factory: sandcastle scaffold + stage-A gate baseline (capture-baseline) - #24
Merged
Conversation
…oon-meta#257) Stage-0 software factory for buzz, per org FACTORY.md conventions: - .sandcastle/ on @ai-hero/sandcastle@0.12.0 (exact pin), template parallel-planner-with-review, Docker sandbox, relay-pilot recipe with all org hardenings (gh auth setup-git hook, sandboxSecrets() passthrough, fail-loud PR/push verification, opus/sonnet model tiering, ~60% context handoff). Nested .sandcastle/package.json {"type":"module"} scopes ESM for tsx (root package.json has no type field — connector#392/block#393 gotcha). - Agent image: node:24-bookworm + rustup 1.95.0 (default profile) + corepack/pnpm@11.4.0 + just 1.46.0 + cargo-nextest 0.9.136 + gh + Claude Code; pkg-config/libssl-dev/cmake for openssl-sys/aws-lc-sys. - Label runners agent-implement.yml / agent-review.yml + agent-image.yml build check (copied from relay; job bodies diffed intact). - Gate (Justfile-driven, in-image proven green at zero debt): fmt-check, desktop-tauri-fmt-check, clippy (-D warnings), test-unit (nextest, infra-free set), desktop-check/test/build, web-check/build. Excluded by design and documented: Flutter/mobile, src-tauri compile checks, Playwright e2e, Postgres/Redis integration, cargo-deny, cross-compile, signing/canary pipelines (upstream ci.yml still runs them all). - .sandcastle/gate-baseline.json: stage-A capture (gate epic toon-protocol/toon-meta#210 ladder) — correctness counts all zero, cold-gate speed, image size; fork has no Actions history so CI-side numbers are sampled from upstream block/buzz main and labeled as such. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gives
toon-protocol/buzza working sandcastle software factory (stage-0) plus the stage-A capture-baseline for the gate ladder. Part of toon-protocol/toon-meta#257 (migration epic toon-protocol/toon-meta#256). The FACTORY.md registry row lands separately in toon-meta — per the registry rule this repo is not "live" until that row exists.What was scaffolded
.sandcastle/— the proven relay-pilot recipe (engine@ai-hero/sandcastle@0.12.0exact-pin, templateparallel-planner-with-review), including every org-hardening already propagated to the other 10 repos: deterministicgh auth setup-gitpush auth,sandboxSecrets()passthrough in all runner entrypoints, fail-loud open-PR / review-push verification, model tiering (planner/merger =claude-opus-4-8; implementer/reviewer/open-pr/push-review =claude-sonnet-5), and the ~60% context-ceiling handoff instruction in the implement/review prompts..sandcastle/.gitignore+.sandcastle/.env.example— included up front (the fractal#15 bootstrap omission)..sandcastle/package.json({"type":"module"}) — buzz's rootpackage.jsonhas notypefield, so without this tsx transpiles the runners to CJS and breaks on top-levelawait/require()of the ESM-only engine (connector#392/feat(desktop): restore Tauri auto-updater support block/buzz#393 gotcha)..github/workflows/agent-image.yml,agent-implement.yml,agent-review.yml— copied from relay with only the pnpm pin (11.4.0), node (24), and image-verify changes; job bodies diffed against the originals to rule out the fractalf041aeccomment-strip regression.package.json:sandcastle*scripts + exact-pinned devDeps (@ai-hero/sandcastle@0.12.0,tsx,zod);pnpm-lock.yamlregenerated with pnpm 11.4.0 (--frozen-lockfileverified green).agent:implement(#1D76DB) /agent:review(#B392F0) created on the repo..sandcastle/gate-baseline.json— the stage-A capture, same shape as relay#77/store#59/toon#120.Gate shape (honest subset the sandbox can run)
Driven by the repo's own Justfile:
just fmt-checkjust desktop-tauri-fmt-checkjust clippy(workspace,-D warnings)just test-unit(infra-free nextest set)just desktop-checkjust desktop-testjust desktop-buildjust web-checkjust web-buildBaseline: zero pre-existing debt on every one of these (fmt 0 violations, clippy 0 warnings, tests green, biome/tsc clean on desktop+web) — measured at main@4d47aa8; Rust checks measured inside the agent image itself.
Explicit exclusions (documented in
gate-baseline.json, still covered by upstreamci.ymlon every PR): Flutter/mobile;desktop/src-tauricompile-level checks (GTK/WebKit + sidecar stubs — only itsfmt-checkis in-gate); Playwright e2e; Postgres/Redis integration tests;cargo-deny; cross-compile / Windows / macOS builds; signing/canary/release pipelines (KEEP rule — no upstream workflow was touched). Pre-existing gap noted: upstream CI has noadmin-webjob; the agent gate mirrors CI and does not silently add one.Proof
sandcastle:buzz(node:24-bookworm + rustup 1.95.0 default profile + corepack/pnpm 11.4.0 + just 1.46.0 + cargo-nextest 0.9.136 + gh + Claude Code), 3.97GB; toolchain-verify script passes inside it.just fmt-check,just desktop-tauri-fmt-check,just clippyandjust test-unitall PASS in the container (timings ingate-baseline.json); JS-side checks pass with the hermit-pinned toolchain.CLAUDE_CODE_OAUTH_TOKENexists in any local repo's gitignored.sandcastle/.env, and minting one was out of scope. The org-level Actions secretCLAUDE_CODE_OAUTH_TOKENis visible to this repo (as areAPP_ID/APP_PRIVATE_KEY), so the label runners are expected to authenticate in CI; the first liveagent:implementrun is the remaining proof.Fork caveat
This repo is a GitHub fork of block/buzz with no Actions run history of its own; upstream CI jobs run here for the first time on this PR and any failures unrelated to the added files (signing secrets, canaries, environment) are pre-existing fork-environment issues, not regressions from this change.
🤖 Generated with Claude Code