From 07721368a034b7416c12116359f38e9d7830804e Mon Sep 17 00:00:00 2001 From: konard Date: Tue, 12 May 2026 08:30:35 +0000 Subject: [PATCH 1/5] Initial commit with task details Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: https://github.com/netkeep80/PersistMemoryManager/issues/384 --- .gitkeep | 1 + 1 file changed, 1 insertion(+) create mode 100644 .gitkeep diff --git a/.gitkeep b/.gitkeep new file mode 100644 index 00000000..bb1b7ba5 --- /dev/null +++ b/.gitkeep @@ -0,0 +1 @@ +# .gitkeep file auto-generated at 2026-05-12T08:30:35.453Z for PR creation at branch issue-384-7ee996adfbc4 for issue https://github.com/netkeep80/PersistMemoryManager/issues/384 \ No newline at end of file From 029ed88f908a4a734e2784cbf8617575a3aeaccd Mon Sep 17 00:00:00 2001 From: konard Date: Tue, 12 May 2026 08:34:30 +0000 Subject: [PATCH 2/5] issue-384: harden repo-guard policy-delta gate to blocking MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upgrade PMM to consume the policy-delta hardening released in netkeep80/repo-guard#99 (merge commit b1b6756) and flip the repo-guard PR check and policy enforcement from advisory to blocking. - .github/workflows/repo-guard.yml: pin action to b1b6756…, rename job to "repo-guard blocking check", set enforcement: blocking. - repo-policy.json: switch top-level enforcement.mode to blocking; add .github/CODEOWNERS to governance_paths so future edits are gated. - scripts/check-repo-guard-rollout.sh: bump expected_action_ref to the new pin, retire 6c81bb1… into old_action_refs, and require both the workflow and policy to be blocking (advisory must no longer appear). - .github/CODEOWNERS: new file scoping repo-policy.json, repo-guard.yml and CODEOWNERS itself to @netkeep80. The existing kernel-subtree-max-bytes size rule (include/**, 270000 bytes, all_tracked, blocking) is preserved unchanged, so this PR enforces the existing library-size budget rather than raising it. Fixes #384 --- .github/CODEOWNERS | 6 ++++++ .github/workflows/repo-guard.yml | 6 +++--- repo-policy.json | 3 ++- scripts/check-repo-guard-rollout.sh | 8 +++++--- 4 files changed, 16 insertions(+), 7 deletions(-) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 00000000..533f535b --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,6 @@ +# Governance ownership for the library-size and policy-delta gate. +# Edits to these paths require maintainer review and are tracked by +# repo-guard's trusted policy boundary. +/repo-policy.json @netkeep80 +/.github/workflows/repo-guard.yml @netkeep80 +/.github/CODEOWNERS @netkeep80 diff --git a/.github/workflows/repo-guard.yml b/.github/workflows/repo-guard.yml index 842dcc5c..60698298 100644 --- a/.github/workflows/repo-guard.yml +++ b/.github/workflows/repo-guard.yml @@ -15,7 +15,7 @@ permissions: jobs: policy-check: - name: repo-guard advisory check + name: repo-guard blocking check runs-on: ubuntu-latest if: github.event_name == 'pull_request' && !github.event.pull_request.draft steps: @@ -25,10 +25,10 @@ jobs: - name: Run repo-guard id: repo_guard - uses: netkeep80/repo-guard@6c81bb1050c7dca93de1a13108e0a024fe095298 + uses: netkeep80/repo-guard@b1b6756639092bbd4ff6a473aeaa637a63475a86 with: mode: check-pr - enforcement: advisory + enforcement: blocking env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/repo-policy.json b/repo-policy.json index 3489fcfa..2a930154 100644 --- a/repo-policy.json +++ b/repo-policy.json @@ -2,7 +2,7 @@ "policy_format_version": "0.3.0", "repository_kind": "library", "enforcement": { - "mode": "advisory" + "mode": "blocking" }, "paths": { "forbidden": [ @@ -33,6 +33,7 @@ "governance_paths": [ "repo-policy.json", "CONTRIBUTING.md", + ".github/CODEOWNERS", ".github/workflows/repo-guard.yml", ".github/workflows/docs-consistency.yml", ".github/PULL_REQUEST_TEMPLATE.md", diff --git a/scripts/check-repo-guard-rollout.sh b/scripts/check-repo-guard-rollout.sh index b72f588a..59bd35cf 100755 --- a/scripts/check-repo-guard-rollout.sh +++ b/scripts/check-repo-guard-rollout.sh @@ -22,11 +22,12 @@ workflow = workflow_path.read_text(encoding="utf-8") policy = json.loads(policy_path.read_text(encoding="utf-8")) issue_template = issue_template_path.read_text(encoding="utf-8") pr_template = pr_template_path.read_text(encoding="utf-8") -expected_action_ref = "6c81bb1050c7dca93de1a13108e0a024fe095298" +expected_action_ref = "b1b6756639092bbd4ff6a473aeaa637a63475a86" expected_action = f"netkeep80/repo-guard@{expected_action_ref}" old_action_refs = { "7ab5ca2f2d9859b4ffa2c423f05e951d4971be84", "99bf716da62c5d01070aa0d7e4d4f8031b43a351", + "6c81bb1050c7dca93de1a13108e0a024fe095298", } expected_profiles = { "governance", @@ -78,7 +79,8 @@ if action_refs: for old_action_ref in old_action_refs: require(old_action_ref not in workflow, f"repo-guard workflow must not use old Action pin {old_action_ref}") require("mode: check-pr" in workflow, "repo-guard workflow must run check-pr mode") -require("enforcement: advisory" in workflow, "repo-guard workflow must remain advisory in this stage") +require("enforcement: blocking" in workflow, "repo-guard workflow must enforce policy in blocking mode") +require("enforcement: advisory" not in workflow, "repo-guard workflow must not run in advisory mode") require("fetch-depth: 0" in workflow, "repo-guard workflow must use full checkout history") require("contents: read" in workflow, "repo-guard workflow must keep contents read-only permission") require("issues: read" in workflow, "repo-guard workflow must keep issues read-only permission") @@ -94,7 +96,7 @@ for forbidden in ( require(forbidden not in workflow, f"repo-guard workflow must not use legacy manual integration pattern: {forbidden}") policy_mode = policy.get("enforcement", {}).get("mode") -require(policy_mode == "advisory", "repo-policy.json must default to advisory enforcement") +require(policy_mode == "blocking", "repo-policy.json must enforce policy in blocking mode") for removed in ("change_classes", "new_file_rules", "change_type_rules"): require(removed not in policy, f"repo-policy.json must not use legacy {removed}") From 9ff9fa386faa94f0741ba2be0391256d45433242 Mon Sep 17 00:00:00 2001 From: konard Date: Tue, 12 May 2026 08:36:08 +0000 Subject: [PATCH 3/5] ci: retrigger repo-guard after marking PR ready for review From 36610caf10075523d8c4f1a737d632111bf79368 Mon Sep 17 00:00:00 2001 From: konard Date: Tue, 12 May 2026 09:06:01 +0000 Subject: [PATCH 4/5] issue-384: fix canonical-docs-sync registry-rule failure in docs/index.md The new policy-delta-hardened repo-guard parses every markdown link in the "Canonical Documents" section of docs/index.md via the markdown_section_links right-hand source, not just the row-leading link. The inline reference to ../include/pmm/block_header.h on the BlockHeader Semantics row added an extra entry (include/pmm/block_header.h) that breaks set_equality against the paths.canonical_docs list, blocking the blocking-mode flip on this PR. Replace the inline markdown link with inline code so the parser no longer picks up the include/pmm path. The canonical document set is unchanged; only the inline rendering of the BlockHeader name on that row changes from a link to inline code. Authorized by issue #384's expected_effects: "pre-existing canonical-docs-sync incompatibility in docs/index.md is fixed without changing the canonical document set". --- docs/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/index.md b/docs/index.md index 0a0dca25..edb3b8bb 100644 --- a/docs/index.md +++ b/docs/index.md @@ -10,7 +10,7 @@ Single entry point for PMM documentation. The canonical set below must match | [PMM Target Model](pmm_target_model.md) | Normative top-level model: PMM as compact persistent storage kernel; boundary vs `pjson` / `pjson_db` / execution / product layers | | [PMM Transformation Rules](pmm_transformation_rules.md) | Normative operational rulebook: allowed issue types, atomic-issue / no-mixed-PR / extraction-first / surface-compression rules, PR review semantics | | [Comment Policy](comment_policy.md) | Canonical text discipline for comments, docs placement, and text-surface review | -| [BlockHeader Semantics](block_and_treenode_semantics.md) | Field-level specification of the single physical [BlockHeader](../include/pmm/block_header.h#pmm-blockheader) layout (`Block` is a type alias for `BlockHeader`) | +| [BlockHeader Semantics](block_and_treenode_semantics.md) | Field-level specification of the single physical `BlockHeader` layout (`Block` is a type alias for `BlockHeader`) | | [Architecture](architecture.md) | Layer stack, memory layout, algorithms, storage backends, configuration | | [API Reference](api_reference.md) | Complete public API: lifecycle, allocation, containers, I/O, error codes | | [Validation Model](validation_model.md) | Low-level pointer and block validation: cheap vs full modes, conversion paths, error categories | From a749efa8a58c45f834457c35fd1341dcb7302df4 Mon Sep 17 00:00:00 2001 From: konard Date: Tue, 12 May 2026 09:20:05 +0000 Subject: [PATCH 5/5] Revert "Initial commit with task details" This reverts commit 07721368a034b7416c12116359f38e9d7830804e. --- .gitkeep | 1 - 1 file changed, 1 deletion(-) delete mode 100644 .gitkeep diff --git a/.gitkeep b/.gitkeep deleted file mode 100644 index bb1b7ba5..00000000 --- a/.gitkeep +++ /dev/null @@ -1 +0,0 @@ -# .gitkeep file auto-generated at 2026-05-12T08:30:35.453Z for PR creation at branch issue-384-7ee996adfbc4 for issue https://github.com/netkeep80/PersistMemoryManager/issues/384 \ No newline at end of file