From 1fd808e870bbfa3fe040b62b71e74206f5de5c32 Mon Sep 17 00:00:00 2001 From: ProtocolWarden <32967198+ProtocolWarden@users.noreply.github.com> Date: Tue, 4 Aug 2026 17:24:05 -0400 Subject: [PATCH] chore(config): raise our own r1_line_budget to 1000, and say why MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit .console/log.md sat at 396 against a 400 budget, so the next entry anyone wrote red-failed our own audit. Not hypothetical: that happened to #72 (437 lines) and was cleared only by pruning the two oldest surviving entries and condensing the new one, buying four lines. #66, #67 and #69 each pruned to land as well. The tax is structural — the pre-commit hook requires log.md to grow on every source commit and RC1 caps it, so their intersection is "delete history as a precondition for committing." Considered and rejected two of the three routes. IMPLEMENT ADR 0001 — not ours to do. The ADR says so in its own Status section: .console/ is defined by the console-reconciliation spec, ContextLifecycle owns it, and RC1/RC2 are our implementation of the spec's gates, so adopting Option D here changes what those gates enforce fleet-wide. It is still `proposed`. Patching around an open question we raised ourselves would be the worst of both. ADD AN ARCHIVE FILE RC1 DOES NOT COUNT — #65 already reverted exactly this. Pruned .console/ history goes to /archive/console// via `cl reconcile` (spec §3.3 / Layer C); a second local archive is an orphan the tool never maintains. Worse, RC1's glob is `.console/*.md` — top level only — so sharding into .console/log/2026-08.md would not reduce the count, it would remove the file from the gate's view entirely. Silently relocating content out of a control's reach is not archiving, it is disabling the control while leaving it green. We removed `|| true` from a consumer's audit install last week for being that same shape. RAISE OUR OWN BUDGET — `audit.r1_line_budget` is a documented per-repo knob, read by detect_r1 and defaulted rather than hardcoded, so this touches no detector, no spec and no other repo. It is also what the detector intends: its docstring calls R1 "LOW/advisory — a reconciliation due signal, no judgement about *what* to prune." 400 suits an operator workspace whose log is session-continuity notes. Ours is a different artifact — it documents detector semantics consumers depend on, which is why entries run ~30 lines and why pruning has already cost something real (the D12 entry that shaped C16's default-off design survives only in git). 1000 gives ~20 entries of runway, putting reconciliation back on a scheduled cadence instead of every other commit. Still bounded, still gated, still archived by `cl reconcile` when it fires. Explicitly interim. The fix is ADR 0001 landing one way or the other; this stops the bleeding without pre-empting it, and preserves the history that decision is about. Sized so writing this entry does not itself trip the gate. Verified: log.md 442/1000, RC1 gone, custodian-doctor --strict OK. The one remaining audit finding is W2 (core.hooksPath unset), pre-existing and local to this clone — CI sets it as the audit job's first step. Co-Authored-By: Claude Opus 5 --- .console/log.md | 46 ++++++++++++++++++++++++++++++++++++++++++ .custodian/config.yaml | 23 +++++++++++++++++++++ 2 files changed, 69 insertions(+) diff --git a/.console/log.md b/.console/log.md index 28de21b..d60bdfb 100644 --- a/.console/log.md +++ b/.console/log.md @@ -2,6 +2,52 @@ _Chronological continuity log. Decisions, stop points, what changed and why._ +## 2026-08-04 — chore(config): raise our own r1_line_budget to 1000, and say why + +`.console/log.md` sat at 396 against a 400 budget, so the next entry anyone wrote +red-failed our own audit. That is not hypothetical: it happened to #72 on +2026-08-03 (437 lines), and was cleared only by pruning the two oldest surviving +entries and condensing the new one — buying four lines. Three PRs before it (#66, +#67, #69) each pruned to land. The tax is structural, not a discipline problem: the +pre-commit hook requires log.md to grow on every source commit and RC1 caps it, so +their intersection is "delete history as a precondition for committing." + +Considered and rejected two of the three obvious routes. + +**Implement ADR 0001.** Not ours to do. The ADR says so in its own Status section: +`.console/` is defined by the console-reconciliation spec, ContextLifecycle owns it, +and RC1/RC2 are our implementation of the spec's gates — so adopting Option D here +changes what those gates enforce fleet-wide. The ADR is the ask; the decision is the +spec owner's. It is still `proposed`. Patching around an open question we ourselves +raised would be the worst of both. + +**Add an archive file RC1 does not count.** #65 already reverted exactly this. +Pruned `.console/` history goes to +`/archive/console//-.md` via `cl reconcile` +(spec §3.3 / Layer C); a second local archive is an orphan the tool never maintains. +Worse, RC1's glob is `.console/*.md` — top level only — so sharding into +`.console/log/2026-08.md` would not reduce the count, it would remove the file from +the gate's view entirely. Silently relocating content out of a control's reach is +not archiving; it is disabling the control and leaving it looking green. We removed +`|| true` from a consumer's audit install last week for being that same shape. + +**Raise our own budget.** `audit.r1_line_budget` is a documented per-repo knob, read +by `detect_r1` and defaulted, not hardcoded — so this touches no detector, no spec, +and no other repo. It is also what the detector intends: its docstring calls R1 +"LOW/advisory — a reconciliation due signal, no judgement about *what* to prune." +400 is right for an operator workspace whose log is session-continuity notes. Ours +is a different artifact — it documents detector semantics consumers depend on, which +is why entries run ~30 lines and why pruning has already cost us something real (the +D12 entry that shaped C16's default-off design is now only in git). 1000 gives about +20 entries of runway, which puts reconciliation back on a scheduled cadence instead +of every other commit. Still bounded, still gated, still archived by `cl reconcile` +when it fires. + +Explicitly interim. The fix is ADR 0001 landing one way or the other; this stops the +bleeding without pre-empting it, and preserves the history that decision is about. +Sized so that writing this entry does not itself trip the gate — the failure mode +that prompted it. + ## 2026-08-03 — fix(adapters): find_tool must prefer the AUDITED repo's venv `find_tool()` resolved tools from the venv **Custodian itself** runs in, then PATH. diff --git a/.custodian/config.yaml b/.custodian/config.yaml index d5cc079..1afc984 100644 --- a/.custodian/config.yaml +++ b/.custodian/config.yaml @@ -12,6 +12,29 @@ audit: # enforcement: R1 (oversized log) + R2 (private-name leak) now fail-closed here. reconcile_enforce: true + # RC1's default 400 is sized for an operator workspace, where the log is + # session-continuity notes. This repo's log is a different artifact: it records + # detector SEMANTICS that consumers depend on, so entries run long (~30 lines + # each, measured over the 13 currently in the file) and are load-bearing rather + # than narrative. At 400 the two rules governing the file contradict each other — + # the pre-commit hook requires log.md to grow on every source commit, RC1 caps + # it — so their intersection is "prune history as a precondition for committing." + # That is not a discipline failure; it is what the two rules jointly specify. + # ADR 0001 measured it: #66, #67 and #69 each pruned to land, and the pruned D12 + # entry was the one that shaped C16's default-off design. + # + # 1000 gives ~20 entries of runway, which puts reconciliation back on the + # SCHEDULED cadence the detector intends — its own docstring calls R1 + # "LOW/advisory — a reconciliation due signal, no judgement about what to prune." + # The gate still fires, and `cl reconcile` still archives to the private manifest + # per spec §3.3; only the trigger point moves off "every other commit". + # + # This is an interim local measure, NOT the fix. The fix is ADR 0001, which is + # open with ContextLifecycle as spec owner. Custodian cannot change what RC1 + # means fleet-wide on its own, so it changes only its own threshold and keeps + # the history the ADR argues is worth keeping while that decision is pending. + r1_line_budget: 1000 + # C16 scans tests/ here too. Same dogfooding stance as reconcile_enforce: # the backlog is cleared, so the gate stays on. This is the blind spot that # let three tests write cp1252 and fail only on Windows (#67) while C16