Phase 3 validation: dependency direction, boundary scan, package metadata

[tonythethompson]

Summary

Runs the three Phase 3 cross-repository validation checks
(docs/plans/open-core-split-continuation.md) that tooling in this session
could actually execute, adds a new docs/plans/phase-3-validation-report.md
with the full detail, and fixes two stale doc claims found along the way.

Linked issue

• No linked GitHub issue (audit/validation work, not a feature or bug fix).

Scope

• Single-responsibility change (Phase 3 validation + the two doc fixes it surfaced)
• No unrelated refactors included

Testing

• dotnet build Trackdub.slnx -m:1
• dotnet test Trackdub.slnx -m:1
• Targeted tests only
• Not run, with justification below

Test notes

Docs-only change (two markdown files) — no source touched, no build/test impact. Relying on CI to confirm.

Architecture review

• No layer dependency violation introduced
• No inference code added to Trackdub.App
• No persistence added to view models
• No pipeline truth moved into UI state
• No state mutation added from model wrappers

License/model impact

• No new third-party dependency
• No new model or model asset
• New dependency/model documented
• Manifest/license requirements reviewed
• Commercial-safe mode impact reviewed

(This PR documents the results of a package-license metadata review, but doesn't change any dependency/model/license itself.)

Risk and rollback

• Low-risk change
• Rollback is straightforward
• Follow-up work required, noted below

Milestone notes

Part of the ongoing Phase 3 (cross-repository validation) closeout from docs/plans/open-core-split-continuation.md.

What was checked, and results:

1. Dependency direction — grepped src/ and docs/ for gated/Avalonia references. Two source hits, both deliberate seams (InternalsVisibleTo("Trackdub.App.Avalonia") + the comment explaining it), not violations. Confirmed Trackdub-gated → Trackdub, never the reverse.
2. Boundary scan — ran the repo's own scripts/ci/check-repository-boundary.py rather than writing a new one. Passed clean.
3. Package metadata — verified the only two packable projects (Trackdub.Cli, Trackdub.OnnxRuntime.Dnnl.Native) carry correct, distinct license metadata (Apache-2.0 vs MIT) rather than a blanket license that would misdescribe the DNNL package's real upstream license.

Not completed — flagged, not faked:

• Branch protection (Phase 3 step 4) — no branch-protection/ruleset tool was available in this session's GitHub MCP server. Recorded as unverified in the report; needs a human to check Settings → Branches on this repo directly.

Doc fixes along the way:

• open-core-split-continuation.md still said trackdubllc/Trackdub "is private" — it's been public since Phase 1's release gates passed. Fixed, and added a Phase 3 status block in the same style as the gated repo's Phase 2.3/2.4 status updates.

Agent notes

Full validation detail lives in the new docs/plans/phase-3-validation-report.md. Also closed 3 stale non-Trackdub issues (#26/#27/#28, a different project's Nushell plugin-registry backlog that had accumulated in this repo's tracker) separately, not part of this diff.

---

Generated by Claude Code

---

Summary by cubic

Runs Phase 3 cross-repo validation (dependency direction, boundary scan, package metadata), adds a detailed report, and updates the plan with current status and follow-ups.

• New Features

  • Added Phase 3 validation report at docs/plans/phase-3-validation-report.md.
  • Boundary scan: ran scripts/ci/check-repository-boundary.py — passed.
  • Dependency direction: grep includes project files; audited 94 <ProjectReference> across 25 *.csproj — no Trackdub → Trackdub-gated refs.
  • Package metadata: source-only check; Trackdub.Cli packs via PackAsTool=true; Trackdub.OnnxRuntime.Dnnl.Native uses MIT; no repo-wide license props.
  • Branch protection: recorded as unverified for both repos; needs manual check.

• Bug Fixes

  • Plan doc: Trackdub marked public; added Phase 3 status block and fixed heading level.
  • Report corrections: clarified source-only packaging check and scoped dependency-direction claim; fixed counts to 94/25.
  • Clarified Step 7 is not completed (noise cleanup was unrelated).

^{Written for commit eaaee7a. Summary will update on new commits.}

Summary by CodeRabbit

• Documentation
  • Added a Phase 3 validation report covering dependency direction, repository boundaries, package licensing, and branch-protection status.
  • Updated the open-core transition plan with completed phases, validation results, public visibility, and remaining verification steps.
  • Documented unavailable tooling, required manual checks, repository maintenance items, and outstanding follow-ups for transparency.

Confidence Score: 5/5

Docs-only change with no source modifications; safe to merge.

Both changed files are markdown documentation. The source-level claims in the report were verified against actual files and are accurate. The one inaccuracy found does not affect any code path.

Files Needing Attention: No files require special attention; the report's branch-protection section carries one factual inaccuracy worth correcting before the document is treated as a definitive audit record.

Important Files Changed

Filename	Overview
docs/plans/phase-3-validation-report.md	New Phase 3 validation report; source-level claims verified against actual files. One inaccuracy: the GitHub plan-tier statement conflates branch protection rules (available on GitHub Free for private repos) with rulesets (Team/Enterprise only), but the practical recommendation (check Settings manually) remains valid.
docs/plans/open-core-split-continuation.md	Visibility fix (private → public) is correct and supported by the new report. Phase 3 status block correctly explains what was and wasn't verified; repeats the same plan-tier inaccuracy as the report but the overall guidance remains actionable.

_{Reviews (6): Last reviewed commit: "Merge branch 'main' into claude/trackdub..." | Re-trigger Greptile}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes update the open-core plan and add a Phase 3 validation report. The documentation records dependency direction, boundary scans, package metadata, repository visibility, branch-protection status, and remaining follow-ups.

Changes

Phase 3 validation

Layer / File(s)	Summary
Repository and package validation docs/plans/phase-3-validation-report.md	Records dependency-direction checks, boundary-scan results, and source-only package metadata validation, including Apache-2.0 and MIT licensing.
Status and follow-ups docs/plans/open-core-split-continuation.md, docs/plans/phase-3-validation-report.md	Updates public-core status, records Phase 3 results, documents unverified branch protection and manual checks, and lists remaining follow-ups.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main Phase 3 validation work documented by this pull request.
Description check	✅ Passed	The description follows the repository template and documents scope, testing, validation results, risks, and follow-up work.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/trackdub-code-audit-irsa5o

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/trackdub-code-audit-irsa5o

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Document Phase 3 validation results and update Phase 3 status

📝 Documentation 🕐 10-20 Minutes

AI Description

• Update Phase 3 plan with current public-repo status and validation summary.
• Add a detailed Phase 3 validation report covering checks run and remaining gaps.

Diagram

graph TD
  A["Phase 3 validation run"] --> B["Dependency direction grep"] --> C["Boundary scan script"] --> D["Package metadata review"] --> E["Write validation report"] --> F["Update Phase 3 plan status"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Promote checks into CI gates

• ➕ Prevents regressions by running boundary/dependency checks automatically on PRs
• ➕ Reduces reliance on one-off manual audits
• ➖ Requires deciding which parts are stable enough for CI (e.g., package metadata rules)
• ➖ May need exemptions for historical docs paths already treated as out-of-scope

2. Automate branch-protection verification via GitHub API tooling

• ➕ Turns the remaining unverified step into a repeatable, auditable check
• ➕ Can document expected rulesets alongside validation output
• ➖ Needs additional tooling/permissions not available in the reported session
• ➖ Might be blocked by org policy around automation tokens

Recommendation: The PR’s approach is appropriate for a Phase 3 closeout: it reuses the repository’s existing boundary scanner, records concrete commands/results, and explicitly flags what could not be verified (branch protection) instead of speculating. If this validation is expected to remain relevant long-term, consider incrementally moving the boundary scan (and any deterministic dependency-direction checks) into CI, while separately establishing a GitHub-API-based method for branch-protection verification.

Files changed (2) +129 / -1

Documentation (2) +129 / -1

open-core-split-continuation.mdFix repo visibility claim and add Phase 3 status block +19/-1

Fix repo visibility claim and add Phase 3 status block

• Updates the Phase 3 plan to reflect that 'trackdubllc/Trackdub' is now public and points readers to the new Phase 3 validation report. Adds a dated status section summarizing which Phase 3 steps were validated, what remains unverified (branch protection), and notes issue-hygiene cleanup context.

docs/plans/open-core-split-continuation.md

phase-3-validation-report.mdAdd detailed Phase 3 validation report with results and gaps +110/-0

Add detailed Phase 3 validation report with results and gaps

• Introduces a new report documenting the three executed validation checks: dependency direction (grep results and rationale), repository boundary scan (script invocation and scope), and packable-project license metadata verification. Explicitly records remaining follow-ups (branch protection verification and manual label cleanup) to avoid treating them as completed.

docs/plans/phase-3-validation-report.md

[Copilot]

Pull request overview

This PR documents Phase 3 cross-repository validation results (dependency direction, repository-boundary scan, and package metadata/license review) by adding a dedicated report and updating the ongoing open-core split plan to reflect current repo visibility and validation status.

Changes:

• Add docs/plans/phase-3-validation-report.md capturing the Phase 3 validation commands, results, and explicitly recorded gaps (e.g., branch protection needing manual verification).
• Update docs/plans/open-core-split-continuation.md to reflect that trackdubllc/Trackdub is public and to record a Phase 3 status snapshot with pointers to the report.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
docs/plans/phase-3-validation-report.md	New Phase 3 validation report documenting what was checked, results, and remaining gaps requiring manual verification.
docs/plans/open-core-split-continuation.md	Updates plan text to reflect public core repo status and adds a Phase 3 status block referencing the new report.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/plans/phase-3-validation-report.md`:
- Around line 14-18: Update both fenced code blocks in the validation report:
label the grep command block with shell and the command output block with
console. Apply the same language identifiers to the additional fenced blocks
referenced at the later occurrence, without changing their contents.
- Around line 91-97: Update the branch-protection status in
open-core-split-continuation.md near the existing lines 252–255 to record the
applicable GitHub plan and verified settings for both trackdubllc/Trackdub and
Trackdub-gated. If either repository was not checked directly, mark its status
as unverified and do not classify the related gap as accepted; remove any
unsupported claim that private visibility alone makes protection unavailable.
- Around line 12-17: The validation report must not claim dependency direction
is verified from the existing grep. Update the verification section around
“Trackdub has no reference to Trackdub-gated” to either add an independent
clean-clone check covering both repositories, including project-reference files
such as *.csproj, or explicitly mark the dependency direction as unverified.
- Around line 64-81: Update the “Package metadata” section to validate generated
artifacts by running dotnet pack for both Trackdub.Cli and
Trackdub.OnnxRuntime.Dnnl.Native, then inspect each resulting .nupkg/.nuspec for
the expected license metadata. If artifact validation cannot be performed,
relabel the section as source-only instead of claiming package validation
passed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 651dc199-9b00-45c4-b444-3cf356de1416

📥 Commits

Reviewing files that changed from the base of the PR and between 8ff42de and 1d7871d.

📒 Files selected for processing (2)

• docs/plans/open-core-split-continuation.md
• docs/plans/phase-3-validation-report.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 19 rules

✅ Cross-repo context

  Not relevant to this PR: trackdubllc/Trackdub-gated

1. Misnested status heading ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

In docs/plans/open-core-split-continuation.md, the new STATUS header is an H2 (same level as “Phase
3”), so the Phase 3 checklist ends up structurally under STATUS rather than under Phase 3.
This breaks the document hierarchy/TOC and makes Phase 3 appear empty in rendered navigation.

Code

docs/plans/open-core-split-continuation.md[243]

+## STATUS: Phase 3 partly complete (2026-07-31) — validation steps run, ownership/protection steps need you

Relevance

●●● Strong

Team accepts doc correctness/maintainability tweaks; similar doc fixes accepted in PRs #5 and #6.

PR-#5
PR-#6

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The file shows ## Phase 3 immediately followed by another ## STATUS heading, and then the Phase
3 numbered checklist begins after the STATUS heading—making it part of the STATUS section in
Markdown.

docs/plans/open-core-split-continuation.md[241-272]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The added `## STATUS: ...` heading is a sibling of `## Phase 3: ...`, so the numbered Phase 3 checklist that follows becomes part of the STATUS section instead of Phase 3.

## Issue Context
This is a docs-structure issue that affects rendered outline/TOC and section scannability.

## Fix Focus Areas
- docs/plans/open-core-split-continuation.md[241-272]

## Suggested fix
Change the STATUS heading to a sub-heading under Phase 3 (e.g., `### STATUS: ...`) or convert it to bold/paragraph text so the subsequent numbered steps remain within the Phase 3 section.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Grep omits project files ✓ Resolved 🐞 Bug ≡ Correctness

Description

The dependency-direction grep command documented in the new Phase 3 report does not include
*.csproj/*.sln, so it can miss build-time references expressed in project files.
As written, the command does not fully support the report’s “no reverse dependency” conclusion.

Code

docs/plans/phase-3-validation-report.md[R14-18]

+```
+grep -rEln "Trackdub-gated|App\.Avalonia|DesktopExportTierGate|DesktopLicensingComposition" \
+  --include="*.cs" --include="*.md" --include="*.props" --include="*.targets" --include="*.slnx" \
+  src/ docs/ *.props *.targets *.slnx
+```

Relevance

●●● Strong

History shows preference for audit/doc correctness; multiple documentation-accuracy fixes accepted
in PR #6.

PR-#6

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The report’s command only includes cs/md/props/targets/slnx, while the repo clearly contains many
.csproj files where dependencies can be expressed (e.g., CLI and test projects).

docs/plans/phase-3-validation-report.md[14-18]
src/Trackdub.Cli/Trackdub.Cli.csproj[1-15]
tests/Trackdub.Application.Tests/Trackdub.Application.Tests.csproj[1-9]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The documented verification command excludes common build-graph files (`*.csproj`, `*.sln`), where project references and build-time dependencies are typically defined.

## Issue Context
The report claims dependency direction was verified; the shown command is part of that evidence, so it should cover project files too.

## Fix Focus Areas
- docs/plans/phase-3-validation-report.md[14-18]

## Suggested fix
Update the command to include `--include="*.csproj"` (and `--include="*.sln"` if applicable) so the search covers project references, or add a note describing additional checks performed beyond grep.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Misleading IsPackable wording ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The report says “Only two projects declare PackageId/IsPackable”, but multiple test projects
also declare IsPackable (set to false).
This is misleading wording in an audit doc (even if the underlying conclusion about only two
packable projects may still be correct).

Code

docs/plans/phase-3-validation-report.md[R69-70]

+Only two projects declare `PackageId`/`IsPackable` in this repo:
+

Relevance

●●● Strong

They accept precise doc wording changes; misleading-guarantee rewording accepted in PR #29.

PR-#29

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The report contains the “only two projects declare” statement, but at least one test project
explicitly declares <IsPackable>false</IsPackable>, contradicting the literal wording.

docs/plans/phase-3-validation-report.md[69-81]
tests/Trackdub.Application.Tests/Trackdub.Application.Tests.csproj[1-9]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The phrase “Only two projects declare `PackageId`/`IsPackable`” is inaccurate because other projects (notably tests) also declare `IsPackable` (typically `false`).

## Issue Context
This is an audit/validation report; precise wording matters to avoid confusing readers about how many projects set packaging-related properties.

## Fix Focus Areas
- docs/plans/phase-3-validation-report.md[69-81]

## Suggested fix
Reword to something like: “Only two projects are packable (`IsPackable=true`) and set package metadata (`PackageId`, license, etc.). Many test projects explicitly set `IsPackable=false`.”

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

Qodo Fixer

✅ Committed (2) · ☑ Fixed (2)

Commits pushed directly to this PR — no separate fix PR opened.

Process — 2 fixed

• ☑ Fixed: Misnested status heading
• ☑ Fixed: Grep omits project files

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• docs/plans/open-core-split-continuation.md
• docs/plans/phase-3-validation-report.md

Previous Review Summaries (2 snapshots, latest commit 0983b3b)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 0983b3b)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• .github/FUNDING.yml
• docs/plans/phase-3-validation-report.md

Previous review (commit b98b6e5)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• docs/plans/open-core-split-continuation.md
• docs/plans/phase-3-validation-report.md

---

_{Reviewed by step-3.7-flash · Input: 121.5K · Output: 11.1K · Cached: 233.9K}

_{Review guidance: REVIEW.md from base branch main}

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/plans/open-core-split-continuation.md`:
- Around line 249-250: Update the validation report paragraph describing Steps
1-3 so Step 1 is marked partially verified rather than passed, unless the
reverse dependency-direction check has been independently rerun against a fresh
Trackdub-gated clone. Preserve the existing caveat about package metadata and
unavailable dotnet tooling.

In `@docs/plans/phase-3-validation-report.md`:
- Around line 113-124: Correct the GitHub plan-scope wording in both status
records: docs/plans/phase-3-validation-report.md lines 113-124 and
docs/plans/open-core-split-continuation.md lines 253-255. State that private
repositories support branch protection and repository rulesets on Pro, Team, and
Enterprise, while GitHub Free excludes them for private repositories, and keep
both repositories’ settings and plans unverified.

🪄 Autofix (Beta)

✅ Autofix completed

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e82f4328-d05e-45e6-84b4-7543bdfbd752

📥 Commits

Reviewing files that changed from the base of the PR and between 6c2ff27 and 0983b3b.

📒 Files selected for processing (2)

• docs/plans/open-core-split-continuation.md
• docs/plans/phase-3-validation-report.md

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 2 file(s) based on 2 unresolved review comments.

Files modified:

• docs/plans/open-core-split-continuation.md
• docs/plans/phase-3-validation-report.md

Commit: 10e2d156eddf17f63e984cc9ea07358ed8817eb6

The changes have been pushed to the claude/trackdub-code-audit-irsa5o branch.

Time taken: 2m 51s

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[linear-code]

TS-106