jamminrebel/pom-omp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: jamminrebel:v2.0.0
Branches Tags
jamminrebel:main
jamminrebel:v2.0.0
...
compare: jamminrebel:main
Branches Tags
jamminrebel:main
jamminrebel:v2.0.0

3 Commits
v2.0.0 ... main

Author SHA1 Message Date
Antigravity
7b714bfc6b fix: make audit gates evidence-backed and correct stale check-count claims 
- wire npm audit (prod + full dev tree) through readGate instead of hardcoded NOT RUN reasons
- record real results: production 0 vulns PASS; dev tree 16 dev-only advisories FAIL, disclosed with reach and remediation
- docs/VERIFICATION.md: six checks -> seven, add package-metadata section and mutation row, record executed row-7 proof
- README/SETTINGS: replace six-gate wording with the actual gate ledger
 2026-08-19 11:40:18 +02:00
Antigravity
0164fcbddb docs: record post-publication reconciliation in TASKLIST 2026-08-19 11:10:21 +02:00
Antigravity
971e89e600 chore: canonical URLs now live (self-hosted Gitea + wiki.pom.loca.zone) 2026-08-19 11:08:38 +02:00
10 changed files with 146 additions and 79 deletions
Expand all files Collapse all files

1
00_admin/validation/audit-dev.json Normal file
View File

@@ -0,0 +1 @@
{"passed": false, "timestamp": "2026-08-19T11:34:04+02:00", "scope": "full development tree audit", "command": "npm audit --registry=https://registry.npmjs.org/", "vulnerabilities": {"info": 0, "low": 0, "moderate": 9, "high": 7, "critical": 0, "total": 16}, "packages": ["adm-zip (high)", "fast-xml-parser (high)", "sharp (high, libvips CVEs)", "@opentelemetry/core (moderate)", "tar (moderate)"], "reach": "dev-only; every advisory is transitive under the @oh-my-pi/* peer SDK. npm audit --omit=dev reports 0 vulnerabilities, so no advisory reaches the published tarball (runtime deps are crc-32, yauzl, yazl).", "remediation": "none available in-window: npm audit fix --dry-run changes 0 packages and still reports 16. Requires an upstream @oh-my-pi release; forcing it would leave the >=16.4.6 <17 peer window."}

1
00_admin/validation/audit-prod.json Normal file
View File

@@ -0,0 +1 @@
{"passed": true, "timestamp": "2026-08-19T11:33:59+02:00", "scope": "production dependency audit", "command": "npm audit --omit=dev --registry=https://registry.npmjs.org/", "vulnerabilities": {"info": 0, "low": 0, "moderate": 0, "high": 0, "critical": 0}}

86
README.md
View File

@@ -41,12 +41,18 @@ Step 1 — obtain the repository source. Canonical project coordinates are recor
| Field | Value | State | | Field | Value | State |
|---|---|---| |---|---|---|
| `homepage` | `https://wiki.omp.loca.zone/` | Live | | `homepage` | `https://wiki.pom.loca.zone/` | Live |
| `bugs.url` | `https://wiki.omp.loca.zone/` | Live | | `bugs.url` | `https://wiki.pom.loca.zone/` | Live |
| `bugs.email` | `antigravity@loca.zone` | Live | | `bugs.email` | `antigravity@loca.zone` | Live |
| `repository.url` | `git+https://omp.loca.zone/pom-omp.git` | Reserved — not yet serving Git | | `repository.url` | `git+https://git.omp.loca.zone/jamminrebel/pom-omp.git` | Live — self-hosted Gitea, anonymous clone |
There is deliberately no public forge mirror: this package has never been published to npm, and no GitHub or self-hosted Git endpoint exists for it today. Until `repository.url` is actually served, obtain the checkout out of band from the maintainer. Do not substitute a third-party URL that has not been confirmed. There is deliberately no public forge mirror and this package has never been published to npm. Clone from the owned endpoint:
```bash
git clone https://git.omp.loca.zone/jamminrebel/pom-omp.git
```
Do not substitute a third-party URL that has not been confirmed.
Step 2 — install, verify, and link from the checkout root: Step 2 — install, verify, and link from the checkout root:
@@ -56,7 +62,7 @@ npm run verify
npm run link npm run link
``` ```
`npm run verify` does not currently complete in this environment. See [Verification status](#verification-status) before treating a failure as a code defect. `npm run verify` completes green from a clean `npm install` on this host. See [Verification status](#verification-status) for the recorded gate evidence.
Step 3 — restart OMP or run `/reload-plugins`, then install the bundled themes: Step 3 — restart OMP or run `/reload-plugins`, then install the bundled themes:
@@ -80,47 +86,39 @@ Precondition: the tarball must contain `prompts/`. `src/prompts.ts` resolves bun
### Verification status ### Verification status
Overall readiness: PARTIAL. Overall readiness: PARTIAL. Seven evidence-backed gates PASS, one FAILS on dev-only transitive advisories, and two host-dependent gates remain NOT RUN.
Currently passing: `npm run verify` exits 0 from a clean `npm install` on this host. Each gate below is recorded as evidence under `00_admin/validation/` and rendered into `RELEASE.json` by `scripts/release-manifest.mjs`; a missing evidence file renders NOT RUN, and `passed !== true` renders FAIL.
| Check | Command | | Gate | Command | State |
|---|---|---|
| TypeScript | `npm run check` | PASS |
| Behavioral tests | `npm test` | PASS |
| Runtime smoke | `npm run smoke` | PASS |
| Structural verification | `node scripts/verify.mjs` | PASS |
| Theme schema | asserted inside `scripts/verify.mjs` | PASS |
| Pack dry run | `npm run pack:dry` | PASS |
| Production dependency audit | `npm audit --omit=dev` | PASS — 0 vulnerabilities |
| Full development tree audit | `npm audit` | **FAIL** — 16 advisories (9 moderate, 7 high) |
| OMP plugin doctor | `npm run doctor` | NOT RUN — requires Bun plus an installed OMP host |
| Interactive TUI smoke | manual OMP session | NOT RUN — requires an interactive terminal |
The development-tree FAIL is disclosed, not waived. Every advisory (`adm-zip`, `fast-xml-parser`, `sharp`/libvips, `@opentelemetry/core`, `tar`) is transitive under the `@oh-my-pi/*` peer SDK and dev-only: `npm audit --omit=dev` reports 0, and POM's three runtime dependencies are `crc-32`, `yauzl`, and `yazl`, so nothing reaches the published tarball. No in-window remediation exists — `npm audit fix --dry-run` changes 0 packages and still reports 16, because the vulnerable versions are pinned by the SDK's own ranges. Clearing it requires an upstream `@oh-my-pi` release; forcing it would leave the `>=16.4.6 <17` peer window.
Never satisfy a gate with a stub: do not vendor dependencies into the repository, and do not hand-write or copy the OMP SDK packages or the OMP theme schema. A gate satisfied by a stub proves nothing about the shipped extension.
Dependency requirements per check:
| Check | Needs installed dependencies |
|---|---| |---|---|
| Extension smoke test | `npm run smoke` | | `npm run smoke` | No — runs through `tsx` against `src/` without resolving the OMP SDK at runtime |
| Release manifest parity | `npm run release:check` | | `npm run release:check` | No — `scripts/release-manifest.mjs` uses Node builtins only |
| State unit tests | `node --import tsx --test tests/state.test.ts` | | `node --import tsx --test tests/state.test.ts` | No — exercises state logic only |
| `npm run check` | Yes — OMP SDK type declarations plus `@types/node` |
The full gate is BLOCKED, not passing. `npm run verify` cannot complete because an npm registry outage (repeated `ETIMEDOUT` on install) left `node_modules` incomplete. Missing at minimum: | `npm test` (full suite) | Yes — `yauzl`, `yazl`, OMP SDK |
| `node scripts/verify.mjs` | Yes — reads the OMP theme schema from `node_modules` |
| Missing | Blocks | | `npm run pack:dry` | Yes — resolvable npm environment |
|---|---| | `npm run doctor` | Yes — plus Bun and an installed OMP host |
| `@oh-my-pi/pi-coding-agent`, `@oh-my-pi/pi-tui`, `@oh-my-pi/pi-utils` | `npm run check`, every test importing `src/` modules that reference the OMP SDK |
| `@types/node` | `npm run check` (`tsc --noEmit`) |
| `yauzl` | `tests/zip.test.ts` and the archive verification path in `src/zip.ts` |
| `node_modules/@oh-my-pi/pi-coding-agent/src/modes/theme/theme-schema.json` | `node scripts/verify.mjs` theme validation |
No claim is made that `npm run verify` has passed in this environment.
### Registry outage and offline guidance
Rules while the registry is unreachable:
- Do not vendor dependencies into the repository.
- Do not stub, hand-write, or copy the OMP SDK packages or the OMP theme schema to turn a gate green. A gate satisfied by a stub proves nothing about the shipped extension.
- Repair or retry registry access, rerun `npm install`, then rerun the full `npm run verify` gate and record its real result.
What each check needs:
| Check | Offline without installed dependencies |
|---|---|
| `npm run smoke` | Meaningful — runs through `tsx` against `src/` without resolving the OMP SDK at runtime |
| `npm run release:check` | Meaningful — `scripts/release-manifest.mjs` uses Node builtins only |
| `node --import tsx --test tests/state.test.ts` | Meaningful — exercises state logic only |
| `npm run check` | Requires installed dependencies (OMP SDK type declarations plus `@types/node`) |
| `npm test` (full suite) | Requires installed dependencies (`yauzl`, `yazl`, OMP SDK) |
| `node scripts/verify.mjs` | Requires installed dependencies (reads the OMP theme schema from `node_modules`) |
| `npm run pack:dry` | Requires a resolvable npm environment |
| `npm run doctor` | Requires Bun plus an installed OMP host |
## Production loop ## Production loop
@@ -215,7 +213,7 @@ npm pack
The local test suite imports production code. The final host smoke test remains `omp plugin doctor` plus an interactive OMP session. The local test suite imports production code. The final host smoke test remains `omp plugin doctor` plus an interactive OMP session.
`npm run check`, `npm test`, and `npm run verify` require a complete `node_modules`; see [Verification status](#verification-status) for what currently passes and what is blocked. `npm run check`, `npm test`, and `npm run verify` require a complete `node_modules`; see [Verification status](#verification-status) for the recorded gate evidence.
## Governing law ## Governing law

74
RELEASE.json
View File

@@ -20,7 +20,7 @@
"themes": 2, "themes": 2,
"behavioralTests": 9, "behavioralTests": 9,
"sourceFilesHashed": 97, "sourceFilesHashed": 97,
"sourceBytesHashed": 312041, "sourceBytesHashed": 313817,
"selfHashPolicy": "RELEASE.json is excluded from its own source inventory; final package and archive hashes are recorded externally." "selfHashPolicy": "RELEASE.json is excluded from its own source inventory; final package and archive hashes are recorded externally."
}, },
"verification": { "verification": {
@@ -97,12 +97,52 @@
} }
}, },
"productionDependencyAudit": { "productionDependencyAudit": {
"status": "NOT RUN", "status": "PASS",
"reason": "Requires network access to npm registry" "timestamp": "2026-08-19T11:33:59+02:00",
"scope": "production dependency audit",
"command": "npm audit --omit=dev --registry=https://registry.npmjs.org/",
"details": {
"passed": true,
"timestamp": "2026-08-19T11:33:59+02:00",
"scope": "production dependency audit",
"command": "npm audit --omit=dev --registry=https://registry.npmjs.org/",
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 0,
"high": 0,
"critical": 0
}
}
}, },
"fullDevelopmentTreeAudit": { "fullDevelopmentTreeAudit": {
"status": "NOT RUN", "status": "FAIL",
"reason": "Requires network access to npm registry" "timestamp": "2026-08-19T11:34:04+02:00",
"scope": "full development tree audit",
"command": "npm audit --registry=https://registry.npmjs.org/",
"details": {
"passed": false,
"timestamp": "2026-08-19T11:34:04+02:00",
"scope": "full development tree audit",
"command": "npm audit --registry=https://registry.npmjs.org/",
"vulnerabilities": {
"info": 0,
"low": 0,
"moderate": 9,
"high": 7,
"critical": 0,
"total": 16
},
"packages": [
"adm-zip (high)",
"fast-xml-parser (high)",
"sharp (high, libvips CVEs)",
"@opentelemetry/core (moderate)",
"tar (moderate)"
],
"reach": "dev-only; every advisory is transitive under the @oh-my-pi/* peer SDK. npm audit --omit=dev reports 0 vulnerabilities, so no advisory reaches the published tarball (runtime deps are crc-32, yauzl, yazl).",
"remediation": "none available in-window: npm audit fix --dry-run changes 0 packages and still reports 16. Requires an upstream @oh-my-pi release; forcing it would leave the >=16.4.6 <17 peer window."
}
}, },
"ompPluginDoctor": { "ompPluginDoctor": {
"status": "NOT RUN", "status": "NOT RUN",
@@ -142,8 +182,8 @@
}, },
{ {
"path": "README.md", "path": "README.md",
"bytes": 10075, "bytes": 10547,
"sha256": "6ccdd0b9eba8955c088edc205a9053a18bb263609ae7e308e5e03b6486c87bff" "sha256": "75b9c26fc6a028575506b1da6df84c20a72323b58ba4acc53f801e9817bf9d5e"
}, },
{ {
"path": "agents/pom-architect.md", "path": "agents/pom-architect.md",
@@ -277,8 +317,8 @@
}, },
{ {
"path": "docs/SETTINGS.md", "path": "docs/SETTINGS.md",
"bytes": 3284, "bytes": 3229,
"sha256": "a0fc17b1d81811aa7810e53c77e619c51aaea62737273903b9af70d0484befb4" "sha256": "9226d0ad0bbb07d49dd8bd06c21febba2166145c1822e58cd621e9b6f472d605"
}, },
{ {
"path": "docs/TOOL_MATRIX.md", "path": "docs/TOOL_MATRIX.md",
@@ -292,8 +332,8 @@
}, },
{ {
"path": "docs/VERIFICATION.md", "path": "docs/VERIFICATION.md",
"bytes": 10255, "bytes": 11486,
"sha256": "0aab7e070ea90dbca30a0ed86a9afdedd2a26707ff359e09cc5f360b2e8a47a9" "sha256": "dfd5c5dd0cadaf5e5e018ebd8d74a0ab718835ec46ad9163e79c91f6dd275a30"
}, },
{ {
"path": "docs/index.md", "path": "docs/index.md",
@@ -307,8 +347,8 @@
}, },
{ {
"path": "package.json", "path": "package.json",
"bytes": 2153, "bytes": 2169,
"sha256": "7e325ea1558fbdb5bb76565f942306ce6568152a5a604ef80fbdb252cadbe92e" "sha256": "0f126696102547f5bef691a24cc06d2eb4557218a56115746160c3025f0dbb89"
}, },
{ {
"path": "prompts/agent-studio.md", "path": "prompts/agent-studio.md",
@@ -392,8 +432,8 @@
}, },
{ {
"path": "scripts/check-docs.mjs", "path": "scripts/check-docs.mjs",
"bytes": 17112, "bytes": 17116,
"sha256": "570eb129e9432d3b6aa8f5112b743c7b2bfc20c75c50fb6e30bf0121130b8286" "sha256": "34a08a55c339ac8004df1438d13ed721d14e9792a3bdc1fd9ac9ad99ab41d6f6"
}, },
{ {
"path": "scripts/install.ps1", "path": "scripts/install.ps1",
@@ -407,8 +447,8 @@
}, },
{ {
"path": "scripts/release-manifest.mjs", "path": "scripts/release-manifest.mjs",
"bytes": 4714, "bytes": 4822,
"sha256": "13dac5093fae178d34484f3bd374f34dbf450e84ea994bb5a0258dfcce5ac541" "sha256": "ca0027d77c2277beeb283c567f9e618a4921b388c863dbb8e81dc381da7e58da"
}, },
{ {
"path": "scripts/smoke.ts", "path": "scripts/smoke.ts",

9
TASKLIST.md
View File

@@ -107,3 +107,12 @@ Purpose: publish only after package truth, docs truth, automation, and live veri
- [ ] 7.3 Publish only with exact status labels. - [ ] 7.3 Publish only with exact status labels.
- [x] 7.3.1 Update README/wiki readiness summary to one of: `BLOCKED` with external prerequisite, `PARTIAL` with exact passing checks, or `READY` with all gates and ego audit complete; completion: no PASS/READY claim lacks linked evidence. - [x] 7.3.1 Update README/wiki readiness summary to one of: `BLOCKED` with external prerequisite, `PARTIAL` with exact passing checks, or `READY` with all gates and ego audit complete; completion: no PASS/READY claim lacks linked evidence.
- [ ] 7.3.2 Final definition of done: package includes runtime prompts; release manifest is evidence-backed; docs/index/sidebar/wiki exist; stale layout/command/prompt/validation/test/settings claims are corrected; package metadata is present or explicitly URL-blocked; runtime/doc-contract decisions for resources and inspect are resolved; full verify is green after dependency install; Linux preview passes; macOS/future ego audit is complete or publication remains blocked. - [ ] 7.3.2 Final definition of done: package includes runtime prompts; release manifest is evidence-backed; docs/index/sidebar/wiki exist; stale layout/command/prompt/validation/test/settings claims are corrected; package metadata is present or explicitly URL-blocked; runtime/doc-contract decisions for resources and inspect are resolved; full verify is green after dependency install; Linux preview passes; macOS/future ego audit is complete or publication remains blocked.
## 8. 🚀 Post-publication reconciliation (Phase E, 2026-08-19)
Publication changed the facts behind several items above. Status recorded, not silently ticked:
- 1.2.3 and 1.3.1 are OBSOLETE, not open: the internal-Artifactory blocker is gone. The lockfile's `resolved` URLs were repointed from the dead mirror to `registry.npmjs.org` (integrity hashes and version pins untouched), `npm install` succeeded, and every repository-local gate was rerun afterwards. Both `npm audit` scopes are now evidence-backed too: production 0 vulnerabilities (PASS), full development tree 16 dev-only transitive advisories (FAIL, disclosed, no in-window remediation). Manifest freshness and verification truth now agree.
- 7.2.3 stays PARTIAL: the Linux half is done — `check-docs` check 5 link-and-orphan PASS, wiki builds via `dev/wikis/build.sh pom`, and `https://wiki.pom.loca.zone/` plus deep pages return 200. The macOS/ego live roast remains platform-blocked (section 6).
- 7.3.2 stays OPEN for the ego-audit clause only. Every other clause is satisfied: `prompts/` ships, `RELEASE.json` is evidence-backed from `00_admin/validation/`, docs index and wiki exist and are served, stale claims are corrected, and package metadata is live rather than reserved.
- Publication facts: self-hosted Gitea (loopback 51400) serves `https://git.omp.loca.zone/jamminrebel/pom-omp.git` with anonymous HTTPS clone; `main` and `v2.0.0` are pushed; the docs wiki is served from `dev/wikis/pom/current`; `wiki.omp.loca.zone` was left untouched.

2
docs/SETTINGS.md
View File

@@ -57,4 +57,4 @@ built-in defaults
| Bun | `>=1.3.14` | `engines.bun` | | Bun | `>=1.3.14` | `engines.bun` |
| Node.js + npm | Node 22 or newer | Local scripts and the `node:test` suite | | Node.js + npm | Node 22 or newer | Local scripts and the `node:test` suite |
Verification state is PARTIAL. `npm run smoke`, `npm run release:check`, and `node --import tsx --test tests/state.test.ts` pass. The full `npm run verify` gate is blocked: an npm registry outage left `node_modules` incomplete (OMP SDK peer packages, `@types/node`, `yauzl`, and the OMP theme schema that `scripts/verify.mjs` reads). Restore registry access, reinstall, then rerun the full gate. See the README sections Verification status and Registry outage and offline guidance. Verification state: `npm run verify` exits 0 from a clean `npm install`. Seven evidence-backed gates PASS, `npm audit` on the full development tree FAILS on 16 dev-only transitive advisories under the `@oh-my-pi/*` peer SDK (production audit reports 0, so nothing reaches the published tarball), and two host-dependent gates (`npm run doctor`, interactive TUI smoke) remain NOT RUN. See the README section Verification status.

38
docs/VERIFICATION.md
View File

@@ -1,6 +1,6 @@
--- ---
title: Documentation verification title: Documentation verification
description: The six documentation-contract checks in scripts/check-docs.mjs and how to prove they fail description: The seven documentation-contract checks in scripts/check-docs.mjs and how to prove they fail
--- ---
# Documentation verification # Documentation verification
@@ -32,10 +32,10 @@ POM docs verification FAIL (1/6: layout-contract)
``` ```
The final line is `POM docs verification PASS` with exit code 0, or The final line is `POM docs verification PASS` with exit code 0, or
`POM docs verification FAIL (<count>/6: <check names>)` with exit code 1. All six checks always `POM docs verification FAIL (<count>/7: <check names>)` with exit code 1. All seven checks always
run; one failure never hides another. run; one failure never hides another.
## The six checks ## The seven checks
| # | Name | Canonical owner | Mirrors checked | | # | Name | Canonical owner | Mirrors checked |
|---|---|---|---| |---|---|---|---|
@@ -45,6 +45,7 @@ run; one failure never hides another.
| 4 | `prompt-order-contract` | `src/prompts.ts` `composePromptStack` and `renderStagePrompt` | `POM.yml` `prompt_precedence` | | 4 | `prompt-order-contract` | `src/prompts.ts` `composePromptStack` and `renderStagePrompt` | `POM.yml` `prompt_precedence` |
| 5 | `link-and-orphan` | the `docs/` tree on disk | every `docs/*.md` page | | 5 | `link-and-orphan` | the `docs/` tree on disk | every `docs/*.md` page |
| 6 | `release-evidence` | `scripts/release-manifest.mjs` gate readers | `RELEASE.json` `verification` | | 6 | `release-evidence` | `scripts/release-manifest.mjs` gate readers | `RELEASE.json` `verification` |
| 7 | `package-metadata` | `package.json` `repository`, `homepage`, `bugs` | canonical `loca.zone` hosts, no placeholders |
### 1. resource-package-parity ### 1. resource-package-parity
@@ -116,6 +117,17 @@ keeps them evidence-bound.
Historical defect: the manifest carried hard-coded `"PASS"` strings for gates that had never been Historical defect: the manifest carried hard-coded `"PASS"` strings for gates that had never been
executed, so the release claimed verification it could not support. executed, so the release claimed verification it could not support.
### 7. package-metadata
Defends canonical project coordinates. `package.json` `repository`, `homepage`, and `bugs` must each
be a string or an object carrying a string `url`, must not retain the `UNRESOLVED` placeholder, must
parse as absolute URLs, and must resolve to `loca.zone` or a subdomain of it, because no third-party
forge mirror has been confirmed for this package. A `repository.url` on owned infrastructure prints a
`note:` line recording its serving state.
Historical defect: the metadata fields carried `UNRESOLVED` placeholders, and later recorded a
`repository.url` that was reserved but not serving Git while the prose claimed it was usable.
## Known divergences ## Known divergences
`KNOWN_COMMAND_DIVERGENCES` in `scripts/check-docs.mjs` is the only escape hatch, and it contains `KNOWN_COMMAND_DIVERGENCES` in `scripts/check-docs.mjs` is the only escape hatch, and it contains
@@ -131,17 +143,21 @@ Each row is a specified procedure for proving that a check actually defends its
mutation, run `node scripts/check-docs.mjs`, confirm the named check reports `FAIL` with the mutation, run `node scripts/check-docs.mjs`, confirm the named check reports `FAIL` with the
expected message, then revert the mutation and confirm the run returns to expected message, then revert the mutation and confirm the run returns to
`POM docs verification PASS`. Mutations are destructive edits to canonical files and must be `POM docs verification PASS`. Mutations are destructive edits to canonical files and must be
reverted before any commit or package step. This section specifies the procedure and the expected reverted before any commit or package step. Rows 1–6 specify the procedure and expected output
output; it records no executed results, because the checker was not run when this page was written. without recorded results. Row 7 was executed on 2026-08-19: pointing `homepage` at
`https://example.com/` produced `FAIL check 7/7 package-metadata` and
`POM docs verification FAIL (1/7: package-metadata)` with exit code 1, and restoring the file
returned `POM docs verification PASS` with exit code 0.
| Check | Mutation to apply | Expected failure | | Check | Mutation to apply | Expected failure |
|---|---|---| |---|---|---|
| 1 `resource-package-parity` | Remove `"prompts"` from the `files` array in `package.json` | `FAIL check 1/6 resource-package-parity` — `package.json: files must contain "prompts" because src/prompts.ts and src/events.ts load it at runtime` | | 1 `resource-package-parity` | Remove `"prompts"` from the `files` array in `package.json` | `FAIL check 1/7 resource-package-parity` — `package.json: files must contain "prompts" because src/prompts.ts and src/events.ts load it at runtime` |
| 2 `command-parity` | Delete the `/pom status [--json]` row from the `## Command map` table in `README.md` | `FAIL check 2/6 command-parity` — `/pom status is documented in src/command.ts HELP, POM.yml commands: but absent from README.md ## Command map` | | 2 `command-parity` | Delete the `/pom status [--json]` row from the `## Command map` table in `README.md` | `FAIL check 2/7 command-parity` — `/pom status is documented in src/command.ts HELP, POM.yml commands: but absent from README.md ## Command map` |
| 3 `layout-contract` | Rename `06_ledgers` to `06_logs` on the ledger line of `skills/pom/references/artifacts.md` | `FAIL check 3/6 layout-contract` — `skills/pom/references/artifacts.md:10 names "06_logs", which src/persistence.ts bootstrapProject never creates` | | 3 `layout-contract` | Rename `06_ledgers` to `06_logs` on the ledger line of `skills/pom/references/artifacts.md` | `FAIL check 3/7 layout-contract` — `skills/pom/references/artifacts.md:10 names "06_logs", which src/persistence.ts bootstrapProject never creates` |
| 4 `prompt-order-contract` | In `POM.yml` `prompt_precedence`, move the executable stage contract entry above the project-local fragment entry so it is no longer last | `FAIL check 4/6 prompt-order-contract` — `POM.yml: prompt_precedence must end with the executable stage contract appended by renderStagePrompt`, plus the misplaced-entry position | | 4 `prompt-order-contract` | In `POM.yml` `prompt_precedence`, move the executable stage contract entry above the project-local fragment entry so it is no longer last | `FAIL check 4/7 prompt-order-contract` — `POM.yml: prompt_precedence must end with the executable stage contract appended by renderStagePrompt`, plus the misplaced-entry position |
| 5 `link-and-orphan` | In `docs/index.md`, change the Package inventory link target from `INVENTORY.md` to `INVENTORY-old.md` | `FAIL check 5/6 link-and-orphan` — `docs/index.md: broken relative link INVENTORY-old.md resolves to docs/INVENTORY-old.md, which does not exist on disk`, and `docs/INVENTORY.md: unreachable page` if `docs/navigation.md` no longer links it either | | 5 `link-and-orphan` | In `docs/index.md`, change the Package inventory link target from `INVENTORY.md` to `INVENTORY-old.md` | `FAIL check 5/7 link-and-orphan` — `docs/index.md: broken relative link INVENTORY-old.md resolves to docs/INVENTORY-old.md, which does not exist on disk`, and `docs/INVENTORY.md: unreachable page` if `docs/navigation.md` no longer links it either |
| 6 `release-evidence` | Replace the `verification.runtimeSmoke` object in `RELEASE.json` with the bare string `"PASS"` | `FAIL check 6/6 release-evidence` — `RELEASE.json: verification.runtimeSmoke is the bare string "PASS"; every gate must be an evidence object carrying a status` | | 6 `release-evidence` | Replace the `verification.runtimeSmoke` object in `RELEASE.json` with the bare string `"PASS"` | `FAIL check 6/7 release-evidence` — `RELEASE.json: verification.runtimeSmoke is the bare string "PASS"; every gate must be an evidence object carrying a status` |
| 7 `package-metadata` | Point `homepage` in `package.json` at `https://example.com/` | `FAIL check 7/7 package-metadata` — `package.json: homepage points at "example.com", which is outside the canonical loca.zone infrastructure` |
Row 5 mutates a link rather than deleting a file, so the mutation is a one-token edit and the revert Row 5 mutates a link rather than deleting a file, so the mutation is a one-token edit and the revert
is exact. Row 6 must be reverted by regenerating the manifest with `npm run release:manifest` rather is exact. Row 6 must be reverted by regenerating the manifest with `npm run release:manifest` rather

6
package.json
View File

@@ -6,11 +6,11 @@
"license": "MIT", "license": "MIT",
"repository": { "repository": {
"type": "git", "type": "git",
"url": "git+https://omp.loca.zone/pom-omp.git" "url": "git+https://git.omp.loca.zone/jamminrebel/pom-omp.git"
}, },
"homepage": "https://wiki.omp.loca.zone/", "homepage": "https://wiki.pom.loca.zone/",
"bugs": { "bugs": {
"url": "https://wiki.omp.loca.zone/", "url": "https://wiki.pom.loca.zone/",
"email": "antigravity@loca.zone" "email": "antigravity@loca.zone"
}, },
"keywords": [ "keywords": [

2
scripts/check-docs.mjs
View File

@@ -395,7 +395,7 @@ checks.push((index) =>
} }
const repository = typeof pkg.repository?.url === "string" ? pkg.repository.url : ""; const repository = typeof pkg.repository?.url === "string" ? pkg.repository.url : "";
if (repository.includes(CANONICAL_HOST)) if (repository.includes(CANONICAL_HOST))
note(`${repository} is reserved on owned infrastructure and is not yet serving Git`); note(`${repository} is served by the owned Gitea instance and accepts anonymous clones`);
}), }),
); );

6
scripts/release-manifest.mjs
View File

@@ -53,6 +53,8 @@ const gates = {
structuralVerification: readGate("00_admin/validation/structural.json", "node scripts/verify.mjs"), structuralVerification: readGate("00_admin/validation/structural.json", "node scripts/verify.mjs"),
themeSchemaValidation: readGate("00_admin/validation/theme.json", "theme schema validation"), themeSchemaValidation: readGate("00_admin/validation/theme.json", "theme schema validation"),
npmPackDryRun: readGate("00_admin/validation/pack.json", "npm pack --dry-run"), npmPackDryRun: readGate("00_admin/validation/pack.json", "npm pack --dry-run"),
productionDependencyAudit: readGate("00_admin/validation/audit-prod.json", "npm audit --omit=dev"),
fullDevelopmentTreeAudit: readGate("00_admin/validation/audit-dev.json", "npm audit"),
}; };
const releaseDate = new Date().toISOString().split("T")[0]; const releaseDate = new Date().toISOString().split("T")[0];
@@ -89,8 +91,8 @@ const release = {
structuralVerification: gates.structuralVerification, structuralVerification: gates.structuralVerification,
themeSchemaValidation: gates.themeSchemaValidation, themeSchemaValidation: gates.themeSchemaValidation,
npmPackDryRun: gates.npmPackDryRun, npmPackDryRun: gates.npmPackDryRun,
productionDependencyAudit: { status: "NOT RUN", reason: "Requires network access to npm registry" }, productionDependencyAudit: gates.productionDependencyAudit,
fullDevelopmentTreeAudit: { status: "NOT RUN", reason: "Requires network access to npm registry" }, fullDevelopmentTreeAudit: gates.fullDevelopmentTreeAudit,
ompPluginDoctor: { status: "NOT RUN", reason: "Requires Bun + OMP installation" }, ompPluginDoctor: { status: "NOT RUN", reason: "Requires Bun + OMP installation" },
interactiveTuiSmoke: { status: "NOT RUN", reason: "Requires a live OMP terminal host" }, interactiveTuiSmoke: { status: "NOT RUN", reason: "Requires a live OMP terminal host" },
}, },