Repository navigation
Gates: GREEN refuses a dependency the approved plan does not name (M10.2) - #106
Merged
Merged
Conversation
…0.2) New plugin/bin/deps lists dependencies a change adds to Cargo.toml, package.json, requirements*.txt, pyproject.toml and go.mod; gate-green-verify blocks any the story's plan does not name. Test: scripts/test/supply-chain.test.py. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QxyVf3NgwsgRyYpBgDDTC
adeelahmad
marked this pull request as ready for review
October 20, 2026 12:05
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
…gate branch Run 49 and run 50 both kept in the evidence ledger. ROADMAP M0.9 records that M10.2's dependency check should also ask `events approval`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBVFNrEg85XAnSfHQidCXN
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AiLhAWTRtwbgMCDQNJUbea
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
…ch; docs for M9.31 Conflicts: the OpenCode plugin's header comment (gate-dispatch on task from master, the door gate last from this branch) and codex-hooks.test.py (both blocks kept). ROADMAP: M9.31 done, new items M9.48, M9.49, M9.54-M9.59, and the M9 row of section 0 brought up to date; TRACKING, CHANGELOG, OVERVIEW. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rsDo9GYzNx8tXucywZHnA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Before: a GREEN worker could add any package to a manifest; acceptance proved behaviour, not where the code came from.
After: gate-green-verify blocks a dependency added to Cargo.toml, package.json, requirements*.txt, pyproject.toml or go.mod unless the story's plan (tasks.md, targets.json, plan.md, validate.md, stories.md) names it. The fix is a re-plan the human approves.
How: new
plugin/bin/deps(added/unplanned, stdlib-only parsers, Python 3.9 safe);_gatelib.shgainsdiff_baseandassert_planned_dependencies; green personas state the limit. Evidence:scripts/test/supply-chain.test.py(2 checks),make ci78/78 locally. Second half of M10.2 (secret scan, dependency audit in the final gate) stays on the ROADMAP.Generated by Claude Code