Repository navigation
Remediation/skill portability - #3
Merged
Merged
Conversation
Implements AppDoc-Skill-Remediation-Plan (F-01..F-13): - Harness-agnostic SKILL.md + references/ (enrichment contract, operations, config schema, verification); Copilot prompts become thin wrappers - MIT LICENSE (Tim Niles); README updated; PowerShell 7.2+ (#requires) - Remove speckit scaffolding, scratch tmp_*.ps1, tracked test output/logs - Rebuilt CI (hygiene + ubuntu/windows Pester incl. golden suites) - Fix empty-set StrictMode false failure in dependencies validator - Cross-platform temp path in quarantine harness - Repo-relative paths in generated evidence/docs; deterministic endpoint order - Theme-driven masthead logo (CMU default, configurable) - Convert legacy tests to Pester 5 syntax; add regression tests - Regenerate self-dogfood docs/ Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
…e (ADR 0003) - validate-documentation: read each sub-validator's exit code (reset first); a failed check is recorded as failed with its issue codes; a validator crash is an internal error and fails the gate - run-appdoc-build: exit 0/1/2/3 (pass / tool error / gate failed / fail-closed); -AllowGateFail for exploratory runs; redaction sweep fails closed when its module cannot load; semantic secret-redaction block exits 3 - ADR 0003, SKILL.md and references/verification.md document the contract Failures the old gate hid, now fixed at the cause: - classic-asp api-inventory had no coverage snapshot - AST + regex extractors double-counted Express routes (dedupe ignores controller) - overview truth pack counted raw records on a first run but graph entities on a re-run (build the graph in memory; clear stale derived evidence up front) - evidence register / verification appendix ran before late evidence producers and counted the pristine report; re-runs differed - gate wrote a scratch copy into <target>/tmp/logs, which the next run scanned - classic-asp platform inventory counted docs/report.html as source Tests: Gate.ValidatorFailure, Build.ExitCodes, Determinism.ReRun Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
…t vocabulary - AppDoc.SecretPolicy.psm1: shared credential key-name vocabulary and operator redaction compiler (redactionPatterns = literal values, new redactionRegexes = regexes; invalid regex throws) - build sweep, source-docs and the semantic gate use it; invalid regex -> exit 3, unparseable config.json -> exit 1 (no silent fallback to defaults) - semantic gate scans raw string leaves as well as JSON text, so secrets with quotes/backslashes are caught; hits never carry the secret value - config extractor, gate redaction-safety check and docs remediator build their credential regexes from the shared vocabulary (fixture output unchanged) - config-schema.md and ADR 0001 amendment document the semantics Tests: Redaction.OperatorPatterns Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
…verlays The composer carried a specific Help Desk application's workflows, role descriptions, purpose rows, glossary and benchmark name, and emitted them as Verified for every Classic ASP target. The security/extcalls generators also let that target's @@HELPWEB_ placeholder prefix bypass redaction, and the extcalls email row printed a hardcoded procedure call regardless of source. - §7 is now "Operational Workflows", built only from evidence: entry-point areas (API evidence) and procedure contracts documented in source (procdict); sequencing/policy/authorization/escalation stay Unknown - §5 scans for generic authorization signals (session flags, access-check routines, role/permission parameters) with file:line; descriptions state only what the match shows; matrix rows are entry-point areas - Purpose/users are never inferred from names; glossary ships only technology terms - Operator overlays: <target>/.appdoc/overlays/<section-slug>.md (or config "overlays"), rendered under "Operator-supplied context", headings demoted, listed in the section evidence - opaqueTokenPattern (config) replaces the hardcoded @@HELPWEB_ pass-through; default is to redact everything - extcalls: email rows show the real source snippet; UNC detection uses literal \\server\share paths; no product names inferred from URLs - Pristine/validator/goldens use the new section name; the old heading is accepted with a deprecation warning until 1.2.0; source-docs sub-tag 'help-desk' -> 'service-procedure' - Fixed while here: composer strings that turned markdown backticks into control characters (`e, `v) and a hardcoded "174 re-runnable commands"; datamodel/validator read SQL from VBScript comments (a procedure named "and") - config-schema.md and ADR 0001 amendment Tests: Composer.NoTargetLeak Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
… ownership
- AppDoc.Provenance.psm1: footer stamped recursively over docs/** as the build's
last Markdown step (one footer, always last); hand-authored files (docs/adr/**
or <!-- appdoc:hand-authored -->) untouched; final pass writes UTF-8 (no BOM)
with LF so output is identical on Windows and Linux
- generators emit `n instead of `r`n (25 files)
- report.html is self-contained by default: vendored Mermaid 11.17.2 inlined
(MIT, NOTICE), system font stack; theme "assets": "cdn" restores network
loading; the redaction sweep skips the marked vendor block (it was corrupting
the library); verified rendering offline in Chromium
- git ownership: only files in the current tree (--no-renames + ls-files),
scope policy applied, mailmap; author emails hidden unless
"ownership": { "showEmails": true }
- validation report names the detected framework instead of "csharp"
- fixed: composer's top-author cell had an unclosed backtick
- revealed by LF output: the gate's redaction-safety check never matched on CRLF
docs; it now runs and accepts both redaction markers
- classic-ASP build-cookbook evidence now carries cicdCount (integrity gate
passes; the "benign warning" note is removed from verification.md)
- ADR 0002 amendment, config-schema (assets, ownership)
Tests: Provenance.Footer, GitOwnership, HtmlReport offline cases, Flask
framework label
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
…he honours corrections - AppDoc.Paths.psm1: Get-AppDocDocsPath / Get-AppDocDocsDirName read outputDir (must stay inside the target); ~110 hardcoded "docs" joins across 60 scripts and modules now resolve through it, so a single generator run alone also honours the setting; the scope policy and source-docs scan exclude the configured folder; recorded evidence paths use it - theme: bundled name, absolute path, or path relative to the target; unknown name warns with the available list; a missing explicit theme file stops the build (config error) instead of silently using CMU - semantic enrichment: a corrected output file for an unchanged input supersedes the cached result (cacheState=superseded) and refreshes the cache - config-schema.md and enrichment-operations.md updated Tests: Config.OutputDir, Config.Theme, quarantine harness proof 5b (fails on the previous code) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
…, linting, dead code Harness neutrality (D-10: /appdoc.enhance removed; something similar returns in 2.0) - delete .github/prompts/appdoc.enhance.prompt.md; drop enhanceTarget from the pristine checklist (now "supply it in" = the section's overlay file); neutral wording in pristine/orchestrator/validator output - /appdoc.begin is a thin wrapper around run-appdoc-build.ps1 (it used to call run-all-generators.ps1 directly and skip config + redaction) - copilot-instructions.md rewritten as a short adapter note; README and enrichment-operations point to references/ as the contract Consistency - 51 functions renamed to approved verbs; exported names keep aliases until 1.2.0 - [CmdletBinding()] on all 52 entry scripts; trailing whitespace and final newlines fixed (generated output verified unchanged) - PSScriptAnalyzerSettings.psd1 Leftovers from the previous plan - removed dead scripts (analyze-codebase, common, generate-architecture-diagram, generate-assessment-report, quality-framework) - .vscode/settings.json -> settings.example.json (opt-in, no broad pwsh/git approvals) - ROADMAP.md rebaselined; SKILL.md version 1.1.0 - CI: actions pinned to commit SHAs; harness/target-name lint over the core and generated docs; entry-script header check; referenced-scripts-exist check; no CR in docs; PSScriptAnalyzer job (verbs + whitespace enforced); a test leg without .NET; docs drift job Tests: Modules.Import Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
…ures - run-all-generators: every evidence producer (generic and classic-ASP) now runs before overview/start-here/task-guides/evidence-register/composer, so the start-here re-run is gone and the overview re-align is an invariant check. - Explicit owner for shared artifacts: when the target is classic ASP with .asp/.inc sources, the classic generators own api-inventory, data-model and build-cookbook and the generic ones are skipped; otherwise the reverse. Web Forms targets no longer get classic-ASP IIS deployment steps. - generate-classic-asp-endpoints writes its own api-inventory appendix (a stale generic "N/A" appendix used to be left behind). - New AppDoc.ClassicAsp module for helpers copied across classic generators; Set-AppDocFieldValue and relative-path helpers consolidated. - Evidence-graph type counts are ordered, so the summary is stable across processes. - No empty catch blocks in production code (CI enforces it); template-helpers dot-sourcing fails closed in every script. - A generator crash is now a tool error: run-appdoc-build exits 1 (ADR 0003 amended, verification.md, new exit-code test). This exposed a missing Scope import in the classic extcalls/security generators, now fixed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
- The final redaction sweep skips hand-authored docs (docs/adr/ and files with the hand-authored marker); it was rewriting a documented `user:pass@` example. - ci-diagram-stability-gate / orchestrator reset $LASTEXITCODE before reading it (StrictMode threw when it was unset, failing the integrity gate on this repo). - Overview truth pack no longer invents one dependency when a .NET framework is detected without code files (it made the overview disagree with the evidence). - CI target-name lint ignores paths to the prompt files themselves. - CHANGELOG.md for 1.1.0; ROADMAP points to it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
Built from the repo root on a scratch copy (gate pass, overallScore 99). Hand-authored files and docs/adr/ are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
- Architecture, build pipeline, exit-code, redaction, enrichment and CI diagrams (Mermaid), fixture gate-score chart, output tree, 20-section list. - Reflects current behaviour: exit codes 0/1/2/3 and -AllowGateFail, config keys (outputDir, redactionRegexes, overlays, opaqueTokenPattern, ownership, assets), offline HTML, provenance and hand-authored rules, artifact ownership. - Corrects the old "byte-stable" claim and lists known limitations from the 2026-10-23 review. - Script comments: exit-code list and shared-artifact owner list brought up to date. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E3WkE7kqih8fmZWRMMKjjg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.