feat(ms-ai-architect): R22 decision-b Enhet 3 — Status-backfill 25 none + ai-act dual-header-dedup 4 (Missing Status/Last-updated 29+4→0) [skip-docs]

To operasjoner, én økt (⊥ R7), begge ren metadata-normalisering (verdi aldri fabrikkert).

Premiss-korreksjon (ground truth 2026-07-07): roadmap sa «27 none + 4 ai-act».
Målt: 29 mangler bold **Status:** = 25 rene none + 4 ai-act (plain Status: GA).
De «27» inkluderte 2 for mye — 2 filer (custom-dashboards-ai-operations,
zero-trust-ai-services) har bold **Status:** KUN forbi byte 500 (present for
full-fil-audit, usynlig for 500B header-parser) → egen header-slanking-residual
(§8-register), utenfor Enhet 3.

Op A — Status-backfill 25 rene none: utvidet backfill-status.mjs MANIFEST 14→39
(samme statusForFile + insertMetaField + hard per-fil-invariant, idempotent skip
på de 14 R21-gjorte). Alle 25 → **Status:** Established Practice (ingen matcher
template|matrix|benchmarks|register). Diff +25/-0.

Op B — ai-act dual-header-dedup (4 filer): ny driver dedup-plain-header.mjs + 2
rene primitiver i transform.mjs — boldifyPlainField (plain→bold, verdi bevart
byte-eksakt, header-scoped, idempotent) + dropRedundantPlainField (sletter plain
KUN når bold m/ identisk verdi beviser redundans; kaster ved avvik/manglende bold).
Per fil: plain Last updated: + Status: GA → bold (2026-06-18/2026-02, GA bevart),
redundant plain Category: fjernet. Hard per-fil-invariant (net -1 linje, begge
felt bold m/ bevart verdi, ingen plain-header igjen, body byte-identisk). Diff -12/+8.

Verifisering: test-backfill-status 8/8 + test-dedup-plain-header 13/13; audit
Missing Status 29→0, Missing English Last updated 4→0; skills-diff 29 filer
+33/-12 (kun **Status:** + 8 bold-swaps), diff-kontekst inspisert per fil; begge
drivere idempotent (re-run 0 writes); suite 806/806 exit 0; none=8 uendret (Enhet 4).
This commit is contained in:
Kjell Tore Guttormsen 2026-07-07 07:45:27 +02:00
commit de0d94cbc1
35 changed files with 510 additions and 57 deletions

View file

@ -1,22 +1,26 @@
#!/usr/bin/env node
// Backfill **Status:** on the 14 English-dialect advisor reference files that carry NO
// status label (R21 — base-field pre-pass del 2, ⊥ R7).
// Backfill **Status:** on English-dialect reference files that carry NO status label
// (R21 + Enhet 3 — base-field pre-pass, ⊥ R7). Single mechanism for the whole corpus.
//
// Ground truth 2026-07-06 (premiss-verified): of the not-due (146) corpus, 21 files lack a
// bold **Status:**. Of those, 3 are Norwegian-dialect (an English Status would mix dialects)
// and 4 (ms-ai-governance/responsible-ai/ai-act-*) carry a PLAIN-TEXT `Status: GA` in a second
// dual-header block that the bold-only regex does not see — inserting a bold **Status:** there
// duplicates/contradicts it. All 7 (3 + 4) are DEFERRED to the decision-b dialect/dual-header
// residual (the same plain block is why R20 duplicated **Category:** on those 4). The clean
// remainder is 14 advisor/architecture files. All 26 not-due Last-updated gaps are also deferred
// (21 already carry a Norwegian date → relabel; 5 are git-unreliable post-R20-churn). This
// applier writes ONLY those 14 Status lines — never a date, never into a Norwegian/dual-header file.
// Scope (ground-truth measured 2026-07-06 → extended 2026-07-07):
// R21 — 14 advisor/architecture files (the clean not-due remainder; 3 Norwegian-dialect
// and 4 dual-header ai-act-* files were held back — see below).
// Enhet 3 — +25 non-advisor files whose header carries no **Status:** at all (audit dialect
// 'none' for Status). Measured 25 — NOT the roadmap's "27": 2 of that count are
// files whose bold **Status:** sits PAST byte 500 (present, but invisible to the
// 500-byte header parser), a separate header-slanking residual, not a missing field.
// Still OUT — the 4 ms-ai-governance/responsible-ai/ai-act-* files carry a PLAIN-TEXT
// `Status: GA` in a dual-header block. Inserting a derived bold **Status:** there
// would duplicate/contradict the authored value; they are handled by the plain→bold
// dedup driver (dedup-plain-header.mjs), which PRESERVES `GA` rather than deriving.
//
// Value rule (operator-approved vocabulary, 2026-07-06): statusForFile() — a filename-token
// map within {Reference, Established Practice}. Reuses the tested insertMetaField primitive,
// with a hard per-file invariant asserted BEFORE any write (exactly one line inserted, it is
// the Status line, body byte-identical). Idempotent: a file already carrying **Status:** is
// skipped, so a re-run is a no-op. Aborts and writes nothing on any drift or invariant breach.
// This applier writes ONLY a derived bold **Status:** line — never a date, never into a
// dual-header ai-act file. Value rule (operator-approved vocabulary): statusForFile() — a
// filename-token map within {Reference, Established Practice}. Reuses the tested insertMetaField
// primitive, with a hard per-file invariant asserted BEFORE any write (exactly one line
// inserted, it is the Status line, body byte-identical). Idempotent: a file already carrying
// **Status:** in its header window is skipped, so a re-run — including the 14 R21 files already
// applied — is a no-op. Aborts and writes nothing on any drift or invariant breach.
//
// Usage: node scripts/kb-update/backfill-status.mjs [--dry]
import { readFileSync, writeFileSync, existsSync, realpathSync } from 'node:fs';
@ -46,10 +50,12 @@ export function statusForFile(relOrBase) {
return /(?:template|matrix|benchmarks|register)/i.test(base) ? 'Reference' : 'Established Practice';
}
// Frozen manifest — the 18 scope-confirmed targets (not-due ∩ missing-**Status:** ∩
// English-dialect), verified against ground truth 2026-07-06. Each value is derived by
// statusForFile() and re-asserted below, so the manifest can never drift from the rule.
// Frozen manifest — the 39 scope-confirmed targets (missing-**Status:** ∩ English-dialect ∩
// not a dual-header ai-act file), verified against ground truth (R21: 14 advisor 2026-07-06;
// Enhet 3: +25 non-advisor 2026-07-07). Each value is derived by statusForFile() and re-asserted
// below, so the manifest can never drift from the rule.
const TARGET_PATHS = [
// R21 — 14 advisor/architecture files (already applied; re-run skips them idempotently).
'skills/ms-ai-advisor/references/architecture/adr-template.md',
'skills/ms-ai-advisor/references/architecture/ai-utredning-template.md',
'skills/ms-ai-advisor/references/architecture/alternativanalyse-methodology.md',
@ -64,6 +70,32 @@ const TARGET_PATHS = [
'skills/ms-ai-advisor/references/architecture/regional-availability-verification.md',
'skills/ms-ai-advisor/references/architecture/security.md',
'skills/ms-ai-advisor/references/architecture/source-traceability-assumption-register.md',
// Enhet 3 — 25 non-advisor files with no **Status:** at all (all → Established Practice).
'skills/ms-ai-engineering/references/mlops-genaiops/cost-optimization-mlops-pipelines.md',
'skills/ms-ai-engineering/references/mlops-genaiops/feedback-loops-continuous-improvement.md',
'skills/ms-ai-engineering/references/mlops-genaiops/genaiops-llm-specific-practices.md',
'skills/ms-ai-engineering/references/mlops-genaiops/governance-audit-ml-operations.md',
'skills/ms-ai-engineering/references/mlops-genaiops/inferencing-optimization-caching.md',
'skills/ms-ai-engineering/references/mlops-genaiops/infrastructure-as-code-mlops.md',
'skills/ms-ai-engineering/references/mlops-genaiops/llm-evaluation-production.md',
'skills/ms-ai-engineering/references/mlops-genaiops/mlops-security-access-control.md',
'skills/ms-ai-engineering/references/mlops-genaiops/mlops-teams-collaboration-tools.md',
'skills/ms-ai-engineering/references/mlops-genaiops/model-deployment-strategies-azure.md',
'skills/ms-ai-engineering/references/mlops-genaiops/monitoring-observability-ml-systems.md',
'skills/ms-ai-engineering/references/mlops-genaiops/prompt-flow-production-deployment.md',
'skills/ms-ai-engineering/references/mlops-genaiops/responsible-ai-mlops-integration.md',
'skills/ms-ai-governance/references/monitoring-observability/anomaly-detection-ai-systems.md',
'skills/ms-ai-governance/references/monitoring-observability/azure-monitor-setup-ai-workloads.md',
'skills/ms-ai-governance/references/monitoring-observability/log-analytics-kql-ai-queries.md',
'skills/ms-ai-governance/references/monitoring-observability/token-usage-tracking-attribution.md',
'skills/ms-ai-governance/references/responsible-ai/ai-center-of-excellence-setup.md',
'skills/ms-ai-governance/references/responsible-ai/ai-governance-structure-framework.md',
'skills/ms-ai-governance/references/responsible-ai/red-teaming-ai-models.md',
'skills/ms-ai-security/references/ai-security-engineering/ai-red-team-operations-practical.md',
'skills/ms-ai-security/references/ai-security-engineering/data-leakage-prevention-ai.md',
'skills/ms-ai-security/references/ai-security-engineering/secure-model-deployment-hardening.md',
'skills/ms-ai-security/references/ai-security-engineering/security-copilot-integration.md',
'skills/ms-ai-security/references/ai-security-engineering/supply-chain-security-ai-models.md',
];
export const MANIFEST = TARGET_PATHS.map((path) => ({ path, status: statusForFile(path) }));

View file

@ -0,0 +1,139 @@
#!/usr/bin/env node
// dedup-plain-header.mjs — Enhet 3 Op B (2026-07-07, ⊥ R7). Normalize the dual-header block on
// the 4 ms-ai-governance/responsible-ai/ai-act-* files.
//
// Those files carry, below the bold header, an authored PLAIN-TEXT block:
// Last updated: <date>
// Status: GA
// Category: <value> ← redundant with a bold **Category:** <same value> (R20)
// This driver, per file:
// 1. boldifyPlainField('Last updated') — plain → **Last updated:**, date PRESERVED byte-exact
// 2. boldifyPlainField('Status') — plain → **Status:** GA, GA PRESERVED (authored, not
// the derived {Reference|Established Practice} vocab)
// 3. dropRedundantPlainField('Category')— delete the plain Category iff a bold **Category:**
// with the IDENTICAL value proves it redundant
// It NEVER derives a value and NEVER deletes a field it cannot prove redundant (the primitive
// throws on a value mismatch or a missing bold field). A hard per-file invariant is asserted
// BEFORE any write: exactly one line removed net, both target fields now bold with the authored
// value, no plain header field remains, and the body (from the first `## `/`---`) is byte-
// identical. Idempotent: a re-run finds the plain fields gone and is a no-op. Aborts, writing
// nothing, on any drift or invariant breach.
//
// Closes the last 4 of the corpus's Missing-Status and all 4 Missing-English-Last-updated.
//
// Usage: node scripts/kb-update/dedup-plain-header.mjs [--dry]
import { readFileSync, writeFileSync, existsSync, realpathSync } from 'node:fs';
import { join, dirname } from 'node:path';
import { fileURLToPath } from 'node:url';
import { boldifyPlainField, dropRedundantPlainField } from './lib/transform.mjs';
const __dirname = dirname(fileURLToPath(import.meta.url));
const PLUGIN_ROOT = join(__dirname, '..', '..');
// Frozen manifest — the 4 dual-header ai-act-* files (ground truth 2026-07-07: the only
// non-advisor files carrying a plain-text Status/Last updated block).
export const MANIFEST = [
'skills/ms-ai-governance/references/responsible-ai/ai-act-classification-methodology.md',
'skills/ms-ai-governance/references/responsible-ai/ai-act-deployer-obligations.md',
'skills/ms-ai-governance/references/responsible-ai/ai-act-fria-template.md',
'skills/ms-ai-governance/references/responsible-ai/ai-act-provider-obligations.md',
];
/**
* The pure Op-B composition: boldify the plain Last updated + Status, then drop the redundant
* plain Category. Order-independent for these files (distinct labels). Pure no I/O.
* @param {string} content
* @returns {string}
*/
export function dedupPlainHeader(content) {
let out = boldifyPlainField(content, 'Last updated');
out = boldifyPlainField(out, 'Status');
out = dropRedundantPlainField(out, 'Category');
return out;
}
// Header region = lines above the first `## `/`---` (mirrors transform.mjs headerEndIndex).
function splitHeaderBody(content) {
const lines = content.split('\n');
let i = 0;
for (; i < lines.length; i++) {
if (/^##\s/.test(lines[i]) || /^---\s*$/.test(lines[i])) break;
}
return { header: lines.slice(0, i).join('\n'), body: lines.slice(i).join('\n') };
}
const RE_PLAIN_META = /^(Last updated|Status|Category):\s*\S/im;
// Assert the hard per-file invariant. Throws (aborting the run) on any breach.
function assertInvariant(rel, oldC, newC) {
const o = oldC.split('\n');
const n = newC.split('\n');
if (n.length !== o.length - 1) {
throw new Error(`ABORT ${rel}: expected exactly one line removed net (was ${o.length}, now ${n.length})`);
}
const oldH = splitHeaderBody(oldC);
const newH = splitHeaderBody(newC);
if (oldH.body !== newH.body) throw new Error(`ABORT ${rel}: body not byte-identical`);
if (RE_PLAIN_META.test(newH.header)) throw new Error(`ABORT ${rel}: a plain header field remains`);
if (!/\*\*Last updated:\*\*\s*\S/.test(newH.header)) throw new Error(`ABORT ${rel}: **Last updated:** missing after dedup`);
if (!/\*\*Status:\*\*\s*\S/.test(newH.header)) throw new Error(`ABORT ${rel}: **Status:** missing after dedup`);
if ((newH.header.match(/\*\*Category:\*\*/g) || []).length !== 1) {
throw new Error(`ABORT ${rel}: expected exactly one bold **Category:** after dedup`);
}
// Value preservation: the authored plain values must survive verbatim in the bold lines.
const oldPlain = (label) => {
const m = new RegExp('^' + label.replace(/ /g, '\\ ') + ':\\s*(\\S.*?)\\s*$', 'im').exec(oldH.header);
return m ? m[1] : null;
};
for (const label of ['Last updated', 'Status']) {
const want = oldPlain(label);
const boldRe = new RegExp('\\*\\*' + label + ':\\*\\*\\s*(\\S.*?)\\s*$', 'im');
const got = boldRe.exec(newH.header);
if (!want || !got || got[1] !== want) {
throw new Error(`ABORT ${rel}: value for '${label}' not preserved (want ${JSON.stringify(want)}, got ${JSON.stringify(got && got[1])})`);
}
}
}
function run({ dry }) {
const planned = [];
const skipped = [];
const missing = [];
for (const rel of MANIFEST) {
const abs = join(PLUGIN_ROOT, rel);
if (!existsSync(abs)) { missing.push(rel); continue; }
const old = readFileSync(abs, 'utf8');
const out = dedupPlainHeader(old);
if (out === old) { skipped.push(rel); continue; } // idempotent: already deduped
assertInvariant(rel, old, out);
planned.push({ rel, out });
}
if (missing.length) {
console.error(`ABORT — ${missing.length} manifest target(s) not found (corpus drift):`);
missing.forEach((m) => console.error(' ' + m));
process.exit(1);
}
if (planned.length + skipped.length !== MANIFEST.length) {
throw new Error(`ABORT — accounted ${planned.length + skipped.length} ≠ manifest ${MANIFEST.length}`);
}
console.log(`Manifest: ${MANIFEST.length} | to dedup: ${planned.length} | already deduped (skipped): ${skipped.length}`);
if (dry) {
console.log('\n(dry run — no writes)');
for (const p of planned) console.log(` ~ ${p.rel}`);
return;
}
for (const p of planned) writeFileSync(join(PLUGIN_ROOT, p.rel), p.out);
console.log(`\nWrote ${planned.length} files.`);
}
const isMain = (() => {
try {
return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
} catch {
return false;
}
})();
if (isMain) run({ dry: process.argv.includes('--dry') });

View file

@ -418,6 +418,88 @@ export function insertMetaField(content, label, value) {
return lines.join('\n');
}
// Header region ends at the first horizontal rule or `## ` section — mirrors the body
// boundary the anchor loops above use. A plain-text meta line below this is genuine prose.
function headerEndIndex(lines) {
for (let i = 0; i < lines.length; i++) {
if (/^##\s/.test(lines[i]) || /^---\s*$/.test(lines[i])) return i;
}
return lines.length;
}
/**
* Normalize a PLAIN-TEXT header field `<label>: <value>` to the house bold form
* `**<label>:** <value>`, PRESERVING the authored value byte-exact (Enhet 3 Op B dedup
* primitive for the dual-header ai-act-* files). Unlike insertMetaField this never derives a
* value: it only re-decorates a line the author already wrote. Acts on the FIRST plain match
* in the header region only (a `Status:` in body prose is untouched). Idempotent: if a bold
* `**<label>:**` already sits in the header the content is returned unchanged; likewise if no
* plain line exists. Body (from the first `## `/`---`) is byte-identical.
*
* @param {string} content full existing file content
* @param {string} label the label WITHOUT decoration, e.g. 'Last updated'
* @returns {string} content with the plain line re-decorated, or unchanged
* @throws if label is blank
*/
export function boldifyPlainField(content, label) {
const s = String(content ?? '');
const lab = String(label ?? '').trim();
if (lab === '') throw new Error('boldifyPlainField: label is required');
const esc = lab.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
const boldRe = new RegExp('^\\s*\\*\\*' + esc + ':\\*\\*', 'i');
const plainRe = new RegExp('^\\s*' + esc + ':\\s*(\\S.*?)\\s*$', 'i');
const lines = s.split('\n');
const end = headerEndIndex(lines);
let plainIdx = -1;
for (let i = 0; i < end; i++) {
if (boldRe.test(lines[i])) return s; // idempotent: already bold → unchanged
if (plainIdx === -1 && plainRe.test(lines[i])) plainIdx = i;
}
if (plainIdx === -1) return s; // no plain line → unchanged
const val = plainRe.exec(lines[plainIdx])[1];
lines[plainIdx] = `**${lab}:** ${val}`;
return lines.join('\n');
}
/**
* Remove a PLAIN-TEXT header field `<label>: <value>` that is provably redundant with an
* existing bold `**<label>:** <value>` carrying the IDENTICAL value (Enhet 3 Op B dedup
* primitive). Refuses to guess: if no bold field exists, or the bold and plain values differ,
* it THROWS (that is a human decision, never an auto-delete). No-op if the plain line is absent
* (idempotent). Operates in the header region only; body is byte-identical.
*
* @param {string} content full existing file content
* @param {string} label the label WITHOUT decoration, e.g. 'Category'
* @returns {string} content with the redundant plain line removed, or unchanged
* @throws if label is blank, no bold field proves redundancy, or the values differ
*/
export function dropRedundantPlainField(content, label) {
const s = String(content ?? '');
const lab = String(label ?? '').trim();
if (lab === '') throw new Error('dropRedundantPlainField: label is required');
const esc = lab.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
const boldRe = new RegExp('^\\s*\\*\\*' + esc + ':\\*\\*\\s*(\\S.*?)\\s*$', 'i');
const plainRe = new RegExp('^\\s*' + esc + ':\\s*(\\S.*?)\\s*$', 'i');
const lines = s.split('\n');
const end = headerEndIndex(lines);
let boldVal = null;
let plainIdx = -1;
let plainVal = null;
for (let i = 0; i < end; i++) {
const bm = boldRe.exec(lines[i]);
if (bm && boldVal === null) boldVal = bm[1];
const pm = plainRe.exec(lines[i]);
if (pm && plainIdx === -1) { plainIdx = i; plainVal = pm[1]; }
}
if (plainIdx === -1) return s; // nothing to drop (idempotent)
if (boldVal === null) throw new Error(`dropRedundantPlainField: no bold **${lab}:** to prove redundancy for plain '${plainVal}'`);
if (boldVal !== plainVal) throw new Error(`dropRedundantPlainField: plain '${plainVal}' ≠ bold '${boldVal}' — not redundant, human decision`);
lines.splice(plainIdx, 1);
return lines.join('\n');
}
/**
* Surgically insert-or-update ONLY the `**Verified:**` and `**Verified by:**` header lines
* on an EXISTING KB file the R7R10 born-verified STAMP primitive. Unlike composeKbFile