docs(governance): describe the org that exists - #30
Merged
Conversation
…at a command can answer
Almost every claim in this file was false. It opens by saying the org is on the
free plan and that tag immutability is therefore "enforced by convention" — the
org is on Team, rulesets are active in ten repos, and `update` is blocked on
`refs/tags/v*`, which also makes its rule 1 ("vN major tags are moving")
impossible rather than merely outdated. The repo matrix lists three plugins that
do not exist and gives every repo a `plugin-sdk/` submodule; there are no
submodules anywhere in the org. The CI section points consumers at
`plugin-ci.yml@v1`, which no caller has used for a long time. The file even
carries an "upgrade path" section instructing the reader to delete itself once
rulesets exist. They exist.
The rewrite records what is genuinely org-level and invisible from any one
repository — the ruleset rules, why the shared workflows are referenced by
branch and why the publisher allow-list must move with them, why plugins pin the
SDK to a tag rather than a commit — and replaces the tables that rotted with the
command that answers them. A copied table is a second source of truth with no
drift check on it, which is exactly how this file got here.
The `@v1` reference in README.md and in the org workflow template goes to `@main`
with it. The template is worse than a stale doc: it seeds the next plugin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W9K9WE1ATSqYFStZGtLpNk
…at a command can answer
Almost every claim in this file was false. It opens by saying the org is on the
free plan and that tag immutability is therefore "enforced by convention" — the
org is on Team, rulesets are active in ten repos, and `update` is blocked on
`refs/tags/v*`, which also makes its rule 1 ("vN major tags are moving")
impossible rather than merely outdated. The repo matrix lists three plugins that
do not exist and gives every repo a `plugin-sdk/` submodule; there are no
submodules anywhere in the org. The CI section points consumers at
`plugin-ci.yml@v1`, which no caller has used for a long time. The file even
carries an "upgrade path" section instructing the reader to delete itself once
rulesets exist. They exist.
The rewrite records what is genuinely org-level and invisible from any one
repository — the ruleset rules, why the shared workflows are referenced by
branch and why the publisher allow-list must move with them, why plugins pin the
SDK to a tag rather than a commit — and replaces the tables that rotted with the
command that answers them. A copied table is a second source of truth with no
drift check on it, which is exactly how this file got here.
The `@v1` reference in README.md and in the org workflow template goes to `@main`
with it. The template is worse than a stale doc: it seeds the next plugin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W9K9WE1ATSqYFStZGtLpNk
…at a command can answer
Almost every claim in this file was false. It opens by saying the org is on the
free plan and that tag immutability is therefore "enforced by convention" — the
org is on Team, rulesets are active in ten repos, and `update` is blocked on
`refs/tags/v*`, which also makes its rule 1 ("vN major tags are moving")
impossible rather than merely outdated. The repo matrix lists three plugins that
do not exist and gives every repo a `plugin-sdk/` submodule; there are no
submodules anywhere in the org. The CI section points consumers at
`plugin-ci.yml@v1`, which no caller has used for a long time. The file even
carries an "upgrade path" section instructing the reader to delete itself once
rulesets exist. They exist.
The rewrite records what is genuinely org-level and invisible from any one
repository — the ruleset rules, why the shared workflows are referenced by
branch and why the publisher allow-list must move with them, why plugins pin the
SDK to a tag rather than a commit — and replaces the tables that rotted with the
command that answers them. A copied table is a second source of truth with no
drift check on it, which is exactly how this file got here.
The `@v1` reference in README.md and in the org workflow template goes to `@main`
with it. The template is worse than a stale doc: it seeds the next plugin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W9K9WE1ATSqYFStZGtLpNk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Almost every claim in
GOVERNANCE.mdwas false. Checked against live state:team; rulesets are active in 10 reposrefs/tags/v*hasupdateanddeletionblocked, enforcedvNmajor tags are moving — re-point with--force-with-lease"updateis blocked; re-pointing is impossible, not merely discouragedlvis-plugin-pageindex,-email,-calendarplugin-sdk/submodule atSDK@v1.0.0github:devDependency, pinned per repo (v8.0.0 → v12.1.0 today)plugin-ci.yml@v1"@v1in a long time; all are@mainWhat the rewrite keeps
Only what is genuinely org-level and invisible from any single repository:
@main, and the trap that removes: the publisher runner group matches its allow-list against the exact ref a caller writes, so a SHA in the caller stores the same decision in an org setting no PR reviews — and when they drift, nothing fails, the job just never gets scheduled. That cost days of silently broken publishing twice in 2026-08 (once from the history rewrite that orphaned the pins, once from the repoint that fixed it). See ci(publish): fail loudly when no runner can accept the job #28 and ci: bound the shared CI jobs the same way the publish job is bounded #29.lvis-plugin-epcurrently pins a raw SHA.)What it removes
The tables. A matrix copied from live state is a second source of truth with no drift check on it, which is precisely how this file ended up describing three plugins that were deleted and a submodule layout that never survived. Each is replaced by the
ghcommand that answers it.Also in this PR
README.mdand.github/workflow-templates/plugin-ci.ymlstill advertisedplugin-ci.yml@v1. The template is worse than a stale doc — it is what a new plugin repo copies — so both go to@main, matching every caller and the runner-group allow-list.🤖 Generated with Claude Code
https://claude.ai/code/session_01W9K9WE1ATSqYFStZGtLpNk