docs(assurance): plan trusted development baseline - #34
Conversation
|
ⓘ Your Qodo trial ends soon. Ask your workspace admin to set up billing to keep reviews running after the trial. Manage billing |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
Warning Review limit reachedNext included review available in 9 minutes. View limit detailsLimit details: You’ve used all 10 included reviews currently available. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
Comment |
|
@qodo review Please review exact current planning head |
|
@coderabbitai review Please perform a fresh review of exact current planning head |
PR Summary by QodoPlan AF-01 trusted development baseline
AI Description
Diagram
High-Level Assessment
Files changed (7)
|
I reviewed the planning head
The AF/CF identity reconciliation is otherwise consistent: AF-01 does not renumber CF-14/15/16, and the documented post-CF-13 implementation gate is an explicit governance dependency rather than an accidental product-authority change. No approval is carried from prior reviews. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== checked-out commit =='
git rev-parse HEAD
git status --short
echo '== changed paths against declared canonical base =='
git diff --name-status 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361..HEAD
echo '== changed document outline =='
for f in \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
specs/015-af-01-trusted-development-baseline/spec.md \
specs/015-af-01-trusted-development-baseline/plan.md \
specs/015-af-01-trusted-development-baseline/tasks.md \
specs/015-af-01-trusted-development-baseline/consistency.md \
docs/COMMAND_F_MASTER_ARCHITECTURE_V2.md \
docs/COMMAND_F_PLAN_INDEX.md
do
if [ -f "$f" ]; then
echo "--- $f"
rg -n '^(#|##|###|####)|\b(AF-0[1-4]|CF-1[3-6]|T00[0-9]|FR-[0-9]+|SC-[0-9]+|MUST|SHALL|CLOSED|PASS|green|ruleset|workflow|SHA256|Scorecard|HL7)' "$f" || true
else
echo "MISSING: $f"
fi
done
echo '== full newly added planning documents =='
for f in \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
specs/015-af-01-trusted-development-baseline/spec.md \
specs/015-af-01-trusted-development-baseline/plan.md \
specs/015-af-01-trusted-development-baseline/tasks.md \
specs/015-af-01-trusted-development-baseline/consistency.md
do
echo "--- $f"
cat "$f"
done
echo '== reconciliation diffs =='
git diff --unified=80 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361..HEAD -- \
docs/COMMAND_F_MASTER_ARCHITECTURE_V2.md docs/COMMAND_F_PLAN_INDEX.md
echo '== workflow inventory and trust-sensitive fields =='
fd -t f -e yml -e yaml .github 2>/dev/null | sort
rg -n -i -C2 '(^name:|^\s*uses:|runs-on:|permissions:|persist-credentials|pull_request_target|workflow_run|contents:\s*write|id-token:\s*write)' .github 2>/dev/null || true
echo '== baseline planning and repository facts referenced by AF-01 =='
for f in docs/COMMAND_F_MASTER_ARCHITECTURE_V2.md docs/COMMAND_F_PLAN_INDEX.md; do
echo "--- $f"
rg -n -C2 '\b(CF-13|CF-14|CF-15|CF-16|AF-01|ruleset|workflow|HL7|R5|R6)\b' "$f" || true
done
echo '== exact diff =='
git diff --check 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361..HEAD
git diff --unified=20 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361..HEAD -- \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
specs/015-af-01-trusted-development-baseline/spec.md \
specs/015-af-01-trusted-development-baseline/plan.md \
specs/015-af-01-trusted-development-baseline/tasks.md \
specs/015-af-01-trusted-development-baseline/consistency.mdLength of output: 181810 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== workflow triggers, paths, and job names =='
for f in $(fd -t f -e yml -e yaml .github/workflows | sort); do
echo "--- $f"
cat -n "$f"
done
echo '== composite Action metadata and local Action references =='
fd -t f -i 'action.y*ml' . | sort
for f in $(fd -t f -i 'action.y*ml' . | sort); do
echo "--- $f"
cat -n "$f"
done
rg -n -C3 '^\s*uses:\s*(\./|[^[:space:]]+/[^[:space:]@]+@)' .github --glob '*.{yml,yaml}' || true
echo '== authority files cited by the consistency analysis =='
for f in AGENTS.md .specify/memory/constitution.md; do
if [ -f "$f" ]; then
echo "--- $f"
rg -n -C3 'independently executable|vertical|workflow|CI|review|Spec Kit|gate|merge|branch' "$f" || cat -n "$f"
else
echo "MISSING: $f"
fi
done
echo '== task references and requirement trace integrity =='
python3 - <<'PY'
import re
from pathlib import Path
tasks = Path("specs/015-af-01-trusted-development-baseline/tasks.md").read_text()
defined = set(re.findall(r'\*\*(T\d{3})\*\*', tasks))
for name in ["spec.md", "plan.md", "consistency.md"]:
p = Path("specs/015-af-01-trusted-development-baseline") / name
text = p.read_text()
refs = set(re.findall(r'\b(T\d{3})\b', text))
missing = sorted(refs - defined)
print(f"{p}: referenced={sorted(refs)} missing={missing}")
print(f"tasks defined: {sorted(defined)}")
PY
echo '== live repository rulesets and main protection =='
gh api repos/TheHalfMoon/commandF/branches/main/protection 2>&1 || true
gh api repos/TheHalfMoon/commandF/rulesets 2>&1 || true
gh api repos/TheHalfMoon/commandF/rules/branches/main 2>&1 || true
echo '== PR `#34` state, head, checks, and reviews =='
gh pr view 34 --repo TheHalfMoon/commandF --json number,state,headRefOid,baseRefOid,mergeable,reviewDecision,statusCheckRollup,reviews 2>&1 || trueLength of output: 15731 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== exact workflow files =='
fd -t f . .github/workflows -e yml -e yaml | sort
echo '== trigger, path-filter, and job-name sections =='
for f in $(fd -t f . .github/workflows -e yml -e yaml | sort); do
echo "--- $f"
rg -n -C4 '^(name:|on:)|^\s{2}(pull_request|push|workflow_dispatch|workflow_call):|^\s{4}(paths|paths-ignore|branches|branches-ignore):|^\s{6}- |^\s{2}[A-Za-z0-9_-]+:|^\s{4}name:' "$f" || true
done
echo '== all workflow uses forms, runner labels, and permissions =='
rg -n -C2 '^\s*(uses:|runs-on:|permissions:|persist-credentials:|container:|image:)' .github/workflows --glob '*.{yml,yaml}' || true
echo '== path-sensitive files named by the planning package =='
rg -n -C3 'paths:|paths-ignore:|\.github/workflows|docs/|specs/|Cargo\.toml|Cargo\.lock|action\.yml|action\.yaml|AGENTS\.md|constitution' \
.github/workflows --glob '*.{yml,yaml}' || trueLength of output: 46431 🤖 web_search executed:
Length of output: 15056
I found two substantive planning defects.
The review found no substantive defect in CF identity preservation, AF-01’s external ruleset blocker, or the stated limits on future assurance claims. At the time of review, You are interacting with an AI system. |
Code Review by Qodo
1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
@qodo review Please re-review exact current planning head |
|
@coderabbitai review Please perform a fresh review of exact current planning head |
Re-review completed against the stated planning head
One minor traceability improvement remains: Conclusion: The previously reported permission-audit and mutable-container issues are remediated at the planning level. I find no new substantive planning contradiction; the package remains |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='9db486b7f78f9d688d15745ccabdc10adcfafd6c'
actual="$(git rev-parse HEAD)"
echo "HEAD=$actual"
if [ "$actual" != "$expected" ]; then
echo "ERROR: expected $expected" >&2
exit 2
fi
base='8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361'
echo '== changed paths =='
git diff --name-status "$base..HEAD"
echo '== planning document outlines =='
for f in \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
specs/015-af-01-trusted-development-baseline/spec.md \
specs/015-af-01-trusted-development-baseline/plan.md \
specs/015-af-01-trusted-development-baseline/tasks.md \
specs/015-af-01-trusted-development-baseline/consistency.md \
docs/COMMAND_F_MASTER_ARCHITECTURE_V2.md \
docs/COMMAND_F_PLAN_INDEX.md
do
echo "--- $f"
if [ -f "$f" ]; then
rg -n '^(#|##|###|####)|\b(AF-0[1-4]|CF-1[3-6]|T0[0-9]{2}|FR-[0-9]+|SC-[0-9]+|MUST|SHALL|ruleset|permissions|container|digest|SHA256|PASS|green|HL7|R5|R6)\b' "$f" || true
else
echo "MISSING"
fi
done
echo '== planning document content =='
for f in \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
specs/015-af-01-trusted-development-baseline/spec.md \
specs/015-af-01-trusted-development-baseline/plan.md \
specs/015-af-01-trusted-development-baseline/tasks.md \
specs/015-af-01-trusted-development-baseline/consistency.md
do
echo "--- $f"
cat -n "$f"
done
echo '== reconciliation diff =='
git diff --unified=60 "$base..HEAD" -- \
docs/COMMAND_F_MASTER_ARCHITECTURE_V2.md docs/COMMAND_F_PLAN_INDEX.md
echo '== workflow inventory and security-relevant syntax =='
fd -t f -e yml -e yaml .github 2>/dev/null | sort
rg -n -i -C3 '(^name:|^\s*uses:|runs-on:|permissions:|persist-credentials:|pull_request_target:|workflow_run:|contents:\s*write|id-token:\s*write|container:|image:|services:)' \
.github --glob '*.{yml,yaml}' 2>/dev/null || true
echo '== task reference integrity =='
python3 - <<'PY'
import re
from pathlib import Path
root=Path('specs/015-af-01-trusted-development-baseline')
tasks=(root/'tasks.md').read_text()
defined=set(re.findall(r'\*\*(T\d{3})\*\*',tasks))
for p in [root/'spec.md',root/'plan.md',root/'consistency.md']:
refs=set(re.findall(r'\bT\d{3}\b',p.read_text()))
print(f'{p}: missing task definitions: {sorted(refs-defined)}')
print(f'defined tasks: {sorted(defined)}')
PY
echo '== diff whitespace check =='
git diff --check "$base..HEAD"
echo '== live ruleset and PR state =='
gh api repos/TheHalfMoon/commandF/rulesets 2>&1 || true
gh api repos/TheHalfMoon/commandF/branches/main/protection 2>&1 || true
gh pr view 34 --repo TheHalfMoon/commandF \
--json headRefOid,baseRefOid,mergeable,reviewDecision,statusCheckRollup,reviews 2>&1 || trueLength of output: 143500 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Action metadata files, including both supported metadata extensions =='
fd -t f -i 'action.y*ml' . | sort | while IFS= read -r f; do
echo "--- $f"
cat -n "$f"
done
echo '== all workflow triggers, filters, and job names =='
fd -t f -e yml -e yaml .github/workflows | sort | while IFS= read -r f; do
echo "--- $f"
cat -n "$f"
done
echo '== plan/task changes since the earlier reviewed planning head =='
git diff --unified=30 639ca68cbbd601e30c1174f437fda0c5598ed24a..HEAD -- \
specs/015-af-01-trusted-development-baseline/spec.md \
specs/015-af-01-trusted-development-baseline/plan.md \
specs/015-af-01-trusted-development-baseline/tasks.md \
specs/015-af-01-trusted-development-baseline/consistency.md
echo '== action metadata and required-check coverage references =='
rg -n -i -C3 \
'action\.ya?ml|composite action|required status|status check|terminal result|always-trigger|paths:|paths-ignore:|pull_request:' \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
specs/015-af-01-trusted-development-baseline \
.github/workflows --glob '*.{md,yml,yaml}'
echo '== complete permissions and container requirement-to-task trace =='
python3 - <<'PY'
from pathlib import Path
for name in ('spec.md', 'plan.md', 'tasks.md', 'consistency.md'):
p=Path('specs/015-af-01-trusted-development-baseline')/name
print(f'--- {p}')
for n, line in enumerate(p.read_text().splitlines(),1):
if any(s in line.lower() for s in ('permission','container','inherit','default','status check','path coverage','action.yml','action.yaml')):
print(f'{n}: {line}')
PYLength of output: 5328 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== all workflow triggers, filters, and job names =='
fd -t f -e yml -e yaml . .github/workflows | sort | while IFS= read -r f; do
echo "--- $f"
cat -n "$f"
done
echo '== exact changes from the earlier reviewed planning head =='
git diff --unified=30 639ca68cbbd601e30c1174f437fda0c5598ed24a..HEAD -- \
specs/015-af-01-trusted-development-baseline/spec.md \
specs/015-af-01-trusted-development-baseline/plan.md \
specs/015-af-01-trusted-development-baseline/tasks.md \
specs/015-af-01-trusted-development-baseline/consistency.md
echo '== action metadata and required-check coverage references =='
rg -n -i -C3 \
'action\.ya?ml|composite action|required status|status check|terminal result|always-trigger|paths:|paths-ignore:|pull_request:' \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
specs/015-af-01-trusted-development-baseline \
.github/workflows --glob '*.{md,yml,yaml}' || true
echo '== permission/container requirement-to-task trace =='
python3 - <<'PY'
from pathlib import Path
for name in ('spec.md', 'plan.md', 'tasks.md', 'consistency.md'):
p=Path('specs/015-af-01-trusted-development-baseline')/name
print(f'--- {p}')
for n, line in enumerate(p.read_text().splitlines(), 1):
if any(s in line.lower() for s in (
'permission', 'container', 'inherit', 'default',
'status check', 'path coverage', 'action.yml', 'action.yaml'
)):
print(f'{n}: {line}')
PYLength of output: 118161
I found two substantive planning defects.
The new machine-checkable permission model is consistent across the specification, plan, tasks, and test plan. It includes effective/inherited permission fail-closed behavior. The job/service container digest policy is also consistently specified and traced. I found no substantive defect in CF identity preservation, the CF-14 planning exception, the external ruleset blocker, or the stated limits on AF-01 assurance claims. The live ruleset read returned no rulesets. The branch-protection endpoint was unavailable to this integration with HTTP 403. The branch was mergeable, but You are interacting with an AI system. |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
@qodo review Please re-review exact current planning head |
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
|
@coderabbitai review Please review exact current planning head |
Re-reviewed the planning package as the current candidate, without carrying approval from earlier heads. No new substantive planning gap found.
This is a clean planning re-review, not implementation or |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected='e2d6a26188e9c375aac8006d672e131c9859bbef'
actual="$(git rev-parse HEAD)"
printf 'HEAD=%s\n' "$actual"
test "$actual" = "$expected"
base='8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361'
root='specs/015-af-01-trusted-development-baseline'
echo '== changed paths from canonical base =='
git diff --name-status "$base..HEAD"
echo '== document outlines =='
for f in \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
"$root/spec.md" "$root/plan.md" "$root/tasks.md" "$root/consistency.md" \
docs/COMMAND_F_MASTER_ARCHITECTURE_V2.md docs/COMMAND_F_PLAN_INDEX.md
do
printf '\n--- %s\n' "$f"
rg -n '^(#|##|###|####)|\b(AF-0[1-4]|CF-1[3-6]|T0[0-9]{2}|FR-[0-9]+|SC-[0-9]+|MUST|SHALL|ruleset|permission|container|digest|action\.ya?ml|required check|terminal|HL7|R5|R6)\b' "$f" || true
done
echo '== AF-01 planning package =='
for f in "$root/spec.md" "$root/plan.md" "$root/tasks.md" "$root/consistency.md"; do
printf '\n--- %s\n' "$f"
cat -n "$f"
done
echo '== amendments since prior reviewed head =='
git diff --check 9db486b7f78f9d688d15745ccabdc10adcfafd6c..HEAD
git diff --unified=35 9db486b7f78f9d688d15745ccabdc10adcfafd6c..HEAD -- \
"$root/spec.md" "$root/plan.md" "$root/tasks.md" "$root/consistency.md"
echo '== workflow and action metadata inventory =='
fd -t f -e yml -e yaml .github | sort
fd -t f -i 'action.y*ml' . | sort
echo '== workflow trust-relevant fields =='
rg -n -i -C3 \
'(^name:|^\s*uses:|runs-on:|permissions:|persist-credentials:|pull_request_target:|workflow_run:|container:|services:|image:|^\s*on:|pull_request:|paths:|paths-ignore:|branches:|branches-ignore:|if:)' \
.github --glob '*.{yml,yaml}' || true
echo '== requirement/task trace integrity =='
python3 - <<'PY'
import re
from pathlib import Path
root=Path('specs/015-af-01-trusted-development-baseline')
tasks=(root/'tasks.md').read_text()
defined=set(re.findall(r'\*\*(T\d{3})\*\*', tasks))
print('defined:', sorted(defined))
for name in ('spec.md','plan.md','consistency.md'):
text=(root/name).read_text()
refs=set(re.findall(r'\bT\d{3}\b', text))
print(f'{name}: referenced={sorted(refs)} missing={sorted(refs-defined)}')
for prefix in ('FR-', 'SC-'):
spec=set(re.findall(rf'\b{prefix}\d+\b',(root/'spec.md').read_text()))
taskrefs=set(re.findall(rf'\b{prefix}\d+\b',tasks))
print(f'{prefix}: spec={sorted(spec)} taskrefs={sorted(taskrefs)} untraced={sorted(spec-taskrefs)}')
PY
echo '== reconciliation references =='
rg -n -C3 '\b(AF-0[1-4]|CF-1[3-6]|HL7|R5|R6|ruleset|Assurance Foundation)\b' \
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.md \
docs/COMMAND_F_MASTER_ARCHITECTURE_V2.md \
docs/COMMAND_F_PLAN_INDEX.md
echo '== current GitHub state =='
gh api repos/TheHalfMoon/commandF/rulesets 2>&1 || true
gh api repos/TheHalfMoon/commandF/branches/main/protection 2>&1 || true
gh pr view 34 --repo TheHalfMoon/commandF \
--json headRefOid,baseRefOid,mergeable,reviewDecision,statusCheckRollup,reviews 2>&1 || trueLength of output: 214143 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== tracked Action metadata files =='
git ls-files | awk 'BEGIN { IGNORECASE=1 } /(^|\/)action\.ya?ml$/ { print }' | sort
echo '== tracked Action metadata content =='
while IFS= read -r f; do
printf '\n--- %s\n' "$f"
cat -n "$f"
done < <(git ls-files | awk 'BEGIN { IGNORECASE=1 } /(^|\/)action\.ya?ml$/ { print }' | sort)
echo '== external or local Action/reusable-workflow references in tracked workflow and metadata files =='
while IFS= read -r f; do
printf '\n--- %s\n' "$f"
rg -n -C2 '^\s*uses:\s*' "$f" || true
done < <(
{
git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml'
git ls-files | awk 'BEGIN { IGNORECASE=1 } /(^|\/)action\.ya?ml$/ { print }'
} | sort -u
)
echo '== constitution and AGENTS authority text =='
for f in .specify/memory/constitution.md AGENTS.md; do
printf '\n--- %s\n' "$f"
rg -n -C3 'independently executable|verification result|vertical|Spec Kit|review|exact.head|merge' "$f" || true
done
echo '== whitespace and planning package status =='
git diff --check 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361..HEAD
git status --short
echo '== current PR `#34` check state =='
gh pr view 34 --repo TheHalfMoon/commandF \
--json headRefOid,mergeable,reviewDecision,statusCheckRollup,reviews 2>&1 || trueLength of output: 1748 🏁 Script executed: #!/bin/bash
set -euo pipefail
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT
git ls-files | awk 'BEGIN { IGNORECASE=1 } /(^|\/)action\.ya?ml$/ { print }' | sort > "$tmp"
echo '== tracked Action metadata files =='
cat "$tmp"
echo '== tracked Action metadata content =='
while IFS= read -r f; do
[ -n "$f" ] || continue
printf '\n--- %s\n' "$f"
cat -n "$f"
done < "$tmp"
echo '== Action/reusable-workflow references in tracked workflow and metadata files =='
{
git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml'
cat "$tmp"
} | sort -u > "${tmp}.inputs"
while IFS= read -r f; do
[ -n "$f" ] || continue
printf '\n--- %s\n' "$f"
rg -n -C2 '^\s*uses:\s*' "$f" || true
done < "${tmp}.inputs"
rm -f "${tmp}.inputs"
echo '== constitution and AGENTS authority text =='
for f in .specify/memory/constitution.md AGENTS.md; do
printf '\n--- %s\n' "$f"
rg -n -i -C3 'independently executable|verification result|vertical|Spec Kit|review|exact.head|merge' "$f" || true
done
echo '== whitespace and planning package status =='
git diff --check 8a45857bf31c4acae57fdfb1e3cdde3d0f7d0361..HEAD
git status --short
echo '== current PR `#34` check state =='
gh pr view 34 --repo TheHalfMoon/commandF \
--json headRefOid,mergeable,reviewDecision,statusCheckRollup,reviews 2>&1 || trueLength of output: 15883
I found no substantive planning defect. The package now consistently governs both The required-check design is complete. FR-007, the plan test cases, and T035-T040 require every selected required check to report a terminal result for every protected-branch PR at the current head. They prohibit direct selection of a whole path-filtered workflow that can remain pending. They also require an always-triggered aggregation gate when conditional validation must contribute to merge policy. The permission and container policy is complete at planning level. The audit must normalize effective permissions, fail closed on unresolved inherited/default authority, compare against machine-checkable policy, and enforce digests for proof-critical job and service containers. T011-T016 and the positive and negative test cases trace these requirements. The AF identities preserve CF-14, CF-15, and CF-16. AF-01 does not authorize CF-14 implementation. The external ruleset limitation remains a blocker, not a waiver. The documents do not claim immutable GitHub-hosted runner images, universal dependency security, a Scorecard correctness threshold, or AF-02/AF-03/AF-04 completion.
T005 is still incomplete. At inspection time, You are interacting with an AI system. |
1 participant
Scope
Planning-only creation of commandF's cross-cutting Assurance Foundation program after canonical CF-13 closeout.
Canonical base:
Exact planning head at PR creation:
Why
The repository audit found a mismatch between strong commandF product proof and weaker uniform development/release enforcement:
maincurrently has no branch protection/ruleset enforcement;ci.ymlstill uses mutable Action/tool references andubuntu-latest, while later proof workflows already use stronger full-SHA/digest-pinned identities;5.0.0published and R66.0.0-ballot5draft (2026-07-17), so future version-readiness evidence must distinguish published vs draft authority.Plan-set changes
Adds:
docs/COMMAND_F_ASSURANCE_PROGRAM_2026-08-26.mdspecs/015-af-01-trusted-development-baseline/spec.mdspecs/015-af-01-trusted-development-baseline/plan.mdspecs/015-af-01-trusted-development-baseline/tasks.mdspecs/015-af-01-trusted-development-baseline/consistency.mdReconciles:
docs/COMMAND_F_MASTER_ARCHITECTURE_V2.mddocs/COMMAND_F_PLAN_INDEX.mdIdentity / roadmap rule
AF identities are Assurance Foundation units and do not consume or rename CF product identities.
AF-01 is the immediate cross-cutting post-CF-13 prerequisite. CF-14 planning may proceed separately, but a new post-CF-13 product implementation must not merge before AF-01 closes.
AF-01 planned stacks
Stack A
Stack B
deny.tomlpolicy;Stack C
AF01_ASSURANCE_SHA256;mainruleset requiring PR/review/checks, resolved conversations, and blocking force-push/deletion;The current GitHub connector exposes ruleset reads but not writes. That limitation is not a waiver: AF-01 remains open until an authorized administrator applies the exact ruleset and live evidence proves it.
Research basis
Primary sources used by the plan include:
Explicit non-goals
This PR changes no Rust, Cargo dependency, workflow, source-control setting, product semantics, CF-06 production oracle identity, CF-10 frozen corpus, or runtime authority.
AF-02/03/04 implementation is not authorized by this PR; each requires its own future Spec Kit package.
Planning gate
T005 remains incomplete until this exact final planning state has:
main.Any content mutation supersedes prior exact-head qualification.
Summary by cubic
Adds the Assurance Foundation (AF) planning package for AF-01 (Trusted Development Baseline), preserving all CF product-slice identities and leaving product semantics unchanged.
Planning scope
mainlacks branch protection,ci.ymluses mutable Action/tool references andubuntu-latest, and no dependency or workflow security-gate layer exists.specs/015-af-01-trusted-development-baseline/.action.yml/action.yamlmetadata, full-SHA Action references, credentialless checkout, fixed runner labels, machine-checkable least-privilege permissions, and digest-pinned proof containers, with positive and counterexample tests.mainruleset; the current connector only reads, not writes, ruleset state.Written for commit e2d6a26. Summary will update on new commits.