gstack/ship/sections/shared-code-reuse.md at dd76b43882e41d3cb12aa0bc856f86a3c9fc26b0

0 Fork 0

mirror of https://github.com/garrytan/gstack.git synced 2026-11-06 00:44:07 +01:00

Files

T

garrytanandcapy-ai[bot] ebbdf33354 fix(review): shared-code evidence gathering is read-only (index-flags flaky, gate 40619718717)

The failing assume-unchanged trial ran git update-index --really-refresh while gathering evidence, which cleared the flag the checker reads. Step 1 now says the read is read-only and names that command; nearby prose tightened so the section stays byte-identical in size (no pin or ledger move).

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

2026-10-28 16:35:19 +00:00

2.3 KiB

Raw Blame History

Reuse a skipped shared-code advisory only with complete structural evidence:

Read the evidence. Read all supporting callers and the helper target read-only: git update-index, even --really-refresh, clears the index flags the checker reads. Establish first-party authored provenance and whether this extraction is worthwhile; the checker cannot. Retain evidence_paths/helper_target.
Run the checker. From the repository root, pass the current finding as literal JSON on stdin. Replace REVIEW_START with this pass's token and the example paths/symbol with actual evidence. Keep the quoted delimiter.

"$HOME/.claude/skills/gstack/bin/gstack-review-log" --check-shared-libs REVIEW_START <<'GSTACK_SHARED_LIBS_REUSE_JSON'
{"advisory":true,"severity":"INFORMATIONAL","evidence_paths":["src/caller-a.ts","src/caller-b.ts"],"helper_target":{"path":"src/shared.ts","symbol":"sharedHelper"}}
GSTACK_SHARED_LIBS_REUSE_JSON

Act on its result. Only reusable: true permits suppression. False, command failure or unreadable output requires fresh source review and a new decision, never suppression. Do not supply your own snapshot, prior record or coverage.
Persist through the logger. The logger recomputes coverage; never supply proof. Real defects retain normal Fix-First handling.

What a reusable result proves (never reconstruct these checks):

Identity: sharedLibsFingerprint plus the repo, raw branch and current snapshot. The checker reads REVIEW_START without consuming/replacing it. Sanitized branch names are not identity.
Prior decision: completed/converged review, verified binding, explicit Skip and logger-versioned snapshot_covered_paths; unversioned coverage needs a fresh decision.
Source: canReuseSharedLibsAdvisory requires every supporting path's raw file byte-for-byte with its blob. Exclude assume-unchanged, skip-worktree and sparse index entries; symlinks/ancestors, submodules, ignored/outside or unreadable files; active/unknown Git filters, encodings and line conversion.
Safe inspection: disables fsmonitor and optional locks; never uses external diff/textconv. Unknown evidence fails closed.

2.3 KiB Raw Blame History

2.3 KiB

Raw Blame History