From 1b01e25f3b40c4acb7c35f9d6f101e44d5786120 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 13 Sep 2026 20:58:41 +0000 Subject: [PATCH] refactor(hooks): shrink check-executables-allow-sync (finding 2) Trim the two comment blocks that re-derived ADR-0019's argument in full (apm's exact-dict-lookup key matching, and why the PyYAML fallback is not a hard requirement) down to a short summary plus a pointer at ADR-0019, which already carries that reasoning verbatim. 231 -> 222 lines. The hook is kept, not deleted, per the audit's own corrected scope: the "or drop it" option in SIMPLIFICATION-AUDIT.md finding #2 is off the table because ADR-0019's Consequences section and the script's own header both call this failure mode silent, and the ADR says a silent-staleness failure here is strictly worse than the duplication this repo's other gates catch. The dual-reader design (PyYAML preferred, hand-rolled shape-scan fallback) is also kept as-is: it exists specifically so a missing python3/PyYAML can't silently skip the check or block every push, which is exactly the loud-failure guarantee this finding must not weaken. No genuine redundancy was found in the parsing logic, the per-branch Why/Fix error messages (each tied to a specific test), or the test matrix (which verifies the two readers agree across every failure mode) without cutting something load-bearing -- so those are untouched, and tests/test-check-executables-allow-sync.sh needed no changes since script behavior and output are byte-identical. All 23 tests in tests/test-check-executables-allow-sync.sh pass, and `pre-commit run check-executables-allow-sync --all-files --hook-stage pre-push` passes against the real repo state. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD --- scripts/check-executables-allow-sync.sh | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/scripts/check-executables-allow-sync.sh b/scripts/check-executables-allow-sync.sh index 632438e..4c9daff 100755 --- a/scripts/check-executables-allow-sync.sh +++ b/scripts/check-executables-allow-sync.sh @@ -2,17 +2,11 @@ set -euo pipefail # Fails the push when root apm.yml's executables.allow key stops naming -# kyberforge's actual version. -# -# apm gates a package's hooks/ and bin/ on an EXACT dict lookup of -# "#" in executables.allow (apm_cli/security/executables.py, -# `allow_executables.get(package_key)`) — there is no wildcard and no -# version-less form. So bumping plugins/kyberforge/apm.yml's `version:` without -# bumping the key in root apm.yml does not error anywhere: the entry simply -# stops matching, kyberforge's SessionStart hook stops deploying, and the apm -# install goes quietly stale — the exact failure ADR-0019 records as live and -# mitigates only with a comment. Nothing else in the pre-push gate compares the -# two files, which is why this exists. +# kyberforge's actual version. apm matches that key by exact dict lookup +# (apm_cli/security/executables.py) — a version bump that misses the key +# update deploys nothing, with no error anywhere. See ADR-0019, "The allow +# key is version-pinned, and that is a live failure mode", for the full +# argument; nothing else in the pre-push gate compares these two files. # # Run from repo root or pass REPO_ROOT as arg. @@ -64,12 +58,9 @@ fi # apresent|absent exactly once — is executables.allow a mapping? # k zero or more # -# python3 + PyYAML is preferred where importable, because it is a real parser. -# It is deliberately NOT a hard requirement: no other hook in this repo's -# pre-push gate needs PyYAML, and making a version-pin check the one thing that -# can block every push on a missing pip package is a worse failure than reading -# two known shapes by hand. The fallback below is not a YAML parser — it -# recognises exactly the two shapes these manifests use and nothing else. +# python3 + PyYAML is preferred where importable; the fallback below is not a +# YAML parser, it recognises only the two shapes these manifests use. PyYAML +# stays optional so a missing pip package can't block every push (ADR-0019). read_facts_python() { python3 - "$ROOT_MANIFEST" "$PLUGIN_MANIFEST" << 'PY'