Defame1297/holocron
0
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

docs: correct stale resolver, status and duplication claims

Browse Source 
ADR-0014 gains a dated correction: skill-size-check now sources the
boundary resolver from kyberforge (ef27c97), so restoring the external
hook contract needs it made self-contained first. ADR-0017's status
reflects its supersession, architecture.md and gates.md carry the
current duplication counts and reason, gates.md defines vacuous green
inline, and the gitleaks lesson is marked historical.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Defame1297
2026-09-16 15:27:29 +00:00
parent 25743911f1
commit 1f3d4f9962
5 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
LESSONS.md
View File

@@ -40,9 +40,9 @@ A research sub-agent reported "Process goes in SKILL.md, context in reference fi
`claude plugin validate --strict` was left out of the standard plugin audit sweep and only discovered when the user flagged the gap. It catches warnings (missing `version` fields, stray non-agent `.md` files) that will fail CI once strict mode is enforced. Fix: run it on every plugin path and marketplace manifest as a named audit step.
## 2026-06-21 — Source and deployed gitleaks configs can silently diverge
## 2026-06-21 — Source and deployed gitleaks configs can silently diverge (historical)
`scripts/gitleaks.toml` (source) and `.gitleaks.toml` (deployed, hook-read) drifted after someone edited the deployed copy directly; rerunning `setup-gitleaks.sh` would have overwritten it, silently deleting the allowlist. Fix: treat the source as sole truth, never hand-edit the deployed copy, and update both together in the same commit.
Superseded — `5b8b6f5` removed `scripts/gitleaks.toml` and `setup-gitleaks.sh`, so `.gitleaks.toml` is now the only copy and there is nothing to diverge from. Kept for the general pattern, which applies to any source/deployed pair: `scripts/gitleaks.toml` (source) and `.gitleaks.toml` (deployed, hook-read) drifted after someone edited the deployed copy directly; rerunning `setup-gitleaks.sh` would have overwritten it, silently deleting the allowlist. Fix: treat the source as sole truth, never hand-edit the deployed copy, and update both together in the same commit.
## 2026-06-21 — `shellcheck` without `-x` blocks pre-commit on scripts using `source` (historical)