Checks live in the framework repo, not in a public data repo #90

Merged

vnprc merged 1 commit from agent/check-placement-rule into master

2026-10-21 23:32:27 +01:00

allod-agent commented

2026-10-21 23:28:55 +01:00

Member

Prose only; no machine, tool or check changes. This records the rule that was missing when the machine-coverage check was built into the secrets template (allod/secrets#43, allod/secrets#48) and only afterwards moved to the framework (allod/archetypes#148): a check committed to a public data repo runs against the template alone, because every deployment builds from a private fork of that repo and pins the framework as it is, so a property that must hold everywhere is asserted in archetypes, whose checks the deploy flake runs against each deployment's own data. Four files say it, each where a session would have met it: the architecture principle on code, data and keys; the test placement section of testing.md; the scope-discipline paragraph of agent-behavior.md; and a fourth way a tracker lies in the pick-next-issue skill, so the sweep asks "where does this fix run?" before ranking an issue filed against a data repo. What stays identical: everything else. Proof: the byte-budget hook passes on the worktree. If it is wrong, revert; it is one commit of prose.

Refs allod/archetypes#148

Risk

R0. Documentation only.

Validation

.hooks/memory-budget --worktree passes.
Each edit cites the owning section by name, not by number, and names no private path, host or account.

Prose only; no machine, tool or check changes. This records the rule that was missing when the machine-coverage check was built into the secrets template (allod/secrets#43, allod/secrets#48) and only afterwards moved to the framework (allod/archetypes#148): a check committed to a public data repo runs against the template alone, because every deployment builds from a private fork of that repo and pins the framework as it is, so a property that must hold everywhere is asserted in `archetypes`, whose checks the deploy flake runs against each deployment's own data. Four files say it, each where a session would have met it: the architecture principle on code, data and keys; the test placement section of `testing.md`; the scope-discipline paragraph of `agent-behavior.md`; and a fourth way a tracker lies in the `pick-next-issue` skill, so the sweep asks "where does this fix run?" before ranking an issue filed against a data repo. What stays identical: everything else. Proof: the byte-budget hook passes on the worktree. If it is wrong, revert; it is one commit of prose. Refs allod/archetypes#148 ## Risk R0. Documentation only. ## Validation - `.hooks/memory-budget --worktree` passes. - Each edit cites the owning section by name, not by number, and names no private path, host or account.

allod-agent added 1 commit

2026-10-21 23:28:56 +01:00

Checks live in the framework repo, not in a public data repo b6ac391b20

A check committed to a template data repo runs against the template
alone: deployments build from private forks of inventory, profiles and
secrets and pin the framework as it is, with the deploy flake's follows
pointing the framework's data inputs at the forks. Say so in the
architecture principle on code, data and keys, in testing.md's placement
section, in agent-behavior.md's scope discipline, and as a fourth way a
tracker lies in the pick-next-issue skill, so the sweep asks where a fix
runs before ranking an issue filed against a data repo.

Refs allod/archetypes#148