feat(gauge): cf-no-bon-ref — sweep the consumer tree for ticket references#23
Merged
Conversation
…ences The no-ticket-ids law had no shippable teeth: the kit's existing sweep guards only the kit's own docs, and the Python cf-gate battery never swept a consumer tree at all — so a consumer leaked ticket ids to main uncaught. This adds cf-no-bon-ref, a language-agnostic byte sweep over the code/config tree, wired as a cf-gate stage and shipped as a console script. Jurisdiction is CODE, not prose: hidden/vendored/cache dirs, the docs/ tree, all markdown/rst, and binary files are out of scope (an ADR or a debt ledger maps epic->ticket as its function). A ref that must live in a code path is registered in no-bon-ref-exemptions.json with a reason, ratcheted by frozen_count — every blessing visible, never silent. The pattern is assembled by concatenation so the gauge's own source stays self-clean. Also scrubs one pre-existing ticket id from ts/README.md so the kit obeys the law it now ships. Verified: full cf-gate green incl the new stage; 18 new unit tests; ruff/mypy/complexipy/file-budget clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contract → World → Failure
Contract: the law battery must BLOCK a ticket-id leak at PR time on the consumer tree.
World: a consumer (mexxa) shipped
BON-####refs intomain— in.gitignore, CSS, a Playwright config, the e2e spec — and nobody caught it.Failure: the
no_bon_refsweep was only a pytest self-test guarding the kit's own docs; the Pythoncf-gatebattery never swept a consumer tree at all. The law had no shippable teeth on consumers.What this adds
cf-no-bon-ref— a language-agnostic byte sweep over the consumer code/config tree, wired as acf-gatestage (stage 8 of 13) and shipped as a console script (so local == CI).docs/tree, all markdown/rst, and binary files. An ADR, a README, or the law-debt ledger maps epic→ticket as its function — that's provenance, not a leak. This is a declared boundary, not a silent paths-ignore.no-bon-ref-exemptions.json({frozen_count, entries:[{path, reason}]}) — mirroring the kit's exemptions ratchet. Every blessing is printed loudly; adding one requires bumpingfrozen_count(visible, never silent).BON--pattern is assembled by concatenation so the gauge's own source never carries it.ts/README.md— the kit now obeys the law it ships.Verification (real gate, not just unit tests)
cf-gatebattery green including the newcf-no-bon-refstage (ruff, file-budget, recursion, exemptions, no-bon-ref, import-contract, mypy, complexipy).ruff/mypy/complexipy/cf-file-budgetclean on the new module (242 lines, ≤500).test_packagingfixture-teardown errors that reproduce on the untouched base (a local wheel-build/venv artifact) — not introduced here.Scope note
This is the Python-path leg (per the scope decision). TS parity (
cf-gate-ts) is a fast-follow. The reusable-workflow enforcement (merged-main projection + self-verifying required-check) is a separate, disjoint PR that merges in any order with this one.Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com