chore: sync oss-owned scaffold files to plugin 0.38.0, and bind three dogfood assertions to the rule under test - #422
Merged
Conversation
/oss:scaffold --apply brought the owned .oss/, .github/workflows/oss-changelog.yml and the 01-oss jit-context layer current, and created the two missing owned files (outbound/README.md, trap.d/README.md). Declared labels.lane_other, curate_route_threshold and .supertool.json's pr_exclude_events in .oss.json/ .supertool.json per doctor's own findings. Updated tests/test-dogfood-entries.sh to bind the newly-installed raw-file-reads-are-uncapped.md by name (assert_not_blocked_by) instead of assert_allows, since that vendored rule now legitimately refuses a bare cat/grep/sed -n at command position for its own reason, independent of the rule these three assertions exist to bound (#239). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
oss:doctorwrote on 2026-09-17, moved offmainand onto a branch so it gets a review instead of a bypass push. The.oss.jsonhalf already landed as #418. This is the rest.Owned files, rewritten by
scaffold.py --apply.github/workflows/oss-changelog.yml,.oss/assemble_changelog.py,.oss/statusline.py,.markdownlint.json,.supertool.json, plus two READMEs that were missing:outbound/README.mdandtrap.d/README.md. None of it is ours to edit by hand. The.supertool.jsonchange also addspr_exclude_eventsfor the radar, which doctor reported as an unfiltered event stream.The vendored
01-ossrule layerRefreshed to what plugin 0.38.0 ships. Two rules are new to this tree:
raw-file-reads-are-uncapped.mdandpython-heredoc-writes-are-unvalidated.md. Both aremode: blockonBash.tests/test-dogfood-entries.sh, the one file here that is oursThe new
raw-file-reads-are-uncapped.mdrefuses a barecat,greporsed -nat command position, for its own reason. Three assertions in this suite usedassert_allowson exactly those forms against the index, to prove the no-shell-writes rule does not over-match. On a tree carrying the new layer they reported 3 failures for a rule that was never at fault.The edit binds them to
SHELL_RULEwithassert_not_blocked_by, which is what theEdit/Writeblock above them already does for the same reason (#239). It narrows the claim to the one this suite is making. A comment at the site says why.This is the part I want read. Doctor made this edit and committed it on
mainwith no issue and no review, which I filed upstream as claude-oss#1649. The edit reads correct to me now. Say so or say why not.Verification
tests/test-dogfood-entries.sh97/97 andtests/run-all.shclean at the time doctor ran them, on the pre-rebase tree. CI is the authority for the rebased one.🤖 Generated with Claude Code
[AI-generated]