docs: say what is risky about reading someone else's repo - #7
Open
BryanZaneee wants to merge 1 commit into
Open
Conversation
The posture checklist this is modelled on governs taxpayer PII. This tool holds a different thing and the rules had to be rewritten rather than copied: the asset at risk is somebody else's source, and the second asset is the reader's trust that an inference is labelled as one. So the checklist bans target-repo content in logs rather than PII, allowlist membership rather than sanitised paths, and a modelled path that reads as observed rather than an unredacted field. Each line is something this project has been wrong about before. The ticket ledger lands here too. Phases 10.5, 11 and 12 are large enough that "a phase is several commits" stops being guidance, so they are branch-sized rows with a dependency column and their own gates. Closes #3 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
BryanZaneee
force-pushed
the
docs/3-contributing-posture
branch
from
August 18, 2026 17:51
4cebd70 to
99b427a
Compare
Owner
Author
|
Force-pushed: removed every em dash from the files this PR adds (D0), so they land clean rather than being swept in a follow-up. Rewritten rather than substituted. Content is otherwise unchanged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
CONTRIBUTING.mdanddocs/posture-checklist.md, and puts the W/T/E/B ticket ledger intoROADMAP.md.Why
Everything from here lands through PRs, and the review checklist needs a document behind it. Closes #3.
Changes
Posture checklist, adapted rather than copied. The source document governs taxpayer PII; this tool holds somebody else's source code and a reader's trust that an inference is labelled as one. So the rules are: no target-repo content in logs or errors, no secrets in source, never emit a phantom endpoint, never let modelled read as observed, nothing target-specific in
src/, allowlist membership not path sanitization, dependencies are a discussion.CONTRIBUTING carries the trunk workflow, branch format, commit rules, the docs-move-with-code table, goldens, PR conventions, the two load-bearing seams, and how to add a language.
ROADMAP gains
## The ticket ledger— 26 rows across four epics, each one branch/PR/issue, with a dependency column and per-epic gates. Status line goes 8-of-13 → 8-of-16; the milestone table gains phases 10.5, 11, 12.Testing
npm test→ 274 pass, 0 fail. Docs only; no source touched.One thing I removed while drafting: both files initially described
--allow-write, which does not exist yet. Describing an unbuilt feature as present, in a document about not overclaiming, is the exact failure it warns against — so that text moves to E2's PR, per this repo's own docs-move-with-the-code rule.Checklist
test/generic.test.mjsgreenADR