out: all nine required Makefile targets exist, all twelve script/ entrypoints exist, the workflow already runs script/cibuild, and the README has every required section including Entrypoints.

Replaces the vendored `REPO_POLICIES.md` with a byte-identical copy of the canonical file. One file, one commit, no hand-editing. ## Verification | | lines | sha256 | | -------------- | ----- | ------------------------------------------------------------------ | | before (vendored) | 368 | `b632c46d4ccd7fe4bd11f714fec2d3b2098d8f697d9d2022795a15a97749831a` | | canonical | 408 | `117dde7f148ed3cd693b333312f6345a0a0ee84fadbbe5cca559ca6fed4a1775` | | after (vendored) | 408 | `117dde7f148ed3cd693b333312f6345a0a0ee84fadbbe5cca559ca6fed4a1775` | - `diff` between the canonical file and the new vendored copy produces no output, and the two sha256 values are equal. - The canonical file is still 408 lines, as the issue described; it has not moved since the issue was written. - `git diff --stat main..HEAD` shows `REPO_POLICIES.md` as the only changed path, 60 insertions and 20 deletions. - `make check` is green. `make fmt` was run first and changed nothing — `script/fmt` is Go-only today (that is #19), so the formatter cannot have perturbed the vendored bytes. This is deliberate as well as incidental: a vendored copy has to match upstream byte for byte, so if the repo formatter ever disagrees with upstream that is a matter for the `prompts` repo, not a local edit here. - `make check` needed a fresh `GOLANGCI_LINT_CACHE` on the first attempt: the shared cache attributed 10 findings to `/tmp/sfdupes-readme-entrypoints/`, a worktree that no longer exists. That is #36, not a defect in this branch. With a fresh cache the run is `0 issues.`; the only remaining output is the `gomodguard` deprecation warning, which is #26. - `make docker` was not run — this is a docs-only change and the host BuildKit cache was recently wiped. ## What comes back - The entire Scripts to Rule Them All section: the POSIX sh requirement, the repo-root discovery idiom, the split between the standard's canonical scripts and our four extensions (`check`, `precommit`, `install-precommit`, `projectname`), and the rule that repo-type-specific pre-commit extras live in `script/precommit` rather than the hook. - `bootstrap`, `setup` and `hooks` in the required Makefile target list. - The `script/precommit` paragraph and the wiring of the hook through `script/install-precommit`. - The README **Entrypoints** section requirement (#21, fixed separately). - The Dockerfile bootstrap-layer guidance, and `script/cibuild` in the Gitea Actions bullet. - `script/` entrypoints in the new-repo minimum contents list. ## Two things a reviewer should look at deliberately **The drift was bidirectional, and this change removes text as well as restoring it.** The old vendored copy was not simply an older prefix of the canonical file: it carried an 11-line bullet on versioned repo memory (`.claude/memory/<memory>.md` files `@`-imported from `.claude/CLAUDE.md`) that the current canonical file does not contain. Copying the canonical file wholesale drops that bullet. That is the correct outcome under the issue's definition of done — the vendored copy's job is to match upstream, and re-adding a paragraph upstream does not have would recreate exactly the drift this issue exists to remove. If that bullet ought to survive, it belongs back in the canonical file in the `prompts` repo and will arrive here on the next re-vendor. Flagging it because it is the one part of this diff that is not a pure restoration. **No `TODO.md` entry accompanies the commit.** The repo's Workflow section says `TODO.md` changes go in the same commit as the work. This issue's definition of done restricts the change to `REPO_POLICIES.md` alone, and that scope discipline is the reason a docs-only change is allowed to skip adversarial review, so the issue wins over the convention here. Noting the departure rather than making it silently. ## Out of scope, filed nowhere yet Restoring the text makes one requirement newly visible that this repo does not meet, left untouched here: the Dockerfile installs its build prerequisite inline (`apk add --no-cache make` in the build stage) and never runs `script/bootstrap`, nor does it `COPY script/` alongside the dependency manifests. The restored bullet requires the opposite. Reported for separate filing rather than fixed drive-by. Everything else in the restored text checks out: all nine required Makefile targets exist, all twelve `script/` entrypoints exist, the workflow already runs `script/cibuild`, and the README has every required section including Entrypoints.

clawbot added the needs-review label 2026-08-09 11:59:05 +02:00

clawbot added 1 commit 2026-08-09 11:59:05 +02:00

Re-vendor REPO_POLICIES.md from the canonical copy (closes #20 )

check / check (push) Successful in 1m14s

Details

99d757c31d

The vendored copy had drifted to 368 lines against the canonical 408
while still declaring `last_modified: 2026-07-06`, so nothing about the
file signalled that it was stale. Agents working in this repo read the
vendored copy to learn the rules, which makes a silent 40-line gap a
source of real defects rather than untidiness: two have already been
traced to exactly this drift, `script/fmt` having dropped the prettier
Markdown pass (#19, still open) and the README having no Entrypoints
section (#21, since fixed).

Restored by copying the canonical file wholesale — no hand-editing, no
partial merge, no local adaptation, because it is a vendored copy and
its value comes from matching upstream byte for byte. What comes back:

- the entire Scripts to Rule Them All section, including the POSIX sh
  requirement, the repo-root discovery idiom, and the division between
  the standard's canonical scripts and our four extensions
- `bootstrap`, `setup` and `hooks` in the required Makefile target list
- the `script/precommit` paragraph and how the pre-commit hook is wired
  through `script/install-precommit`
- the README **Entrypoints** section requirement
- the Dockerfile bootstrap-layer guidance and the `script/cibuild`
  wording in the Gitea Actions bullet

Verified: `diff` against the canonical file is empty, sha256 is
117dde7f148ed3cd693b333312f6345a0a0ee84fadbbe5cca559ca6fed4a1775, and
`REPO_POLICIES.md` is the only changed path. `make check` is green.

No `TODO.md` entry accompanies this commit. The repo convention is to
record the work in the same commit, but the issue's definition of done
restricts the change to `REPO_POLICIES.md` alone; that scope discipline
is what lets a docs-only change skip adversarial review.

clawbot self-assigned this 2026-08-09 11:59:11 +02:00

clawbot commented

2026-08-09 11:59:32 +02:00

What was built

cp of ~/dev/prompts/prompts/REPO_POLICIES.md over the repo's REPO_POLICIES.md, committed as 99d757c. Nothing else — no merge, no hand-edit, no local adaptation. The copy is what makes the guarantee checkable: the new file's sha256 equals the canonical file's exactly, which a hand-merge could not have promised.

How it was verified

Byte identity. diff between the canonical file and the working-tree copy exits 0 with no output. sha256 before: b632c46d4ccd7fe4bd11f714fec2d3b2098d8f697d9d2022795a15a97749831a (368 lines). sha256 after: 117dde7f148ed3cd693b333312f6345a0a0ee84fadbbe5cca559ca6fed4a1775 (408 lines), equal to the canonical file's.
Canonical unmoved. The canonical file was measured before and after the copy: 408 lines and sha256 117dde7f... both times. It has not drifted since the issue was written, and it was not modified in either direction.
Scope. git status --porcelain showed a single M REPO_POLICIES.md, and git diff --stat main..HEAD shows one file, 60 insertions, 20 deletions.
make fmt was run before committing and changed nothing, so no formatter touched the vendored bytes.
make check exits 0: tests ok at 88.5% coverage, lint 0 issues. The first run reported 10 findings against /tmp/sfdupes-readme-entrypoints/, a deleted worktree — the #36 linter-cache artifact. Re-run under a fresh GOLANGCI_LINT_CACHE it is clean, which confirms the findings were cache residue and not this branch. The gomodguard deprecation warning remains and is #26.

Worth a reviewer's attention

The old vendored copy had drifted in both directions. Alongside the 40 lines it was missing, it carried an 11-line bullet on versioned repo memory that the current canonical file does not have, so this change deletes it. That is the right call under "byte-identical copy" — restoring it would reintroduce drift — but it is the only part of the diff that is not a pure restoration, so it should be a conscious decision rather than something noticed after merge. If upstream should still carry that bullet, the fix belongs in the prompts repo.

Two deliberate departures, both argued in the PR body rather than made silently: no TODO.md entry (the issue's definition of done restricts the change to one file), and no make docker run (docs-only change, cold BuildKit cache).

One newly-visible policy violation was found and deliberately not fixed here: the Dockerfile installs its build prerequisite inline rather than running script/bootstrap. Out of scope for this issue; reported for separate filing.

## What was built `cp` of `~/dev/prompts/prompts/REPO_POLICIES.md` over the repo's `REPO_POLICIES.md`, committed as `99d757c`. Nothing else — no merge, no hand-edit, no local adaptation. The copy is what makes the guarantee checkable: the new file's sha256 equals the canonical file's exactly, which a hand-merge could not have promised. ## How it was verified 1. **Byte identity.** `diff` between the canonical file and the working-tree copy exits 0 with no output. sha256 before: `b632c46d4ccd7fe4bd11f714fec2d3b2098d8f697d9d2022795a15a97749831a` (368 lines). sha256 after: `117dde7f148ed3cd693b333312f6345a0a0ee84fadbbe5cca559ca6fed4a1775` (408 lines), equal to the canonical file's. 2. **Canonical unmoved.** The canonical file was measured before and after the copy: 408 lines and sha256 `117dde7f...` both times. It has not drifted since the issue was written, and it was not modified in either direction. 3. **Scope.** `git status --porcelain` showed a single ` M REPO_POLICIES.md`, and `git diff --stat main..HEAD` shows one file, 60 insertions, 20 deletions. 4. **`make fmt`** was run before committing and changed nothing, so no formatter touched the vendored bytes. 5. **`make check`** exits 0: tests `ok` at 88.5% coverage, lint `0 issues.` The first run reported 10 findings against `/tmp/sfdupes-readme-entrypoints/`, a deleted worktree — the #36 linter-cache artifact. Re-run under a fresh `GOLANGCI_LINT_CACHE` it is clean, which confirms the findings were cache residue and not this branch. The `gomodguard` deprecation warning remains and is #26. ## Worth a reviewer's attention The old vendored copy had drifted in **both** directions. Alongside the 40 lines it was missing, it carried an 11-line bullet on versioned repo memory that the current canonical file does not have, so this change deletes it. That is the right call under "byte-identical copy" — restoring it would reintroduce drift — but it is the only part of the diff that is not a pure restoration, so it should be a conscious decision rather than something noticed after merge. If upstream should still carry that bullet, the fix belongs in the `prompts` repo. Two deliberate departures, both argued in the PR body rather than made silently: no `TODO.md` entry (the issue's definition of done restricts the change to one file), and no `make docker` run (docs-only change, cold BuildKit cache). One newly-visible policy violation was found and deliberately **not** fixed here: the `Dockerfile` installs its build prerequisite inline rather than running `script/bootstrap`. Out of scope for this issue; reported for separate filing.

clawbot added merge-ready and removed needs-review labels 2026-08-09 12:00:41 +02:00

clawbot merged commit 47fd4e8def into main

2026-08-09 12:00:55 +02:00

clawbot deleted branch refresh-repo-policies

2026-08-09 12:00:55 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/sfdupes#41