Repository navigation
Reuse maintained components and follow published standards join the catalog, and dependency currency becomes the consumer's half of deprecation discipline - #411
Conversation
…atalog, and dependency currency becomes the consumer's half of deprecation discipline Closes #398. The catalog had no record for three principles a project stated in prose: nothing hand-rolled where a maintained component does the job, a part an RFC or industry standard covers follows that standard, and the stack is kept current. Two of them become records and the third joins the record that already holds it. - reuse-maintained-components (principle). The hand-rolled-toolchain set enforces only the installer case. This record states the general claim: a maintained component carries the edge cases and fixes of every user it has, and a private copy carries only its author's. Spolsky's defense of NIH is the counterweight in does_not_mean, and Cox's "Our Software Dependency Problem" supplies the costs. It conflicts with economy-of-mechanism (a large dependency under a small trusted guard) and minimize-attack-surface (each dependency is a supply-chain edge). Both ends are written. - follow-published-standards (principle). It differs from robustness-principle, which asks how liberal a reader should be. This record asks what a part emits and claims, and does_not_mean hands the leniency question back to robustness-principle. The sources are RFC 2026, RFC 7282 and the W3C QA Framework. - deprecation-discipline already refuses a pin behind its newest tag (claimed by no-stale-hook-pins), and that is currency. It gains the alias "Dependency currency", an applies_when and a review question for end-of-life and advisory-carrying components, and OWASP A06 as a source. Both new records are partially automatable and unclaimed, so they render into REVIEW.md and AGENTS.md (487 lines of 900). Thirty review-carried records now have no control. Claude-Session: https://claude.ai/code/session_01LLQgSP5VfjmzynDrYMSBd5
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 47 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title accurately identifies all three main changes: adding the two principles and extending deprecation discipline with dependency currency. It is long but remains clear and specific. |
| Linked Issues check | |
Issue #398 requires catalog coverage for maintained-component reuse, published standards, and dependency currency. The PR adds reuse-maintained-components with applicability, exceptions, review ques… |
| Out of Scope Changes check | |
The changed catalog records, generated documentation and indexes, catalog registration, conflict and related links, enforcement tracking, and control-count comment support the objectives in issue #398… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
Full details: Linked Issues check
-
Explanation
Issue
#398requires catalog coverage for maintained-component reuse, published standards, and dependency currency. The PR addsreuse-maintained-componentswith applicability, exceptions, review questions, partial checks, and supporting sources. It addsfollow-published-standardswith standard citation, profile, conformance-test, and departure requirements, plus the requested RFC and W3C sources. It extendsdeprecation-disciplinewith the “Dependency currency” alias, end-of-life and advisory applicability, migration review questions, and an OWASP A06 source. The catalog and generated indexes and review files include the new records.
Full details: Out of Scope Changes check
-
Explanation
The changed catalog records, generated documentation and indexes, catalog registration, conflict and related links, enforcement tracking, and control-count comment support the objectives in issue
#398. No unrelated change is demonstrated by the available PR evidence.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (11 skipped: 11 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #411 +/- ##
=======================================
Coverage 94.84% 94.84%
=======================================
Files 52 52
Lines 27217 27217
=======================================
Hits 25815 25815
Misses 1402 1402 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The review run already prints how many review-carried records have no control, and names them, on every invocation. A count spelled out in a comment is a second copy of that fact that no hook compares to the first, so every new record had to edit it by hand. Claude-Session: https://claude.ai/code/session_01LLQgSP5VfjmzynDrYMSBd5
Closes #398.
The catalog had no record for three principles a project stated in prose:
nothing hand-rolled where a maintained component does the job, a part an
RFC or industry standard covers follows that standard, and the stack is
kept current. Two of them become records and the third joins the record
that already holds it.
enforces only the installer case. This record states the general claim:
a maintained component carries the edge cases and fixes of every user it
has, and a private copy carries only its author's. Spolsky's defense of
NIH is the counterweight in does_not_mean, and Cox's "Our Software
Dependency Problem" supplies the costs. It conflicts with
economy-of-mechanism (a large dependency under a small trusted guard) and
minimize-attack-surface (each dependency is a supply-chain edge). Both
ends are written.
robustness-principle, which asks how liberal a reader should be. This
record asks what a part emits and claims, and does_not_mean hands the
leniency question back to robustness-principle. The sources are RFC 2026,
RFC 7282 and the W3C QA Framework.
(claimed by no-stale-hook-pins), and that is currency. It gains the alias
"Dependency currency", an applies_when and a review question for
end-of-life and advisory-carrying components, and OWASP A06 as a source.
Both new records are partially automatable and unclaimed, so they render
into REVIEW.md and AGENTS.md (487 lines of 900). Thirty review-carried
records now have no control.
https://claude.ai/code/session_01LLQgSP5VfjmzynDrYMSBd5
Summary by CodeRabbit