Conversation
4ndreello
force-pushed
the
feat/lean-spec-gates
branch
from
September 10, 2026 19:43
c0b2793 to
99f63c5
Compare
4ndreello
marked this pull request as ready for review
September 10, 2026 19:45
4ndreello
pushed a commit
that referenced
this pull request
Sep 10, 2026
Close the two reviewer findings on PR #78: Tests none now holds only when every touched layer is marked none, otherwise the strongest test type among touched layers applies. Drop the proof bullet duplicated with the orchestrator Verify rule, keeping the probe as the single source and cutting the generated prompt to 13885 bytes. Co-Authored-By: Muse Code
Close the two reviewer findings on PR #78: Tests none now holds only when every touched layer is marked none, otherwise the strongest test type among touched layers applies. Drop the proof bullet duplicated with the orchestrator Verify rule, keeping the probe as the single source and cutting the generated prompt to 13885 bytes. Co-Authored-By: Muse Code
4ndreello
force-pushed
the
feat/lean-spec-gates
branch
from
September 10, 2026 20:03
1abb1f6 to
bf9b001
Compare
added 5 commits
September 10, 2026 23:22
Inline five mandatory gates in the orchestrator prompt so every run executes them on any harness without a skill call: spec gate, task gate, coverage matrix, scratch-probe slice close, and batched decisions. Long-form shapes live in plugin/prompts/spec-workflow.md, cited from the prompt and read on demand. Raise the orchestrator budget to 16384 bytes for the fixed core. Co-Authored-By: Muse Code
Adapt validate_spec, validate_tasks, check_commit, and validate_state to this repo's shapes and conventions, with a vitest wrapper pinning their behavior. Update NOTICE for the adapted scripts. Co-Authored-By: Muse Code
SonarCloud flagged path-injection on every file the gate scripts open: CLI-built paths were read with no confinement, so a faulty absolute path from an agent escapes the project. Every read now goes through a helper that realpaths, refuses anything outside the invocation root with exit 2, and requires a real file. Also honor an explicit feature target even when the root has no .specs tree, instead of silently passing with nothing checked. Escape cases pinned in tests. Co-Authored-By: Muse Code
SonarCloud path-injection stands on any CLI-derived text reaching open(), guard or not. The gate CLIs now take bare feature names only: every opened path is built from a directory-listing entry, and check_commit takes message text via --message or stdin with no file input at all. Run all three validators from the repo root.
The per-file copy tripped the duplication gate. One _gate_io module now owns the confined reader; behavior unchanged.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a fixed spec-gates core to the orchestrator prompt plus deterministic gate scripts, instead of vendoring a skill whole.
The orchestrator now carries five mandatory gates inline (spec gate, task gate, coverage matrix, scratch-probe slice close, batched decisions) that run on every harness with no skill call. Long-form shapes live in plugin/prompts/spec-workflow.md, read on demand. scripts/spec-gates/ adds four adapted validators (validate_spec, validate_tasks, check_commit, validate_state) with a vitest wrapper, plus NOTICE attribution and a 16384-byte orchestrator budget.
Skill context: the design is inspired by tlc-spec-driven v3.3.0 (Felipe Rodrigues, CC-BY-4.0). Prompt prose is rewritten in our own words; the four scripts are adapted from the skill's scripts (types and sections fitted to this repo) with credit in NOTICE. A 100% verbatim copy was considered and rejected: ~3.8k lines of permanent context cost, the original's own discretionary valves (auto-sizing, optional phases), a conflicting second workflow next to ours, and template shapes our specs do not follow.
Needs a careful look at: no pasted sentences from the skill, NOTICE accuracy on adapted vs rewritten parts, script fidelity, and whether the five inline bullets earn their context cost.