v0.10.0 canonized "a new check is not shipped until its row exists" and
shipped with SKILL.md still saying "the two network calls" — after the
third had been added — and with no mention of VERIFY-COMMAND at all. The
invariant was violated one file over, in the same commit that wrote it.
Three corrections, and one is a trap worth naming: the remedy for
VERIFY-MISSING is to document the command that already exists, after
running it. Writing `npm test` into a README because the finding
mentioned it, with no scripts.test behind it, turns a WARN about missing
documentation into a false claim on the first screen — a worse defect
than the one being fixed, and one this gate can never catch, because it
runs nothing. VERIFY-NONE needs no action at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LwZeAZ8cHmGZofM9dryuT9
`VERSION-UNAVAILABLE` (SKIP/notRun) becomes `VERSION-NONE` (OK). A repo that
claims no version in any of the four places one can be written down has not
left a check un-run — the check ran, saw all four, and found no subject. That
is the shape `checkReadmeLanguage` has always answered with OK.
0.8.0 deferred this and recorded the reason in the engine: re-levelling "moves
a repo's status". Measured false across 19 clones — an added OK cannot worsen
the worst *judged* finding, and all three repos emitting the code already read
OK. Status moves only for a repo whose entire finding set was skips.
OK cannot bless a real gap here: no class requires a version file, and a
`plugin` missing its manifest is an independent FILE-MISSING ERROR.
Renamed, not just re-levelled: `-UNAVAILABLE` is this engine's naming for a
notRun skip, and one OK-level `-UNAVAILABLE` would mislead exactly the reader
this change serves. A source scan keeps the old name out.
A/B sweep, both engines offline, 19 clones: 223 judged findings, every status
and buckets identical; 3 conversions (notChecked 14→13, 3→2, 14→13), byDesign
untouched. 170 tests. `--refresh`: register 21 = forge 21.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CTNGvxzCLZp3UXfibYG4kb
SKILL.md's opening list still glossed `SKIP` as "the check could not run" and
then contradicted itself five lines later, where 0.8.0 had added the two kinds.
A session reading only the list reports every deliberate skip as something that
failed to run, and sends someone to fix fixture links that are deliberate on
purpose. 0.7.1 exists because 0.7.0 shipped the same class of defect; this is
the check that was supposed to stop it happening twice.
README's `--offline` note and its bilingual-undecidable paragraph now name which
kind their skips are, and what resolves them. Both were true and incomplete —
incomplete in the one direction that matters now that the summary line names
only one of the two.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHaQTcaD3w2C6PqVsAmrcv
`notChecked` merged "deliberately not judged" with "could not run". 0.7.0 took
SKIP out of the severity lattice, which fixed "clean repos look skipped"; this
fixes the same defect one level down, where it was saying so more quietly.
Measured across 19 clones, 35 of 39 skips are deliberate — so
`portfolio-optimiser — OK · 11 not checked` announced eleven unread checks when
all eleven were fixture and out-of-repo links.
Every SKIP finding now carries `skip: 'byDesign' | 'notRun'`, set at the
emission site rather than looked up from its code: VERSION-TAG is emitted at
SKIP with no tags and at ERROR with the wrong one, so a code→kind map has to
re-derive a reason the emitter already had. Untagged falls to `notRun`, the
loud side. Results carry `skips: { byDesign, notRun }`; `notChecked` stays a
number and stays the total, because a consumer doing `notChecked > 0` against
an object gets a silent false.
The summary line names only `notRun` — the deliberate ones keep their own
`NOT JUDGED` heading in the detail output. Landing the split in `--json` alone
would have left the symptom exactly where it was.
VERSION-UNAVAILABLE stays `notRun` by decision, not by default: it is arguably
"no subject to judge", the shape checkReadmeLanguage answers with OK, but
re-levelling it moves a repo's status and is a second behaviour change.
Verified: 169 tests. 19 clones swept with both engines offline — 220 judged
findings, every status, notChecked and buckets identical, no finding differing
beyond the new tag. The exhaustiveness test scans the engine SOURCE, not a
finding set: a corpus test only sees the sites it triggers, and the next
emission site added would take the reader's default invisibly.
BREAKING CHANGE: the summary line's coverage qualifier reads `· N not run` and
counts only un-runnable skips, where it read `· N not checked` over all of
them. `--json` gains `skips`; `notChecked` is unchanged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHaQTcaD3w2C6PqVsAmrcv
Three published documents went out with 0.7.0 unread.
SKILL.md told a reader what a SKIP FINDING means and stopped there.
Complete before 0.7.0, not now: a repo can headline `OK · 3 not
checked`, and a session reporting the status word alone would report a
green pass over three unjudged findings. Status and count are now
required together. Shipping without this made the plugin whose purpose
is catching stale published documents ship one.
README's example output cited commits older than the behaviour they
demonstrate — 5884a64 (0.6.0) beside a `notChecked` that did not exist
in it, and a7276e6 two releases back. The version names a file; only the
sha names the code. Both now cite 10ad125.
README also now states the unit: `notChecked` counts un-judged FINDINGS,
not checks. portfolio-optimiser's `11 not checked` is almost entirely
LINK-OUTSIDE-REPO, so the bare number reads worse than the repo is. Named
as a known limitation, not corrected in the string — the fix is splitting
"deliberately not judged" from "could not run", which is the next release.
Measured 2026-08-04: two repos (llm-security, config-audit) independently
proved the /repo-standard skill had resolved ${CLAUDE_PLUGIN_ROOT} to a
cached 0.1.1 while 0.2.0 was installed and the catalog pinned it — same
instruction, same variable, wrong engine. 0.1.1 has neither BADGE-COUNT nor
README-LANGUAGE, so a broadcast recommending the skill produced clean-looking
runs that could not have found what they were sent to find.
The header line and --json output now carry `repo-standard v<version>`
(headerLine/withEngineVersion, both pure and unit tested). SKILL.md tells the
reader to confirm it against the catalog pin before trusting green. The
stale-cache resolution itself is the harness's, not this repo's — not fixed
here, only made visible instead of silent.
TDD: 4 new tests. 111/111 green.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01496ZWasKPnA627crFBXWhe
Measured 2026-08-04: 13 script invocations in one shell loop tripped an
anonymous Forgejo rate limit at 26 requests, because each invocation makes
TWO calls (org listing + catalog marketplace.json), not the ONE this repo's
own CLAUDE.md claimed. That line went stale when INSTALL-TRUTH added the
second call and nobody updated the count it depended on.
fetchWithRetry wraps both calls, honoring Retry-After on HTTP 429 instead of
silently falling back to SKIP. TDD: 5 new tests inject a fake fetch and sleep
to drive the retry/backoff/give-up paths without touching the network.
A sweep across every repo still doesn't belong in this engine — that's
org-ops's job by this file's own header — but a single repo's self-check
should not read as broken just because the forge was briefly busy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01496ZWasKPnA627crFBXWhe
BADGE-COUNT and README-LANGUAGE are additions, so this is a minor rather than a
patch. The catalog ref still sat on v0.1.1 against a released v0.1.3; bumping it
to v0.2.0 clears that lag in the same move, because a ref points, it does not
queue.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mf1zhujv5QjYuAn1a9HcgW
Every claim about visual content failed adversarial verification, so this adds
no engine check. What it adds is judgement about a diagram that already exists:
the org's own measured example renders at 1,459 px and wraps node text mid-word
while its neighbour sits at 191 px. Rendering and rendering well are separate
questions.
Also records what the platform actually permits — Mermaid verified live on
15.0.6+gitea-1.22.0, silent degradation past MERMAID_MAX_SOURCE_CHARACTERS, and
no #gh-dark-mode-only until Gitea 1.26.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mf1zhujv5QjYuAn1a9HcgW
- extractChangelogTop truncated PEP 440 pre-release versions (0.5.0a2 -> 0.5.0),
so VERSION-CHANGELOG disagreed with VERSION-TAG over a version everything
already agreed on. Reported by llm-ingestion-okf with a repro.
- BADGE-STATIC-CLAIM treated a bare `status` badge as a run claim, same as
tests/build/CI. A self-declared maturity label asserts no run, same class
as version/licence/platform. Reported by llm-ingestion-pipeline-security.
- BOILERPLATE flagged FIXME when a scanner's own docs named the TODO/FIXME
convention rather than an instance of it. Reported by config-audit.
92 tests green, up from 86.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uwwfdmrfnp7FuGQ4z25RKH
`checkInternalLinks` compared a link's resolved target only against `present`
(tracked files), so `[x](dir/)` was always LINK-INTERNAL-MISSING even when
every file under it was tracked. Reported by portfolio-optimiser-claude with a
minimal repro; the same defect inflated ERROR counts in voyage, linkedin-studio
and portfolio-optimiser — 12 of the org's 71 measured ERRORs were this one
check, not twelve repo problems.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uwwfdmrfnp7FuGQ4z25RKH
The 0.1.0 entry said eleven checks; there are twelve, and both the code and
the README table already said so. 2963f4f fixed the entry in place but landed
after the tag, so the catalog's pin kept serving the wrong count.
Documentation only: scripts/ and register/ are unchanged from v0.1.0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Wuy8mxQj8Zt4z23hiRjiN
Measured this build against a documentation brief for public repos. The
five original checks covered roughly one of its ten sections, so this
adds what a single repo can answer on its own.
New: required README headings per class (Non-goals is the cheapest
trust-builder there is), in-repo version consistency across manifest /
badge / CHANGELOG / tag, badge honesty, boilerplate, licence-claim,
and relative links. Findings now carry a BUCKET beside the level -
broken / missing / weakening - and output is grouped by it, because
that is the order the work gets done in.
Traits are a second axis beside class: class is structural and readable
off the catalog, a trait says what the code does. `security` attaches
SECURITY.md and a Known limitations section. The two names carrying it
are proposed, not measured - that list is the operator's.
Solo-maintained settles a category: CONTRIBUTING, CODE_OF_CONDUCT and
MAINTAINERS are required by no class. Consumer-facing documents are
untouched by that; SECURITY.md exists for the stranger who finds a hole.
Three bugs found by running against llm-security, not by reading:
- ~30 link findings, all noise. Regexes inside code spans are
`[...](...)` to a naive scanner. Strip code first.
- `file:` and other schemes were treated as repo-relative paths.
- Relative links were resolved against the repo root instead of the
file they sit in, calling two files missing that sat next to the
README linking them.
Same fix applied to the boilerplate check: a document ABOUT placeholder
detection was tripping the placeholder detector.
Also removed this repo's own static tests badge. There is no CI - the
forge has zero Actions runners registered - so it could never become
real, and it is the exact anti-pattern the gate now flags.
67 tests. Against llm-security every remaining finding is real and
matches the census's independent hand-measurement.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WYJ3FHLtVgzFXMZ6UF598h
Five checks a single repository can answer on its own: README first
screen, install block, files required by its class, open/<name>
references, description length. Pure classifiers with I/O resolved into
their input, mirroring check-versions.mjs; ERROR/WARN/SKIP/OK, exit 1
on ERROR. 32 tests.
The reference check has THREE outcomes: "matches no repo" (ERROR) is
separate from "matches a known non-repo" (WARN). Sharing an outcome
would let real dead links hide inside correct text. Only names in URL
position count, and .git is normalised first - without that a raw scan
turns 3 dead names into ~20.
enabledPlugins is treated as a legitimate second install form; what the
gate requires in addition is a CLI command. The JSON form is never
reported as the defect.
STATE.md is gitignored from this first commit - public remote.
No hook yet: a blocking gate must first be precise enough not to fail a
correct repository.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WYJ3FHLtVgzFXMZ6UF598h
