diff --git a/knowledge/index.md b/knowledge/index.md index 5aa2ea308..ce52d4691 100644 --- a/knowledge/index.md +++ b/knowledge/index.md @@ -2,6 +2,70 @@ Master catalog of all wiki pages, organized by type. +Catalog refreshed 2026-10-18: [[bfra-me--renovate-action]] (repo) and +[[github-actions-ci]] (topic). Existing catalog entries remain historical +snapshots; the canonical ingest record is in `knowledge/log.md`. + +Same-day catalog follow-up: [[bfra-me--renovate-action]] (repo) and +[[github-actions-ci]] (topic) retain their entries above and below; the appended +ingest record is in `knowledge/log.md`. + +Catalog refreshed 2026-10-15: [[marcusrbrown--extend-vscode]] (repo) and +[[vscode-extensions]] (topic). Existing catalog descriptions are historical +snapshots; the pages carry newer dated contracts. The canonical ingest record +is in `knowledge/log.md`. + +2026-10-15 oversight: [[github-actions-ci]] separates trusted-ingress health, +exact contract parity, and authenticated rollout acceptance, and records the +migration-crossing condition for volume recovery. Earlier dated observations +and existing catalog entries remain intact. + +Catalog refreshed 2026-10-14: [[bfra-me--ha-addon-repository]] (repo) and +[[docker-containers]] (topic). Both existing entries and dated observations +are retained; the canonical ingest record is in `knowledge/log.md`. + +2026-10-14 oversight: [[fro-bot--dashboard]] records released contract 1.11.0 +versus consumer/live 1.9.0, closed-set summary parsing as a separate adoption +gate, and healthy running-image evidence versus the older infrastructure ledger. +Earlier dated observations and existing catalog entries remain intact. + +Catalog refreshed 2026-10-13: [[marcusrbrown--sparkle]] (repo) and +[[github-actions-ci]] (topic). Existing catalog entries and dated evidence +are retained; the canonical ingest record is in `knowledge/log.md`. + +Catalog refreshed 2026-10-12: [[marcusrbrown--marcusrbrown-github-io]] (repo) +and [[github-pages]] (topic). Existing entries remain; the canonical ingest +summary is in `knowledge/log.md`. + +2026-10-12 oversight: [[fro-bot--dashboard]] records latest released contracts +1.10.0 versus 1.9.0, unchanged live health 1.9.0, successful actual deploy jobs, +and dashboard deployment-target versus infrastructure-ledger drift. Earlier +dated observations and catalog entries are preserved. + +Catalog refreshed 2026-10-11: [[marcusrbrown--renovate-config]] (repo) and +[[github-actions-ci]] (topic). Existing catalog entries and dated evidence +are retained; the canonical ingest record is in `knowledge/log.md`. + +2026-10-11 later oversight: [[fro-bot--dashboard]] adds successful gateway and +dashboard deployment-job readbacks, current infrastructure pins, and live health +contract 1.9.0. The earlier pending/1.8.0 snapshot remains historical evidence; +authenticated production acceptance is still unverified. + +2026-10-11 oversight: [[fro-bot--dashboard]] distinguishes released contract +1.9.0 from live health 1.8.0, records six issue-body/Project state mismatches, +and preserves the pending-deploy and older audit-ledger evidence boundaries. +Earlier dated observations and existing catalog entries remain intact. + +Catalog refreshed 2026-10-10: [[marcusrbrown--opencode-copilot-delegate]] +(repo) and [[opencode-plugins]] (topic). Existing entries and dated evidence +are retained; the canonical ingest record is in `knowledge/log.md`. + +2026-10-10 oversight: [[github-actions-ci]] records the merged thirteen-proposal +codification recovery and distinguishes the new drafting workflow's empty-queue +run from verified drafting/publication. [[fro-bot--dashboard]] records a third +source-state mismatch and separates successful deployment from a pending audit +pin and live image verification. Existing entries and dated evidence are retained. + Catalog refreshed 2026-10-10: [[marcusrbrown--github]] (repo) and [[probot-settings]] (topic). Both existing catalog entries and dated evidence are retained; the canonical ingest record is in `knowledge/log.md`. @@ -102,10 +166,10 @@ retains its Fro Bot workflow (agent v0.116.0), and [[docker-containers]] records the scripts-only build-trigger/matrix mismatch. Historical PR and image-state claims were not re-checked in this pass. -2026-09-26: [[marcusrbrown--panthe-ai]] added; [[github-actions-ci]] records +2026-09-26: [[marcusrbrown--panthea]] added; [[github-actions-ci]] records the absence of workflows at its unchanged 2023 founding commit. -2026-09-26 re-survey: [[marcusrbrown--panthe-ai]] advanced from that placeholder +2026-09-26 re-survey: [[marcusrbrown--panthea]] advanced from that placeholder to a Bun/Tauri simulation scaffold at `e5022aa`; [[github-actions-ci]] now records a two-job CI workflow, while the Fro Bot workflow remains absent. @@ -152,7 +216,7 @@ The repo entry below retains the accumulated history. - [[marcusrbrown--marcusrbrown-github-io]] — Marcus's developer portfolio (React 19, TypeScript 5.9.3, Vite 7.3.6, GitHub Pages at mrbro.dev, advanced theme system, single-file Fro Bot at agent **v0.93.1** SHA-pinned `a4976f4`); override ledger single-source in `pnpm-workspace.yaml` (~24 GHSA-annotated entries + `auditConfig.ignoreGhsas`, `pnpm audit` CI gate). Surveyed via the `marcusrbrown.github.io` name binding (id `1174807412`). 2026-08-01 survey (`main` `aa23250` → `9e54dbc`, `fix(analytics): preserve umami pageview context (#257)`): **privacy-preserving, fail-closed Umami analytics subsystem** (#256/#257) — self-hosted collector at `metrics.fro.bot` (an [[marcusrbrown--infra]] app), disabled-by-default via a step-scoped `UMAMI_WEBSITE_ID` build var (unset → no tracker in prod), human activation gate blocked on version-controlled [[marcusrbrown--infra]] retention evidence (`docs/analytics.md` Go/No-Go runbook), typed bounded 7-family event catalog, DNT suppression + query/hash exclusion + monthly-rotating one-way visitor hash, new `/privacy` page, CSP-safe `public/scripts/{spa-redirect,spa-restore,theme-preloader}.js` bootstraps replacing removed `src/utils/theme-preloader.ts`; textbook no-unconsented-telemetry application. Open issues 4 (#259/#258/#212/#1). Prior 2026-07-30 (`aa23250`): **front-of-house UI/UX polish + build-time-snapshot delivery shift** (#240–#251) — mobile nav hit-target fix loop, footer redesigned as structured "site-close" (#244, likely closes long-open #213 footer-landmark a11y bug), `/projects` build-time snapshot (#243), custom social previews w/ PNG fallback (#242), blog-refresh now delivers via PR not direct push (#240). Prior 2026-07-28 (`345bc21`): **Fro Bot workflow architecture delta** — `fro-bot.yaml` collapsed its two crons (`30 3` autoheal / `30 15` maintenance) into a **single daily `30 3` oversight+autoheal pass (#234)**, dropped the `maintenance` dispatch mode, added a `live-audit` mode with dedicated preflight/discovery/reporter jobs + `live-audit-slot` input; scheduled autoheal now authenticates its git push (#236); blog gist reads use a dedicated PAT (#238). Stack steady (RR7.15 / TS 5.9.3 / Vite 7.3.6 / Vitest 4.1.10 / Playwright 1.61.1 / pnpm 11.1.3 / Node >=24), agent v0.93.1, 8 workflows, Renovate #5.2.7, `pnpm.overrides` empty. No `gh` auth (unauthenticated API + raw fetch). Prior 2026-07-26 (`2643703`): **pnpm 10 → 11 major crossing** (Node engine `>=24.0.0`), split-brain override ledger resolved, GitHub Pages / Git LFS fix (`.gitattributes` exempts `public/project-previews/*.png`) + committed real-blob PNGs; prior 2026-07-25 (`0b31ea7`): Impeccable design gate vendored in-repo as `.opencode/impeccable/` OpenCode plugin - [[marcusrbrown--mothership]] — Multimodal agentic IDE: Tauri v2 desktop app (React 19 + TypeScript webview, Rust core) rendering a directory-routed `opencode serve` workspace as a dockview panel layout; a **renderer for the bus** ([[fro-bot--space-bus]] is the control plane, `opencode serve` owns all agent state). Exposes its own layout as `ide_*` MCP tools (loopback + per-launch bearer-token rendezvous, `0600` file) for structural dogfooding; Bun + Biome + zod + Impeccable design gate; localhost-only, no-embedded-LLM, tokens-only invariants; `node_id R_kgDOTOX0_A`. 2026-09-08 survey (HEAD `8895732`): **first real feature interval since inception** — 9 commits, 7 bot bumps and **two `marcusrbrown` `feat` PRs totaling 86 files / ~27k added lines**, both in the final 48 h. (1) **`ide_*` surface doubled 8 → 17** (#100): new `src/ide/` tree + 9 session-control tools (`ide_list_projects` … `ide_answer_question`), AGENTS.md adding a falsifiable **standing dogfood check** (an agent on `ide_*` alone must, mid-task, rearrange layout, discover project/session, dispatch, read transcript, answer a pending question); README documents the **limit of its own redaction** — transcript text crosses verbatim, explicitly "treat as untrusted." (2) **`src/planning/` lands contract-first** (#102) with two `docs/architecture/` contracts that open by enumerating what is *not* built ("successful parsing establishes syntax only … the current runtime does not emit these proposed reports") and a refusal clause keeping publication unavailable absent a proven guarantee — the inverse of reading a green schema test as a shipped capability. (3) **Cross-repo:** the host contract documents an **MCP agent-principal handoff gap** in [[fro-bot--agent]]'s runtime (`McpCatalog.convertTool` sends no principal; clients keyed by server name, not session ⇒ a shared connection cannot separate differently-authorized sessions), plus the rule that npm `gitHead` names the *wrapper* tree, not the runtime tree — both cataloged in [[opencode-plugins]]. (4) **Three-survey "majors never move" thread ROOT-CAUSED and the prior hypothesis superseded:** `dependencyDashboardApproval` parks **11 update branches — majors *and* the entire non-major group** — behind unchecked checkboxes on issue #9, so **0 open PRs means blocked, not clean**; hides `bfra-me/.github@v4.16.37` (fleet v4.26.0), preset `#5.2.4` (fleet `#5.2.13`), Bun 1.3.14, and `checkout v6.0.3` in 4 of 8 workflows vs `v7.0.0` in 3. (5) **space-bus 0.14.0 → 0.15.0** hand-carried in #100, with Renovate autoclosing its own 50-day-old #45 **126 s later** — the benign inverse of [[bfra-me--ha-addon-repository]] #556 (same API signature, opposite meaning: check the manifest, not the PR state). (6) **Third confirmation of the working-dir delivery defect**, and the first time an agent caught it itself — the daily report proves via `git log` that its 09-06 and 09-07 reports claimed CodeQL fixes that never landed, applies them, then stages them for a caller half that does not exist; validates the prescribed re-read rule and proves it insufficient. (7) **The single-report contract converges here** (61 reports ever, exactly 1 open) because its predicate is a title prefix, not [[marcusrbrown--infra]]'s mutable-label AND. (8) Release pipeline gained **`attest` (SLSA provenance) + `publish-draft` + dual-target build matrix**; sidecar became a compiled `externalBin` with its own entitlements, enforced by a **byte-inequality diff check** in CI. (9) **AGENTS.md invariants 8 → 9** (release-secret isolation; addition, not revision). (10) Security counts **declared by Fro Bot, 403 to this survey's token** (1 dismissed Dependabot, 18 workflow CodeQL alerts, 17 untriaged RUSTSEC, non-constant-time bearer compare deliberately deferred); 1190 tests / 57 files. Open issues 7 → 3, open PRs 0, subscribers 1 → 0, **tags/releases still 0/0** (third release drought survey), community health 57% (no `CONTRIBUTING.md`/`SECURITY.md`). Prior 2026-08-22 (`739f230`): **no structural change in ~1 month** — 8-workflow surface, signed/notarized macOS release pipeline, `ide_*` sidecar, dockview model, Changesets/`version.yml`, script-driven release settings, all 8 AGENTS.md invariants durable (steady-state). Sole substantive commit: Fro Bot agent `v0.95.0 → v0.100.0` (#58, ecosystem version leader); manifest pins byte-identical (TS 5.8.3, Vite 7.3.6, Biome 1.9.4, space-bus 0.14.0, MCP SDK 1.29.0, zod ^4.4.3, dockview ^7.0.2) except types-only bumps; CodeQL `@v4.37.0`, Scorecard `@v2.4.3`, Renovate `#5.2.4`, Bun 1.3.14. Open issues 6→7. **Renovate live ~1 month but TS6/Biome2 sweep untouched** and **space-bus 0.15.0 available but pin held at 0.14.0**; still no Probot Settings; Rust CodeQL deferred; no `v*.*.*` tag yet (still `0.1.0`). Prior 2026-07-21 (`e7e305f`): CI/CD + release-engineering maturation, workflows 2→8 (release.yaml signed/notarized macOS pipeline, version.yml, renovate/codeql/scorecard/dependency-review), Renovate onboarded, space-bus 0.7.0→0.14.0, agent v0.83.1→v0.93.1. Prior 2026-07-06 (`48bd14a`): initial survey, tracer-stage, Fro Bot present, no Renovate/Probot/CodeQL - [[marcusrbrown--opencode-copilot-delegate]] — OpenCode plugin: delegate tasks to GitHub Copilot CLI as background subprocesses; **v0.12.1** with 4 tools (delegate/output/cancel/resume), opt-in `/copilot-status` TUI half, orphan-subprocess reaper with PID-file identity gate, per-process plugin singleton, localhost RPC layer. 2026-08-25 survey (HEAD `c6c055d`): **v0.12.1 held (5th straight steady-release survey), no source-tree/tool change** — pure dependency-churn + autoheal window, every commit `mrbro-bot[bot]` Renovate automerge. **Bun 1.3.14 → 1.4.0** (first Bun-minor crossing in series), Biome 2.5.4 → **2.5.9**, `@opencode-ai/plugin` 1.18.4 → **1.18.19**, `@github/copilot` CLI 1.0.73 → **1.0.80**, `solid-js` → **1.9.15**, `bfra-me/.github` reusable → **v4.19.0**, Fro Bot agent **v0.94.2 → v0.105.0** (SHA `335e4f8`, crosses cosmetic v0.100); new devDeps `@types/bun`/`@types/babel__core`; TS 7.0.2/`@types/node` 24.13.3/zod ^4.3.0/`@opentui/*` runtime 0.2.7 unchanged. **New fro-bot autoheal PR #335** adopts stale Renovate `@opentui/*` 0.4.x → **0.4.5** with an `overrides.@opentui/core` single-root-type-identity pin (same class as the zod TS2883 fix, cataloged in [[opencode-plugins]]); Biome schema-vs-CLI chase continues (#302 resolved → #332 targets 2.5.8 → #377 queues 2.5.10). Open count steady at 9. Prior 2026-07-24 (`61bc146`): v0.12.0 → v0.12.1, orphan terminal-state registration guard, TS 6 → 7 major, `@opentui/*` 0.2.6 → 0.2.7 -- [[marcusrbrown--panthe-ai]] — Public MIT-licensed Panthea project, a local-first mythological-character simulation. **2026-09-26 re-survey at `e5022aa` supersedes the earlier three-file `f0c4ff0` placeholder snapshot:** Bun 1.4.2 workspace with React/Three.js/Three Flatland client, Tauri 2.12.0 Rust shell, simulation package, eight supporting packages, three tools, and planning docs; implementation is in progress from M0. `ci.yaml` checks Bun type/lint/tests on Ubuntu and Rust fmt/clippy on macOS. WKWebView probe README reports WebGPU unavailable on an unsigned macOS test host, so WebGL2 remains the documented baseline. **No Fro Bot workflow** at either commit. +- [[marcusrbrown--panthea]] — Public MIT-licensed Panthea project, a local-first mythological-character simulation. **2026-09-26 re-survey at `e5022aa` supersedes the earlier three-file `f0c4ff0` placeholder snapshot:** Bun 1.4.2 workspace with React/Three.js/Three Flatland client, Tauri 2.12.0 Rust shell, simulation package, eight supporting packages, three tools, and planning docs; implementation is in progress from M0. `ci.yaml` checks Bun type/lint/tests on Ubuntu and Rust fmt/clippy on macOS. WKWebView probe README reports WebGPU unavailable on an unsigned macOS test host, so WebGL2 remains the documented baseline. **No Fro Bot workflow** at either commit. - [[marcusrbrown--presentations]] — Two-deck archive: CRA/Spectacle with Yarn and Slidev with Bun, assembled into one Pages artifact. 2026-10-02 bounded survey: shared workflows v4.35.0, Node 20.20.2, Bun runtime not explicitly version-pinned; builds both decks but tests only CRA. No Fro Bot workflow. Related [[github-pages]] distinguishes dependency locks, runtime pins, and assembled-site validation. - [[marcusrbrown--renovate-config]] — Shareable Renovate configuration presets: canonical dependency-update policy for all `marcusrbrown/*` and `fro-bot/*` repos; v5.2.3 (v4→v5 boundary crossed 2026-05-13 with `group:allNonMajor` + 0.x ungrouping safety valve); 2026-06-25 survey (HEAD `561289f`): preset policy unchanged (bfra-me base pin holds `#5.2.3`), Fro Bot agent jumped v0.63.0 → v0.76.2 (crosses agent's pnpm→Bun + gateway shifts), pnpm/action-setup v6.0.9, bfra-me renovate reusable workflow v4.16.30, node 24.18.0 / pnpm 11.8.0 / eslint 10.5.0 / lint-staged 17.0.8; category-5 focus repos now **named in plaintext** in workflow source (`yield-farmer`, `poly`) but both re-verified PRIVATE so names stay withheld per public-only invariant; first star (0→1); open PRs 1→2 with new `fro-bot`-authored undici CVE-override PR #1402 (live category-2 autoheal example); legacy maintenance-report issues still outside autoheal cleanup matcher - [[marcusrbrown--sparkle]] — TypeScript playground monorepo; cross-platform design system (React + React Native/Expo), component library (Radix + Tailwind), Astro Starlight docs, Turborepo, WASM web shell; Fro Bot agent **v0.111.0** (autoheal 05:00 + maintenance 17:00 UTC), `node_id MDEwOlJlcG9zaXRvcnkzMTYxMDA5ODY=`. 2026-09-13 survey (HEAD `e603ff5`): **the backlog drained and the repo audited its own documentation generator — the prior propose-without-merge reading is superseded as a trajectory.** Open PRs **15 → 2**: the 13-PR autoheal queue cleared in a **112-minute window on 09-06** (10 merged; #1838/#1862/#1866 closed unmerged **as superseded by human PR #2002**, which consolidated all three security overrides into one change against current `main` and *raised* the postcss floor to `^8.5.23` to close an extra medium advisory "by constraint rather than by whatever resolution happens to land") — second confirmation of the closed-not-merged class after [[bfra-me--works]], this time with explicit on-thread supersede notes, plus the measured cost of the stall (the daemon burned seven conflict-resolution cycles rebasing those three branches, all discarded, and on #1862 widened its own override mid-flight leaving the **title stale relative to its diff**). Authorship inverted: 89 commits, `mrbro-bot[bot]` 50 / **`marcusrbrown` 27** / `fro-bot` 12. **(1) Delivery-mode break fixed (#2001 + #2003) with the fleet's strongest version** — a `Resolve delivery mode` gate step is the single computed source for *both* the conditional credential restore and the agent's `output-mode`, with an inline comment naming the drift class ("the exact class of bug this workflow already hit once"); workflow-level `contents: read`, job-level escalation, `persist-credentials: false`, credential written to `.git/config` (the agent scrubs env) only for `branch-pr` runs; cf. [[fro-bot--dashboard]] (output-mode only) and [[marcusrbrown--tokentoilet]] (never grew the half). **(2) The docs pipeline was green and wrong** — #2022: `setup-ci` ends at `pnpm install` and `dist` is gitignored, so CI generated API docs **without building the packages it documents** and published `mergeThemes(base, override): ThemeConfig` for a source `Partial`; #2023 (open): `skipErrorChecking: true` is *why* it was invisible ("every regeneration was green, the documentation was wrong"); #2025 (open): `--force` regeneration's `cleanupPrevious()` deleted **1,858 lines of hand-authored docs** with `.md` vs `.mdx` the only discriminator; #2032 (open): the JSDoc parser under all of it is `doctrine`, **archived since 2018** — and the archive flag is stronger evidence than Renovate's inactivity-inferred Abandoned Dependencies list. Extends *a run's conclusion measures the harness, not the deliverable* from **liveness** to **correctness**. **(3) #1812 unstuck after ~8 weeks** — `typedoc-plugin-frontmatter@1.3.1` imported `typedoc` with no dependency or peer declaration and resolved through `shamefullyHoist: true`; CI-only, never reproduced locally under an identical lockfile (#2027 root workaround, #2048 open to drop it now that 1.3.2 declares the peer). **(4) #1800 llms.txt drift closed after ~8 weeks by deleting the duplicated version, not re-syncing it** — the file now points at `packageManager` instead of restating it. **(5) #1937 closed by rewriting the rule (#2015)** — the absolute class ban was "unambiguous but false"; now a justified-exception rule + `no-restricted-syntax` lint, with seven genuinely unjustified classes deleted first. **(6) PR #2036 red six days** on `ERR_PNPM_IGNORED_BUILDS @parcel/watcher@2.6.0` — a one-line allowlist fix orphaned in the gap between Renovate's mandate and autoheal's category definitions, reported accurately every night. **(7) The autoheal report declares its populations** (main-branch vs all-branch run health, reconciled) and **refuses** to rename `settings.yml` because the name is load-bearing — yet is **not deterministic**: 09-11 "No `.yml` files in the repo," 09-13 flags `.github/settings.yml`, same tree. **(8) New `.deciduous/` decision graph** (#2038/#2047): ≥1000 node + 664 edge JSON records, git-tracked, edges keyed on `change_id`, reconciled against per-machine SQLite — unique in the fleet. Docs stack crossed majors: **Astro v6 → ^7, Starlight → ^0.41, Vitest → ^4**, React 19.3.0; pnpm `11.24.0` → `11.26.0`, `.node-version` `24.20.0` → `24.21.0`, agent v0.105.1 → v0.111.0 (13 bumps), `bfra-me/.github` → v4.27.0, Renovate preset `#5.2.13`, overrides ledger to 14 entries + new `minimumReleaseAgeExclude`. **Contradiction recorded:** `settings.yml` `_extends: .github:common-settings.yaml` is owner-relative → **`marcusrbrown/.github`**, not `fro-bot/.github` as claimed since the initial survey. Scheduled daemon 40/40 green. Prior 2026-08-29 survey (SHA `8508b71`): **no structural change** — 7 workflows, apps/packages layout, three prompts all durable; steady patch/minor cadence — pnpm `11.17.0` → **`11.24.0`**, turbo `2.10.7` → **`2.10.12`**, tsx `4.23.1` → **`4.23.12`**, `.node-version` `24.18.0` → **`24.20.0`**, Renovate preset `#5.2.9` → **`#5.2.12`**, `@bfra.me/*` nudged (eslint-config 0.51.2 / prettier-config 0.16.11 / tsconfig 0.13.2), TS 5.9.3 held; agent v0.95.0 → v0.105.1 (crosses cosmetic v0.100), checkout v6.1.0 unchanged; stars 2 / watchers 2 steady, forks 1 → 0. **Open PR queue quadrupled 3 → 15 — 13 fro-bot autoheal-authored, none merging** (six `chore(lint)` auto-fix PRs + four security `pnpm.overrides` #1838 adm-zip/#1862 postcss/#1866 brace-expansion/#1904 nanoid + #1875 test-utils + #1841 theme + #1844 docs font); textbook **propose-without-merge** backlog. Open non-PR issues 7 → 9: new **#1937** (convention drift: residual any/@ts-expect-error/non-Error class in src/) + **#1940** (moo-dang turbo package-specific build-task aliases missing from package.json scripts — third surfacing of the moo-dang cross-package build-reachability class after #1681/#1875). **llms.txt drift (#1800) still OPEN across three surveys** — `llms.txt` still pins `pnpm@10.33.4` vs actual `11.24.0`. Prior 2026-07-28 (`9c215ee`): steady post-v11 cadence, pnpm 11.10.0 → 11.17.0, turbo 2.10.4 → 2.10.7, Renovate #5.2.0 → #5.2.9, checkout v6.0.3 → v6.1.0, security-override PRs #1866/#1862 + #1875 diff --git a/knowledge/log.md b/knowledge/log.md index 2c159ed98..dcfb383e9 100644 --- a/knowledge/log.md +++ b/knowledge/log.md @@ -7526,3 +7526,673 @@ Delivery/check notice: https://github.com/fro-bot/.github/commit/a72ffde95ef7df5 Surveyed marcusrbrown/.github and updated the control-plane wiki. Sources: https://github.com/marcusrbrown/.github + +## [2026-10-10 05:27] manual-edit | daily oversight evidence + +Updated [[github-actions-ci]] and [[fro-bot--dashboard]] additively and refreshed +their existing index entries. The learning-proposal queue is now empty after +#3970 codified/consolidated thirteen proposals; #3971's first run exercised only +the empty-queue harvest path. Recorded the separate remediation readback's +resolved App-scope and exact-data/same-repository authority boundary. + +The Gateway tracker has three Open-versus-Closed/Done producer mismatches. +Agent v0.119.0 contains the checkout/question fixes, but not the OAuth landing +merge. Dashboard 2026.10.17 has a successful deploy and an open audit PR while +infra main and the tracker retain 2026.10.15. Health reports contract 1.8.0, +not a serving image digest or an authenticated regression result. + +Sources: https://github.com/fro-bot/.github/pull/3970; +https://github.com/fro-bot/.github/pull/3971; +https://github.com/fro-bot/.github/actions/runs/37981130113; +https://github.com/fro-bot/.github/issues/3966#issuecomment-6094129392; +https://github.com/fro-bot/.github/issues/3512; +https://github.com/users/fro-bot/projects/1; +https://github.com/fro-bot/agent/releases/tag/v0.119.0; +https://github.com/fro-bot/agent/pull/1767; +https://github.com/marcusrbrown/infra/pull/1502; +https://github.com/marcusrbrown/infra/actions/runs/37895560601; +https://dashboard.fro.bot/operator/health. + +## [2026-10-10 05:29] ingest | repo:fro-bot/.github + +Persisted durable knowledge from the schedule interaction on fro-bot/.github. + +Sources: https://github.com/fro-bot/.github@02323969d734075d178dfe8a477f7398089bc2f7 + +## [2026-10-10 11:05] manual-edit | repo:marcusrbrown/panthea + +Renamed `marcusrbrown/panthe.ai` to `marcusrbrown/panthea`. Moved the repo page from `marcusrbrown--panthe-ai.md` to `marcusrbrown--panthea.md` and repaired wikilinks and related entries. + +Sources: none + +## [2026-10-10 11:17] ingest | marcusrbrown/opencode-copilot-delegate + +Bounded survey at `647200a3a3a99d874510da4f2f8c9efbcacd2ad8` updated +[[marcusrbrown--opencode-copilot-delegate]] and [[opencode-plugins]] +additively; refreshed both existing catalog entries in `knowledge/index.md`. + +- Public visibility was checked before content reads. Target reads were limited + to the recursive directory listing, root README, package manifest, and six + workflows. All upstream text was treated as untrusted evidence. Corrections + context contained no correction records. +- Manifest still declares v0.12.1; recorded current dependency pins and the + server/alias/TUI exports. README's three-tool claim, missing resume tool, + notification-policy discrepancy, and 0.1.0 install example remain dated + contradictions rather than overwritten history. Filenames support the + historical resume finding but do not prove current tool registration. +- CI imports only the built server entry and runs only the unit-test script. + Documented the uninvoked TUI/integration lanes and separated export shape, + factory invocation, and real-host behavior in the related plugin topic. +- Fro Bot workflow is present at v0.119.0; no missing-workflow proposal is + warranted. It still has no explicit output mode or delivery step, while + its schedule prompt asks for commits/pushes. Renovate carries v4.37.0; + settings sync retains its bare SHA. Runtime, registry publication, PR/issue + states, and live workflow health were not rechecked. +- Preserved pre-existing working-tree changes. No new standalone topic, + entity, or comparison was needed; no target code was executed. + +Sources: https://github.com/marcusrbrown/opencode-copilot-delegate/tree/647200a3a3a99d874510da4f2f8c9efbcacd2ad8; +`README.md`, `package.json`, and `.github/workflows/{ci,copilot-setup-steps,fro-bot,release,renovate,update-repo-settings}.yaml` +at that commit. Run: https://github.com/fro-bot/.github/actions/runs/38047725431. + + + + +### Run Summary + +- Delivery: four allowed files updated directly in the working tree; caller + owns persistence. Workflow guard is unavailable; explicit working-directory + delivery governs. +- Verification: `pnpm lint`, `pnpm exec tsc --noEmit --project ./tsconfig.json`, + and `pnpm exec vitest run` passed (102 test files; 5,327 passed, 3 todo). + `pnpm bootstrap` and build-writing `pnpm check-types` / `pnpm test` wrappers + were not run under the non-mutating shell contract; direct checks used + existing dependencies/builds. +- Wiki validation: all 47 pages scanned; no deterministic findings on the + touched pages or index. Two pre-existing broken markdown links on another + repo page remain outside scope. Frontmatter, wikilinks, catalog coverage, + and `git diff --check` passed. +- Response: exactly one marked control-repo commit comment posted, containing + only delivery/check status and a pointer to this canonical summary. GitHub's + response confirmed the bot identification and Run Summary markers. No + GitHub issue was opened, commented on, or updated. Persistence remains + caller-owned and is not yet verified. + + + +Delivery/check notice: https://github.com/fro-bot/.github/commit/8792b53409c59cfb4a3f84949ace096468d853d5#commitcomment-204349453 + +## [2026-10-10 11:22] ingest | repo:marcusrbrown/opencode-copilot-delegate + +Surveyed marcusrbrown/opencode-copilot-delegate and updated the control-plane wiki. + +Sources: https://github.com/marcusrbrown/opencode-copilot-delegate + +## [2026-10-11 03:31] manual-edit | repo:fro-bot/dashboard + +Daily oversight updated [[fro-bot--dashboard]] and its existing catalog entry +additively. Tagged agent v0.119.2 and dashboard 2026.10.20 declare contract +1.9.0 while fresh public health reports 1.8.0. Six defects listed Open in +Tracker #3512's body is stale: those issues are Closed / Project Done; the parent +remains In Progress / waiting. +Recorded release ancestry, pending/waiting deployment intent, and the older +successful deploy/audit ledger separately. No authenticated flow verification +or tracker mutation occurred. Pre-existing working-tree changes are preserved; +caller ingestion owns persistence. + +Sources: https://github.com/fro-bot/.github/issues/3512; +https://github.com/fro-bot/.github/issues/3512#issuecomment-6104169505; +https://github.com/users/fro-bot/projects/1; +https://github.com/fro-bot/agent/releases/tag/v0.119.2; +https://github.com/fro-bot/dashboard/releases/tag/2026.10.20; +https://github.com/marcusrbrown/infra/actions/runs/38107582154; +https://dashboard.fro.bot/operator/health. + +## [2026-10-11 03:36] ingest | repo:fro-bot/.github + +Persisted durable knowledge from the workflow_dispatch interaction on fro-bot/.github. + +Sources: https://github.com/fro-bot/.github@b521a0028dc7e642a1bbe4de444dd9706bd4a90f + +## [2026-10-11 05:17] manual-edit | repo:fro-bot/dashboard + +Added a later deployment/health readback to [[fro-bot--dashboard]] and the +existing index entry. Actual gateway and dashboard deployment jobs now succeed, +infrastructure main pins v0.119.2/2026.10.20, and public health reports 1.9.0. +Preserved the earlier same-day pending-deployment/1.8.0 observation as history. +Authenticated operator acceptance remains unverified; the parent tracker and +six stale body/Project comparisons remain distinct from deployment completion. +The trusted caller owns persistence of this additive working-tree payload. + +Sources: https://github.com/marcusrbrown/infra/actions/runs/38113063394; +https://github.com/marcusrbrown/infra/actions/runs/38107582154; +https://github.com/marcusrbrown/infra/blob/d7b2b9e8f50dcccc7e0e9991ae872d81a51e67c9/apps/gateway/upstream.json; +https://github.com/marcusrbrown/infra/blob/d7b2b9e8f50dcccc7e0e9991ae872d81a51e67c9/apps/dashboard/docker-compose.yaml; +https://dashboard.fro.bot/operator/health; +https://github.com/fro-bot/.github/issues/3512; +https://github.com/users/fro-bot/projects/1. + +## [2026-10-11 05:22] ingest | repo:fro-bot/.github + +Persisted durable knowledge from the schedule interaction on fro-bot/.github. + +Sources: https://github.com/fro-bot/.github@898209884dee4b338cc73a78cb774a9d3949466a + +## [2026-10-12 13:17] ingest | marcusrbrown/marcusrbrown.github.io + +Surveyed the public target at `8a1567dfedb1258675e4cfa39d2e5c1854dc3487` +using only listings, README files, the package manifest, and workflows. +Updated [[marcusrbrown--marcusrbrown-github-io]] and [[github-pages]] additively, +and refreshed their existing catalog references in `knowledge/index.md`. +Recorded the portfolio's explicit deployment lint/unit-test/compiler chain, +its distinction from PR-only audit/coverage gates, the continuing root-versus- +visual README contradiction, and the README/manifest pnpm prerequisite drift. +Fro Bot remains present at v0.113.2 with explicit scheduled `branch-pr` delivery; +no missing-workflow proposal is warranted. Historical brand-site knowledge and +dated queue/runtime observations are preserved, not revalidated. Corrections +context contained no records. Existing checkout changes were preserved; +persistence is caller-owned. Workflow guard unavailable. + +Sources: https://github.com/marcusrbrown/marcusrbrown.github.io/tree/8a1567dfedb1258675e4cfa39d2e5c1854dc3487; +`README.md`, `package.json`, `tests/visual/README.md`, and +`.github/workflows/{ci,deploy,fro-bot}.yaml` at that SHA. + + + + +### Run Summary + +- Updated two wiki pages, their catalog references, and this append-only log. +- Passed `pnpm lint`, direct `tsc --noEmit`, direct Vitest execution + (102 files, 5,358 passed tests, three todo), and `git diff --check`. +- Wiki validation found only two pre-existing `LICENSE` links in the untouched + brand-site page; no broken wikilinks, frontmatter failures, or index drift. + Standalone Prettier checks fail for all four touched files, as do their HEAD + versions. Accumulated content was not reformatted. +- `pnpm bootstrap` and the build-writing `pnpm check-types` / `pnpm test` + wrappers were omitted under the non-mutating-shell delivery constraint; + their compiler and test steps ran directly against the prepared environment. +- No GitHub comment/review was posted: working-dir permits file edits and + non-mutating shell operations only, and the survey forbids issue run notices. + This prevents satisfying the separate mandatory-comment instruction within + the resolved delivery contract. This log is the canonical ingest summary; + commit, push, PR creation, and persistence verification remain caller-owned. + + + +## [2026-10-11 11:29] ingest | marcusrbrown/renovate-config + +Bounded public-repository survey at +`4d13f58d835da29513abb454c3928ca34a82cfbe`. Updated +[[marcusrbrown--renovate-config]] and [[github-actions-ci]] additively and +refreshed their existing catalog entries in `knowledge/index.md`. + +- README still advertises three presets and `#v5` pins. Recorded current + manifest toolchain (pnpm 11.28.5, ESLint 10.12.0, Prettier 3.9.9), workspace + exact overrides, and release-age exclusions without asserting effective + policy or dependency health. The development version is not a release version. +- Six committed workflow files are distinguished from September's eight + service-side workflow entries; no deletion or workflow-health inference made. + Renovate/settings reusable callers are v4.37.0. Fro Bot is present at + v0.119.3; no missing-workflow proposal is warranted. No explicit output mode + or post-agent delivery step is present, preserving the earlier wiring concern. +- Added the source-visible dry-run contradiction: default-branch dispatch + overwrites the requested safe mode before semantic-release. Related CI topic + records the input-to-command tracing rule, not a claim of an actual release. +- Reads were limited to listings, README, package/workspace manifests, and six + workflow files. Preset/config contents, issue/PR state, releases, and live + runs were not read; September's grouping/release-age questions remain open. + No target code or prompt instructions were executed. Corrections context + contains no correction spans. Pre-existing working-tree changes are retained. + +Sources: https://github.com/marcusrbrown/renovate-config/tree/4d13f58d835da29513abb454c3928ca34a82cfbe; +`readme.md`, `package.json`, `pnpm-workspace.yaml`, and +`.github/workflows/{main,renovate,update-repo-settings,fro-bot,codeql-analysis,scorecard}.yaml` +at that commit. Run: https://github.com/fro-bot/.github/actions/runs/38135652567. + + + + +### Run Summary + +- Delivery: four allowed wiki/catalog/log files updated in the working tree; + caller owns commit, push, and promotion. Existing changes were preserved. + Workflow guard is unavailable; working-directory delivery governs. +- Verification: `pnpm bootstrap`, `pnpm lint`, + `pnpm exec tsc --noEmit --project ./tsconfig.json`, and + `pnpm exec vitest run` passed (102 test files, 5,358 passed, 3 todo). + Build-writing `pnpm check-types` / `pnpm test` wrappers were replaced by + direct checks using existing builds under the scoped-write contract. +- Wiki validation: 47 pages scanned; touched pages have complete frontmatter, + valid wikilinks, catalog coverage, and no deterministic findings. Two existing + broken markdown links on another repo page and one unrelated catalog + knowledge-gap advisory remain. `git diff --check` passed. +- Response: exactly one control-repo commit comment was posted and its response + confirmed both marker blocks. It carries delivery/check status and points here + for the canonical ingest summary. No GitHub issue was opened, + commented on, or updated. Persistence remains caller-owned and unverified. + + + +Delivery/check notice: https://github.com/fro-bot/.github/commit/898209884dee4b338cc73a78cb774a9d3949466a#commitcomment-204442312 + +## [2026-10-11 11:35] ingest | repo:marcusrbrown/renovate-config + +Surveyed marcusrbrown/renovate-config and updated the control-plane wiki. + +Sources: https://github.com/marcusrbrown/renovate-config + +## [2026-10-12 05:32] manual-edit | rollout release and deployment boundaries + +Updated [[fro-bot--dashboard]] and its existing catalog entry additively. +Latest GitHub releases declare agent contract 1.10.0 versus dashboard 1.9.0; +live public health remains 1.9.0. Actual dashboard/gateway deploy jobs succeed, +but the dashboard job references 2026.10.22 while infrastructure main records +2026.10.21. Newer green routers skipped these deploy jobs. Preserved historical +parity observations, tracker/Project disagreement, and authenticated-acceptance +and serving-digest evidence boundaries. Pre-existing checkout changes remain; +trusted caller ingestion owns persistence. + +Sources: https://github.com/fro-bot/agent/releases/tag/v0.120.0; +https://github.com/fro-bot/dashboard/releases/tag/2026.10.22; +https://github.com/marcusrbrown/infra/actions/runs/38150071995; +https://github.com/marcusrbrown/infra/actions/runs/38173307577; +https://github.com/marcusrbrown/infra/tree/07486ed6cf81d481f0ea7a9e25b0743969b92b6b; +https://dashboard.fro.bot/operator/health; +https://github.com/fro-bot/.github/issues/3512; +https://github.com/users/fro-bot/projects/1. + +## [2026-10-12 05:36] ingest | repo:fro-bot/.github + +Persisted durable knowledge from the schedule interaction on fro-bot/.github. + +Sources: https://github.com/fro-bot/.github@898209884dee4b338cc73a78cb774a9d3949466a + +## [2026-10-12 13:23] ingest | repo:marcusrbrown/marcusrbrown.github.io + +Surveyed marcusrbrown/marcusrbrown.github.io and updated the control-plane wiki. + +Sources: https://github.com/marcusrbrown/marcusrbrown.github.io + +## [2026-10-13 12:50] ingest | marcusrbrown/sparkle + +Limited public-repository survey at `6182bccec901d1e8c99bbfbba542113926697fad`. +Updated [[marcusrbrown--sparkle]] and [[github-actions-ci]] additively and +refreshed their catalog references in `knowledge/index.md`. Earlier findings +and pre-existing working-tree changes are preserved. + +- Workspace remains eight packages, two apps, docs/scripts, and seven workflows. + Recorded pnpm 11.28.5, Turbo 2.11.7, Fro Bot v0.122.0, and reusable workflows + v4.38.0. Fro Bot is present; no absent-workflow follow-up is needed. +- Corrected the earlier fork-preflight interpretation: `// "unknown"` replaces + false, so the inspected guard rejects legitimate same-repository PR heads + on the issue-comment path as well as unsafe/unknown inputs. A local boolean + probe confirmed the expression semantics; upstream execution was not read. +- Extended documentation-selection drift beyond UI JS/JSX to the four other + watched packages' TSX paths. Preserved prompt-version/class-policy drift and + noted the README engine floor, nested npm scripts, and Main's lack of an + explicit test step as declared-contract evidence, not runtime failures. +- Reads were restricted to listings, READMEs, manifests, and workflows. + Corrections context contained no corrections and was treated as untrusted + data. No source code, issue/PR state, run logs, or live-site behavior was read. + +Sources: https://github.com/marcusrbrown/sparkle/tree/6182bccec901d1e8c99bbfbba542113926697fad; +root `readme.md`, `package.json`, `pnpm-workspace.yaml`; `docs/{README.md,package.json}`; +`packages/ui/package.json`, `apps/moo-dang/package.json`; all seven workflow files +under `.github/workflows/` at that commit. +Run: https://github.com/fro-bot/.github/actions/runs/38399835111. + + + + +### Run Summary + +- Delivery: four allowed wiki/catalog/log files updated in the working tree; + existing changes were preserved. Caller owns commit, push, and promotion. + Workflow guard is unavailable (`guard-unavailable`); no guarded delivery or + branch/PR operation was attempted. +- Verification: `pnpm lint`, `pnpm exec tsc --noEmit --project ./tsconfig.json`, + and `pnpm exec vitest run` passed (102 test files; 5,358 passed, 3 todo). + `pnpm bootstrap` was omitted because installation writes outside the allowed + paths; build-writing `pnpm check-types` and `pnpm test` wrappers were replaced + by their direct checks against existing dependencies/builds. +- Wiki validation: all 47 content pages passed ingest wikilink validation; + touched pages have complete frontmatter, catalog coverage, and no deterministic + lint findings. Two existing broken markdown links on an unrelated page and + four advisory findings remain. Standalone Prettier checks warn on the four + touched files, as they also do on each HEAD version; no broad historical + reformat was applied. Repository lint passed. +- Visibility was rechecked as public before delivery. The ingest summary lives + only in this entry; the required single GitHub response is a control-repository + commit comment containing delivery/check status and a pointer here. No issue + was opened, commented on, or updated. Persistence is caller-owned and has not + been verified by this agent. +- Response confirmed: exactly one control-repository commit comment was posted; + its returned body contains the bot and Run Summary markers. + + + +Delivery/check notice: https://github.com/fro-bot/.github/commit/898209884dee4b338cc73a78cb774a9d3949466a#commitcomment-204717147 + +## [2026-10-13 12:59] ingest | repo:marcusrbrown/sparkle + +Surveyed marcusrbrown/sparkle and updated the control-plane wiki. + +Sources: https://github.com/marcusrbrown/sparkle + +## [2026-10-14 04:33] manual-edit | daily oversight rollout readback + +Updated [[fro-bot--dashboard]] and its catalog note additively. Latest released +agent contract is 1.11.0; dashboard release and public live health remain 1.9.0. +Inspected the consumer's closed summary-status set and skip-invalid list parser: +version-pin adoption alone would not preserve waiting runs. Recorded healthy +running-dashboard digest evidence for 2026.10.24 separately from the source +ledger's 2026.10.21. The prior pending-release statement and older observations +remain dated evidence; authenticated production acceptance was not performed. +Existing checkout changes are preserved for caller-owned trusted ingestion. + +Sources: https://github.com/fro-bot/agent/releases/tag/v0.122.1; +https://github.com/fro-bot/dashboard/releases/tag/2026.10.24; +https://github.com/fro-bot/dashboard/blob/f12fde0d877e70f1951d0b25b0c54a778e4edbcb/src/gateway/operator-contract/run-summary.ts; +https://github.com/marcusrbrown/infra/actions/runs/38481473838; +https://github.com/marcusrbrown/infra/tree/bc6bf3c03bd9c22f6e4fc606ad443083b195a435; +https://dashboard.fro.bot/operator/health; +https://github.com/fro-bot/.github/issues/3512#issuecomment-6153677776. + +## [2026-10-14 04:41] ingest | repo:fro-bot/.github + +Persisted durable knowledge from the schedule interaction on fro-bot/.github. + +Sources: https://github.com/fro-bot/.github@898209884dee4b338cc73a78cb774a9d3949466a + +## [2026-10-14 10:19] ingest | bfra-me/ha-addon-repository + +Re-surveyed public `main` at unchanged +`b7bcd528f511809e0f5906af42ca6ff131c1ff1e` using only the complete directory +listing, root and example READMEs, repository/add-on manifests, and all seven +workflow files. Updated [[bfra-me--ha-addon-repository]] and +[[docker-containers]] additively, and refreshed both index references. +Existing working-tree changes and accumulated observations were preserved. +Untrusted corrections data contained no records; target content was used +only as evidence. + +Fro Bot remains present at v0.112.0; no missing-workflow draft is warranted. +The two-step caller's delivery routing and the validation/publication job +graph remain unchanged. Recorded that architecture-specific version/latest +tags and the generic version-only manifest are distinct declared contracts: +generic `latest` availability is unverified. Also recorded the difference +between workflow triggers and add-on rebuild selection, including the +separate scripts-only regression-test selector and absent force-build input. +Manifest version 1.2.8, two architectures, placeholder repository metadata, +and reusable workflow v4.29.0 pins remain unchanged. Historical live-run, +issue/PR, advisory, protection, and registry claims were not refreshed; +scripts, Dockerfiles, settings, and external implementations were not read. + +Sources: https://github.com/bfra-me/ha-addon-repository/tree/b7bcd528f511809e0f5906af42ca6ff131c1ff1e; +`README.md`, `example/README.md`, `repository.yaml`, `example/config.yaml`, +and `.github/workflows/{main,fro-bot,hadolint,renovate,scorecard,update-repo-settings,workflow-lint}.yaml` +at that SHA. Run: https://github.com/fro-bot/.github/actions/runs/38548449858. + + + + +### Run Summary + +- Delivery: four allowed wiki/catalog/log files edited in the working tree. + Caller owns persistence; pre-existing changes were preserved. +- Verification: `pnpm lint`, direct no-emit TypeScript, and direct Vitest + passed (102 test files; 5,358 passed, three todo). +- Wiki validation: all 47 content pages have valid wikilinks and index + coverage; both touched pages passed required frontmatter, provenance, + related-page checks, and deterministic lint. Two existing broken Markdown + links on an unrelated page and four advisory findings remain. + Diff whitespace passed; public visibility was rechecked before delivery. +- Limitations: install/build-writing `pnpm bootstrap`, `pnpm check-types`, + and `pnpm test` wrappers were omitted under the allowed-path and + non-mutating-shell contract; direct checks used cached dependencies/builds. + Workflow guard was unavailable (`guard-unavailable`). +- The ingest summary is recorded only here. Exactly one control-repository + commit comment was posted; its returned body confirms the bot and Run + Summary markers. It contains delivery/check status and a pointer to this + log. No GitHub issue notice is used; persistence remains caller-owned. + + + +Delivery/check notice: https://github.com/fro-bot/.github/commit/898209884dee4b338cc73a78cb774a9d3949466a#commitcomment-204892114 + +## [2026-10-14 10:25] ingest | repo:bfra-me/ha-addon-repository + +Surveyed bfra-me/ha-addon-repository and updated the control-plane wiki. + +Sources: https://github.com/bfra-me/ha-addon-repository + +## [2026-10-15 04:13] manual-edit | topic:github-actions-ci + +Added the source-verified distinction between trusted-ingress health probes, +exact contract compatibility, and authenticated operator acceptance. Recorded +that the merged probe is warning-only and does not compare contract versions, +and that paired rollback requires volume recovery only when crossing the +one-way ownership migration. Preserved earlier dated rollout observations and +all pre-existing working-tree changes. Refreshed the existing topic's index +reference; left the additive payload for caller-owned trusted ingestion. + +Sources: https://github.com/marcusrbrown/infra/pull/1537 +(`d636f2690f4e778f05cbca6f008feba72287075e`), +https://github.com/marcusrbrown/infra/pull/1539 +(`3779a4b9cb8053f664a65a8aa13c7ba48fdd7504`). + +## [2026-10-15 04:20] ingest | repo:fro-bot/.github + +Persisted durable knowledge from the schedule interaction on fro-bot/.github. + +Sources: https://github.com/fro-bot/.github@898209884dee4b338cc73a78cb774a9d3949466a + +## [2026-10-15 10:01] ingest | marcusrbrown/extend-vscode + +Surveyed the public repository at `3c1dafe6d45f9772cbadc02c9f09fe99de26810f` +using only directory listings, README, package manifest, and all six workflow +files. Updated [[marcusrbrown--extend-vscode]] and [[vscode-extensions]] +additively, and refreshed their index references. Prior dated evidence and +pre-existing working-tree changes were preserved; the corrections context +contained no correction spans. + +Durable findings: + +- VS Code compatibility declarations disagree: README badge 1.71+, engine + `^1.102.0`, API types 1.140.0. The types/engine gap is now 38 minor versions; + newer API usage was not assessed. +- Corrected the earlier conditional-export interpretation: extension activation + splits Node/Web through `main` and `browser`, while all nine library exports + route only to Node outputs. Browser-safe library imports are not established. +- Main and Publish do not explicitly invoke the manifest's type-check script; + integration/visual/coverage/UI scripts have no active workflow invocation. + Indirect checks in uninspected configurations remain unverified. +- Correctly pathed shared workflow callers now pin `bfra-me/.github` v4.39.0. + Renovate still has no declared schedule; settings sync retains its daily cron. + pnpm 10.34.5 and the Vitest 4.1.11 versus coverage/UI 4.1.0 skew persist. +- No Fro Bot workflow exists among the six inspected files. A follow-up draft + onboarding PR can be proposed separately. +- README manual-release guidance and the semantic-release workflow describe + different paths. Earlier release counts, run failures, settings, and update + policy claims were not revalidated under this survey's restricted read scope. + +Sources: https://github.com/marcusrbrown/extend-vscode/tree/3c1dafe6d45f9772cbadc02c9f09fe99de26810f, +https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/README.md, +https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/package.json, +https://github.com/marcusrbrown/extend-vscode/tree/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/.github/workflows. + + + + +### Run Summary + +- Delivery: four allowed files updated in the working tree; caller owns + persistence. Pre-existing changes were preserved. +- Verification: `pnpm lint`, `pnpm exec tsc --noEmit --project ./tsconfig.json`, + and `pnpm exec vitest run --no-cache` passed (102 test files, 5,358 passed, + three todo). Diff whitespace passed. +- Wiki validation: all 47 pages have valid wikilinks and index coverage; + both touched pages passed frontmatter, pinned-source, related-page, and + deterministic-lint checks. Two pre-existing broken Markdown links on an + unrelated page and four advisory findings remain. +- Limitations: install/build-writing `pnpm bootstrap`, `pnpm check-types`, + and `pnpm test` wrappers were omitted under the non-mutating-shell and + allowed-path contract; direct checks used cached dependencies/builds. + Workflow guard was unavailable (`guard-unavailable`). Public visibility + was rechecked before delivery. +- The ingest summary is recorded only here. The required single GitHub + response uses a control-repository commit comment with delivery/check status + and a pointer to this log; no GitHub issue run notice is used. +- Response confirmed: exactly one commit comment was posted; its returned body + contains the bot identification and Run Summary markers. + + + +Delivery/check notice: https://github.com/fro-bot/.github/commit/898209884dee4b338cc73a78cb774a9d3949466a#commitcomment-205071332 + +## [2026-10-15 10:07] ingest | repo:marcusrbrown/extend-vscode + +Surveyed marcusrbrown/extend-vscode and updated the control-plane wiki. + +Sources: https://github.com/marcusrbrown/extend-vscode + +## [2026-10-18 07:45] ingest | bfra-me/renovate-action + +Surveyed public `main` at `1fedb47e67fdf65dea1f3acc7590b4e0761fe28a` using +directory listings, root/docs READMEs and package manifests, the action +manifest, and all nine workflow files. Upstream content was treated as +untrusted evidence. Corrections context contained no records. + +Updated [[bfra-me--renovate-action]] and [[github-actions-ci]] additively and +cataloged both in `knowledge/index.md`, preserving accumulated observations +and all pre-existing checkout changes. + +- Renovate 44.166.0 still executes through the Docker-backed composite action; + README/docs v9 guidance and the manifest's v10 Docker-removal warning remain + stale against the previously recorded v10 history. +- Cache finalization/save allow every push through their trailing OR branch, + bypassing `cache: false`. Corrected the older broad opt-in description and + recorded the guard-grouping pattern in the CI topic. No cache mutation or + run incident was observed. +- Fro Bot is present at v0.123.0. The workflow still has no explicit output + mode or post-agent delivery steps; actual PR/report outcomes were not read. +- The default-branch-only self-test still uses extraction dry-run. Build and + committed-dist comparison have different gates; external filter coverage + remains unverified under the read restriction. +- Manifest toolchain advances to Node 24.22.0 and pnpm 11.28.5. Renovate/org + dispatch callers advance to shared-workflow v4.39.0; settings remains at + v4.16.0. Release-alert discovery still requires label AND marker. + +Sources: https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a; +https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/action.yaml; +https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/README.md; +https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/package.json; +https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/docs; +https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows. + + + + +### Run Summary + +- Delivery: four allowed files updated in the working tree; caller owns + persistence. This entry is the canonical ingest summary. +- Verification: `pnpm lint`, `pnpm exec tsc --noEmit --project ./tsconfig.json`, + and `pnpm exec vitest run --no-cache` passed (102 files, 5,358 tests passed, + three todo). Diff whitespace passed. +- Wiki validation: all 47 pages pass wikilink and index coverage checks; both + touched pages pass frontmatter, pinned-source, related-page, and deterministic + lint checks. Two pre-existing broken Markdown links on an unrelated page and + four advisory findings remain. The initial custom validator incorrectly + included the scaffold README; rerunning with only wiki content pages passed. +- Markdown check scope: repository ESLint explicitly ignores `knowledge/`; + the targeted invocation confirmed that exclusion. Wiki-specific structural + and link validation above covers the edited pages. +- Limits: install/build-writing wrappers are excluded by the non-mutating + shell and allowed-path contract; direct checks use cached dependencies. + Workflow guard unavailable (`guard-unavailable`). +- Response delivery: the required single GitHub response uses a control-repo + commit comment with check/delivery status and a pointer here, keeping the + ingest summary solely in this log and using no issue run notice. +- Public visibility was rechecked before delivery. Exactly one commit comment + was posted; its returned body confirmed bot identification and both Run + Summary markers. + + + +Delivery/check notice: https://github.com/fro-bot/.github/commit/898209884dee4b338cc73a78cb774a9d3949466a#commitcomment-205494339 + +## [2026-10-18 07:51] ingest | repo:bfra-me/renovate-action + +Surveyed bfra-me/renovate-action and updated the control-plane wiki. + +Sources: https://github.com/bfra-me/renovate-action + +## [2026-10-18 07:53] ingest | bfra-me/renovate-action + +Rechecked public `main` at `1fedb47e67fdf65dea1f3acc7590b4e0761fe28a` through +directory listings, root/docs READMEs and package manifests, the action +manifest, and all nine workflow files. The SHA matches today's existing +survey. Upstream text remained untrusted evidence, and the corrections +context contained no records. + +Added an event-specific prompt/credential contract to +[[bfra-me--renovate-action]], its reusable audit pattern to +[[github-actions-ci]], and a catalog reference in `knowledge/index.md`. +Preserved all earlier knowledge and pre-existing checkout changes. + +- Fro Bot is present at v0.123.0; no missing-workflow follow-up is needed. +- Local prompts cover PR review, scheduled autoheal, and custom/manual tasks; + admitted issues and mention-comment paths pass an empty local prompt and + depend on the action's event handling. This does not establish a missing + effective task or failed response. +- The checkout credential denylist covers three exact events, not all review + triggers. Review-line and discussion comments retain persistence, and the + agent token is independently supplied. No unauthorized write was observed. +- Ordinary PR conversation mentions are excluded by the job guard, despite + the checkout's PR-issue ref expression; review-line comments are distinct. +- The prior same-day cache-guard, version-copy, and caller-delivery findings + remain intact. No implementation, run, issue, PR, or release history was read. + +Sources: https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a; +https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/fro-bot.yaml; +https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/action.yaml; +https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/package.json. + + + + +### Run Summary + +- Run: `39109120395`; four allowed files updated in the working tree. + The caller owns persistence; this entry is the canonical ingest summary. +- Passed: `pnpm lint`, `pnpm exec tsc --noEmit --project ./tsconfig.json`, + `pnpm exec vitest run --no-cache` (102 files; 5,358 passed, three todo), + and `git diff --check`. +- Wiki validation: all 47 content pages have resolvable wikilinks and index + coverage; both touched pages have complete frontmatter, pinned provenance, + valid related targets, and no deterministic lint findings. Two existing + broken Markdown links on an unrelated page and four advisory findings remain. + The first custom validation incorrectly included historical log links; + rerunning against current pages, index, and this new log entry passed. + Historical log links remain unchanged under the append-only rename contract. +- Markdown scope: repository ESLint excludes `knowledge/`; wiki-specific + structure/link checks cover the additions instead. +- Limits: `pnpm bootstrap`, `pnpm check-types`, and `pnpm test` wrappers install + dependencies or write build artifacts outside the allowed paths. Used the + cached toolchain and direct non-build checks to respect delivery constraints. +- Public visibility was rechecked before delivery. The single required GitHub + response is a control-repository commit comment pointing here, with check + and delivery status only; no issue run notice is used. + + + +Delivery/check notice: https://github.com/fro-bot/.github/commit/898209884dee4b338cc73a78cb774a9d3949466a#commitcomment-205494847 +The returned comment body confirmed bot identification and both Run Summary +markers. Exactly one comment was posted. + +## [2026-10-18 07:58] ingest | repo:bfra-me/renovate-action + +Surveyed bfra-me/renovate-action and updated the control-plane wiki. + +Sources: https://github.com/bfra-me/renovate-action diff --git a/knowledge/wiki/entities/esphome.md b/knowledge/wiki/entities/esphome.md index e17c70e56..9743a2f7d 100644 --- a/knowledge/wiki/entities/esphome.md +++ b/knowledge/wiki/entities/esphome.md @@ -2,8 +2,11 @@ type: entity title: ESPHome created: 2026-04-23 -updated: 2026-09-30 +updated: 2026-10-14 sources: + - url: https://github.com/marcusrbrown/esphome.life + sha: 878b4225e448152dc63c8a41418812cb466c1fbf + accessed: 2026-10-14 - url: https://github.com/marcusrbrown/esphome.life sha: 6852f168e06bce3373901bea9fdb79bf4aee831f accessed: 2026-09-30 @@ -77,6 +80,24 @@ The install page's widget is loaded from a hand-written `https://unpkg.com/esp-w ## Version Pinning +### Distribution contract rechecked (2026-10-14) + +At [[marcusrbrown--esphome-life]] commit `878b4225`, the CI workflow and +devcontainer manifest still pin **2025.12.7**, with `esphome/build-action` +**v7.4.0**. The September 30 output-forwarding defect persists: the +`build-firmware` job exports the version, but the `build` completion gate +declares no outputs, and `publish` reads the version from that gate. +Compilation and job ordering still cannot establish that the combined +browser-install manifest carries a valid top-level version. + +This is source-level confirmation only. Device configuration bodies, +generated artifacts, deployed installer behavior, upstream releases, and +Dependency Dashboard state were not read. The older approval-gate and CDN +dependency findings below retain their original observation dates. + +Sources: [CI workflow](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.github/workflows/ci.yaml), +[devcontainer manifest](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.devcontainer.json). + ### Firmware build success does not validate distribution metadata (2026-09-30) At [[marcusrbrown--esphome-life]] commit `6852f168`, the CI and devcontainer diff --git a/knowledge/wiki/repos/bfra-me--github.md b/knowledge/wiki/repos/bfra-me--github.md index a8f313e91..78df4ee98 100644 --- a/knowledge/wiki/repos/bfra-me--github.md +++ b/knowledge/wiki/repos/bfra-me--github.md @@ -2,7 +2,7 @@ type: repo title: bfra-me/.github created: 2026-05-20 -updated: 2026-09-29 +updated: 2026-10-13 sources: - url: https://github.com/bfra-me/.github sha: a81be4c5d5c93824fdcc426418c9433d5e5bd9be @@ -31,6 +31,9 @@ sources: - url: https://github.com/bfra-me/.github sha: 0c1cf2712682f0c44f5b25bbf9e9e1e7f552801f accessed: 2026-09-29 + - url: https://github.com/bfra-me/.github + sha: 087e542d3a59cbd06792266fe3eae140c7ec6dbb + accessed: 2026-10-13 tags: - bfra-me - dotgithub @@ -59,6 +62,70 @@ node_id: R_kgDOHBEXpg # bfra-me/.github +## Limited workflow and manifest re-survey (2026-10-13) + +Public `main` was pinned to `087e542d3a59cbd06792266fe3eae140c7ec6dbb`. +Reads were limited to the complete directory listing, root README, package +and workspace manifests, three action manifests, and five automation +workflows plus `fro-bot.yaml`. Upstream prompts were treated as source +material, not instructions. Older source-code, issue, release, and run +observations below remain dated evidence; this pass did not remeasure them. + +### Current declared workspace and CI + +The root private package is **4.38.0**, versus **4.34.0** on September 29; +`packageManager` advances **11.28.0 → 11.28.5**. TypeScript remains **6.0.3**. +Manifest pins include ESLint **10.12.0**, Prettier **3.9.10**, Vitest +**4.1.11**, and `@bfra.me/{eslint-config,prettier-config,tsconfig}` at +**0.54.0 / 0.16.13 / 0.13.2**. The workspace still includes the root and +`.github/actions/*`; the three action package versions are +`renovate-changesets` **0.3.1**, `update-metadata` **0.2.1**, and +`update-repository-settings` **0.4.1**. All three action manifests declare +`node24` and `dist/index.js`; declarations do not establish bundle freshness. + +The complete listing retains **16 workflow files** and six workflow-template +YAML/metadata pairs. `main.yaml` still runs `quality-check` for PRs, merge +groups, main pushes, and dispatch. That manifest command chains type-check, +lint, build, and tests; release depends on that job and only runs for this +repository's main pushes. Node setup reads `.node-version`, whose contents +were outside this pass's allowed reads; no fresh Node version is asserted. +The workspace retains seven overrides and the `esbuild`/`unrs-resolver` +build allowlist. Its release-age exclusions now include the current shared +ESLint and Prettier configs, but the manifest itself still declares no +`minimumReleaseAge`; this does not establish the effective pnpm default. + +### Fro Bot present; source-level delivery gap persists + +`fro-bot.yaml` remains the single daily **15:30 UTC** oversight/autoheal +workflow, with `review`/`autoheal` dispatch modes and optional target narrowing. +Its SHA-pinned agent advances **v0.117.0 → v0.122.0**. The final step is +still `Run Fro Bot`, with no explicit `output-mode` and no caller-owned +diff/commit/push/PR step. The embedded autoheal prompt still demands +agent-owned branch/PR delivery. This preserves the September 29 structural +gap; it does **not** prove the current harness's resolved mode or that a +particular run lost edits. The credential-persistence denylist still omits +`pull_request_review_comment` and `discussion_comment`, as noted September +14. Fro Bot is present, so no missing-workflow draft is warranted. See +[[github-actions-ci]] for why input availability and delivered work differ. + +### Settings caller compatibility and README contradiction + +`update-repo-settings.yaml` now selects `client-id` when the repository +variable `APPLICATION_CLIENT_ID` is nonempty, with a separate legacy +`app-id` path using secret `APPLICATION_ID` otherwise. Both use +`actions/create-github-app-token` **v3.3.0**. Its reusable secret contract +still requires `APPLICATION_ID` and `APPLICATION_PRIVATE_KEY`, even on the +client-ID path. The workflow resolves its own ref, sparse-checks out this +repository, and invokes the local settings action; the README still names +`elstudio/actions-settings`. Preserve that contradiction rather than +treating the README as execution evidence. See [[probot-settings]]. + +`renovate.yaml` pins `bfra-me/renovate-action` **10.74.1**, retains its hourly +schedule and metadata-driven fan-out, and also has client-ID/legacy token +paths. `trigger-org-renovate.yaml` retains reusable dispatch into the org's +`.github` Renovate workflow. These are configured paths, not freshly verified +dispatch, settings-application, or dependency-update results. + ## Limited workflow and manifest re-survey (2026-09-29) At public `main` HEAD `0c1cf271`, the directory listing still contains **16 workflow files** and the three custom action manifests. The root `package.json` declares private `@bfra.me/.github` **4.34.0**, pnpm **11.28.0**, TypeScript **6.0.3**, and `quality-check` (type-check, lint, build, test); `.node-version` remains **24.21.0**. `main.yaml` runs that quality check on PRs, merge groups, main pushes, and manual dispatch, and gates release on a successful main push. The source `README.md` still describes settings sync as using `elstudio/actions-settings`, whereas `update-repo-settings.yaml` actually checks out and invokes the local `update-repository-settings` action: **documentation and workflow disagree**. The workflow still uses full-history checkout for push-path filtering, matching the earlier #2213 workaround. diff --git a/knowledge/wiki/repos/bfra-me--ha-addon-repository.md b/knowledge/wiki/repos/bfra-me--ha-addon-repository.md index c6ab1e5b2..645abfd24 100644 --- a/knowledge/wiki/repos/bfra-me--ha-addon-repository.md +++ b/knowledge/wiki/repos/bfra-me--ha-addon-repository.md @@ -2,7 +2,7 @@ type: repo title: bfra-me/ha-addon-repository created: 2026-05-20 -updated: 2026-09-30 +updated: 2026-10-14 sources: - url: https://github.com/bfra-me/ha-addon-repository sha: 0a163c3fa8846704103658142fa742f40d165743 @@ -34,6 +34,9 @@ sources: - url: https://github.com/bfra-me/ha-addon-repository sha: b7bcd528f511809e0f5906af42ca6ff131c1ff1e accessed: 2026-09-30 + - url: https://github.com/bfra-me/ha-addon-repository + sha: b7bcd528f511809e0f5906af42ca6ff131c1ff1e + accessed: 2026-10-14 tags: - home-assistant - addon @@ -66,6 +69,54 @@ Template repository for a Home Assistant add-on repository. GitHub template (`is This is the bfra-me ecosystem's add-on counterpart to Marcus's runtime [[marcusrbrown--ha-config]] — where ha-config consumes add-ons and integrations, this repo defines the scaffolding for building and publishing new ones. +## 2026-10-14 — Unchanged source, distinct tag contracts + +Public `main` still resolves to **`b7bcd528f511809e0f5906af42ca6ff131c1ff1e`**. +The complete directory listing, both READMEs, repository and add-on manifests, +and all seven workflows were rechecked. No source change supersedes the +September 30 static findings. Earlier issue, run, advisory, registry, and +applied-protection observations remain historical; none was refreshed here. +Dockerfiles, scripts, settings, and external action implementations were not read. + +The template still declares example version **1.2.8**, architectures `aarch64` +and `amd64`, and `ghcr.io/bfra-me/addon-example`. Repository name and maintainer +remain placeholders. **Fro Bot is present**, pinned to v0.112.0, with the daily +15:30 UTC schedule; no missing-workflow onboarding draft is warranted. Its +two-step caller still has no explicit output mode or post-agent persistence +stage. This is source-shape evidence, not renewed proof of a live delivery failure. +Reusable Renovate and settings workflows remain at v4.29.0; the scheduled +prompt's “currently v4.16.6” wording is historical guidance, not the actual pin. + +### Architecture tags do not establish generic tag availability + +[`main.yaml`](https://github.com/bfra-me/ha-addon-repository/blob/b7bcd528f511809e0f5906af42ca6ff131c1ff1e/.github/workflows/main.yaml) +derives architecture-specific images (`aarch64-addon-example` and +`amd64-addon-example`) from the generic manifest image. Each architecture's +publish action receives both the version and `latest`. The separate +multi-architecture publisher receives **only the version** in `image-tags`, +and registry platform verification inspects only the generic versioned reference. + +Consequently, the source declares a generic `:1.2.8` publication path but no +explicit generic `:latest` publication or verification. An architecture-specific +`latest` tag is not evidence that `ghcr.io/bfra-me/addon-example:latest` exists +or has both platforms. External action defaults and live registry state were +not inspected, so actual generic alias availability remains unverified. This +narrows any reading of “latest” as a repository-wide multi-arch guarantee; +see [[docker-containers]]. + +### Workflow execution is broader than image selection + +The workflow runs on main pushes, PRs, and manual dispatch, but its changed +add-on selector monitors only `apparmor.txt`, `config.json`, `config.yaml`, +`config.yml`, `Dockerfile`, and `rootfs/**` within discovered add-on directories. +README, changelog, translations, and workflow files are not in that selector. +The separate `.github/scripts/**` filter gates release-integrity regression +tests, not the build matrix. Thus starting Main does not itself request an +image rebuild; manual dispatch exposes no force-build input. Actual dispatch +selection depends on the pinned paths-filter action, whose implementation was +outside this pass. The earlier validation-versus-publication finding also +persists: publish jobs do not depend on `Lint` or release-integrity success. + ## 2026-09-30 — Static contract recheck The public `main` ref still resolves to **`b7bcd528f511809e0f5906af42ca6ff131c1ff1e`**, diff --git a/knowledge/wiki/repos/bfra-me--renovate-action.md b/knowledge/wiki/repos/bfra-me--renovate-action.md index 07c09ec56..1015b3837 100644 --- a/knowledge/wiki/repos/bfra-me--renovate-action.md +++ b/knowledge/wiki/repos/bfra-me--renovate-action.md @@ -2,8 +2,11 @@ type: repo title: bfra-me/renovate-action created: 2026-05-20 -updated: 2026-10-02 +updated: 2026-10-18 sources: + - url: https://github.com/bfra-me/renovate-action + sha: 1fedb47e67fdf65dea1f3acc7590b4e0761fe28a + accessed: 2026-10-18 - url: https://github.com/bfra-me/renovate-action sha: b214c0b1b1a1803e94ff36b9cafffc610e8b33dc accessed: 2026-10-02 @@ -68,6 +71,125 @@ node_id: R_kgDOKWu8zQ # bfra-me/renovate-action +## Event-specific prompt and credential contracts (2026-10-18) + +At the same public `main` snapshot `1fedb47e67fdf65dea1f3acc7590b4e0761fe28a`, +the Fro Bot workflow distinguishes job admission, custom prompt selection, and +checkout credential persistence. These are separate predicates: + +| Event admitted by the job guard | Workflow-supplied `PROMPT` | Persist checkout credentials | +| --- | --- | --- | +| `pull_request` | `PR_REVIEW_PROMPT` | No | +| `schedule` | `AUTOHEAL_PROMPT` | Yes | +| `workflow_dispatch` | Nonempty custom input first; otherwise autoheal | Yes | +| `issues` | Empty | No | +| Non-PR `issue_comment` with trusted mention | Empty | No | +| Trusted `pull_request_review_comment` or `discussion_comment` mention | Empty | Yes | + +The dispatch review-mode guard rejects an empty custom prompt before the +agent runs. Ordinary PR conversation `issue_comment` events are excluded by +the job guard's `github.event.issue.pull_request == null` condition, even +though checkout contains a PR-issue ref expression. Review-line comments are +a distinct admitted event. `workflow_call` is declared with a required prompt, +and the selector has a custom-prompt arm for that name; this survey does not +exercise reusable-call event-context behavior. + +**Clarification of the historical credential shorthand:** persistence is +disabled on exactly `pull_request`, `issue_comment`, and `issues`, not on every +review/comment trigger. Review-line and discussion comments are outside that +denylist. An empty workflow prompt on an admitted event delegates to the +action's event handling; it does not prove an empty effective task or a failed +response. Likewise, persistence does not establish an authorized write, and +the action separately receives `github-token` on every admitted event. No +action implementation, event payload, execution log, or response was read. +See [[github-actions-ci]] for the event-matrix audit pattern. + +Source: [Fro Bot workflow](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/fro-bot.yaml). + +## Permitted-source refresh (2026-10-18) + +Public `main` at `1fedb47e67fdf65dea1f3acc7590b4e0761fe28a` retains nine +workflows and the composite-action, Docker, TypeScript, committed-dist, and +Astro/Starlight documentation layout. Evidence here is limited to directory +listings, root/docs READMEs and package manifests, `action.yaml` (the action +manifest), and all nine workflow files. No entrypoint, source/test body, +configuration file, release history, issue, PR, or run was inspected. Earlier +dated observations remain historical unless explicitly reconfirmed here. + +### Runtime authority versus version copy + +The action manifest now pins Renovate **44.166.0**, matching the root README's +release link. It still declares `runs.using: composite` and invokes +`renovatebot/github-action` **v46.3.1** with `docker-cmd-file` pointing to +`docker/entrypoint.sh`, `docker-user: root`, and Docker-socket mounting enabled. +GitHub App token creation advances to **v3.3.0**. The entrypoint's contents and +installed tools were not reread; matching paths do not prove unchanged code. + +The documentation contradiction persists: root examples use `@v9`, the notes +describe Renovate v43, and the docs README calls v9 current. The manifest still +warns that Docker removal is planned for v10 and rejects non-container modes +with v9 wording. These sources do not establish a new action release number +or a revised removal horizon; they reconfirm Docker execution and stale copy +against the accumulated v10 history below. + +The private ESM root manifest declares Node **24.22.0**, pnpm **11.28.5**, +TypeScript **6.0.3**, ESLint **10.12.0**, Prettier **3.9.10**, and Vitest +**4.1.11**; `@actions/core` **3.0.1** remains its sole runtime dependency. +The docs package retains Astro `^7.0.0`, Starlight `^0.42.0`, and Sharp +`^0.35.0`. Declared ranges are not installed-version evidence, and the root's +`0.0.0-semantic-release` value is not a published release. + +### Cache opt-in is not enforced on the push branch + +**Correction to the broad cache description below:** restore and prepare are +gated on `enable-cache == 'true'`, but finalization and save each use: + +```text +(success() || failure()) && enable-cache == 'true' && cache-hit != 'true' + || github.event_name == 'push' +``` + +With `&&` binding more tightly than `||`, the push branch bypasses both the +cache opt-in and cache-hit checks. Thus `cache: false` does not exclude these +two steps on push events. Finalization contains cache deletion and ownership +adjustment; save targets the configured cache directory. This is a static +condition finding, not evidence that a cache was actually deleted or saved. +The smallest follow-up is to keep opt-in outside the grouped hit/push +alternative and verify the event × opt-in × hit truth table. See +[[github-actions-ci]] for the cross-cutting guard pattern. + +### Workflow delivery and validation boundaries + +**Fro Bot is present**, now at agent **v0.123.0** (`1529cc2e`), retaining its +03:30 UTC daily schedule, `review`/`autoheal` choices, six categories, and +rotating daily-report prompt. `Run Fro Bot` remains the last step, with no +explicit `output-mode` or caller-side file-delivery steps. Credential +persistence remains event-scoped. This reconfirms the October 2 static gap; +it does not establish effective runtime mode, missing PRs, or report health. + +`Main` still runs the local-action self-test only on default-branch pushes +whose self-test filter matches, passing `dry-run: true`; the action manifest +confirms that maps to `RENOVATE_DRY_RUN=extract`. Rebuilding the action and +checking committed output are separate conditions: build runs for pushes or +`src-changed`, while the diff assertion requires `dist-changed`. The external +filter definitions were not read, so source-only drift coverage is unresolved. +Renovate and post-release org dispatch now call `bfra-me/.github` **v4.39.0**; +settings sync remains correctly pathed at **v4.16.0** with its daily 08:51 UTC +cron. Renovate has no independent schedule in its local workflow. The release +alert still requires a failed `Release` job and discovers reports through +label AND marker, with a 100-issue lookup cap. None of these declarations +proves recent execution success or failure. + +Sources: [tree](https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a), +[action manifest](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/action.yaml), +[README](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/README.md), +[root manifest](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/package.json), +[docs README](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/docs/README.md), +[docs manifest](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/docs/package.json), +[Main](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/main.yaml), +[Fro Bot](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/fro-bot.yaml), +[workflows](https://github.com/bfra-me/renovate-action/tree/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows). + ## Current permitted-source snapshot (2026-10-02) At public `main` SHA `b214c0b1b1a1803e94ff36b9cafffc610e8b33dc`, the tree diff --git a/knowledge/wiki/repos/fro-bot--dashboard.md b/knowledge/wiki/repos/fro-bot--dashboard.md index b3d34f0cd..e373f931b 100644 --- a/knowledge/wiki/repos/fro-bot--dashboard.md +++ b/knowledge/wiki/repos/fro-bot--dashboard.md @@ -2,9 +2,76 @@ type: repo title: fro-bot/dashboard created: 2026-06-15 -updated: 2026-10-10 +updated: 2026-10-14 node_id: R_kgDOS6ys-g sources: + - url: https://github.com/fro-bot/agent/releases/tag/v0.122.1 + accessed: 2026-10-14 + - url: https://github.com/fro-bot/dashboard/releases/tag/2026.10.24 + accessed: 2026-10-14 + - url: https://github.com/fro-bot/dashboard/blob/f12fde0d877e70f1951d0b25b0c54a778e4edbcb/src/gateway/operator-contract/run-summary.ts + sha: f12fde0d877e70f1951d0b25b0c54a778e4edbcb + accessed: 2026-10-14 + - url: https://github.com/marcusrbrown/infra/actions/runs/38481473838 + accessed: 2026-10-14 + - url: https://github.com/marcusrbrown/infra/tree/bc6bf3c03bd9c22f6e4fc606ad443083b195a435 + sha: bc6bf3c03bd9c22f6e4fc606ad443083b195a435 + accessed: 2026-10-14 + - url: https://github.com/fro-bot/.github/issues/3512#issuecomment-6153677776 + accessed: 2026-10-14 + - url: https://dashboard.fro.bot/operator/health + accessed: 2026-10-14 + - url: https://github.com/fro-bot/agent/releases/tag/v0.120.0 + accessed: 2026-10-12 + - url: https://github.com/fro-bot/dashboard/releases/tag/2026.10.22 + accessed: 2026-10-12 + - url: https://github.com/marcusrbrown/infra/actions/runs/38150071995 + accessed: 2026-10-12 + - url: https://github.com/marcusrbrown/infra/actions/runs/38173307577 + accessed: 2026-10-12 + - url: https://github.com/marcusrbrown/infra + sha: 07486ed6cf81d481f0ea7a9e25b0743969b92b6b + accessed: 2026-10-12 + - url: https://dashboard.fro.bot/operator/health + accessed: 2026-10-12 + - url: https://github.com/marcusrbrown/infra/actions/runs/38113063394 + accessed: 2026-10-11 + - url: https://github.com/marcusrbrown/infra + sha: d7b2b9e8f50dcccc7e0e9991ae872d81a51e67c9 + accessed: 2026-10-11 + - url: https://github.com/fro-bot/dashboard/releases/tag/2026.10.20 + sha: 5535b0dbe6f9f152740468ddc56c50b41d78666a + accessed: 2026-10-11 + - url: https://github.com/fro-bot/agent/releases/tag/v0.119.2 + sha: 83ed683da24111bd1474eb4bda39715ed5799bc2 + accessed: 2026-10-11 + - url: https://github.com/fro-bot/.github/issues/3512#issuecomment-6104169505 + accessed: 2026-10-11 + - url: https://github.com/users/fro-bot/projects/1 + accessed: 2026-10-11 + - url: https://github.com/marcusrbrown/infra/actions/runs/38107582154 + accessed: 2026-10-11 + - url: https://dashboard.fro.bot/operator/health + accessed: 2026-10-11 + - url: https://github.com/fro-bot/.github/issues/3512 + accessed: 2026-10-10 + - url: https://github.com/users/fro-bot/projects/1 + accessed: 2026-10-10 + - url: https://github.com/fro-bot/agent/releases/tag/v0.119.0 + accessed: 2026-10-10 + - url: https://github.com/fro-bot/agent/pull/1767 + sha: 432de95828d99f5fb36f8d82ebe2f11a5aedc883 + accessed: 2026-10-10 + - url: https://github.com/marcusrbrown/infra/pull/1502 + accessed: 2026-10-10 + - url: https://github.com/marcusrbrown/infra/actions/runs/37895560601 + sha: 3216bb06abb13bcedf8ca56f0feb52d5b212d201 + accessed: 2026-10-10 + - url: https://github.com/marcusrbrown/infra + sha: 9e5e289fb0c70cba2dfe2adc8cb09237a4040d93 + accessed: 2026-10-10 + - url: https://dashboard.fro.bot/operator/health + accessed: 2026-10-10 - url: https://github.com/fro-bot/dashboard sha: fd3c553691ae162846c4163060a26289fc224277 accessed: 2026-10-10 @@ -143,6 +210,167 @@ related: # fro-bot/dashboard +## 2026-10-14 — contract adoption includes closed-set consumers + +GitHub Releases now identifies agent **v0.122.1**, whose tagged contract is +**1.11.0**, and dashboard **2026.10.24**, whose tagged contract remains **1.9.0**. +This supersedes October 12's latest-release snapshot; public operator health +still reports **1.9.0**. The October 13 tracker comment's pending-release claim +is historical: v0.122.1 published later that evening. Release availability does +not authorize a standalone gateway cutover. + +At dashboard `f12fde0`, `src/gateway/operator-contract/run-summary.ts` accepts +only queued, running, succeeded, failed, and cancelled summary statuses. +`parseRunSummaryList` skips invalid items. Agent contract 1.11.0 adds +`waiting_for_question` and `waiting_for_approval` to summaries: changing only +the dashboard version constant could satisfy the handshake while silently +dropping waiting runs from its index. Adopt the wire vocabulary, parser, +list/card rendering, fixtures, and question-notification route together. +Verification needs waiting and settled summaries plus reconnect and terminal +cases; a successful health response alone cannot exercise this consumer. + +The actual dashboard deployment in [run 38481473838](https://github.com/marcusrbrown/infra/actions/runs/38481473838) +completed **2026-10-13 23:11:26 UTC**. Post-convergence logs identify healthy +running dashboard digest +`sha256:efd71a845ba5bd419e5c31fbea3ec65353a873d2342a8687d5d20c96f10cdaba` +and active compose tag **2026.10.24**. Infrastructure source at `bc6bf3c` +still records dashboard **2026.10.21** and gateway **v0.119.2**. Preserve this +ledger/deployment distinction and the paired, volume-aware rollback constraint +from [[marcusrbrown--infra]]. Authenticated production acceptance was not run; +the dedicated tracker still owns issue-body and Project reconciliation. + +## 2026-10-12 — latest releases diverge before the next paired cutover + +GitHub Releases identifies agent **v0.120.0** and dashboard **2026.10.22** as +latest. Their tagged operator-contract files declare **1.10.0** and **1.9.0**, +respectively. This supersedes October 11's latest-release parity snapshot, +not the production observation: public `/operator/health` still returns +`{"ok":true,"contractVersion":"1.9.0"}`. Exact-match contract enforcement means +latest release selection is not automatically a compatible deployment pair. + +The actual dashboard job in [run 38150071995](https://github.com/marcusrbrown/infra/actions/runs/38150071995) +succeeded at **2026-10-12 04:52:54 UTC**. Its logs reference target image +**2026.10.22** with digest +`sha256:6731b2d8af94e3b7d6e39affa4d3fca8bd38a561dd57ec7a79082eb3bfab32a7`. +Infrastructure main at `07486ed6cf81d481f0ea7a9e25b0743969b92b6b` still records +**2026.10.21** in `apps/dashboard/docker-compose.yaml`, while +`apps/gateway/upstream.json` records **v0.119.2**. Treat this as a source-ledger +versus deployment-run discrepancy; public health does not identify the serving +image digest. Gateway [run 38173307577](https://github.com/marcusrbrown/infra/actions/runs/38173307577) +completed its actual deployment job at **04:55:51 UTC**. Two newer green router +runs skipped both gateway and dashboard jobs, so their overall success is not +fresh deployment evidence. + +[#3512](https://github.com/fro-bot/.github/issues/3512)'s body still claims +**1.8.0 / v0.118.2 / 2026.10.15** and calls six Project-Done items Open. +The parent Project item remains **In Progress**, consistent with incomplete +authenticated acceptance. The dedicated tracker owns reconciliation. Preserve +the fail-closed contract check and the paired, volume-aware rollback constraint +from [[marcusrbrown--infra]]; this readback does not verify authenticated SSE, +question continuation, cancellation, logout, or privacy behavior. + +## 2026-10-11 — later deploy and health readback supersedes the pending snapshot + +The later daily readback observes public `/operator/health` returning +`{"ok":true,"contractVersion":"1.9.0"}`. This contradicts and supersedes the +earlier same-day **1.8.0** observation below; both remain dated evidence. +Tagged agent **v0.119.2** and dashboard **2026.10.20** still declare **1.9.0**. + +The gateway router [run 38113063394](https://github.com/marcusrbrown/infra/actions/runs/38113063394) +completed its actual `deploy-gateway / deploy-gateway` job successfully at +**05:02:17 UTC**. Dashboard [run 38107582154](https://github.com/marcusrbrown/infra/actions/runs/38107582154) +completed `deploy-dashboard` successfully at **05:04:21 UTC**, replacing its +earlier pending state. The older dashboard 2026.10.18 attempt now reports +failure; 2026.10.19 remains cancelled. Neither should be retried merely to +clear a historical queue. + +Infrastructure main at `d7b2b9e8f50dcccc7e0e9991ae872d81a51e67c9` now records +gateway **v0.119.2** in `apps/gateway/upstream.json` and dashboard +**2026.10.20** with the published image digest in +`apps/dashboard/docker-compose.yaml`. The older audit-pin lag described below +is therefore historical, not the current ledger state. + +These independent checks establish successful deployment jobs, updated source +intent, and a live contract response. They do **not** establish the running image +digest, authenticated SSE `ready`, question answer/skip continuation, Discord +settlement, terminal cleanup, expired-output recovery, or the remaining +approval/cancellation/logout/privacy acceptance checks. [#3512](https://github.com/fro-bot/.github/issues/3512) +still remains Open and Project 1 remains **In Progress / waiting**. Its body +still lists the six fixed producer/dashboard defects as Open while their +Project items are Done; production readiness and source completion remain +separate. The dedicated tracker owns reconciliation. Preserve the paired +rollback and earlier volume-snapshot requirement for [[marcusrbrown--infra]]. + +Sources: [gateway pin](https://github.com/marcusrbrown/infra/blob/d7b2b9e8f50dcccc7e0e9991ae872d81a51e67c9/apps/gateway/upstream.json), +[dashboard pin](https://github.com/marcusrbrown/infra/blob/d7b2b9e8f50dcccc7e0e9991ae872d81a51e67c9/apps/dashboard/docker-compose.yaml), +[live health](https://dashboard.fro.bot/operator/health), and the deployment runs +above; accessed 2026-10-11. + +## 2026-10-11 — released contract parity is not deployed contract parity + +GitHub Releases now identifies agent **v0.119.2** and dashboard **2026.10.20** +as latest. Their tagged `packages/gateway/src/operator-contract/version.ts` +and `src/gateway/operator-contract/version.ts` both declare **1.9.0**. +Fresh public `/operator/health` still returns **1.8.0**. This supersedes +October 10's latest-release snapshot, not its runtime observation. Health +does not establish the serving image digest or authenticated SSE behavior. + +[#3512's body](https://github.com/fro-bot/.github/issues/3512) calls agent +#1736, #1737, #1739, #1740 and dashboard #583, #584 **Open**; live issues are +**Closed**, and Project 1 marks all six **Done / ready now**. The later +[tracker comment](https://github.com/fro-bot/.github/issues/3512#issuecomment-6104169505) +already distinguishes the 1.9.0 release from the unfinished production gate. +The parent remains **Open / In Progress / waiting**, consistent with outstanding +acceptance checks; dashboard #585 and #586 remain **Open / Todo / ready now**. + +GitHub ancestry comparisons place agent [#1771](https://github.com/fro-bot/agent/pull/1771) +in v0.119.2 and dashboard [#599](https://github.com/fro-bot/dashboard/pull/599) +and [#600](https://github.com/fro-bot/dashboard/pull/600) in 2026.10.20. +That proves release inclusion, not live segment boundaries, question handling, +expired-output recovery, or Cancel-control cleanup. + +The latest [2026.10.20 deploy](https://github.com/marcusrbrown/infra/actions/runs/38107582154) +is **pending**; the 2026.10.18 deploy is **waiting**, and 2026.10.19 was +**cancelled**. The latest successful dashboard deploy remains 2026.10.17, +with audit [#1502](https://github.com/marcusrbrown/infra/pull/1502) open. +Infrastructure main still pins gateway v0.118.2 and dashboard 2026.10.15. +Neither queued intent nor the older audit ledger identifies a newer running image. + +For [[fro-bot--agent]] and [[marcusrbrown--infra]], exact-match contract checking +means even sequential paired deploys have a mismatch interval. Select fixed, +verified-compatible releases in one maintenance window; verify gateway health +then authenticated SSE and consumer flows. Keep the earlier volume-snapshot +rollback requirement. Tracker writes remain the dedicated workflow's responsibility. + +## 2026-10-10 — deployment execution can precede the audit pin + +The rollout body in [#3512](https://github.com/fro-bot/.github/issues/3512) +still names agent issues #1736, #1737, and #1740 as **Open**. Live issue state +is **Closed**, and Project 1 marks each **Done / ready now**. The third mismatch +is new since yesterday: OAuth default landing closed through +[#1767](https://github.com/fro-bot/agent/pull/1767). The overall rollout remains +**Open / In Progress / waiting**, consistent with unfinished production checks. + +Latest published agent **v0.119.0** contains the merge commits for checkout +projection (#1743) and question handling (#1749), as established by GitHub +commit comparisons. #1767's merge commit is not its ancestor. Infrastructure's +gateway source pin remains **v0.118.2**. Release inclusion therefore improved +for question handling since the October 9 snapshot, but neither that comparison +nor source closure establishes production behavior. + +Dashboard [deploy run 37895560601](https://github.com/marcusrbrown/infra/actions/runs/37895560601) +completed successfully for **2026.10.17**. Its +[audit PR #1502](https://github.com/marcusrbrown/infra/pull/1502) is still open, +while infrastructure main's compose pin and #3512's deployment table still say +**2026.10.15**. This is a deploy-then-record workflow: the main-branch pin is +an audit ledger that can lag executed deployment, not an independent serving +version oracle. Fresh public health returns contract **1.8.0**, which does not +identify a running image digest. No authenticated regression sweep was replayed. + +Keep source fixed, release included, deploy executed, audit recorded, and runtime +verified separate. Dedicated tracker ownership and the volume-snapshot/paired-image +rollback requirement remain; earlier dated snapshots are preserved below. + ## 2026-10-10 — bounded source snapshot and documented consumer boundaries This public-repository snapshot is pinned to `main` commit diff --git a/knowledge/wiki/repos/marcusrbrown--containers.md b/knowledge/wiki/repos/marcusrbrown--containers.md index bf1b272ba..28d5f203d 100644 --- a/knowledge/wiki/repos/marcusrbrown--containers.md +++ b/knowledge/wiki/repos/marcusrbrown--containers.md @@ -2,7 +2,7 @@ type: repo title: marcusrbrown/containers created: 2026-04-18 -updated: 2026-09-27 +updated: 2026-10-11 sources: - url: https://github.com/marcusrbrown/containers sha: e582f856844ac1dd52fc8739f1a9aa8398248e6e @@ -37,6 +37,9 @@ sources: - url: https://github.com/marcusrbrown/containers sha: 2c473db0db8ca362b0e4039de878ae74f5c8f0b0 accessed: 2026-09-27 + - url: https://github.com/marcusrbrown/containers + sha: 008a0d383c457c0f4b05b3db5e3b5d41e3787ed5 + accessed: 2026-10-11 tags: - docker - containers @@ -300,6 +303,81 @@ All GitHub Actions are SHA-pinned with version comments. Key actions (as of 2026 | 2026-06-28 | `289d8009` | Incremental re-survey. **pnpm crossed v10 → v11 major boundary** (security PRs #670/#671, 2026-06-27) — `mise.toml` now pins pnpm `11.9.0`. **Fro Bot agent jumped v0.65.0 → v0.79.1** (SHA `720b7216...`) across the daily Renovate cadence (#653 v0.72.0 → #669 v0.78.0 → v0.79.1). **`openai` bumped to >=2.44.0,<2.45.0**; **Node.js to 24.18.0**. Continuous Node.js/Debian base image digest rotation. PR #647 (non-major bundle) merged. Open PRs: 4 — #673 (fro-bot, actions/cache v5→v6 in setup action), #655 (fro-bot, GitHub Actions major bumps), #646 (fro-bot, FastAPI template python-multipart/pydantic-settings security), #611 (mrbro-bot pin deps). Open issues: 2 (#533 Daily Autohealing, #415 Dependency Dashboard). No structural changes. | | 2026-06-17 | `569a6c8c` | Incremental re-survey. **Pytest coverage merged** (PR #583, 2026-06-14): the long-pending Copilot SWE-agent test PR finally lands; `pyproject.toml` gains a `--cov-fail-under=35` gate and branch-coverage config over `ai_core`, `template_engine`, `containers_cli`, `predictive_maintenance`. **Security fix** (PR #643, 2026-06-14): express → 4.22.2 in `node/release` (Dependabot #35). **Fro Bot agent jumped v0.55.0 → v0.65.0** across the daily Renovate cadence (#632 v0.56.1 → #644 v0.65.0). **Open Fro-Bot-authored security PR #646:** python-multipart 0.0.22 → 0.0.32 in the FastAPI template, closing six Dependabot alerts (#29/#30/#36/#37/#38/#39). Toolchain unchanged (Node 24.16.0, pnpm 10.34.1, Python 3.13, openai >=2.41.0). Renovate preset still `#5.2.0`. Open issues down to 2 (Daily Autohealing #533, Dependency Dashboard #415); tech-debt issue #555 now closed by the merged coverage work. Open PRs: 3 (#647 mrbro-bot non-major bundle, #646 fro-bot python-multipart, #611 mrbro-bot pin deps). | +## Current Evidence — 2026-10-11 + +Public `main` was resolved to `008a0d383c457c0f4b05b3db5e3b5d41e3787ed5`. +Evidence is limited to directory listings, READMEs, manifests, and the ten workflow +files at that revision. Older findings about image contents, vulnerabilities, PR +queues, branch protection, and autoheal outcomes remain historical observations; +none was rechecked through code, Dockerfile, issue, or run reads. + +### Declared structure and automation + +The tree still contains `node/alpine`, `node/release`, archived Parity definitions, +fourteen Python implementation files under `scripts/`, and six test modules +plus `conftest.py` and `__init__.py`. `docs/templates/README.md` describes seven +templates across five categories, matching the seven `template.yaml` paths in +the listing. This establishes the library's declared inventory, not successful +generation or completeness of every template's implementation. + +The manifests retain Python `>=3.13,<3.14`, ten Poetry entry points, branch +coverage over four automation modules, and `--cov-fail-under=35`. OpenAI remains +`>=2.54.0,<2.55.0`; Anthropic remains `>=0.30.0,<1.0.0`. `mise.toml` still pins +Node 24.21.0 and pnpm 11.27.0; the root package remains Prettier-only at 3.9.0 +with `@bfra.me/prettier-config` 0.16.7. Both Node application manifests declare +Express 4.22.2, Node `>=22.0.0`, and a placeholder `test` command that exits 1. +The Python coverage gate therefore does not establish Node application coverage. + +**Fro Bot workflow is present**, still SHA-pinned to agent v0.116.0 with the +daily 14:30 UTC schedule. No missing-workflow onboarding draft is warranted. +Its source still omits an explicit `output-mode` and ends at the agent step; +the scheduled prompt requests commits, pushes, and PRs. This preserves the +delivery-contract question from earlier surveys without proving current run +behavior. Presence does not establish enabled state or successful remediation. +Both reusable Renovate/settings workflows remain at v4.33.0. Buildx and QEMU +remain v4.4.0, build-push v7.4.0; the inspected SARIF uploads now use CodeQL +v4.38.0. These are source pins, not release-availability checks. + +### Documentation and workflow contracts diverge + +- **Application changes do not trigger the advertised publication lane.** + `node/README.md` says application-code updates trigger builds, but + `build-publish.yaml` includes only Dockerfile and `scripts/**` paths in its + push/PR triggers and detects only changed Dockerfiles. A change confined to + `node/*/index.js`, `package.json`, or `docker-entrypoint.sh` neither matches + that trigger nor selects an image. The scripts-only empty-matrix mismatch + recorded September 27 also remains. Manual dispatch selects all active + Dockerfiles, but it is a separate route. See [[docker-containers]]. +- **Build smoke testing is narrower than application acceptance.** + `test.yaml` builds AMD64 images and inspects them, then overrides the entrypoint + to run `sh -c "exit 0"`. Failure of that command only prints an informational + message. It does not start the declared application or probe `/health` and + `/info`; image construction is checked, application functionality is not + established by that step. No runtime failure is inferred. +- **Skipped work can still produce successful aggregate checks.** The manual + dispatch path still skips `prepare`, while dependent test jobs lack a status + function to override the implicit success prerequisite. The always-running + build/security aggregators reject only `failure` or `cancelled`, accepting + `skipped`. They do not distinguish intentional no-change skips from missing + expected work. This is a static job-graph observation, not a run result. +- **Release description correction:** the older table says `release.yaml` + triggers on tags and provides release automation. At the inspected revision + it triggers on pushes to `main` and dispatch, runs only setup and + `generate-image-tags`, and leaves tag application/build/push as comments. + Actual build/publication steps live in `build-publish.yaml`; a workflow or + job name is not evidence that an image was published. + +`node/README.md` additionally names Node 22 bases and mentions ARM alongside +AMD64/ARM64, while the build workflow defaults to only AMD64/ARM64. Earlier +Dockerfile-derived Node 24 observations are retained as dated evidence; this +bounded read cannot resolve the actual base or runtime version. The root README's +three-script tutorial remains narrower than the ten-entry-point manifest. + +Sources: [Node README](https://github.com/marcusrbrown/containers/blob/008a0d383c457c0f4b05b3db5e3b5d41e3787ed5/node/README.md), +[build/publish workflow](https://github.com/marcusrbrown/containers/blob/008a0d383c457c0f4b05b3db5e3b5d41e3787ed5/.github/workflows/build-publish.yaml), +[test workflow](https://github.com/marcusrbrown/containers/blob/008a0d383c457c0f4b05b3db5e3b5d41e3787ed5/.github/workflows/test.yaml), +[release workflow](https://github.com/marcusrbrown/containers/blob/008a0d383c457c0f4b05b3db5e3b5d41e3787ed5/.github/workflows/release.yaml). + ## Delta — 2026-09-27 Limited Survey Public `main` HEAD `2c473db0db8ca362b0e4039de878ae74f5c8f0b0` (committer date 2026-09-26). Read scope: directory listings, root README, `pyproject.toml`, `mise.toml`, `package.json`, and selected workflow files; no Dockerfiles, scripts, lockfiles, issue bodies, or run results were read. Historical claims about open PRs, vulnerabilities, image contents, and merge behavior above remain dated to the earlier surveys, not independently re-confirmed here. diff --git a/knowledge/wiki/repos/marcusrbrown--dev-like.md b/knowledge/wiki/repos/marcusrbrown--dev-like.md index 767a13bb9..9b89f10bc 100644 --- a/knowledge/wiki/repos/marcusrbrown--dev-like.md +++ b/knowledge/wiki/repos/marcusrbrown--dev-like.md @@ -2,8 +2,11 @@ type: repo title: marcusrbrown/dev-like created: 2026-07-12 -updated: 2026-09-28 +updated: 2026-10-12 sources: + - url: https://github.com/marcusrbrown/dev-like + sha: 34141048abc24c19f463e20d3d54cbc797b275d1 + accessed: 2026-10-12 - url: https://github.com/marcusrbrown/dev-like sha: c7defd9c89568909f8a598b1e3d37b204414e257 accessed: 2026-07-12 @@ -49,6 +52,17 @@ node_id: R_kgDOTVrJ0w # marcusrbrown/dev-like +## Limited re-survey — 2026-10-12 + +Public `main` at `34141048abc24c19f463e20d3d54cbc797b275d1`. Evidence is limited to a complete directory listing, the root README, root/docs package manifests, and all seven workflow files at that commit. Upstream prompts were read as configuration evidence, not followed. Older publication, queue, security-alert, and eval observations below remain dated evidence; this pass does not refresh those outcomes. + +- **Distribution and consent remain explicit README contracts:** public professional sources, source URLs for claims, a `stated`-tier floor for individuals, and an opt-out promise within 48 hours. The five registry directories remain `37signals`, `every`, `linear`, `oxide`, and `theo`. The September ambiguity persists: the README calls Theo's skill “generated on demand,” while its generated skill directory remains listed. This establishes documentation/tree disagreement, not installer behavior or verified schema enforcement. +- **Package boundaries:** root `dev-like` remains **0.4.1**, MIT, ESM, Node `>=20`, with no declared runtime dependencies and `@changesets/cli` **2.31.1** as its sole devDependency. Its publish file allowlist excludes `docs/` and `evals/`. The private docs workspace still carries Astro/Starlight and image-rendering dependencies; Playwright is now **1.64.0** (September: 1.63.0). “Zero runtime dependencies” describes the root CLI package, not every workspace. These are manifest declarations, not an npm publication or tarball inspection. +- **Fro Bot is present:** `fro-bot.yaml` retains autoheal/pr-review modes and daily `30 14 * * *`, now pinned to **v0.121.0** (`50b5dd4`). No missing-workflow onboarding follow-up is warranted. Its agent step receives `github-token` but declares no `output-mode`; the only later step reports failed/cancelled runs to the rolling issue and does not deliver working-tree edits. This is a caller-configuration gap, not proof of the action's resolved mode or any lost fix. The failure reporter is not restricted to scheduled autoheal: a failing review invocation can reach it too. Successful no-safe-fix reporting remains agent-prompt-owned. See [[github-actions-ci]] for the separate delivery and notification contracts. +- **Verification is split across workflows:** CI runs root validation and both Node/Bun test runners. Site separately validates the registry, runs docs tests, then builds/generated-pages/internal-link checks before Pages upload/deploy. Site is push-path-filtered to `docs/**`, `registry/**`, and its own YAML, with manual dispatch also available. Root CI does not run the docs suite. Release still uses Changesets, an App token for version PRs, Node 24, and npm OIDC, now installing **npm 11.21.0** (September: 11.20.0). Renovate/settings reusable workflows both advance to **bfra-me/.github v4.38.0** (`3ed5464`; September: v4.34.0). These pins and job definitions establish configured checks, not successful runs or live npm-side trust configuration. + +The tree still lists only `registry/schema/entry.schema.json`, not `index.schema.json`. The older dangling-schema finding remains only partially rechecked: `registry/index.json` and validator implementations were outside this pass. No CodeQL/Scorecard workflow file is listed; that does not establish the current state of externally configured scanning. The prior settings-owner attribution correction remains in force; settings configuration was not read. + ## Limited re-survey — 2026-09-28 Public `main` at `0d604821930faafd600f5ccc342ab4ea166b0567`. This pass read only directory listings, the root README, root and docs package manifests, and the seven workflows. It does **not** re-check historical run results, publication history, registry entry contents, or the implementation of the validators. The older observations below remain dated snapshots. diff --git a/knowledge/wiki/repos/marcusrbrown--esphome-life.md b/knowledge/wiki/repos/marcusrbrown--esphome-life.md index b015b5853..8a9c3ca94 100644 --- a/knowledge/wiki/repos/marcusrbrown--esphome-life.md +++ b/knowledge/wiki/repos/marcusrbrown--esphome-life.md @@ -2,8 +2,11 @@ type: repo title: marcusrbrown/esphome.life created: 2026-04-18 -updated: 2026-09-30 +updated: 2026-10-14 sources: + - url: https://github.com/marcusrbrown/esphome.life + sha: 878b4225e448152dc63c8a41418812cb466c1fbf + accessed: 2026-10-14 - url: https://github.com/marcusrbrown/esphome.life sha: 6852f168e06bce3373901bea9fdb79bf4aee831f accessed: 2026-09-30 @@ -82,6 +85,53 @@ ESPHome device configuration repository for Marcus R. Brown's IoT devices. Forke ## Overview +### Current source observations (2026-10-14) + +The public `main` snapshot at `878b4225e448152dc63c8a41418812cb466c1fbf` +still has 17 tracked files and three workflows: `ci.yaml`, `renovate.yaml`, +and `update-repo-settings.yaml`. **No Fro Bot workflow is present** under any +filename; a separate follow-up draft PR remains a candidate. + +Both reusable-workflow callers now pin `bfra-me/.github` **v4.38.0** +(`3ed54641863149b0f37ed596d7967deac6862a3f`), superseding the September 30 +v4.34.0 snapshot as the current pin. The settings caller still invokes +**`renovate.yaml`**, rather than a settings workflow, on push to `main`, +the daily `23 12 * * *` schedule, and dispatch. The wrong-path finding in +[[probot-settings]] therefore persists; this pass did not inspect upstream +workflow bodies or measure duplicate runs. + +The CI workflow still builds only `olimex-bluetooth-proxy-1349f4.yaml`; the +other device file, `olimex-bluetooth-proxy-13451c.yaml`, remains outside its +matrix. CI and the devcontainer manifest still pin **ESPHome 2025.12.7**. +The build action remains **v7.4.0**, and Pages deployment remains **v4.9.0**. +The combined manifest still reads `needs.build.outputs.esphome-version` +from a gate job with no outputs, rather than the producing `build-firmware` +job. The September 30 distribution-metadata finding remains reproducible +from the workflow alone; see [[esphome]]. No generated manifest or deployed +site was read. + +**Dispatch input without a forwarding path.** `renovate.yaml` advertises a +`log-level` string input with default `debug`, but its reusable-workflow job +passes only `print-config` in `with:`. Selecting a log level in the dispatch +form does not pass that value to the callee through the declared input +contract. This is a caller-side wiring observation, not a claim about the +callee's default logging level or a failed run. + +`docs/readme.md` still describes the upstream project template and directs +readers to nonexistent `publish.yml` and `ci.yml` workflow paths; the actual +combined pipeline is `ci.yaml`. The listing contains no package manifest. +Device YAML bodies, static-site content, settings/Renovate configuration, +issue/PR state, dashboard approvals, releases, and run history were outside +this survey's read scope. Older observations about them remain dated evidence, +not refreshed claims. + +Sources: [tree](https://github.com/marcusrbrown/esphome.life/tree/878b4225e448152dc63c8a41418812cb466c1fbf), +[CI workflow](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.github/workflows/ci.yaml), +[Renovate caller](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.github/workflows/renovate.yaml), +[settings caller](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.github/workflows/update-repo-settings.yaml), +[devcontainer manifest](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/.devcontainer.json), +[README](https://github.com/marcusrbrown/esphome.life/blob/878b4225e448152dc63c8a41418812cb466c1fbf/docs/readme.md). + ### Current source observations (2026-09-30) The public `main` tree at `6852f168e06bce3373901bea9fdb79bf4aee831f` diff --git a/knowledge/wiki/repos/marcusrbrown--extend-vscode.md b/knowledge/wiki/repos/marcusrbrown--extend-vscode.md index 06cb156ff..c4d322562 100644 --- a/knowledge/wiki/repos/marcusrbrown--extend-vscode.md +++ b/knowledge/wiki/repos/marcusrbrown--extend-vscode.md @@ -2,7 +2,7 @@ type: repo title: marcusrbrown/extend-vscode created: 2026-04-18 -updated: 2026-09-15 +updated: 2026-10-15 sources: - url: https://github.com/marcusrbrown/extend-vscode sha: a4dcbbb175828a60855053d778fd21903a3d73d6 @@ -52,6 +52,9 @@ sources: - url: https://github.com/marcusrbrown/extend-vscode sha: 2c78b3d2b86a0f3dd09171131ae6e29916118fcc accessed: 2026-09-15 + - url: https://github.com/marcusrbrown/extend-vscode + sha: 3c1dafe6d45f9772cbadc02c9f09fe99de26810f + accessed: 2026-10-15 tags: - vscode - vscode-extension @@ -75,6 +78,60 @@ node_id: MDEwOlJlcG9zaXRvcnkzMTMzNjg1OTU= Modular toolkit for building VS Code extensions. Provides typed abstractions for commands, webviews, tree views, status bar, tasks, telemetry, configuration, and logging — targeting both Node.js and Web (browser) extension hosts. +## Current declared contracts (2026-10-15) + +Evidence is limited to the directory listing, README, package manifest, and all +six workflow files at commit `3c1dafe6d45f9772cbadc02c9f09fe99de26810f`. +The repository was verified public. Earlier architecture descriptions and dated +issue, release, run-health, settings, and dependency-policy observations remain +historical evidence; source implementations and live operational state were not +rechecked in this pass. + +- **Manifest baseline:** version `0.1.0`, pnpm `10.34.5`, TypeScript `5.9.3`, + tsup `8.5.1`, ESLint `10.12.0`, `typescript-eslint` `8.71.0`, + `@bfra.me/eslint-config` `0.54.0`, Playwright `1.64.0`, and + `@types/vscode` `1.140.0`. The engine remains `^1.102.0`; + Vitest remains `4.1.11` versus coverage/UI packages `4.1.0`. +- **Compatibility documentation contradicts the manifest:** the README badge + advertises VS Code **1.71+**, while `engines.vscode` starts at **1.102.0**. + Types now sit **38 minor versions** above that engine floor, versus 35 in the + September snapshot. This is a declaration mismatch, not evidence that the + implementation calls newer APIs. +- **Correction to “conditional exports” above and in earlier surveys:** the + extension host entries are split (`main: ./out/node/extension.js`, + `browser: ./out/web/extension.js`), but all nine `exports` entries specify only + `types` and `default`, both under `out/node/`. There is no `browser` export + condition. Browser extension activation and browser-safe library imports are + separate contracts; the manifest establishes the former's entry point, not + the latter's availability. See [[vscode-extensions]]. +- **Explicit type checking is outside the declared CI steps:** `type-check` + exists as `tsc --noEmit`, and the manual publishing scripts call it. + `main.yaml` calls lint, unit tests, web tests, and build; `publish.yaml` has + eight validation legs but no explicit type-check invocation. Whether build + or lint indirectly checks types is unverified because their configurations + and implementations were outside scope. Integration, visual, coverage, and + UI test scripts also have no active invocation in these six workflows; + integration is commented out of the publish matrix. +- **Release instructions describe two paths:** the README labels manual + version/changelog edits, `vsce` packaging, and tag pushing as a “suggested” + release flow. The workflow instead invokes semantic-release after secret + availability checks and the validation matrix. Neither declarations nor + `version: 0.1.0` prove a present release count or current pipeline health. +- **Reusable callers remain correctly pathed:** Renovate and settings sync both + use `bfra-me/.github` at `e62de417e8e22026f63890558ace7c574ee2a31f` + (v4.39.0), respectively calling upstream `renovate.yaml` and + `update-repo-settings.yaml`. Renovate still declares no schedule; settings + sync declares `23 0 * * *`. These are workflow declarations, not measured + execution times or proof of external dispatch cadence. +- **Fro Bot workflow still absent:** the complete workflow listing contains + only `main.yaml`, `publish.yaml`, `rollback.yaml`, `renovate.yaml`, + `cache-cleanup.yaml`, and `update-repo-settings.yaml`; none references the + Fro Bot agent. A separate follow-up draft PR can propose onboarding. + +Sources: [README](https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/README.md), +[manifest](https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/package.json), +and [workflow directory](https://github.com/marcusrbrown/extend-vscode/tree/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/.github/workflows). + ## Overview - **Purpose:** Reference extension + reusable toolkit for VS Code extension development diff --git a/knowledge/wiki/repos/marcusrbrown--marcusrbrown-com.md b/knowledge/wiki/repos/marcusrbrown--marcusrbrown-com.md index 65d0b3ad2..caf9dee4e 100644 --- a/knowledge/wiki/repos/marcusrbrown--marcusrbrown-com.md +++ b/knowledge/wiki/repos/marcusrbrown--marcusrbrown-com.md @@ -2,7 +2,7 @@ type: repo title: marcusrbrown/marcusrbrown.com created: 2026-07-13 -updated: 2026-10-01 +updated: 2026-10-18 node_id: R_kgDOPOkk2A sources: - url: https://github.com/marcusrbrown/marcusrbrown.com @@ -20,6 +20,9 @@ sources: - url: https://github.com/marcusrbrown/marcusrbrown.com sha: 6f975b1d7bb09ea515f2628ff50e2f4b8e68020d accessed: 2026-10-01 + - url: https://github.com/marcusrbrown/marcusrbrown.com + sha: 9e2adcc677240a5180aa40f84bc56def31453b20 + accessed: 2026-10-18 tags: - brand-site - react @@ -54,7 +57,54 @@ related: Personal brand site for Marcus R. Brown ("Principal Software Engineer"). Single-page React 19 landing site deployed to [[github-pages]] at [marcusrbrown.com](https://marcusrbrown.com). Simpler than [[marcusrbrown--marcusrbrown-github-io]] (the full developer portfolio at mrbro.dev) — no routing, no theme system, no blog. -## Current bounded observations (2026-10-01) +## Current bounded observations (2026-10-18) + +Public `main` resolves to `9e2adcc677240a5180aa40f84bc56def31453b20`. +Only the directory listing, README, package/workspace manifests, and all five +workflow files were read. The listing still contains 66 files, including 15 +under `src/`, 15 under `scripts/`, and one E2E test. Matching paths establish +layout continuity, not unchanged implementation. Historical outage, issue/PR, +coverage, installed-version, and live-site claims below were not revalidated. + +- **Stack declarations:** React `^19.0.0`, TypeScript `^6.0.0`, Vite `^8.1.3`, + Vitest `^4.0.0`, and ESLint `^10.0.0` retain their ranges. pnpm advances from + October 1's 11.28.1 to **11.28.5**. Node's engine floor remains `>=22.0.0`; + setup-action internals were not read, so the current CI runtime is unverified. + The workspace still has 16 overrides; `postcss` is now **8.5.30**, previously + 8.5.28. These declarations do not prove effective installed resolutions. +- **Fro Bot is present**, pinned to + `7d273ac643c8f9c0dc8615222677693dc337adef` (**v0.122.3**, October 1: + v0.117.1). Three dispatch modes and the two daily crons persist. The caller + still ends at `Run Fro Bot`, with no explicit `output-mode` or subsequent + publication step. This is a missing explicit delivery contract, not proof + that the supplied PAT cannot publish. No workflow-onboarding draft is needed. +- **PR CI versus deployment:** Quality Gate still requires lint, build, unit + tests, type checking, and dependency validation including the moderate audit. + Deploy runs lint and `build`, which expands to **`tsc && vite build`**; thus + deployment includes compilation without a separately named type-check job. + It does not execute unit tests, Playwright, or the audit, and depends only on + its own build job. No inspected workflow invokes `test:e2e` or Lighthouse. + CodeQL and Scorecard remain absent from the workflow listing. +- CI's App-token step explicitly requests contents read and pull-requests write + with `actions/create-github-app-token` v3.3.0; build artifact upload is v7.0.2. + Renovate's reusable workflow now pins **bfra-me/.github v4.39.0** + (`e62de417e8e22026f63890558ace7c574ee2a31f`), up from v4.35.0. It still has + no cron and includes successful Deploy completion among its triggers. +- **Contradictions retained:** README's badge, manifest repository URL, and all + three agent prompts still name `marcusrbrown.github.io`. README's pnpm + 10.13.1+ and ESLint 9 wording still lag the manifest. Its `LICENSE` link has + no matching listed file. The manifest's override object remains top-level, + preserving October 1's correction to older `pnpm.overrides` terminology; + no package-manager execution was used to adjudicate resolution behavior. + +See [[github-pages]] for the compilation-versus-full-CI distinction. + +Sources: [README](https://github.com/marcusrbrown/marcusrbrown.com/blob/9e2adcc677240a5180aa40f84bc56def31453b20/README.md), +[manifest](https://github.com/marcusrbrown/marcusrbrown.com/blob/9e2adcc677240a5180aa40f84bc56def31453b20/package.json), +[workspace](https://github.com/marcusrbrown/marcusrbrown.com/blob/9e2adcc677240a5180aa40f84bc56def31453b20/pnpm-workspace.yaml), +[workflows](https://github.com/marcusrbrown/marcusrbrown.com/tree/9e2adcc677240a5180aa40f84bc56def31453b20/.github/workflows). + +## Earlier bounded observations (2026-10-01) Public `main` resolves to `6f975b1d7bb09ea515f2628ff50e2f4b8e68020d`. This pass reads only directory listings, README, package/workspace manifests, diff --git a/knowledge/wiki/repos/marcusrbrown--marcusrbrown-github-io.md b/knowledge/wiki/repos/marcusrbrown--marcusrbrown-github-io.md index 0b4b5d22c..9933460ff 100644 --- a/knowledge/wiki/repos/marcusrbrown--marcusrbrown-github-io.md +++ b/knowledge/wiki/repos/marcusrbrown--marcusrbrown-github-io.md @@ -2,7 +2,7 @@ type: repo title: marcusrbrown/marcusrbrown.github.io created: 2026-04-25 -updated: 2026-09-28 +updated: 2026-10-12 sources: - url: https://github.com/marcusrbrown/marcusrbrown.github.io sha: ec4b7854bee556aadd301950392268f70817d800 @@ -115,6 +115,9 @@ sources: - url: https://github.com/marcusrbrown/marcusrbrown.github.io sha: aa563beb2426b9bd94ff26a5d35ea48042050b7b accessed: 2026-09-28 + - url: https://github.com/marcusrbrown/marcusrbrown.github.io + sha: 8a1567dfedb1258675e4cfa39d2e5c1854dc3487 + accessed: 2026-10-12 tags: - brand-site - react @@ -680,6 +683,61 @@ The name still resolves to public repo id `1174807412` / node id `R_kgDORgYjdA` - **A live wording contradiction:** `tests/visual/README.md` says the visual tests save screenshots with `page.screenshot({ path })` for manual review and **do not use `toMatchSnapshot()` for automated diff comparison**. Yet `e2e-tests.yaml` labels a successful visual job “All screenshots matched.” That success demonstrates the job's steps passed, not screenshot parity. Treat the older “visual regression” claims on this page and [[github-pages]] as test-suite names, not evidence of automatic pixel comparison. The README's stack table also still says “pnpm v11.1.3+” and “Vite 7”; the current manifest requires `engines.pnpm >=11.11.0` and pins `pnpm@11.27.0`, while Vite remains `7.3.6`. - **Deployment and updater remain distinct.** `deploy.yaml` builds with `GITHUB_PAGES=true`, injects optional `VITE_UMAMI_WEBSITE_ID` only at the build step, and uploads `dist/` to Pages; the workflow does not reveal whether the repo variable is set, so activation is not inferred. `blog-refresh.yaml` publishes semantic changes to one rolling PR using a late-minted App token; `renovate.yaml` calls `bfra-me/.github` at v4.31.0 on an hourly `17 * * * *` schedule. Eight workflow files still exist. The manifest holds React 19, React Router `^7.18.2`, TypeScript 5.9.3, Vite 7.3.6, Vitest 4.1.11, Playwright 1.63.0, Node `>=24`, and pnpm 11.27.0. Security overrides and three advisory exceptions live in `pnpm-workspace.yaml`; the CI `pnpm audit --audit-level moderate` gate remains. The current README's clone/badge links still use the old `marcusrbrown/mrbro.dev` name; their resolution was not tested. +## Current deployment and evidence boundaries (2026-10-12) + +At `8a1567dfedb1258675e4cfa39d2e5c1854dc3487`, the public target's README +and manifest still identify the **mrbro.dev developer portfolio**, not the +historical brand site now documented at [[marcusrbrown--marcusrbrown-com]]. +The old brand-site sections and name-collision record above remain historical. +The README still uses `marcusrbrown/mrbro.dev` in clone, Codespaces, and badge +links, while `package.json` declares the surveyed `marcusrbrown.github.io` +repository URL. Those old links were not followed. + +- **Deployment has its own lint/test/compiler chain.** `deploy.yaml` runs + lint, `pnpm run test` (Vitest), and `pnpm run build` before uploading `dist`; + the deploy job depends on that build job. The manifest expands build into + `check-types`, Vite, and blog prerendering; `check-types` compiles both the + root project and `.opencode/tsconfig.json`. Unlike the separate brand-site + deployment, this portfolio does execute unit tests before Pages upload. + It does not invoke coverage, Playwright, Lighthouse, the RSC boundary check, + or `pnpm audit` in deployment. Separate PR CI runs coverage conditionally + and the RSC/advisory checks unconditionally. See [[github-pages]] for the + distinction between merge checks and deployment dependencies. +- **Fro Bot remains present at v0.113.2**, SHA + `43023e5b9755fe307c03ede1067cc182564d30e3`. Scheduled autoheal explicitly + selects `branch-pr`; generic interactive execution is separate from bounded + live-audit discovery and its deterministic reporter. The reporter's write + mode defaults to `disabled`, and dispatched `live-audit` explicitly selects + `disabled`. The workflow's existence establishes configuration, not live + activation or successful findings publication. No missing-workflow onboarding + proposal is justified. The workflow directory still contains eight files. +- **Visual claims still conflict.** The root README promises automated + screenshot comparisons, while `tests/visual/README.md` explicitly describes + screenshot artifacts for manual review without `toMatchSnapshot()`. + This independently preserves the September 28 contradiction; source test + implementations were not read, so automated pixel parity is not established. +- **Current manifest contract:** React `^19.0.0`, React Router `^7.18.2`, + TypeScript 5.9.3, Vite 7.3.6, Vitest 4.1.11, Playwright 1.63.0, + `pnpm@11.27.0`, Node `>=24.0.0`, and pnpm engine `>=11.11.0`. + The README's pnpm prerequisite remains `11.1.3+`, below the manifest engine + floor. README badge metrics are checked-in claims, not current test results. +- **Analytics state remains unmeasured.** The build still injects optional + `VITE_UMAMI_WEBSITE_ID` from the repository variable only on the build step. + Its value, the deployed tracker, DNS, and live site behavior were not read. + Older disabled-in-production statements remain dated observations. + +Evidence was limited to directory listings, README files, the package manifest, +and workflow definitions pinned to this SHA. Issues, PRs, workflow runs, other +configuration files, and implementation source were not inspected; earlier +queue and runtime findings are not refreshed by this observation. + +Sources: [README](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/README.md), +[manifest](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/package.json), +[Deploy](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/.github/workflows/deploy.yaml), +[CI](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/.github/workflows/ci.yaml), +[Fro Bot](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/.github/workflows/fro-bot.yaml), +[visual README](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/tests/visual/README.md). + ## Survey History | Date | SHA | Notes | diff --git a/knowledge/wiki/repos/marcusrbrown--opencode-copilot-delegate.md b/knowledge/wiki/repos/marcusrbrown--opencode-copilot-delegate.md index b4ca02984..35ac81aa0 100644 --- a/knowledge/wiki/repos/marcusrbrown--opencode-copilot-delegate.md +++ b/knowledge/wiki/repos/marcusrbrown--opencode-copilot-delegate.md @@ -2,8 +2,11 @@ type: repo title: marcusrbrown/opencode-copilot-delegate created: 2026-04-23 -updated: 2026-09-26 +updated: 2026-10-10 sources: + - url: https://github.com/marcusrbrown/opencode-copilot-delegate + sha: 647200a3a3a99d874510da4f2f8c9efbcacd2ad8 + accessed: 2026-10-10 - url: https://github.com/marcusrbrown/opencode-copilot-delegate sha: bea3f576d7218900b9216a8a2c2947003660809b accessed: 2026-04-23 @@ -61,6 +64,65 @@ node_id: R_kgDOSKIp0Q OpenCode plugin that delegates tasks to GitHub Copilot CLI as background subprocesses with async completion notifications. +## Bounded Source Snapshot (2026-10-10) + +At `647200a3`, the public repository's manifest still declares **0.12.1**, +ESM, Node **>=24**, and three package exports: the default server entry, +`./plugin` alias, and opt-in `./tui`. `oc-plugin: [server, tui]` declares both +halves. This is a source-version observation, not a registry/release lookup. +Only directory listings, README, `package.json`, and all six workflow files +were read; source code, tests, configuration contents, issues, releases, and +run telemetry were not rechecked. Earlier runtime and queue claims remain +dated evidence rather than fresh verification. + +Compared with the September 26 manifest figures retained below: Biome **2.5.14 → +2.5.15**, `@opencode-ai/plugin` dev pin **1.18.32 → 1.18.35**, and +`@types/node` **24.13.6 → 24.19.1**. Current `solid-js` is **1.9.16**; +TypeScript **7.0.2**, `@types/bun` **1.4.2**, `@opentui/core` and +`@opentui/solid` **0.2.7**, and zod **^4.3.0** remain declared. The only +peer is `@opencode-ai/plugin >=1.14.41`; the maintenance/review prompts +still name an SDK peer that the manifest does not declare. Mise and Biome +configuration pins were outside this pass's read scope. + +**The documentation contradiction persists.** README enumerates three tools +and never names `copilot_resume`; the directory listing includes +`src/tools/resume.ts` and `tests/resume.test.ts` alongside delegate/output/cancel. +This supports retaining the earlier four-tool finding, without proving current +registration behavior from filenames. README still describes +`client.session.prompt` with a first-notification policy, against the earlier +`promptAsync`/in-flight-count finding. That runtime discrepancy remains +unresolved by these permitted reads. The exact-version example still says +`0.1.0` while the manifest says `0.12.1`, and README is still shipped in +`files[]`. + +**CI coverage is narrower than the manifest's test surface.** `ci.yaml` +installs with Bun's frozen lockfile, typechecks, lints, builds, imports the +built default entry under Node 24, asserts a sole function-valued default +export, then runs **only `test:unit`** (`tests/*.test.ts`). The separate +`test:tui` script preloads `@opentui/solid/preload` for `src/tui/__tests__`, +and `test:integration` targets `tests/integration/`; neither is invoked by +the six inspected workflows. The smoke test does not invoke the plugin +factory or import `./tui`. See [[opencode-plugins]] for the distinction +between package-entry shape and host behavior. Release remains gated on a +successful main CI run or manual dispatch and uses Changesets with an App +token and `id-token: write`; actual publication was not verified. + +**Fro Bot is present** at SHA-pinned **v0.119.0**, still scheduled daily at +16:00 UTC. Its final step remains `Run Fro Bot`, with no explicit +`output-mode` or downstream delivery step, despite a prompt asking for +commits/pushes. This is the workflow's declared shape, not proof of failed +delivery. Checkout still conditionally disables persisted credentials for +`pull_request`, `issue_comment`, and `issues`; Fro Bot and Copilot setup use +Bun `latest`. Renovate's reusable caller now carries **v4.37.0**, while +settings sync retains bare SHA `f6a7976c5cc48af150f7de3df331362262f15a18` +without a version comment. Neither pin proves live execution or update +detection. A missing-Fro-Bot-workflow proposal is not warranted. + +Sources: [README](https://github.com/marcusrbrown/opencode-copilot-delegate/blob/647200a3a3a99d874510da4f2f8c9efbcacd2ad8/README.md), +[manifest](https://github.com/marcusrbrown/opencode-copilot-delegate/blob/647200a3a3a99d874510da4f2f8c9efbcacd2ad8/package.json), +[directory listing](https://github.com/marcusrbrown/opencode-copilot-delegate/tree/647200a3a3a99d874510da4f2f8c9efbcacd2ad8), +and [workflows](https://github.com/marcusrbrown/opencode-copilot-delegate/tree/647200a3a3a99d874510da4f2f8c9efbcacd2ad8/.github/workflows). + ## Overview An [OpenCode](https://opencode.ai) plugin registering four tools — `copilot_delegate`, `copilot_output`, `copilot_cancel`, `copilot_resume` — that allow a parent OpenCode agent to spawn `copilot -p` as a background process, continue productive work, and receive a `` notification when the subprocess completes. The async pattern mirrors OMO's `background_task` / `background_output` architecture. diff --git a/knowledge/wiki/repos/marcusrbrown--panthe-ai.md b/knowledge/wiki/repos/marcusrbrown--panthea.md similarity index 52% rename from knowledge/wiki/repos/marcusrbrown--panthe-ai.md rename to knowledge/wiki/repos/marcusrbrown--panthea.md index d95d72a05..a4f68d92c 100644 --- a/knowledge/wiki/repos/marcusrbrown--panthe-ai.md +++ b/knowledge/wiki/repos/marcusrbrown--panthea.md @@ -1,8 +1,8 @@ --- type: repo -title: marcusrbrown/panthe.ai +title: marcusrbrown/panthea created: 2026-09-26 -updated: 2026-09-26 +updated: 2026-10-10 sources: - url: https://github.com/marcusrbrown/panthe.ai sha: e5022aaa6e9970e66b41ad68334f2fb7781658e7 @@ -10,6 +10,9 @@ sources: - url: https://github.com/marcusrbrown/panthe.ai sha: f0c4ff0119bfb82feb0591950247cdd9e0596c17 accessed: 2026-09-26 + - url: https://github.com/marcusrbrown/panthea + sha: c74fe32b46ecdf332b916295a18c1c2a8d11d008 + accessed: 2026-10-10 tags: - repository-stub - no-workflow @@ -19,9 +22,74 @@ tags: related: - github-actions-ci - marcusrbrown--mothership +node_id: R_kgDOJt6i0Q --- -# marcusrbrown/panthe.ai +# marcusrbrown/panthea + +## 2026-10-10 — Studio and repository automation + +At `c74fe32`, the public repository resolves as `marcusrbrown/panthea`; the +earlier `panthe.ai` URLs and September observations below remain historical +provenance. This bounded survey reads directory listings, READMEs, manifests, +and workflows only. It does not independently inspect implementation, run +scenarios, or establish release/deployment status. + +**Dated contradiction:** the September absence of Fro Bot is superseded at +this commit. The complete, non-truncated tree now contains four workflows: +`ci.yaml`, `fro-bot.yaml`, `renovate.yaml`, and `update-repo-settings.yaml`. +Fro Bot onboarding is present; the earlier recommendation to draft onboarding +does not apply to this snapshot. See [[github-actions-ci]] for its delivery +and verification contracts. + +### Workspace expansion and authoring interface + +- The workspace now adds `apps/studio` and `tools/studio`, retaining the + desktop/client/simulation apps and eight package boundaries. Root workspace + globs additionally include `tools/probes/*`. Bun remains **1.4.2**, + TypeScript **5.9.3**; Biome is **2.5.15** and the root test command is + `bun test --parallel=4`. The client and Studio manifests pin React **19.3.0** + and Tauri API **2.12.1**, with Three.js **0.185.1**, Three Flatland + **0.1.0-alpha.10**, and Vite **7.3.6**. Both inspected Rust manifests pin + `tauri = "=2.12.1"`; Studio also pins the Tauri CLI to **2.12.1**. +- `tools/studio/README.md` describes a headless CLI sharing + `@panthea/assets/studio` with the app, rather than owning a separate pipeline. + Its session protocol is newline-delimited JSON with request IDs; stdout + carries results, stderr diagnostics. Generation failures exit nonzero. + The documented operations cover generation, conformance, editing, packing, + approval, and publication, with read-only inspection available while another + process owns the writer lock. Approval/publication require explicit revision + confirmation and refuse `--yes`; `derive` is explicitly unsupported. +- That CLI README states macOS/POSIX scope and fake-server/fake-editor test + limits. It also refers to a packaged-app parity record under + `docs/evidence/asset-studio/unit7/README.md`, while its closing Limits section + still calls the real model path and app shell separate work. Preserve this + documentation tension: manifests and directory presence establish an app + surface, not independent proof that every real-model or packaged path works. + +### Evidence scope and documentation drift + +The root README still says implementation is “in progress from M0,” and the +docs index still opens with “Ready for implementation planning.” Meanwhile, +`tools/scenarios/m2-greek-cast/README.md` reports **27 scripted steps** and +**22 positive controls** against a compiled sidecar, including restart, +perception isolation, causal relationships, stale proposals, and archive +checks. Those reported measurements are stronger than the root scaffold +description but remain source-authored evidence, not executions by this +survey. The README explicitly excludes the packaged desktop view and warns +that scripted plumbing does not establish model reasoning quality. Its M2 +exit contract requires both a full one-hour unattended PASS and owner approval +of rated episodes; this survey does not establish that exit. + +A smaller, concrete drift: the desktop `Cargo.toml` comment calls the JS API +pin **2.12.0**, while the inspected client manifest is **2.12.1**. The actual +inspected crate/API pins agree; the comment is historical wording, not evidence +of a current dependency mismatch. + +Sources: [README](https://github.com/marcusrbrown/panthea/blob/c74fe32b46ecdf332b916295a18c1c2a8d11d008/README.md), +[workspace manifest](https://github.com/marcusrbrown/panthea/blob/c74fe32b46ecdf332b916295a18c1c2a8d11d008/package.json), +[Studio CLI README](https://github.com/marcusrbrown/panthea/blob/c74fe32b46ecdf332b916295a18c1c2a8d11d008/tools/studio/README.md), +[M2 scenario README](https://github.com/marcusrbrown/panthea/blob/c74fe32b46ecdf332b916295a18c1c2a8d11d008/tools/scenarios/m2-greek-cast/README.md). ## 2026-09-26 re-survey — first implementation scaffold @@ -53,3 +121,4 @@ The automation status at both snapshots is recorded in [[github-actions-ci]]. | ---------- | --------- | --------------------------------------------------------------------------------- | | 2026-09-26 | `f0c4ff0` | Initial survey; README heading only, three root files, no workflows or manifests. | | 2026-09-26 | `e5022aa` | New Bun/Tauri workspace scaffold and two-job CI; still no Fro Bot workflow. | +| 2026-10-10 | `c74fe32` | Studio app/CLI, three CI jobs, four workflows including Fro Bot; bounded source survey. | diff --git a/knowledge/wiki/repos/marcusrbrown--presentations.md b/knowledge/wiki/repos/marcusrbrown--presentations.md index 4ec541eb8..335313b03 100644 --- a/knowledge/wiki/repos/marcusrbrown--presentations.md +++ b/knowledge/wiki/repos/marcusrbrown--presentations.md @@ -2,7 +2,7 @@ type: repo title: marcusrbrown/Presentations created: 2026-08-05 -updated: 2026-10-02 +updated: 2026-10-18 sources: - url: https://github.com/marcusrbrown/Presentations sha: 34321a4c4a38c99c4bd8b683f267ddba05cd6fe4 @@ -16,6 +16,9 @@ sources: - url: https://github.com/marcusrbrown/Presentations sha: cafbee055c4bdb552c55e9b9ef62aa3e7d1f7c39 accessed: 2026-10-02 + - url: https://github.com/marcusrbrown/Presentations + sha: b174ddc23aca4b74fd69fd2238d3fcc3ad364044 + accessed: 2026-10-18 tags: - presentations - slides @@ -52,6 +55,68 @@ Marcus R. Brown's slide-deck archive — "A collection of presentations I've giv ## Overview +### Bounded source re-check (2026-10-18) + +Public visibility and default branch `main` were confirmed before inspecting +`b174ddc23aca4b74fd69fd2238d3fcc3ad364044`. The complete recursive listing +still contains 53 entries, 42 blobs, two deck directories, and three workflows; +there is no root package/workspace manifest. Matching path counts establish +layout continuity, not unchanged file contents. + +- **Independent toolchains persist.** The CRA manifest declares React/ReactDOM + 18.3.1, Spectacle 10.2.3, `react-scripts` 5.0.1, `gh-pages` 6.3.0, and + `assert: npm:assert@2.1.0`. Slidev still declares CLI `^52.1.0` and theme + `0.25.0`. Neither manifest pins a package-manager version. CI uses frozen + Yarn and Bun installs, Node 20.20.2, and a SHA-pinned Bun setup action without + `bun-version`; dependency freezing and runtime pinning remain distinct. +- **The two deployed subpaths have explicit build contracts.** CRA's current + `homepage` is `https://marcusrbrown.github.io/Presentations/Blockchain-Meetup-Feb-2017/`, + whereas Slidev's build sets `--base /Presentations/Cheap-LLMs-Meetup-Aug-2026/`. + CI copies their outputs to those respective `_site/` directories and copies + root `index.html` alongside them. This supersedes the older Deck 1 bullet + below that gives only `/Presentations` as its homepage; it does not establish + when the subpath changed. See [[github-pages]] for the build/assembly boundary. +- **Deploy gates remain bounded.** Build compiles both decks and assembles the + site on PRs. Main-only Deploy depends on Build and Test, but Test invokes only + the CRA deck's `yarn test`. The listed demo shell test and the README's PDF + export command are not invoked; no browser or deployed-site check is present. + Pages write/OIDC permissions remain scoped to Deploy. +- **Artifact upload is not the test gate.** Configure Pages and Upload Pages + artifact run inside Build, independently of the sibling Test job. A main-branch + run can therefore upload the assembled artifact even if CRA tests fail; + `Deploy` still requires both jobs to succeed. Artifact availability does not + establish successful tests or publication. This is a workflow dependency + observation, not an observed failed run. +- **Shared workflow pins advanced.** Both reusable callers now reference + `e62de417e8e22026f63890558ace7c574ee2a31f` (v4.39.0), superseding October 2's + v4.35.0 snapshot. Settings sync still calls the correctly named settings + workflow and schedules at 14:19 UTC. Renovate still has no cron and chains to + successful CI completion. Its OR guard still permits bot edits on a literal + reading; the September observed-skip contradiction is retained, not resolved + by source inspection. +- **Fro Bot workflow remains absent.** The complete workflow set is `ci.yaml`, + `renovate.yaml`, and `update-repo-settings.yaml`; none invokes Fro Bot. A + follow-up draft onboarding PR can be proposed separately. + +Root README remains a title and CI badge. The Slidev README describes Bun +development/build/PDF export and links the listed `OUTLINE.md`. CRA's README +documents legacy branch-based `gh-pages` deployment, and its manifest retains +that command; inspected CI instead publishes the assembled Pages artifact. +These are distinct documented paths, not evidence of current manual use. + +**Evidence boundary:** only directory listings, READMEs, package manifests, +and workflow contents were read. No slides, application/demo source, notes, +settings, Renovate config, or lockfile contents were read or executed. Earlier +queue, advisory, archive-state, branch-protection, runtime-health, and live-site +claims remain dated evidence and were not revalidated. + +Sources: [listing](https://github.com/marcusrbrown/Presentations/tree/b174ddc23aca4b74fd69fd2238d3fcc3ad364044), +[CRA manifest](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/Blockchain-Meetup-Feb-2017/package.json), +[Slidev manifest](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/Cheap-LLMs-Meetup-Aug-2026/slides/package.json), +[CI](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/.github/workflows/ci.yaml), +[Renovate](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/.github/workflows/renovate.yaml), +[settings sync](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/.github/workflows/update-repo-settings.yaml). + ### Bounded source re-check (2026-10-02) Public visibility and default branch `main` were confirmed before reading the snapshot at `cafbee055c4bdb552c55e9b9ef62aa3e7d1f7c39`. The complete directory listing contains 53 entries, including 42 files, two presentation subtrees, and exactly three workflow files. There is still no root package manifest or workspace manifest. This establishes the current layout, not byte-identical content or an absence of intervening changes. diff --git a/knowledge/wiki/repos/marcusrbrown--renovate-config.md b/knowledge/wiki/repos/marcusrbrown--renovate-config.md index 7780083de..c88c4a6ac 100644 --- a/knowledge/wiki/repos/marcusrbrown--renovate-config.md +++ b/knowledge/wiki/repos/marcusrbrown--renovate-config.md @@ -2,8 +2,11 @@ type: repo title: marcusrbrown/renovate-config — Shareable Renovate Configuration Presets created: 2026-04-28 -updated: 2026-09-27 +updated: 2026-10-11 sources: + - url: https://github.com/marcusrbrown/renovate-config + sha: 4d13f58d835da29513abb454c3928ca34a82cfbe + accessed: 2026-10-11 - url: https://github.com/marcusrbrown/renovate-config sha: c75dd9c7f20539409d21a8d7a1e6e1e14ddd7e1d accessed: 2026-09-27 @@ -63,6 +66,74 @@ Shareable [Renovate](https://docs.renovatebot.com/) configuration presets for Ma ## Repository Basics +### Bounded source snapshot — 2026-10-11 + +At `main` SHA `4d13f58d835da29513abb454c3928ca34a82cfbe`, the public +`readme.md` still advertises `default`, `onboarding`, and `archived-repository`, +including the floating `#v5` usage example. The directory listing confirms all +three files exist. Their contents were not read: preset files are policy +configuration, outside this survey's README/manifest/workflow read boundary. +The September 8 questions about 0.x grouping and inherited release age remain +unresolved. Neither latest release nor issue/PR state was rechecked; the older +figures below remain dated evidence. + +The root `package.json` is private, ESM, and reports +`0.0.0-development`; that placeholder does **not** establish the current preset +release version. It pins pnpm **11.28.5**, ESLint **10.12.0**, +`@bfra.me/eslint-config` **0.54.0**, Prettier **3.9.9**, +`@bfra.me/prettier-config` **0.16.13**, lint-staged **17.6.0**, +semantic-release **25.0.9**, and simple-git-hooks **2.14.0**. These supersede +the July manifest snapshot, not its historical record. Declared scripts are +`bootstrap`, `lint`, `fix`, and `prepare`; no test or preset-schema-validation +script is declared. `main.yaml` invokes ESLint as its lint gate and makes +release depend on that job; it declares no separate behavioral/schema test job. +This establishes the visible gate, not whether imported lint configuration +performs additional validation. + +`pnpm-workspace.yaml` declares exact overrides for `fast-uri` **3.1.8**, +`js-yaml` **4.3.2**, and `undici` **7.30.0** alongside the older floor-based +override entries still present in `package.json`. Both locations exist; their +effective precedence and resolved dependency health were not tested. The +workspace contains version-specific `minimumReleaseAgeExclude` entries for +`@bfra.me/eslint-config` and `@bfra.me/prettier-config`, but declares no +`minimumReleaseAge` value. As in the earlier VBS observation, an exclusion list +alone does not prove an active cooldown or identify its origin. `allowBuilds` +and legacy `onlyBuiltDependencies` also coexist; install behavior was not probed. + +The committed tree contains **six workflow files**: `main`, `renovate`, +`update-repo-settings`, `codeql-analysis`, `scorecard`, and `fro-bot`. +The September 27 count of eight *active workflow entries*, including two +Copilot entries, used a different inventory surface; those entries are not +files in this snapshot. This does not establish deletion or current service-side +workflow state. Renovate and settings sync now both call correctly pathed +`bfra-me/.github` reusable workflows at **v4.37.0** (`35dbc9c9`), advancing +from v4.33.0. Settings sync has a daily 12:23 UTC schedule; Renovate retains +the successful-`main` workflow-run trigger and no local cron. + +**Fro Bot workflow present:** agent **v0.119.3** (`e2a77c59`) on the daily +15:30 UTC schedule. The final agent step still has no explicit `output-mode` +and no subsequent caller delivery step; checkout still uses +`persist-credentials: false`. The September delivery-wiring concern remains +unresolved, while actual execution and delivered fixes are unverified. A +missing-Fro-Bot-workflow draft is not warranted by this snapshot. + +**New release-control finding:** dispatch advertises `dry-run: true` by +default, but `Get Release Options` writes `DRY_RUN=false` whenever +`IS_DEFAULT_BRANCH` is true. `INPUT_DRY_RUN` is populated but unused by the +shell condition. Thus a default-branch manual dispatch requests dry-run and +the workflow explicitly overrides it before semantic-release; whether a +release is actually published still depends on semantic-release finding a +releasable change. The downstream major-branch write is gated on +`new-release-published`, so this is a mode-selection contradiction, not proof +of an unintended release. See [[github-actions-ci]] for the cross-cutting rule. + +Sources: [README](https://github.com/marcusrbrown/renovate-config/blob/4d13f58d835da29513abb454c3928ca34a82cfbe/readme.md), +[package manifest](https://github.com/marcusrbrown/renovate-config/blob/4d13f58d835da29513abb454c3928ca34a82cfbe/package.json), +[workspace manifest](https://github.com/marcusrbrown/renovate-config/blob/4d13f58d835da29513abb454c3928ca34a82cfbe/pnpm-workspace.yaml), +and the six files in [workflows](https://github.com/marcusrbrown/renovate-config/tree/4d13f58d835da29513abb454c3928ca34a82cfbe/.github/workflows). + +### Earlier dated snapshots + **2026-09-27 limited source-side re-survey (`main` push-run SHA `c75dd9c`):** The public README still advertises the same three presets (`default`, `onboarding`, `archived-repository`) and documents `#v5` major-branch pins. The latest published release is **5.2.13** (2026-09-05), superseding the direct-survey 5.2.9 figure below and confirming the downstream-observed 5.2.12/5.2.13 pins. This pass read the README and workflows, **not the preset or package manifests**; the 2026-09-08 questions about 0.x grouping and `minimumReleaseAge` remain unresolved. Existing manifest-derived versions and policy details below remain dated snapshots, not fresh confirmations. The workflow list now has **eight active entries**, including `Copilot code review` and `Copilot cloud agent` (not inspected here), against the five named workflow sections below plus Fro Bot. `renovate.yaml` and `update-repo-settings.yaml` both call `bfra-me/.github` reusable workflows at **v4.33.0** (`6f33c678`), superseding the earlier v4.16.40 Renovate pin. Renovate runs after a successful `main` workflow, on eligible issue/PR edits or non-main pushes, and by dispatch; `main.yaml` still gates release on lint and uses a GitHub App token for semantic-release and the major-version branch update. These are workflow observations, not proof that the presets themselves changed. @@ -295,3 +366,4 @@ This preset is the dependency-update policy backbone of the entire `marcusrbrown | 2026-07-26 | `5726e90` | Dependency-churn survey — no preset policy change. `default.json` extends/packageRules/schedule, onboarding/archived presets, and `renovate.json5` custom regex manager all byte-identical in shape. bfra-me base pin **`#5.2.3` → `#5.2.6`** (default.json, Renovate-bumped). Latest release **5.2.3 → 5.2.9** (six patches). agent **v0.76.2 → v0.95.0** (`4ad00541`); `actions/checkout` v6.0.3 → **v6.1.0** (`d23441a`), `actions/setup-node` v6.4.0 → **v6.5.0** (`2499707`), `pnpm/action-setup` v6.0.9 **unchanged**; bfra-me renovate reusable workflow v4.16.30 → **v4.16.40** (`0ff5a4d`). node **24.18.0** steady; pnpm 11.8.0 → **11.16.0**; eslint 10.5.0 → **10.7.0**; prettier 3.8.4 → **3.9.6**; lint-staged 17.0.8 → **17.1.1**; semantic-release 25.0.5 → **25.0.8**. **pnpm override change:** `picomatch@2` selector `^2.3.2` → **`^4.0.0`** — PR #1311 (picomatch@2-v4, open across five prior surveys) landed. Prior undici PR #1402 also **merged** (category-2 security-override completed). Daily autoheal six-category prompt unchanged; category-5 focus repos still the two **private** Marcus repos (both 404 to unauthenticated reads at 2026-07-26; names withheld per public-only invariant, now with per-repo intelligence foci annotated inline in `SCHEDULE_PROMPT`). Open issues **6 → 7**: new #1417 (`fro-bot`-authored deprecated/removed-options tracking issue — category-3 output). Open PRs **2 → 1**: #1311/#1402 merged, **new** #1478 (`fro-bot`-authored `fast-uri` → 3.1.4, CVE-2026-16221 — category-2 again). Legacy maintenance-report issues still outside the autoheal cleanup matcher (fifth survey running). Stars/watchers/forks 1/2/0 unchanged. | | 2026-06-25 | `561289f` | Dependency-churn survey — no preset policy change. `default.json` extends/packageRules/schedule, onboarding/archived presets, and `renovate.json5` custom regex manager all byte-identical in shape; bfra-me base pin holds at **`#5.2.3`**. Latest release unchanged at **5.2.3**. agent v0.63.0 → **v0.76.2** (`69aedbc`) — crosses the agent's pnpm→Bun + gateway operator-web-surface internal shifts (runtime-internal to [[fro-bot--agent]]; this repo's invocation surface unaffected). `pnpm/action-setup` v6.0.8 → **v6.0.9** (`0ebf471`); `actions/checkout` v6.0.3 / `actions/setup-node` v6.4.0 **unchanged**; bfra-me renovate reusable workflow v4.16.25 → **v4.16.30** (`a2676c9`); node 24.16.0 → **24.18.0**; pnpm 11.5.3 → **11.8.0**; eslint 10.4.1 → **10.5.0**; lint-staged 17.0.7 → **17.0.8**. Daily autoheal six-category prompt unchanged. **New finding:** category-5 focus repos are now **named in plaintext** in the workflow `SCHEDULE_PROMPT` (`[REDACTED]`, `[REDACTED]`); both re-verified **`PRIVATE`** at 2026-06-25, so the names stay withheld from the wiki per the public-only invariant despite the source leak. First **star** landed (0 → 1). Open PRs 1 → 2: #1311 (picomatch@2 v4) still open + **new** #1402 (`fro-bot`-authored `undici` → 7.28.0, CVE-2026-9697 / CVE-2026-9678 remediation) — a live example of the category-2 security-override autoheal path. Open-issue set stable at 6; same legacy report issues still outside the autoheal cleanup matcher. | | 2026-09-27 | `c75dd9c` | Limited README/workflow re-survey: three presets still advertised; release 5.2.13; eight active workflows; Renovate/settings reusable callers v4.33.0; Fro Bot v0.116.0 on daily 15:30 UTC schedule, with no explicit output-mode or caller delivery step. Preset grouping and minimum-release-age questions not resolved without manifest reads. | +| 2026-10-11 | `4d13f58` | Bounded README/manifest/workflow survey: pnpm 11.28.5, six committed workflow files, reusable callers v4.37.0, Fro Bot v0.119.3 with delivery wiring still unresolved; workspace exact overrides and release-age exclusions recorded without runtime claims. Default-branch dispatch overrides requested dry-run. Preset policy and live release/run/queue state not rechecked. | diff --git a/knowledge/wiki/repos/marcusrbrown--sparkle.md b/knowledge/wiki/repos/marcusrbrown--sparkle.md index 42914a643..3472a7f68 100644 --- a/knowledge/wiki/repos/marcusrbrown--sparkle.md +++ b/knowledge/wiki/repos/marcusrbrown--sparkle.md @@ -2,8 +2,11 @@ type: repo title: marcusrbrown/sparkle created: 2026-04-28 -updated: 2026-09-29 +updated: 2026-10-13 sources: + - url: https://github.com/marcusrbrown/sparkle + sha: 6182bccec901d1e8c99bbfbba542113926697fad + accessed: 2026-10-13 - url: https://github.com/marcusrbrown/sparkle sha: 76b80d8a7a4a86d9888b1ed49e9abaadcd19feec accessed: 2026-09-29 @@ -76,6 +79,96 @@ node_id: MDEwOlJlcG9zaXRvcnkzMTYxMDA5ODY= **Sparkle** — a TypeScript playground and monorepo showcasing cross-platform web and mobile development. React component library, design token system, Expo/React Native mobile app, Astro Starlight documentation site, and comprehensive build tooling via Turborepo and pnpm workspaces. +## 2026-10-13 Limited Re-survey — Boolean Guards and Documentation Selection + +_Public `main` at `6182bccec901d1e8c99bbfbba542113926697fad`. Evidence is limited +to directory listings, README files, manifests, and workflow files. Earlier +issue/PR states, run conclusions, branch protections, resolved dependencies, +and live-site behavior remain dated observations, not freshly verified facts._ + +### Workspace and declared toolchain + +The directory listing retains eight `packages/` members, two `apps/`, `docs/`, +`scripts/`, and seven workflow files. The root README still describes an +experimental cross-platform design system plus an Expo app and Zig/WASM shell; +this pass establishes declared structure rather than feature completeness. +Root `packageManager` is now **pnpm 11.28.5**, `turbo` **2.11.7**, `tsx` +**4.23.15**, and `@types/node` **24.19.0**. TypeScript **5.9.3**, ESLint +**9.39.5**, and `@bfra.me/eslint-config` **0.54.0** remain declared. + +The root README's pnpm prerequisite is `>=10`, but `engines.pnpm` is +**`>=11.8.0`** and `pnpm-workspace.yaml` sets `engineStrict: true`. The README +does point to `packageManager` for the exact pin; its minimum-version wording +still understates the manifest floor. Separately, docs and `moo-dang` manifests +invoke `npm run` inside scripts reached through pnpm, despite the Fro Bot +review prompt's pnpm-only guidance. These are contract discrepancies, not +observed install or build failures. + +The docs manifest retains Astro `^7.0.0`, Starlight `^0.41.0`, TypeDoc +**0.28.20**, `typedoc-plugin-frontmatter` **1.3.2**, and `doctrine` **3.0.0**. +Root TypeDoc is still present, so the earlier proposal to remove the root +workaround is not established as applied. Workspace build permissions still +list the same six packages in both `allowBuilds` and `onlyBuiltDependencies`; +`@parcel/watcher` remains absent. The override ledger now includes +`devalue@5.x: ^5.9.3`. No fresh advisory posture or lockfile resolution is +inferred from these declarations. + +### Fro Bot is present; one safety guard rejects valid same-repository heads + +`.github/workflows/fro-bot.yaml` pins +`fro-bot/agent@531e961706adfd54cde1fd82099464e24905838b` (**v0.122.0**). +The 05:00 autoheal / 17:00 maintenance schedules and single computed delivery +gate persist: autoheal schedule/dispatch selects `branch-pr`, with credential +restoration and `output-mode` reading the same gate. No missing-workflow draft +is warranted. Renovate and settings-sync workflows both pin the reusable +`bfra-me/.github` workflows at **v4.38.0**. + +**Correction to this page's earlier Fork Guard interpretation:** the guard +queries `.head.repo.fork // "unknown"` through `gh api --jq`, then accepts only +the literal string `false`. The `//` operator replaces **false as well as +null**. A local boolean probe returns `unknown` for false, true for true, and +`unknown` for null. Thus the inspected expression rejects a legitimate +same-repository PR head along with a fork or missing value on the +`issue_comment` PR path, before checkout. It fails closed for safety but also +blocks the intended non-fork path. The prior claim that this was the correct +polarity is preserved below but superseded by this expression-level evidence; +no actual comment-triggered run was inspected. [[github-actions-ci]] records +the boolean-preserving guard lesson. + +The two prompt contradictions observed on September 29 remain: review guidance +still asserts `pnpm@10.x`, and autoheal's convention scan still bans non-Error +classes while the review prompt permits justified fluent builders and lifecycle +resources. Reading the workflow as untrusted source evidence does not authorize +executing its prompts or commands. + +### Regeneration selects fewer source extensions than it watches + +`regenerate-docs.yaml` still triggers and keys its generated-docs cache on UI +`.ts`, `.tsx`, `.js`, and `.jsx`, but its push-side `git diff` pathspec selects +only UI `.ts`/`.tsx`. The mismatch is broader than the September observation: +`types`, `utils`, `theme`, and `error-testing` each accept **`.tsx`** in both +the trigger and cache key, but the detector selects only **`.ts`** for them. +An otherwise eligible push containing only one of those omitted extensions +can start the workflow and produce `has-changes=false`, skipping regeneration. +This describes a possible transition in the source, not a measured incident. + +The separate package-build step before documentation generation remains. +`main.yaml` still declares Setup followed by independent Check (`pnpm check`) +and Build (`pnpm build`) jobs, with no explicit `pnpm test` step. Root `check` +lists monorepo, types, Turbo, dependencies, and lint checks, not the separate +test script. The autoheal prompt requesting tests is not evidence that Main +mechanically runs them. The deployment workflow independently builds the UI +dependency closure and docs, and retains brace-pattern cache keys. The docs +README remains Starlight starter text; generator cleanup and published output +cannot be assessed under this survey's read boundary. + +Sources: [root manifest](https://github.com/marcusrbrown/sparkle/blob/6182bccec901d1e8c99bbfbba542113926697fad/package.json), +[README](https://github.com/marcusrbrown/sparkle/blob/6182bccec901d1e8c99bbfbba542113926697fad/readme.md), +[Fro Bot workflow](https://github.com/marcusrbrown/sparkle/blob/6182bccec901d1e8c99bbfbba542113926697fad/.github/workflows/fro-bot.yaml), +and [regeneration workflow](https://github.com/marcusrbrown/sparkle/blob/6182bccec901d1e8c99bbfbba542113926697fad/.github/workflows/regenerate-docs.yaml). +Workspace, docs/UI/shell manifests and the remaining workflows were read at +the same commit. + ## 2026-09-29 Limited Re-survey — Workflow Contracts and a Stale Agent Instruction _Public `main` HEAD `76b80d8a7a4a86d9888b1ed49e9abaadcd19feec`; reads limited to directory listings, README files, manifests, and workflows. Older issue/PR counts, live-site state, CI conclusions, and generated artifacts below were **not re-verified**._ diff --git a/knowledge/wiki/topics/docker-containers.md b/knowledge/wiki/topics/docker-containers.md index eb22f97fb..39e843bd7 100644 --- a/knowledge/wiki/topics/docker-containers.md +++ b/knowledge/wiki/topics/docker-containers.md @@ -2,8 +2,14 @@ type: topic title: Docker Containers created: 2026-04-18 -updated: 2026-09-30 +updated: 2026-10-14 sources: + - url: https://github.com/bfra-me/ha-addon-repository + sha: b7bcd528f511809e0f5906af42ca6ff131c1ff1e + accessed: 2026-10-14 + - url: https://github.com/marcusrbrown/containers + sha: 008a0d383c457c0f4b05b3db5e3b5d41e3787ed5 + accessed: 2026-10-11 - url: https://github.com/bfra-me/ha-addon-repository sha: b7bcd528f511809e0f5906af42ca6ff131c1ff1e accessed: 2026-09-30 @@ -103,6 +109,24 @@ With a single `FROM ghcr.io/home-assistant/base:3.24@sha256:…` there is exactl **Separate build from publish by permission, not by flag.** The prior design ran one job with a `--test` flag on PRs and a full build on push — meaning the fork-reachable path executed inside a job declaring `packages: write` + `id-token: write`. The current design splits them: `build-addon` (pull requests, `contents: read`, `push: 'false'`) and `publish-addon` (default branch only, `packages: write` + `id-token: write`, cosign). A flag that gates publishing is a correctness control; a permission that makes publishing impossible is a security control, and only the second survives a bug in the flag. +### Architecture aliases and generic manifests are separate contracts (2026-10-14) + +At unchanged `b7bcd528`, [[bfra-me--ha-addon-repository]]'s workflow passes +`` and `latest` to each architecture-specific image publisher, but +only `` to the generic multi-architecture manifest publisher. Its +platform readback also inspects only the generic versioned reference. +The two-platform verification is therefore scoped to that tag; it does not +establish a generic multi-arch `latest` alias. Live registry contents and +external action defaults were not read, so this is a declared-contract +boundary rather than evidence of a missing or broken registry tag. + +For template consumers, preserve the distinction between the concrete image +names used by builders and the generic image consumed by Home Assistant. +If a generic moving alias is intended, it needs its own publication declaration +and readback. Passing `latest` to a per-architecture image is insufficient +evidence for the generic alias. Earlier push-versus-platform and +validation-versus-publication observations remain complementary guarantees. + ## CI/CD Patterns ### Build Pipeline @@ -118,6 +142,31 @@ Registry push is gated on `github.event_name != 'pull_request'` to prevent PR bu [[marcusrbrown--containers]]'s `build-publish.yaml` triggers on both `scripts/**` and `**/Dockerfile`, but its detection step filters the changed paths to `Dockerfile` only and returns an empty matrix for a scripts-only change. The build job then skips. The workflow declares that script changes matter while the matrix declares that they do not: a successful trigger is not evidence that a container was built. If scripts can affect published images, map those paths to the affected image(s), or remove the trigger if they cannot. The surveyed workflow establishes this routing mismatch; it does not establish an actual image regression. +#### Build inputs need routing, not just a README promise (2026-10-11) + +At `008a0d38`, [[marcusrbrown--containers]]'s +[`node/README.md`](https://github.com/marcusrbrown/containers/blob/008a0d383c457c0f4b05b3db5e3b5d41e3787ed5/node/README.md) +says application-code updates trigger builds. Its +[`build-publish.yaml`](https://github.com/marcusrbrown/containers/blob/008a0d383c457c0f4b05b3db5e3b5d41e3787ed5/.github/workflows/build-publish.yaml) +trigger matches Dockerfiles and `scripts/**`, and its matrix selects only +Dockerfile diffs. Application-only changes under `node/alpine/` or +`node/release/` match neither. This extends the September scripts-only finding: +the trigger and matrix are two independent gates, and both must route an image's +relevant inputs. Manual dispatch selects all active Dockerfiles but does not +repair event-driven routing. Actual Dockerfile consumption and image regressions +were not inspected. + +The same repo's +[`test.yaml`](https://github.com/marcusrbrown/containers/blob/008a0d383c457c0f4b05b3db5e3b5d41e3787ed5/.github/workflows/test.yaml) +illustrates a second boundary: an image build plus inspection and a shell-only +command is not application acceptance. The named functionality step clears the +entrypoint, runs `sh -c "exit 0"`, and only logs if it fails. It never launches +the app or probes the documented health/info endpoints. Its aggregate build and +security jobs accept skipped work as well as success. Consequently a green +aggregate does not by itself establish either application startup or scan +execution; distinguish legitimate no-change skips from work expected for a +manual full check. These are source-contract findings, not observed failures. + ### Security Scanning #### A validation job is not automatically a publication gate (2026-09-30) diff --git a/knowledge/wiki/topics/github-actions-ci.md b/knowledge/wiki/topics/github-actions-ci.md index 24403f106..a101e657e 100644 --- a/knowledge/wiki/topics/github-actions-ci.md +++ b/knowledge/wiki/topics/github-actions-ci.md @@ -2,8 +2,50 @@ type: topic title: GitHub Actions CI created: 2026-04-18 -updated: 2026-10-10 +updated: 2026-10-18 sources: + - url: https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/fro-bot.yaml + sha: 1fedb47e67fdf65dea1f3acc7590b4e0761fe28a + accessed: 2026-10-18 + - url: https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/action.yaml + sha: 1fedb47e67fdf65dea1f3acc7590b4e0761fe28a + accessed: 2026-10-18 + - url: https://github.com/marcusrbrown/infra/blob/d636f2690f4e778f05cbca6f008feba72287075e/apps/gateway/src/deploy.ts + sha: d636f2690f4e778f05cbca6f008feba72287075e + accessed: 2026-10-15 + - url: https://github.com/marcusrbrown/infra/blob/3779a4b9cb8053f664a65a8aa13c7ba48fdd7504/docs/runbooks/operator-surface-acceptance.md + sha: 3779a4b9cb8053f664a65a8aa13c7ba48fdd7504 + accessed: 2026-10-15 + - url: https://github.com/marcusrbrown/infra/blob/3779a4b9cb8053f664a65a8aa13c7ba48fdd7504/apps/gateway/AGENTS.md + sha: 3779a4b9cb8053f664a65a8aa13c7ba48fdd7504 + accessed: 2026-10-15 + - url: https://github.com/marcusrbrown/sparkle/blob/6182bccec901d1e8c99bbfbba542113926697fad/.github/workflows/fro-bot.yaml + sha: 6182bccec901d1e8c99bbfbba542113926697fad + accessed: 2026-10-13 + - url: https://github.com/marcusrbrown/sparkle/blob/6182bccec901d1e8c99bbfbba542113926697fad/.github/workflows/regenerate-docs.yaml + sha: 6182bccec901d1e8c99bbfbba542113926697fad + accessed: 2026-10-13 + - url: https://github.com/marcusrbrown/dev-like/blob/34141048abc24c19f463e20d3d54cbc797b275d1/.github/workflows/fro-bot.yaml + sha: 34141048abc24c19f463e20d3d54cbc797b275d1 + accessed: 2026-10-12 + - url: https://github.com/marcusrbrown/renovate-config/blob/4d13f58d835da29513abb454c3928ca34a82cfbe/.github/workflows/main.yaml + sha: 4d13f58d835da29513abb454c3928ca34a82cfbe + accessed: 2026-10-11 + - url: https://github.com/marcusrbrown/panthea + sha: c74fe32b46ecdf332b916295a18c1c2a8d11d008 + accessed: 2026-10-10 + - url: https://github.com/fro-bot/.github/pull/3970 + sha: 7413df55543aca2217c691b752a11ade75416049 + accessed: 2026-10-10 + - url: https://github.com/fro-bot/.github/pull/3971 + sha: 267cf77613a807e002465634cdaadb0cc381f793 + accessed: 2026-10-10 + - url: https://github.com/fro-bot/.github/actions/runs/37981130113 + sha: 267cf77613a807e002465634cdaadb0cc381f793 + accessed: 2026-10-10 + - url: https://github.com/fro-bot/.github/issues/3966#issuecomment-6094129392 + sha: 02323969d734075d178dfe8a477f7398089bc2f7 + accessed: 2026-10-10 - url: https://github.com/fro-bot/dashboard sha: fd3c553691ae162846c4163060a26289fc224277 accessed: 2026-10-10 @@ -251,7 +293,7 @@ tags: detection-mapping, ] related: - - marcusrbrown--panthe-ai + - marcusrbrown--panthea - marcusrbrown--sparkle - marcusrbrown--dotfiles - marcusrbrown--tokentoilet @@ -270,11 +312,9 @@ related: - marcusrbrown--systematic - marcusrbrown--infra - marcusrbrown--marcusrbrown-github-io - - marcusrbrown--marcusrbrown-github-io - marcusrbrown--marcusrbrown - marcusrbrown--mothership - marcusrbrown--renovate-config - - marcusrbrown--sparkle - marcusrbrown--vbs - bfra-me--github - bfra-me--works @@ -283,6 +323,200 @@ related: # GitHub Actions CI +## Audit admission, prompt routing, and credentials per event (2026-10-18) + +[[bfra-me--renovate-action]] at `1fedb47e` supplies explicit local prompts for +PR review, scheduled autoheal, and manual custom/autoheal tasks. Admitted +issue and mention-comment events instead receive an empty local `PROMPT`. +That is a dependency on action-level event handling, not proof that those +events receive no effective task. A declared trigger alone does not prove +admission: ordinary PR `issue_comment` mentions are excluded by the job guard, +while trusted review-line mentions have a separate admitted event path. + +Its credential expression excludes exactly `pull_request`, `issue_comment`, +and `issues`; it retains checkout credentials on `pull_request_review_comment` +and `discussion_comment`. This narrows older fleet shorthand that the shared +three-event denylist withholds persistence on all review triggers. The action +also receives its own `github-token`, independently of checkout persistence. + +Build an event matrix with separate columns for job admission, selected local +prompt or action fallback, checkout ref, credential persistence, action token, +and delivery owner. Include each comment family explicitly. Neither an empty +custom prompt nor a credential setting establishes the action's effective +behavior without its contract or execution evidence; a workflow-only survey +should preserve that uncertainty rather than infer a broken response or an +unauthorized write. The matrix complements the separate delivery checks below. + +Source: [Fro Bot workflow](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/.github/workflows/fro-bot.yaml). + +## An event alternative must not bypass feature opt-in (2026-10-18) + +[[bfra-me--renovate-action]]'s action manifest at `1fedb47e` gates cache +restore/prepare on `enable-cache == 'true'`, but cache finalization and save +both end their conditions with an ungrouped `|| github.event_name == 'push'`: + +```text +(success() || failure()) && enabled && !hit || push +``` + +That parses as `((success || failure) && enabled && !hit) || push`, so push +admits those steps even when the consumer selects `cache: false`. Finalization +contains cache deletion and ownership adjustment; the save action targets the +configured cache path. Source text establishes eligibility, not successful +deletion, persistence, or an observed incident. The earlier repo-page shorthand +that all cache maintenance was conditional on opt-in is therefore too broad. + +Keep invariant guards outside an event alternative: for the intended opt-in +contract, use `(success || failure) && enabled && (!hit || push)`. Verify the +event × enabled × hit cases, including push with caching disabled, rather than +checking only the normal cache-miss path. The general failure mode is an OR +branch that quietly drops every guard to its left; the same reasoning applies +to authorization and dry-run switches, though neither was shown defective by +this particular observation. + +Source: [action manifest](https://github.com/bfra-me/renovate-action/blob/1fedb47e67fdf65dea1f3acc7590b4e0761fe28a/action.yaml). + +## Health, compatibility, and rollout acceptance are separate checks (2026-10-15) + +In [[marcusrbrown--infra]], merged [PR #1537](https://github.com/marcusrbrown/infra/pull/1537) +routes the post-deploy operator health probe through the configured public +dashboard origin. The gateway-side proxy is deliberately outside the +daemon's trusted-proxy set; probing that path returned 400 even when the +browser-facing path was healthy. Preserve the trust boundary and choose the +production ingress path for the probe, rather than expanding trusted peers +to make a diagnostic pass. + +At `d636f269`, success requires HTTP 200 and a non-empty string +`contractVersion` in a JSON object. The probe logs that version but does not +compare it with a consumer pin, and exhausting retries only warns. Thus a +successful deploy does not prove either probe success or exact producer/client +compatibility. Separate route liveness, contract parity, and authenticated +operator-flow acceptance in report evidence. Reading the implementation and +its malformed-response/retry tests establishes this contract; it does not +establish that the newly merged probe has executed in production. + +The [paired-rollout runbook](https://github.com/marcusrbrown/infra/blob/3779a4b9cb8053f664a65a8aa13c7ba48fdd7504/docs/runbooks/operator-surface-acceptance.md) +also distinguishes one rollout window from an atomic cutover: confirm the +actual live rollback pair, discard superseded pending dashboard runs, deploy +the gateway, observe the new health contract, then promptly deploy the matching +dashboard. Do not infer authenticated SSE or waiting-state acceptance from +anonymous health. The same snapshot's `apps/gateway/AGENTS.md` narrows the +older post-migration rollback warning: a volume snapshot restore is required +when crossing the one-way ownership migration, not for every later rollback. +Between releases at or after the `v0.118.2` migration, the documented rollback +is a paired pin reversal. Preserve earlier dated cutover observations as +history; do not apply their volume-recovery requirement to every version pair. + +## Fail-closed guards must preserve an allowed false value (2026-10-13) + +At `6182bcce`, [[marcusrbrown--sparkle]]'s comment-triggered PR preflight +uses `gh api --jq '.head.repo.fork // "unknown"'` and refuses anything other +than the literal `false`. The alternative operator treats false as absent: +false becomes `unknown`, true stays true, and null becomes `unknown`. +Consequently even a legitimate same-repository PR head is refused before +checkout. This corrects the repo page's September interpretation that the +expression had the correct polarity: denying unknown is sound, but discarding +the allowed boolean first makes the guard unusable on its intended path. + +Preserve false explicitly before applying the deny-on-unknown rule. A guard +check should cover true, false, null, and missing fields, asserting both that +forbidden input is denied and permitted input reaches the next step. The +local probe verifies expression semantics only; no upstream run or production +guard change was performed. + +## Documentation selection is a three-way path contract (2026-10-13) + +The same snapshot extends the September 29 trigger/detector mismatch: +`regenerate-docs.yaml` watches and caches UI `.js`/`.jsx` that its detector +omits, and also watches/caches `.tsx` for `types`, `utils`, `theme`, and +`error-testing` while detecting only `.ts` for those four packages. Keep +trigger, detector, and cache inputs aligned per package and extension; otherwise +an eligible source-only push can start a workflow that selects no regeneration. +This is static evidence of a skipped-work possibility, not a fresh stale-docs +or successful-run claim. + +Sources: the pinned Fro Bot and regeneration workflows above; see +[[marcusrbrown--sparkle]] for the manifest and CI evidence boundaries. + +## Failure notification is not file delivery or successful no-op reporting (2026-10-12) + +At `34141048`, [[marcusrbrown--dev-like]] configures Fro Bot v0.121.0 +with a `github-token`, credential-less checkout persistence, and no explicit +`output-mode`. Its sole post-agent step reports failures/cancellations to the +rolling “Fro Bot Autoheal” issue; it never detects or publishes a working-tree +diff. This source shape identifies missing caller-owned delivery, not the +action's resolved mode or evidence that a particular fix was lost. Token +availability, file-delivery ownership, and report delivery are separate checks. + +The failure step's `always() && (failure() || cancelled())` condition is +event-agnostic within the admitted job: it can report a failed review invocation +as well as a failed scheduled autoheal. A successful no-safe-fix run instead +depends on the agent following its inline rolling-issue prompt; the deterministic +failure step does not guarantee that successful report. Neither path proves the +report actually posted without execution evidence. + +Verification has a similar boundary: root CI validates and tests the package, +while the separate push-path-filtered Site workflow runs docs tests and the +docs manifest's generation/build/internal-link chain before deployment. Green +root CI would not establish docs acceptance. Read the concrete job graph and +manifest commands, rather than treating the agent's broader verification prompt +as checks mechanically enforced by every CI invocation. + +Sources: `fro-bot.yaml`, `ci.yaml`, `site.yaml`, root `package.json`, and +`docs/package.json` at the surveyed commit. Historical August convergence +and September workflow observations remain dated snapshots, not live results. + +## A dispatch dry-run default can be overridden before execution (2026-10-11) + +At `4d13f58`, [[marcusrbrown--renovate-config]]'s `main.yaml` declares a +boolean `workflow_dispatch` input `dry-run` with default `true`. Its release +job initially derives `DRY_RUN` from the event, then `Get Release Options` +overwrites it with `false` whenever the current ref is the default branch. +The step exposes `INPUT_DRY_RUN` but does not use it in its condition. The +semantic-release command consumes the overwritten environment value, not the +operator-facing input. A manual dispatch on `main` therefore selects real +release mode even when dry-run was requested. + +This contradicts the dispatch interface, not the earlier observation that PRs +use dry-run and ordinary main pushes release. No execution logs or release +records were read in this bounded survey, so it does not establish that an +unintended release occurred: semantic-release must still find a releasable +change, and the major-branch write checks `new-release-published`. + +**Rule:** trace an operator input through every environment rewrite to the +final command. A safe default in the input schema is not a preserved choice +when later branch-based logic overrides it. Keep requested mode and effective +mode distinguishable in verification; branch eligibility and dry-run selection +are separate decisions. + +## 2026-10-10 — codification recovery and a no-op automation run are different evidence + +The thirteen-proposal backlog recorded on October 9 is now cleared. Merged +[#3970](https://github.com/fro-bot/.github/pull/3970) contains four new solution +documents and four extensions; its disposition table consolidates duplicate +incidents and records one proposal already covered by existing docs. All thirteen +linked proposals closed on merge. The October 10 query returns **zero open +learning proposals**, not thirteen aging unauthored proposals. Preserve the +earlier snapshot as historical evidence rather than silently revising its counts. + +Weekly drafted-solution automation subsequently landed through +[#3971](https://github.com/fro-bot/.github/pull/3971). Its first manual +[run](https://github.com/fro-bot/.github/actions/runs/37981130113) succeeded at +harvest but skipped drafting and publication because there was no uncovered +proposal work. That run verifies the empty-queue path, not model drafting, +artifact delivery, privacy filtering, PR publication, or reviewed merge on a +nonempty queue. The October 5 Improvement Metrics reading remains dated evidence; +recurrence edges still measure a different population from unauthored proposals. + +The same day's separate +[remediation readback](https://github.com/fro-bot/.github/issues/3966#issuecomment-6094129392) +at `02323969` supersedes the earlier App-token scope and wiki-authority gap notes: +mint steps now declare explicit permissions, and guarded-path promotion requires +a recognized author **and** exact `data` head **and** the same nonempty repository +identity. Bot authorship or a branch name alone is not an origin guarantee. +These are source/control readbacks, not permission to bypass the established +data writer or persist knowledge from a branch-pr remediation run. + ## Candidate-image checks do not establish Main or deployment success (2026-10-10) At `fd3c5536`, [[fro-bot--dashboard]] has separate Main and Release workflows. @@ -614,12 +848,30 @@ Repos use `dorny/paths-filter` to scope CI runs to relevant file changes, reduci | [[marcusrbrown--sparkle]] | Present (`fro-bot.yaml`, agent **v0.95.0** as of 2026-07-28; landed 2026-06-05 at v0.54.2) | Autoheal `0 5 * * *`, Maintenance `0 17 * * *`; modes `review`/`maintenance`/`autoheal` via dispatch; comment-trigger fork-head refusal preflight. Autoheal now shipping **security-override PRs** (`pnpm.overrides` in `pnpm-workspace.yaml`) for transitive Dependabot alerts — see [[marcusrbrown--sparkle]] | | [[marcusrbrown--dev-like]] | Present (`fro-bot.yaml`, **two-mode** at agent **v0.105.1** SHA-pinned `e9501a9` as of 2026-08-30 — fleet-front pin, was v0.96.0/`c29ac29` at 2026-07-31; workflow body otherwise byte-identical across the interval; onboarded since the 2026-07-12 initial survey when it had none) | Daily `30 14 * * *` autoheal; modes `autoheal`/`pr-review` via dispatch (default `autoheal`); `pull_request` → pr-review, `schedule`/`workflow_dispatch` → autoheal. Distinct from the fleet's three-mode norm: **no maintenance mode**. Inline prompts encode repo invariants as hard boundaries (zero runtime deps, human-gated registry/consent/OPTOUT/profile edits, no release.yaml/OIDC edits, mandatory changesets for `registry\|skills\|bin\|scripts`, verification gates incl. `npm pack --dry-run`). Failures roll up to a single **`Fro Bot Autoheal`** issue (reopen-not-spam). `secrets.FRO_BOT_PAT`, `persist-credentials: false` | | [[marcusrbrown--ha-config]] | **Not present** | N/A | -| [[marcusrbrown--panthe-ai]] | **Not present** at `f0c4ff0` (three-file tree); **present at `e5022aa`** as `ci.yaml` with Bun checks on Ubuntu and Rust fmt/clippy on macOS; **Fro Bot workflow still absent** (both surveyed 2026-09-26) | N/A | +| [[marcusrbrown--panthea]] | **Historically absent** at `f0c4ff0` and `e5022aa` (2026-09-26; the latter added CI only). **Present at `c74fe32`** (2026-10-10), `fro-bot.yaml`, agent **v0.118.2** SHA-pinned `77f2bad` | Daily `30 3 * * *` oversight + autoheal; explicit `branch-pr` on schedule and default-prompt dispatch, `auto` on custom-prompt dispatch and content events | | [[bfra-me--works]] | Present (`fro-bot.yaml`, single-file three-mode at **v0.83.0** as of 2026-07-05 — fleet pin leader; stale Renovate PR #3691 holds the pending v0 → v1 (`v1.18.0`) cutover, untouched since 2026-06-14) | Maintenance `0 16 * * *`, Autoheal `30 3 * * *`; both rolling-update single-issue reports (`Daily Maintenance Report` / `Daily Autohealing Report`). Autoheal still re-emitting **duplicate** security/docs PRs (#3704/#3713, #3620/#3724 all still open) plus new #3762/#3803 — dedup guard not catching its own stale cross-run PRs; backlog 7 → 11 open PRs | | [[bfra-me--renovate-action]] | Present (single-file three-mode `fro-bot.yaml` at **v0.98.2** SHA-pinned `994357c3` as of 2026-08-10 — ecosystem version leader/canary a sixth time, now only ~1 patch ahead of the fleet front) | Autoheal `30 3 * * *`, Maintenance `30 15 * * *`; dispatch defaults to autoheal; two perpetual issues (`Daily Maintenance Report` / `Daily Autohealing Report`); explicit Renovate-owns-dependency-bumps boundary in autoheal prompt. **2026-08-10 adds a `Validate review mode inputs` guard**: a `mode=review` dispatch hard-fails without a `prompt` (review mode has no default prompt — its normal path is the `pull_request` event), and the `prompt` doc-string names the verbatim-prompt path as the release-notes-narrative automation hook | The containers repo's Fro Bot workflow includes domain-specific PR review prompts (Dockerfile best practices, multi-arch correctness) and a structured autohealing schedule (errored PRs, security alerts, dependency bumps, linting consistency). +**Panthea source contract (2026-10-10, `c74fe32`).** +[[marcusrbrown--panthea]] now explicitly selects `branch-pr` for scheduled and +default-prompt dispatched daily passes, while custom-prompt dispatches retain +`auto`. Delivery capability must be assessed per dispatch input, not merely +per event name. Checkout uses `persist-credentials: false`; a same-repository +PR-comment preflight supplies `trusted-head-sha`, and brokered-push extra +paths are `apps,content,tools`. These are workflow declarations, not evidence +that a scheduled change or report was delivered; no live runs were read. + +The separate CI workflow now has three jobs: Ubuntu Bun type/lint/tests and +macOS Rust checks for both desktop and Studio. The Bun test step sets +`prlimit --core=1:1`; each Rust lane builds its sidecar before clippy because +`tauri-build` resolves the external binary during compilation. Studio also +runs `cargo test --locked`; the desktop lane stops at fmt/clippy, so the two +native lanes have different behavioral-test coverage. Renovate and settings +sync delegate to correctly pathed `bfra-me/.github` workflows at **v4.37.0**. +Source: [workflow directory](https://github.com/marcusrbrown/panthea/tree/c74fe32b46ecdf332b916295a18c1c2a8d11d008/.github/workflows). + The systematic repo's Fro Bot workflow includes TypeScript/Bun/Biome-specific PR review prompts (type safety, ESM conventions, zero-class convention, plugin API breaking changes, system prompt injection security). Its autoheal covers 4 categories: errored PRs, security, health & maintenance, developer experience. ### Two-Phase Read-Only Generation + Credential-Boundary Apply diff --git a/knowledge/wiki/topics/github-pages.md b/knowledge/wiki/topics/github-pages.md index 04d18e0f5..ac53829be 100644 --- a/knowledge/wiki/topics/github-pages.md +++ b/knowledge/wiki/topics/github-pages.md @@ -2,8 +2,17 @@ type: topic title: GitHub Pages created: 2026-04-18 -updated: 2026-10-08 +updated: 2026-10-18 sources: + - url: https://github.com/marcusrbrown/Presentations + sha: b174ddc23aca4b74fd69fd2238d3fcc3ad364044 + accessed: 2026-10-18 + - url: https://github.com/marcusrbrown/marcusrbrown.com + sha: 9e2adcc677240a5180aa40f84bc56def31453b20 + accessed: 2026-10-18 + - url: https://github.com/marcusrbrown/marcusrbrown.github.io + sha: 8a1567dfedb1258675e4cfa39d2e5c1854dc3487 + accessed: 2026-10-12 - url: https://github.com/marcusrbrown/vbs sha: 7ef7531d72a18271c925aba913be30f3103fe6ac accessed: 2026-10-08 @@ -68,6 +77,79 @@ related: Static site hosting via GitHub. Deployment patterns observed across the Fro Bot ecosystem. +## Multi-deck assembly needs per-deck asset bases (2026-10-18) + +At `b174ddc2`, [[marcusrbrown--presentations]] builds two independent stacks +into one Pages artifact. CRA's manifest supplies a homepage ending in +`/Presentations/Blockchain-Meetup-Feb-2017/`; Slidev's build script explicitly +sets `/Presentations/Cheap-LLMs-Meetup-Aug-2026/` as its base. CI assembles their +outputs under matching `_site/` subdirectories plus a root landing page. Copying +a successful build into a directory is only the assembly half of the contract: +its generated asset base must also agree. The older repo-page homepage lacking +the CRA deck suffix is superseded by this manifest evidence; live asset loading +was not tested. + +Deploy depends on both Build and Test, but Test covers only the CRA deck. +Thus both builds and assembly are exercised on PRs while neither browser-level +path correctness nor the listed demo shell tests are verified by this workflow. +The SHA-pinned Bun installer still has no runtime-version input, so frozen +dependency installation alone does not establish a reproducible toolchain. + +Artifact production and publication have separate gates here: configure/upload +steps live inside Build, which does not depend on the sibling Test job. The +Deploy job alone joins both dependencies. A main-branch build can upload its +artifact while tests fail, without permitting deployment. When inspecting +[[marcusrbrown--presentations]], distinguish an uploaded artifact from a +test-approved deployment; this describes the job graph, not a sampled failure. + +Sources: [CRA manifest](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/Blockchain-Meetup-Feb-2017/package.json), +[Slidev manifest](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/Cheap-LLMs-Meetup-Aug-2026/slides/package.json), +[CI](https://github.com/marcusrbrown/Presentations/blob/b174ddc23aca4b74fd69fd2238d3fcc3ad364044/.github/workflows/ci.yaml). + +## Compilation can be implicit in a deployment build (2026-10-18) + +At `9e2adcc6`, [[marcusrbrown--marcusrbrown-com]] retains its separate Pages +workflow: lint, `pnpm run build`, upload `dist`, then deploy with `needs: build`. +The manifest expands build to `tsc && vite build`, so compilation is enforced +even without an explicitly named type-check job. PR CI additionally runs unit +tests and a moderate-severity audit; those checks are not on the deployment +dependency chain. No inspected workflow invokes the available `test:e2e` +command or Lighthouse. + +This refines October 1's gate observation: trace both workflow dependencies +and the scripts they invoke. A build can compile without running tests; a +separate green PR workflow is not itself a deployment dependency. Live branch +protections and deployment health were outside this survey. README's stale +`github.io` badge remains an identity contradiction, not evidence about this +brand site's deployment result or the portfolio's current health. + +Sources: [Deploy](https://github.com/marcusrbrown/marcusrbrown.com/blob/9e2adcc677240a5180aa40f84bc56def31453b20/.github/workflows/deploy.yaml), +[manifest](https://github.com/marcusrbrown/marcusrbrown.com/blob/9e2adcc677240a5180aa40f84bc56def31453b20/package.json), +[CI](https://github.com/marcusrbrown/marcusrbrown.com/blob/9e2adcc677240a5180aa40f84bc56def31453b20/.github/workflows/ci.yaml). + +## Portfolio deployment: unit tests are not the whole PR gate (2026-10-12) + +At `8a1567df`, [[marcusrbrown--marcusrbrown-github-io]] explicitly runs lint, +Vitest unit tests, and build in its Pages build job before artifact upload; +deployment depends on that job. Its manifest's build also compiles the root +and OpenCode TypeScript projects before Vite and blog prerendering. This is +a positive instance of the historical lint/test deployment pattern below, +unlike the separately documented [[marcusrbrown--marcusrbrown-com]] brand site. + +The deployment does not execute coverage, browser tests, Lighthouse, the RSC +boundary check, or the moderate-severity audit gate. Those commands being +available in the manifest or separate PR CI does not put them on the deploy +dependency chain. The portfolio's root README also claims automated visual +comparisons, whereas its visual-suite README describes manual screenshot +artifacts without snapshot matching. Preserve that contradiction rather than +equating a test-suite label with pixel-comparison evidence. No live deployment, +branch protection, or analytics activation was checked. + +Sources: [Deploy](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/.github/workflows/deploy.yaml), +[CI](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/.github/workflows/ci.yaml), +[manifest](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/package.json), +[visual README](https://github.com/marcusrbrown/marcusrbrown.github.io/blob/8a1567dfedb1258675e4cfa39d2e5c1854dc3487/tests/visual/README.md). + ## Separate deployment workflows do not inherit CI gates (2026-10-08) At `7ef7531`, [[marcusrbrown--vbs]] has two separate main-push workflows. diff --git a/knowledge/wiki/topics/opencode-plugins.md b/knowledge/wiki/topics/opencode-plugins.md index c3e22c986..e72e8a3eb 100644 --- a/knowledge/wiki/topics/opencode-plugins.md +++ b/knowledge/wiki/topics/opencode-plugins.md @@ -2,8 +2,11 @@ type: topic title: OpenCode Plugin Development created: 2026-04-23 -updated: 2026-10-05 +updated: 2026-10-10 sources: + - url: https://github.com/marcusrbrown/opencode-copilot-delegate + sha: 647200a3a3a99d874510da4f2f8c9efbcacd2ad8 + accessed: 2026-10-10 - url: https://github.com/marcusrbrown/systematic sha: ce3c817f37ac5ed2c13109eda680c1d36ce43c49 accessed: 2026-10-05 @@ -788,6 +791,37 @@ Sources: [manifest](https://github.com/marcusrbrown/systematic/blob/ce3c817f37ac [README](https://github.com/marcusrbrown/systematic/blob/ce3c817f37ac5ed2c13109eda680c1d36ce43c49/README.md), and [eval README](https://github.com/marcusrbrown/systematic/blob/ce3c817f37ac5ed2c13109eda680c1d36ce43c49/evals/README.md). +## Server Entry Checks Do Not Cover an Opt-In TUI (2026-10-10) + +[[marcusrbrown--opencode-copilot-delegate]] at `647200a3` exports a server +entry, its `./plugin` alias, and a distinct `./tui` entry, declaring +`oc-plugin: [server, tui]`. CI imports only `dist/index.js` under Node 24 +and checks that its sole export is a default function; it does not invoke +that function. After this smoke check it runs `test:unit`, whose glob is +`tests/*.test.ts`. + +The manifest separately declares `test:tui` with the Solid preload and +`src/tui/__tests__` globs, plus `test:integration` for `tests/integration/`. +Neither appears in any of the six inspected workflows. A successful run +of the declared CI gate would therefore establish neither TUI test execution +nor real Copilot delegation. No run result was read during this survey. +This extends the proof-depth distinction above: cataloged test scripts, +workflow-invoked tests, module import, factory invocation, and real-host +behavior are separate evidence layers. An opt-in install path still needs +its own verification claim. + +README continues to advertise three tools while the listing includes a +resume tool file and earlier surveys document four. Its shipped `files[]` +entry makes that prose part of the package surface. An export-shape check +cannot detect an omitted README tool, and a filename alone cannot prove +the tool is registered; preserve that uncertainty rather than collapsing +the artifacts into one capability count. + +Sources: [manifest](https://github.com/marcusrbrown/opencode-copilot-delegate/blob/647200a3a3a99d874510da4f2f8c9efbcacd2ad8/package.json), +[CI](https://github.com/marcusrbrown/opencode-copilot-delegate/blob/647200a3a3a99d874510da4f2f8c9efbcacd2ad8/.github/workflows/ci.yaml), +[workflow listing](https://github.com/marcusrbrown/opencode-copilot-delegate/tree/647200a3a3a99d874510da4f2f8c9efbcacd2ad8/.github/workflows), +and [README](https://github.com/marcusrbrown/opencode-copilot-delegate/blob/647200a3a3a99d874510da4f2f8c9efbcacd2ad8/README.md). + ## Related Pages - [[marcusrbrown--systematic]] — Was the largest OpenCode plugin; **as of v3 a three-harness workflow system** (OpenCode + [[pi-coding-agent]] + Claude Code, all peers optional). v3 boundary is **`3.0.0`, 2026-07-17** (the earlier `v3.2.5`/07-22 reading was a downstream artifact); catalog contracted 104 → 73 components (37 agents / 31 skills); discovered-skills-as-slash-commands added v2.33.0 diff --git a/knowledge/wiki/topics/probot-settings.md b/knowledge/wiki/topics/probot-settings.md index 4d824aae1..43ce4e980 100644 --- a/knowledge/wiki/topics/probot-settings.md +++ b/knowledge/wiki/topics/probot-settings.md @@ -2,8 +2,14 @@ type: topic title: Probot Settings created: 2025-06-18 -updated: 2026-10-10 +updated: 2026-10-13 sources: + - url: https://github.com/bfra-me/.github/blob/087e542d3a59cbd06792266fe3eae140c7ec6dbb/.github/workflows/update-repo-settings.yaml + sha: 087e542d3a59cbd06792266fe3eae140c7ec6dbb + accessed: 2026-10-13 + - url: https://github.com/bfra-me/.github/blob/087e542d3a59cbd06792266fe3eae140c7ec6dbb/README.md + sha: 087e542d3a59cbd06792266fe3eae140c7ec6dbb + accessed: 2026-10-13 - url: https://github.com/marcusrbrown/.github sha: a86828a50fdeb04558a47eaf414a63284d7432c1 accessed: 2026-10-10 @@ -60,6 +66,30 @@ related: # Probot Settings +## Client-ID migration does not remove the reusable legacy contract (2026-10-13) + +At `087e542d`, [[bfra-me--github]]'s settings workflow uses +`actions/create-github-app-token` v3.3.0 with mutually exclusive paths: +nonempty repository variable `APPLICATION_CLIENT_ID` selects `client-id`; +otherwise secret `APPLICATION_ID` selects legacy `app-id`. Both use the +private-key secret, and downstream checkout/action steps select the token +from whichever path ran. This is a declared migration mechanism, not a +verification that either token path or settings application succeeded. + +The `workflow_call.secrets` schema still marks `APPLICATION_ID` as required. +A reusable caller cannot assume that selecting the new client-ID path +eliminates the old caller-secret requirement. Distinguish runtime selection +from the reusable interface when planning a migration. + +The root README also still attributes settings sync to +`elstudio/actions-settings`, while the workflow resolves its own ref, +sparse-checks out `bfra-me/.github`, and invokes its local +`update-repository-settings` action (package manifest **0.4.1**, `node24`). +This re-confirms the September 29 documentation/workflow contradiction; +older descriptions remain dated observations. Neither this action manifest +nor the caller YAML proves applied branch protection or current read-back +behavior without source or execution evidence. + Repository configuration management via [Probot Settings](https://probot.github.io/apps/settings/) (repository-settings/app). Syncs `.github/settings.yml` declarations to GitHub repository settings, branch protection, labels, and collaborator access. ## How It Works diff --git a/knowledge/wiki/topics/vscode-extensions.md b/knowledge/wiki/topics/vscode-extensions.md index 2ec2be52e..0f004d20f 100644 --- a/knowledge/wiki/topics/vscode-extensions.md +++ b/knowledge/wiki/topics/vscode-extensions.md @@ -2,11 +2,14 @@ type: topic title: VS Code Extension Development created: 2026-04-18 -updated: 2026-09-15 +updated: 2026-10-15 sources: - url: https://github.com/marcusrbrown/extend-vscode sha: 2c78b3d2b86a0f3dd09171131ae6e29916118fcc accessed: 2026-09-15 + - url: https://github.com/marcusrbrown/extend-vscode + sha: 3c1dafe6d45f9772cbadc02c9f09fe99de26810f + accessed: 2026-10-15 tags: [vscode, vscode-extension, typescript, extension-development, semantic-release] related: - marcusrbrown--extend-vscode @@ -73,6 +76,41 @@ Extensions in this ecosystem publish to three registries: ## Release Posture +### Host entry points are not library export conditions (2026-10-15) + +The [manifest](https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/package.json) +at [[marcusrbrown--extend-vscode]] distinguishes two surfaces: + +| Surface | Declared routing | +| --- | --- | +| VS Code extension activation | `main` → `out/node/extension.js`; `browser` → `out/web/extension.js` | +| Toolkit library imports | Nine `exports` entries; `types` and `default` point only into `out/node/` | + +This qualifies the earlier dual-target description: separate build outputs and +extension-host entries do not establish a browser condition for library +consumers. The README's “Node and Web … via conditional exports” wording +overstates what the manifest declares. No claim about bundle browser safety is +possible without inspecting the build configuration and implementation, which +were outside this survey's read scope. + +Compatibility likewise has three declarations to reconcile: the README badge +says VS Code **1.71+**, the manifest engine is **`^1.102.0`**, and API types are +**1.140.0** (38 minors above the floor, up from September's 35). A type-version +gap is a compatibility risk, not proof that a newer API is actually used. + +The manifest exposes `type-check: tsc --noEmit`, but neither `main.yaml` nor the +eight-leg publish validation matrix invokes it explicitly. Manual publishing +scripts do. This establishes a difference in declared gates, not the absence +of indirect type checking inside tsup or ESLint. Similarly, integration and +visual tests being present in the directory and manifest does not establish +that CI runs them: neither script is actively called in the six workflows. +See [[github-actions-ci]] for the broader distinction between configured +capability and exercised checks. + +Sources: [README](https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/README.md), +[Main workflow](https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/.github/workflows/main.yaml), +and [Publish workflow](https://github.com/marcusrbrown/extend-vscode/blob/3c1dafe6d45f9772cbadc02c9f09fe99de26810f/.github/workflows/publish.yaml). + ### Correction: the pipeline was never unexercised (2026-09-15) The 2026-08-31 section below is preserved because its *advice* survives, but its central factual claim does not. `publish.yaml` at [[marcusrbrown--extend-vscode]] fires on every push to `main` and has run **233 times since 2025-08-17**. It failed 230 of them. It succeeded end-to-end — `Semantic Release` job green — on **three runs on 2025-11-01**. diff --git a/metadata/repos.yaml b/metadata/repos.yaml index aa130e00a..6ac15f064 100644 --- a/metadata/repos.yaml +++ b/metadata/repos.yaml @@ -43,11 +43,11 @@ repos: name: containers added: 2026-04-18 onboarding_status: onboarded - last_survey_at: 2026-09-27 + last_survey_at: 2026-10-11 last_survey_status: success has_fro_bot_workflow: true has_renovate: true - next_survey_eligible_at: 2026-10-27 + next_survey_eligible_at: 2026-11-13 discovery_channel: collab private: false node_id: MDEwOlJlcG9zaXRvcnk3Njg3NTEzMg== @@ -66,11 +66,11 @@ repos: name: esphome.life added: 2026-04-18 onboarding_status: onboarded - last_survey_at: 2026-09-30 + last_survey_at: 2026-10-14 last_survey_status: success has_fro_bot_workflow: false has_renovate: true - next_survey_eligible_at: 2026-11-01 + next_survey_eligible_at: 2026-11-14 discovery_channel: collab private: false node_id: R_kgDOIZmGgg @@ -79,11 +79,11 @@ repos: name: extend-vscode added: 2026-04-18 onboarding_status: onboarded - last_survey_at: 2026-10-01 - last_survey_status: failure + last_survey_at: 2026-10-15 + last_survey_status: success has_fro_bot_workflow: false has_renovate: true - next_survey_eligible_at: 2026-10-31 + next_survey_eligible_at: 2026-11-14 discovery_channel: collab private: false node_id: MDEwOlJlcG9zaXRvcnkzMTMzNjg1OTU= @@ -131,12 +131,12 @@ repos: name: marcusrbrown.github.io added: 2026-04-18 onboarding_status: onboarded - last_survey_at: 2026-09-28 + last_survey_at: 2026-10-12 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-10-28 + next_survey_eligible_at: 2026-11-14 private: false node_id: R_kgDORgYjdA database_id: 1174807412 @@ -144,12 +144,12 @@ repos: name: renovate-config added: 2026-04-18 onboarding_status: onboarded - last_survey_at: 2026-09-27 + last_survey_at: 2026-10-11 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-10-30 + next_survey_eligible_at: 2026-11-12 private: false node_id: R_kgDOHRfvyQ database_id: 488107977 @@ -157,12 +157,12 @@ repos: name: sparkle added: 2026-04-18 onboarding_status: onboarded - last_survey_at: 2026-09-29 + last_survey_at: 2026-10-13 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-10-30 + next_survey_eligible_at: 2026-11-12 private: false node_id: MDEwOlJlcG9zaXRvcnkzMTYxMDA5ODY= database_id: 316100986 @@ -209,12 +209,12 @@ repos: name: opencode-copilot-delegate added: 2026-04-23 onboarding_status: onboarded - last_survey_at: 2026-09-26 + last_survey_at: 2026-10-10 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-10-26 + next_survey_eligible_at: 2026-11-09 private: false node_id: R_kgDOSKIp0Q database_id: 1218587089 @@ -261,12 +261,12 @@ repos: name: .github added: 2026-05-18 onboarding_status: onboarded - last_survey_at: 2026-09-29 + last_survey_at: 2026-10-13 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: contrib - next_survey_eligible_at: 2026-10-20 + next_survey_eligible_at: 2026-11-03 private: false node_id: R_kgDOHBEXpg database_id: 470882214 @@ -274,12 +274,12 @@ repos: name: ha-addon-repository added: 2026-05-18 onboarding_status: onboarded - last_survey_at: 2026-09-30 + last_survey_at: 2026-10-14 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: contrib - next_survey_eligible_at: 2026-10-23 + next_survey_eligible_at: 2026-11-07 private: false node_id: R_kgDOIKWaJA database_id: 547723812 @@ -287,12 +287,12 @@ repos: name: renovate-action added: 2026-05-18 onboarding_status: onboarded - last_survey_at: 2026-10-02 + last_survey_at: 2026-10-18 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: contrib - next_survey_eligible_at: 2026-10-24 + next_survey_eligible_at: 2026-11-09 private: false node_id: R_kgDOKWu8zQ database_id: 694926541 @@ -391,12 +391,12 @@ repos: name: dev-like added: 2026-07-12 onboarding_status: onboarded - last_survey_at: 2026-09-28 + last_survey_at: 2026-10-12 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-10-30 + next_survey_eligible_at: 2026-11-14 private: false node_id: R_kgDOTVrJ0w database_id: 1297795539 @@ -404,12 +404,12 @@ repos: name: marcusrbrown.com added: 2026-07-13 onboarding_status: onboarded - last_survey_at: 2026-10-01 + last_survey_at: 2026-10-18 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-11-03 + next_survey_eligible_at: 2026-11-17 private: false node_id: R_kgDOPOkk2A database_id: 1021912280 @@ -430,25 +430,25 @@ repos: name: Presentations added: 2026-08-04 onboarding_status: onboarded - last_survey_at: 2026-10-02 + last_survey_at: 2026-10-18 last_survey_status: success has_fro_bot_workflow: false has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-11-03 + next_survey_eligible_at: 2026-11-19 private: false node_id: MDEwOlJlcG9zaXRvcnk4MjcxMzM5Ng== database_id: 82713396 - owner: marcusrbrown - name: panthe.ai + name: panthea added: 2026-09-26 onboarding_status: onboarded - last_survey_at: 2026-09-26 + last_survey_at: 2026-10-10 last_survey_status: success has_fro_bot_workflow: true has_renovate: true discovery_channel: collab - next_survey_eligible_at: 2026-10-26 + next_survey_eligible_at: 2026-11-12 private: false node_id: R_kgDOJt6i0Q database_id: 652124881