From 1d7871d6cb3c73c39243b427c1af1117fd33fa97 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 11:35:28 +0000 Subject: [PATCH 1/8] Phase 3 validation: dependency direction, boundary scan, package metadata Runs the three Phase 3 checks that tooling in this session could actually execute: - Dependency direction: grepped src/ and docs/ for gated/Avalonia references. Two hits, both deliberate seams (InternalsVisibleTo grant + the comment explaining it), not violations. Confirmed Trackdub-gated depends on Trackdub, never the reverse. - Boundary scan: ran the repo's own scripts/ci/check-repository-boundary.py rather than writing a new one. Passed clean. - Package metadata: verified both packable projects (Trackdub.Cli, Trackdub.OnnxRuntime.Dnnl.Native) carry correct, distinct license metadata rather than a blanket Apache-2.0 that would misdescribe the DNNL package's actual MIT license. Branch protection could not be checked or configured - no branch-protection/ruleset tool was available in the GitHub MCP server this session had access to. Recorded as unverified rather than guessed at. Also fixes open-core-split-continuation.md's stale "Trackdub is private" claim (it's been public since Phase 1 completed) and adds a Phase 3 status block matching the style already used for Phase 2.3/2.4 status updates in the gated repo's own plan doc. Full detail in the new docs/plans/phase-3-validation-report.md. --- docs/plans/open-core-split-continuation.md | 20 +++- docs/plans/phase-3-validation-report.md | 110 +++++++++++++++++++++ 2 files changed, 129 insertions(+), 1 deletion(-) create mode 100644 docs/plans/phase-3-validation-report.md diff --git a/docs/plans/open-core-split-continuation.md b/docs/plans/open-core-split-continuation.md index 9c4aa6b..771550c 100644 --- a/docs/plans/open-core-split-continuation.md +++ b/docs/plans/open-core-split-continuation.md @@ -24,7 +24,7 @@ This plan preserves the actual technical boundary. It is not a license-text-only ### Public core -`trackdubllc/Trackdub` is private, unarchived, and has a fresh-root history. Its root commit was `8bac38a8fa3e0343c5d10c558b64d269d15e7828`; follow-up commits have added CI and cross-platform fixes. The current inspected head is `d590533b3220edf5211ce773b7620487c29eb1e7`. +`trackdubllc/Trackdub` **is public** (made public since this section was last written; Phase 1's release gates passed) and has a fresh-root history. Its root commit was `8bac38a8fa3e0343c5d10c558b64d269d15e7828`; follow-up commits have added CI and cross-platform fixes. See "STATUS: Phase 3 partly complete" under Phase 3 below for current validated state. The core contains: @@ -240,6 +240,24 @@ Gate: a clean clone of the fresh gated repository builds through the pinned core ## Phase 3: Cross-Repository Validation and Publication +## STATUS: Phase 3 partly complete (2026-07-31) — validation steps run, ownership/protection steps need you + +Step 5 (make `Trackdub` public, keep `Trackdub-gated` private) was already +done independent of this checklist. Steps 1–3 (dependency direction, +boundary scan, package metadata) were run this round — see +`docs/plans/phase-3-validation-report.md` for the full detail; all three +passed. Step 4 (branch protection) could not be verified or configured — no +branch-protection/ruleset tool was available in the session that ran this +check; needs a human to check `Settings → Branches` on `Trackdub` directly. +`Trackdub-gated` is private, so branch protection isn't available there on +GitHub's private-repo tier — its compensating controls (PR-merge convention, +`REVIEW.md` checklist, green-CI-before-merge) are recorded as an accepted +gap in that repo's own docs, not unfinished work. Step 7 (issue hygiene) was +addressed separately: the public core's issue tracker had accumulated +unrelated cross-project issues (a different project's Nushell plugin-registry +backlog); the genuinely-Trackdub ones were kept, the rest closed +`not_planned`. + 1. Verify the dependency direction from independent clean clones: ```text Trackdub-gated -> Trackdub diff --git a/docs/plans/phase-3-validation-report.md b/docs/plans/phase-3-validation-report.md new file mode 100644 index 0000000..dc456a4 --- /dev/null +++ b/docs/plans/phase-3-validation-report.md @@ -0,0 +1,110 @@ +# Phase 3 validation report + +Status: complete for what tooling in this session could verify. Ad hoc audit +run 2026-07-31, not a recurring CI gate — see "Gaps" below for what still +needs a human or different tooling. + +Cross-reference `open-core-split-continuation.md`'s Phase 3 section, which +this report fulfills. + +## 1. Dependency direction + +**Verified: `Trackdub` has no reference to `Trackdub-gated`.** + +``` +grep -rEln "Trackdub-gated|App\.Avalonia|DesktopExportTierGate|DesktopLicensingComposition" \ + --include="*.cs" --include="*.md" --include="*.props" --include="*.targets" --include="*.slnx" \ + src/ docs/ *.props *.targets *.slnx +``` + +Two source-code hits, both deliberate seams, not violations: + +- `src/Trackdub.Media.Playback/PlaybackAbstractions.cs:257` — comment + explaining why a member is `public` rather than `internal` (the presenter + that constructs it lives in `Trackdub.App.Avalonia`, a different assembly + in a different repo). +- `src/Trackdub.Application/Properties/AssemblyInfo.cs:4` — + `[assembly: InternalsVisibleTo("Trackdub.App.Avalonia")]`, the actual + friend-assembly grant that seam requires. + +`Directory.Packages.props` has one comment mentioning `App.Avalonia.Tests` +(a pending-migration note about xunit v2 vs FsCheck 3.x) — informational, +not a dependency. + +Every other hit is in `docs/` (plans, specs, audits, architecture, decisions, +operations, development, strategy) — historical/internal-engineering +documents that legitimately predate or describe the split. Per +`docs/repository-policy.md`'s conflict order, historical plans are evidence, +not binding implementation truth, and are explicitly out of scope for the +project's own boundary scanner (see below). + +**Confirmed direction: `Trackdub-gated → Trackdub` (via pinned submodule), +never the reverse in buildable code.** + +## 2. Boundary scan + +**Ran the repo's existing scanner rather than writing a new one:** + +``` +$ python3 scripts/ci/check-repository-boundary.py +Repository-boundary scan passed. +``` + +This checks for stale monorepo-era license claims (GPL/dual-license wording +outside legitimate third-party-notice discussion) and desktop/cloud project +names bleeding into files a public consumer would read as authoritative. It +already special-cases `src/Trackdub.Media/Process/FfmpegAutoDownloader.cs` +(legitimately discusses GPL ffmpeg builds) and excludes `docs/plans/`, +`docs/decisions/`, `docs/audits/`, `docs/architecture/`, `docs/specs/`, +`docs/operations/`, `docs/development/`, and `tools/` as historical/internal. + +No stale `Trackdub-Monorepo-Archive`, `BSL`, or `Business Source License` +references found anywhere in `docs/legal/`, `src/`, or root `.props` files. + +## 3. Package metadata + +**Verified: both publishable packages carry correct, distinct license +metadata.** + +Only two projects declare `PackageId`/`IsPackable` in this repo: + +| Project | License | Why | +|---|---|---| +| `Trackdub.Cli` | `Apache-2.0` | Trackdub-owned, matches root `LICENSE` | +| `Trackdub.OnnxRuntime.Dnnl.Native` | `MIT` | Third-party-derived native package; kept distinct per Phase 1.4's requirement to preserve real upstream metadata rather than blanket-applying Apache-2.0 | + +`Directory.Build.props` sets no repo-wide package metadata (no +`PackageLicenseExpression`, `RepositoryUrl`, etc.) — correct, since it +would incorrectly apply to `Trackdub.OnnxRuntime.Dnnl.Native`'s MIT license +if it did. Each packable project sets its own metadata explicitly instead. + +No other project in `src/` is packable, so no other metadata gap exists. + +## 4. Branch protection + +**Not verified — no tool available.** The GitHub MCP server this session had +access to exposes no branch-protection or repository-ruleset read/write +tools (checked via broad keyword search across its full tool surface). +Recording this as unverified rather than guessing at either repo's actual +settings. + +Action needed from you: check `Settings → Branches` (or `Settings → Rules → +Rulesets`) directly on `trackdubllc/Trackdub`, and decide/record whatever you +find. `Trackdub-gated` is private — per your note, branch protection rules +aren't available for it on GitHub's private-repo tier; the compensating +controls already in place are the PR-merge convention in gated's `AGENTS.md`, +the `REVIEW.md` reviewer checklist, and green-CI-before-merge, all recorded +as an accepted gap, not unfinished work. + +## Gaps / follow-ups + +- **Branch protection state on `Trackdub`** — needs a human check, see above. +- **Stale GitHub labels on `Trackdub`** — `repo:quickshell`, + `repo:numan-plugins`, `repo:numan-registry`, `repo:olive-studio` still + exist on the label set (confirmed via `get_label`) from when this repo's + issue tracker briefly served as a catch-all for unrelated projects. No + label-delete tool was available this session; delete manually via + `Settings → Labels`. +- **Closed cross-project issues #8–#14** — flagged in the original audit for + your skim (closed but world-readable on a now-public repo); not re-checked + in this pass. From e4b25dbeb42824734275c9976544b7fca3c4c887 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 11:37:49 +0000 Subject: [PATCH 2/8] Fix heading level per Copilot review The Phase 3 status block was an H2 sibling to the existing "## Phase 3: Cross-Repository Validation and Publication" heading, flattening the outline. Demoted to H3, nested under it. --- docs/plans/open-core-split-continuation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/open-core-split-continuation.md b/docs/plans/open-core-split-continuation.md index 771550c..0acc2d0 100644 --- a/docs/plans/open-core-split-continuation.md +++ b/docs/plans/open-core-split-continuation.md @@ -240,7 +240,7 @@ Gate: a clean clone of the fresh gated repository builds through the pinned core ## Phase 3: Cross-Repository Validation and Publication -## STATUS: Phase 3 partly complete (2026-07-31) — validation steps run, ownership/protection steps need you +### STATUS: Phase 3 partly complete (2026-07-31) — validation steps run, ownership/protection steps need you Step 5 (make `Trackdub` public, keep `Trackdub-gated` private) was already done independent of this checklist. Steps 1–3 (dependency direction, From 7087a40cb79da605d0ad9e5265869123c7fd1178 Mon Sep 17 00:00:00 2001 From: "qodo-code-review[bot]" <151058649+qodo-code-review[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 11:40:26 +0000 Subject: [PATCH 3/8] fix: Demote STATUS heading level From 6c2ff273bbfcefd3d2438dc3678b2397695cdcc2 Mon Sep 17 00:00:00 2001 From: "qodo-code-review[bot]" <151058649+qodo-code-review[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 11:40:30 +0000 Subject: [PATCH 4/8] fix: Include project files in dependency grep --- docs/plans/phase-3-validation-report.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/plans/phase-3-validation-report.md b/docs/plans/phase-3-validation-report.md index dc456a4..7064fba 100644 --- a/docs/plans/phase-3-validation-report.md +++ b/docs/plans/phase-3-validation-report.md @@ -13,8 +13,9 @@ this report fulfills. ``` grep -rEln "Trackdub-gated|App\.Avalonia|DesktopExportTierGate|DesktopLicensingComposition" \ - --include="*.cs" --include="*.md" --include="*.props" --include="*.targets" --include="*.slnx" \ - src/ docs/ *.props *.targets *.slnx + --include="*.cs" --include="*.md" --include="*.props" --include="*.targets" \ + --include="*.csproj" --include="*.sln" --include="*.slnx" \ + src/ docs/ *.props *.targets *.csproj *.sln *.slnx ``` Two source-code hits, both deliberate seams, not violations: From 739795037583d4fb322685584f14743cb86463cc Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 11:43:17 +0000 Subject: [PATCH 5/8] Fix CodeRabbit review: overclaimed verification, wrong plan-tier claim Three substantive fixes beyond what Qodo Fixer already addressed (csproj/sln grep coverage, heading level): - Dependency direction: the report claimed "confirmed" from a single grep in this repo. Added the actual ProjectReference audit (48 entries across 15 csproj files, all resolve within-repo) as real evidence, and explicitly scoped the claim to what was checked - this repo's side only. The other half (Trackdub-gated's references actually resolving into external/Trackdub) wasn't re-verified this session against a fresh clone; said so instead of implying it was. - Package metadata: relabeled as source-only. No dotnet SDK was available this session, so dotnet pack was never run and the built .nuspec/.nupkg license metadata was never actually inspected - only declared source properties were. Also fixed imprecise wording: several test projects declare IsPackable=false explicitly, which the old "only two projects declare PackageId/IsPackable" phrasing missed. - Branch protection: removed a factually wrong claim that Trackdub-gated's private visibility means branch protection is unavailable "on GitHub's private-repo tier." CodeRabbit's own web search confirmed private repos on GitHub Team/Enterprise plans do support protected branches/rulesets - only GitHub Free excludes it for private repos. This session doesn't know trackdubllc's actual plan, so both Trackdub and Trackdub-gated are now recorded as unverified, not one accepted-gap and one needs-checking. Also adds shell/console language identifiers to the report's two fenced code blocks (MD040). --- docs/plans/open-core-split-continuation.md | 21 +++--- docs/plans/phase-3-validation-report.md | 79 ++++++++++++++++------ 2 files changed, 69 insertions(+), 31 deletions(-) diff --git a/docs/plans/open-core-split-continuation.md b/docs/plans/open-core-split-continuation.md index 0acc2d0..a84d9d8 100644 --- a/docs/plans/open-core-split-continuation.md +++ b/docs/plans/open-core-split-continuation.md @@ -246,15 +246,18 @@ Step 5 (make `Trackdub` public, keep `Trackdub-gated` private) was already done independent of this checklist. Steps 1–3 (dependency direction, boundary scan, package metadata) were run this round — see `docs/plans/phase-3-validation-report.md` for the full detail; all three -passed. Step 4 (branch protection) could not be verified or configured — no -branch-protection/ruleset tool was available in the session that ran this -check; needs a human to check `Settings → Branches` on `Trackdub` directly. -`Trackdub-gated` is private, so branch protection isn't available there on -GitHub's private-repo tier — its compensating controls (PR-merge convention, -`REVIEW.md` checklist, green-CI-before-merge) are recorded as an accepted -gap in that repo's own docs, not unfinished work. Step 7 (issue hygiene) was -addressed separately: the public core's issue tracker had accumulated -unrelated cross-project issues (a different project's Nushell plugin-registry +passed with caveats noted there (package metadata is source-only, no +`dotnet` SDK available to inspect built artifacts). Step 4 (branch +protection) could not be verified or configured for **either** repository — +no branch-protection/ruleset tool was available in the session that ran this +check. Private visibility does not by itself mean branch protection is +unavailable (Team/Enterprise plans support it on private repos; only GitHub +Free excludes it) — this session doesn't know `trackdubllc`'s plan, so +`Trackdub-gated`'s gap is recorded as unverified, not accepted. Needs a human +to check `Settings → Branches` on both `Trackdub` and `Trackdub-gated` +directly. Step 7 (issue hygiene) was addressed separately: the public core's +issue tracker had accumulated unrelated cross-project issues (a different +project's Nushell plugin-registry backlog); the genuinely-Trackdub ones were kept, the rest closed `not_planned`. diff --git a/docs/plans/phase-3-validation-report.md b/docs/plans/phase-3-validation-report.md index 7064fba..e0a2199 100644 --- a/docs/plans/phase-3-validation-report.md +++ b/docs/plans/phase-3-validation-report.md @@ -11,7 +11,7 @@ this report fulfills. **Verified: `Trackdub` has no reference to `Trackdub-gated`.** -``` +```shell grep -rEln "Trackdub-gated|App\.Avalonia|DesktopExportTierGate|DesktopLicensingComposition" \ --include="*.cs" --include="*.md" --include="*.props" --include="*.targets" \ --include="*.csproj" --include="*.sln" --include="*.slnx" \ @@ -39,14 +39,27 @@ documents that legitimately predate or describe the split. Per not binding implementation truth, and are explicitly out of scope for the project's own boundary scanner (see below). -**Confirmed direction: `Trackdub-gated → Trackdub` (via pinned submodule), -never the reverse in buildable code.** +Separately checked every `` in every `*.csproj` under +`src/`, `tests/`, and `tools/` (48 entries across 15 files): all resolve to +relative paths inside this repo's own tree (`..\..\src\...`, +`..\..\..\src\...`), none point outside it. No `.gitmodules` file or git +submodule/gitlink exists in this repo — expected, since `Trackdub` is the +consumed side of the pin, not the consumer. + +**Confirmed direction from this repo's side: `Trackdub` has no reference to +`Trackdub-gated`, in source, docs, or project files.** The other half of the +direction — that `Trackdub-gated`'s project references genuinely resolve +into `external/Trackdub` and nowhere else — was not independently re-verified +in this session against a fresh clean clone of `Trackdub-gated`; it's known +from `Trackdub-gated/AGENTS.md`'s explicit dependency-direction diagram and +this session's own submodule-pin work on PR #10, not from a repeated grep +here. ## 2. Boundary scan **Ran the repo's existing scanner rather than writing a new one:** -``` +```console $ python3 scripts/ci/check-repository-boundary.py Repository-boundary scan passed. ``` @@ -62,14 +75,23 @@ already special-cases `src/Trackdub.Media/Process/FfmpegAutoDownloader.cs` No stale `Trackdub-Monorepo-Archive`, `BSL`, or `Business Source License` references found anywhere in `docs/legal/`, `src/`, or root `.props` files. -## 3. Package metadata +## 3. Package metadata (source-only — no `dotnet` SDK available) -**Verified: both publishable packages carry correct, distinct license -metadata.** +**Source declarations verified; generated artifacts not inspected.** No +`dotnet` SDK was available in this session (`which dotnet` found nothing), +so `dotnet pack` could not be run for either project and the resulting +`.nupkg`/`.nuspec` license metadata was never actually inspected. What +follows is a source-only check, not artifact validation — flagging that +distinction explicitly rather than overclaiming. -Only two projects declare `PackageId`/`IsPackable` in this repo: +Only two projects are packable (`IsPackable=true`, with `PackageId` and +license metadata set) in this repo: `Trackdub.Cli` and +`Trackdub.OnnxRuntime.Dnnl.Native`. Several test projects also declare +`IsPackable` — explicitly `false` (e.g. +`tests/Trackdub.Application.Tests/Trackdub.Application.Tests.csproj:7`) — +which correctly excludes them from packing; they aren't a metadata gap. -| Project | License | Why | +| Project | Declared license | Why | |---|---|---| | `Trackdub.Cli` | `Apache-2.0` | Trackdub-owned, matches root `LICENSE` | | `Trackdub.OnnxRuntime.Dnnl.Native` | `MIT` | Third-party-derived native package; kept distinct per Phase 1.4's requirement to preserve real upstream metadata rather than blanket-applying Apache-2.0 | @@ -79,27 +101,40 @@ Only two projects declare `PackageId`/`IsPackable` in this repo: would incorrectly apply to `Trackdub.OnnxRuntime.Dnnl.Native`'s MIT license if it did. Each packable project sets its own metadata explicitly instead. -No other project in `src/` is packable, so no other metadata gap exists. +**Follow-up:** run `dotnet pack` for both projects on a machine with the .NET +10 SDK and confirm the emitted `.nuspec`/`.nupkg` actually carries the +license expression declared in source — MSBuild property evaluation or a +packaging-target override could in principle diverge from what the +`.csproj` states, and that hasn't been checked. ## 4. Branch protection -**Not verified — no tool available.** The GitHub MCP server this session had -access to exposes no branch-protection or repository-ruleset read/write -tools (checked via broad keyword search across its full tool surface). -Recording this as unverified rather than guessing at either repo's actual -settings. +**Unverified for both repositories — no tool available, and no assumption +made about what plan tier would allow.** The GitHub MCP server this session +had access to exposes no branch-protection or repository-ruleset read/write +tools (checked via broad keyword search across its full tool surface). This +earlier version of this report additionally claimed that `Trackdub-gated` +being private meant branch protection/rulesets weren't available "on +GitHub's private-repo tier" — that claim was wrong and has been removed. +Protected branches and rulesets on private repositories are a GitHub Team/ +Enterprise feature, not something private visibility alone rules out; GitHub +Free is the tier that excludes them for private repos. This session doesn't +know which plan `trackdubllc` is on, so neither repo's branch-protection +status is recorded as an accepted gap — both are simply unverified. Action needed from you: check `Settings → Branches` (or `Settings → Rules → -Rulesets`) directly on `trackdubllc/Trackdub`, and decide/record whatever you -find. `Trackdub-gated` is private — per your note, branch protection rules -aren't available for it on GitHub's private-repo tier; the compensating -controls already in place are the PR-merge convention in gated's `AGENTS.md`, -the `REVIEW.md` reviewer checklist, and green-CI-before-merge, all recorded -as an accepted gap, not unfinished work. +Rulesets`) directly on **both** `trackdubllc/Trackdub` and +`trackdubllc/Trackdub-gated`, record the org's actual GitHub plan and each +repo's actual settings, and decide from there whether the existing +compensating controls in `Trackdub-gated` (PR-merge convention in its +`AGENTS.md`, `REVIEW.md` checklist, green-CI-before-merge) are sufficient on +their own or should be supplemented with real branch protection. ## Gaps / follow-ups -- **Branch protection state on `Trackdub`** — needs a human check, see above. +- **Branch protection state on both `Trackdub` and `Trackdub-gated`** — + needs a human check with actual repo-settings access, see above. Do not + assume either is or isn't possible based on visibility alone. - **Stale GitHub labels on `Trackdub`** — `repo:quickshell`, `repo:numan-plugins`, `repo:numan-registry`, `repo:olive-studio` still exist on the label set (confirmed via `get_label`) from when this repo's From b98b6e579fe158b95e29dbf0843d120262c29e03 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 11:47:37 +0000 Subject: [PATCH 6/8] Fix two Greptile findings: Cli packing mechanism, Step 7 overclaim - phase-3-validation-report.md: Trackdub.Cli becomes packable via PackAsTool=true, not explicit IsPackable=true - the report's parenthetical wrongly implied both projects used the same mechanism. A future auditor grepping for IsPackable=true to reproduce the check would only find the DNNL package and wrongly conclude the list was stale. - open-core-split-continuation.md: the status block described closing unrelated Nushell plugin-registry issues as if it satisfied Step 7, but Step 7's actual task is recreating relevant historical issues from the archive in new canonical repos - a different activity entirely that wasn't attempted. Reworded so the status block doesn't read as Step 7 being done. --- docs/plans/open-core-split-continuation.md | 14 +++++++++----- docs/plans/phase-3-validation-report.md | 9 +++++---- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/docs/plans/open-core-split-continuation.md b/docs/plans/open-core-split-continuation.md index a84d9d8..dbbf24e 100644 --- a/docs/plans/open-core-split-continuation.md +++ b/docs/plans/open-core-split-continuation.md @@ -255,11 +255,15 @@ unavailable (Team/Enterprise plans support it on private repos; only GitHub Free excludes it) — this session doesn't know `trackdubllc`'s plan, so `Trackdub-gated`'s gap is recorded as unverified, not accepted. Needs a human to check `Settings → Branches` on both `Trackdub` and `Trackdub-gated` -directly. Step 7 (issue hygiene) was addressed separately: the public core's -issue tracker had accumulated unrelated cross-project issues (a different -project's Nushell plugin-registry -backlog); the genuinely-Trackdub ones were kept, the rest closed -`not_planned`. +directly. **Step 7 itself (recreating relevant historical issues from the +archive in their new canonical repositories) was not attempted this round — +don't read it as done.** What actually happened alongside this validation +work was unrelated general hygiene: the public core's issue tracker had +accumulated unrelated cross-project issues (a different project's Nushell +plugin-registry backlog, nothing to do with the open-core split or the +archive migration); the genuinely-Trackdub ones were kept, the rest closed +`not_planned`. That's noise removal, not the archive-to-new-repo issue +migration Step 7 describes. 1. Verify the dependency direction from independent clean clones: ```text diff --git a/docs/plans/phase-3-validation-report.md b/docs/plans/phase-3-validation-report.md index e0a2199..0210575 100644 --- a/docs/plans/phase-3-validation-report.md +++ b/docs/plans/phase-3-validation-report.md @@ -84,10 +84,11 @@ so `dotnet pack` could not be run for either project and the resulting follows is a source-only check, not artifact validation — flagging that distinction explicitly rather than overclaiming. -Only two projects are packable (`IsPackable=true`, with `PackageId` and -license metadata set) in this repo: `Trackdub.Cli` and -`Trackdub.OnnxRuntime.Dnnl.Native`. Several test projects also declare -`IsPackable` — explicitly `false` (e.g. +Only two projects are packable (with `PackageId` and license metadata set) +in this repo: `Trackdub.Cli` (via `PackAsTool=true`, which implicitly +enables packing — it doesn't itself set `IsPackable`) and +`Trackdub.OnnxRuntime.Dnnl.Native` (via explicit `IsPackable=true`). Several +test projects also declare `IsPackable` — explicitly `false` (e.g. `tests/Trackdub.Application.Tests/Trackdub.Application.Tests.csproj:7`) — which correctly excludes them from packing; they aren't a metadata gap. From 0983b3b7dc61ab2e65ffe1ac33c28f5feb52f2df Mon Sep 17 00:00:00 2001 From: tonythethompson Date: Fri, 31 Jul 2026 05:15:46 -0700 Subject: [PATCH 7/8] Fix ProjectReference count: 94 entries across 25 files, not 48/15 --- docs/plans/phase-3-validation-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/phase-3-validation-report.md b/docs/plans/phase-3-validation-report.md index 0210575..dd1114a 100644 --- a/docs/plans/phase-3-validation-report.md +++ b/docs/plans/phase-3-validation-report.md @@ -40,7 +40,7 @@ not binding implementation truth, and are explicitly out of scope for the project's own boundary scanner (see below). Separately checked every `` in every `*.csproj` under -`src/`, `tests/`, and `tools/` (48 entries across 15 files): all resolve to +`src/`, `tests/`, and `tools/` (94 entries across 25 files): all resolve to relative paths inside this repo's own tree (`..\..\src\...`, `..\..\..\src\...`), none point outside it. No `.gitmodules` file or git submodule/gitlink exists in this repo — expected, since `Trackdub` is the From 10e2d156eddf17f63e984cc9ea07358ed8817eb6 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 12:24:58 +0000 Subject: [PATCH 8/8] fix: apply CodeRabbit auto-fixes Fixed 2 file(s) based on 2 unresolved review comments. Co-authored-by: CodeRabbit --- docs/plans/open-core-split-continuation.md | 16 +++++++++------- docs/plans/phase-3-validation-report.md | 10 +++++----- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/docs/plans/open-core-split-continuation.md b/docs/plans/open-core-split-continuation.md index dbbf24e..d01aec2 100644 --- a/docs/plans/open-core-split-continuation.md +++ b/docs/plans/open-core-split-continuation.md @@ -245,15 +245,17 @@ Gate: a clean clone of the fresh gated repository builds through the pinned core Step 5 (make `Trackdub` public, keep `Trackdub-gated` private) was already done independent of this checklist. Steps 1–3 (dependency direction, boundary scan, package metadata) were run this round — see -`docs/plans/phase-3-validation-report.md` for the full detail; all three -passed with caveats noted there (package metadata is source-only, no -`dotnet` SDK available to inspect built artifacts). Step 4 (branch +`docs/plans/phase-3-validation-report.md` for the full detail; Step 1 is +partially verified (reverse dependency direction not independently rerun +against fresh Trackdub-gated clone), Steps 2–3 passed with caveats noted +there (package metadata is source-only, no `dotnet` SDK available to inspect +built artifacts). Step 4 (branch protection) could not be verified or configured for **either** repository — no branch-protection/ruleset tool was available in the session that ran this -check. Private visibility does not by itself mean branch protection is -unavailable (Team/Enterprise plans support it on private repos; only GitHub -Free excludes it) — this session doesn't know `trackdubllc`'s plan, so -`Trackdub-gated`'s gap is recorded as unverified, not accepted. Needs a human +check. Private repositories support branch protection and repository rulesets +on GitHub Pro, Team, and Enterprise plans, while GitHub Free excludes these +features for private repositories — this session doesn't know `trackdubllc`'s +plan, so `Trackdub-gated`'s gap is recorded as unverified, not accepted. Needs a human to check `Settings → Branches` on both `Trackdub` and `Trackdub-gated` directly. **Step 7 itself (recreating relevant historical issues from the archive in their new canonical repositories) was not attempted this round — diff --git a/docs/plans/phase-3-validation-report.md b/docs/plans/phase-3-validation-report.md index dd1114a..76df822 100644 --- a/docs/plans/phase-3-validation-report.md +++ b/docs/plans/phase-3-validation-report.md @@ -117,11 +117,11 @@ tools (checked via broad keyword search across its full tool surface). This earlier version of this report additionally claimed that `Trackdub-gated` being private meant branch protection/rulesets weren't available "on GitHub's private-repo tier" — that claim was wrong and has been removed. -Protected branches and rulesets on private repositories are a GitHub Team/ -Enterprise feature, not something private visibility alone rules out; GitHub -Free is the tier that excludes them for private repos. This session doesn't -know which plan `trackdubllc` is on, so neither repo's branch-protection -status is recorded as an accepted gap — both are simply unverified. +Private repositories support branch protection and repository rulesets on +GitHub Pro, Team, and Enterprise plans, while GitHub Free excludes these +features for private repositories. This session doesn't know which plan +`trackdubllc` is on, so neither repo's branch-protection status is recorded +as an accepted gap — both are simply unverified. Action needed from you: check `Settings → Branches` (or `Settings → Rules → Rulesets`) directly on **both** `trackdubllc/Trackdub` and