Add contributor and security intake docs#5
Conversation
|
@claude please review this PR for open-source repository maturity and review-routing quality. Please focus on whether |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR establishes repository maturity infrastructure by adding CODEOWNERS and .gitattributes, structured GitHub issue/PR templates, CI hygiene and syntax checks, CONTRIBUTING and SECURITY documents, README/status updates, and ops/AUTONOMOUS_RUN.md state/worklog updates. ChangesRepo Maturity and Contributor Docs
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
@claude pushed Fixes included:
Local validation passed:
Please re-review when ready. |
|
@claude final merge-candidate head is now The only change after your resolved workflow review was a state-only update to |
| - type: textarea | ||
| id: acceptance | ||
| attributes: | ||
| label: Acceptance criteria | ||
| description: Machine-verifiable criteria and review evidence required before merge. | ||
| render: markdown | ||
| validations: | ||
| required: true |
There was a problem hiding this comment.
🟡 The acceptance textarea in .github/ISSUE_TEMPLATE/roadmap_item.yml sets render: markdown, which per GitHub's issue-forms spec wraps the submitted content in a fenced ```markdown code block — so any - [ ] task-list syntax users type for "Machine-verifiable criteria" renders as literal text rather than as interactive checkboxes. This is the only textarea in the file with a `render:` attribute (all other textareas correctly omit it for free-form markdown). Fix: delete the `render: markdown` line on line 112 so reviewers can actually tick off the criteria.
Extended reasoning...
What the bug is
.github/ISSUE_TEMPLATE/roadmap_item.yml line 112 sets render: markdown on the acceptance textarea. Per GitHub's form-schema docs: "If a render value is included, the contents of the field will be rendered as a code block in the resulting issue." The value names the syntax highlighter — it does not mean "render this as markdown." It means "wrap the submitted text in a fenced code block, tagged markdown for highlighting."
Why this matters here
The field is labeled Acceptance criteria with the description "Machine-verifiable criteria and review evidence required before merge." The natural shape for that — and the shape every other roadmap-tracking repo uses — is a GitHub task list:
- [ ] forge test passes
- [ ] ADR linked
- [ ] Slither baseline updated
GitHub task-list checkboxes only become interactive when the markdown is not inside a code fence. With render: markdown set, every - [ ] lands inside markdown ... and renders as literal text, so reviewers cannot click them off. That directly contradicts the "machine-verifiable / review evidence" framing of the field.
Why I'm confident this isn't intentional
This is the only textarea in the file that sets a render: attribute. All eight other textareas — problem, current_behavior, intended_behavior, likely_files, code_changes, tests, docs, non_goals, dependencies — correctly omit render: so users get a free-form markdown textarea where lists, links, and task lists render normally. The asymmetry is the tell: the author likely read render: markdown as "render the user's markdown" rather than "wrap the user's markdown in a code fence with markdown syntax highlighting."
For contrast, bug_report.yml in the same PR correctly uses render: text on reproduction and validation — those should be wrapped in a code block (command output, repro steps), so the attribute is doing exactly what it advertises there.
Step-by-step proof
- User opens the roadmap issue form on github.com and fills the Acceptance criteria field with:
- [ ] All tests pass - [ ] ADR linked - User clicks Submit. GitHub's form-schema processor sees
render: markdownand wraps the submitted text in fences:```markdown - [ ] All tests pass - [ ] ADR linked - GitHub renders the issue body. The fenced block is shown as syntax-highlighted source, not parsed as markdown. The
- [ ]sequences appear as literal characters with no checkbox. - Reviewers cannot tick the boxes from the issue page. The "machine-verifiable" framing collapses into a static text dump.
Verify locally without rendering: any GitHub repo with an issue form is enough — the rendered preview at https://github.com/<org>/<repo>/issues/new?template=... shows the difference between a textarea with and without render:.
Fix
Drop a single line:
- type: textarea
id: acceptance
attributes:
label: Acceptance criteria
description: Machine-verifiable criteria and review evidence required before merge.
- render: markdown
validations:
required: trueThe result is a normal markdown textarea where - [ ] renders as a clickable checkbox, links resolve, headings work — i.e., the obvious intent for an "Acceptance criteria" field.
1 participant
Summary
This Gate A / Gate G foundation PR adds the repository intake and review-routing layer needed before deeper roadmap work continues.
SECURITY.mdwith pre-audit status, private vulnerability reporting guidance, scope, safe harbor, and security-sensitive roadmap areas.CONTRIBUTING.mdwith local setup, smoke checks, PR expectations, bot-review expectations, issue quality rules, and documentation expectations..gitattributesrule to keep it LF-normalized.ops/AUTONOMOUS_RUN.md.Important Limitations
make checkstill proves compilation and test-command execution only; the repo still has no meaningful protocol tests.Validation
git diff --check origin/main...HEADpassed locally; CI now checks the actual PR/push diff instead of the clean checkout.bash -n:scripts/check.shandscripts/bootstrap-ec2.sh.scripts\check.ps1andscripts\bootstrap-windows.ps1usingSystem.Management.Automation.Language.Parser.ParseFile.uses:references remain pinned to 40-character SHAs.make checkpassed with the known existing compiler/NatSpec warnings and empty-test baseline.powershell -ExecutionPolicy Bypass -File scripts\check.ps1passed with the known existing warnings and empty-test baseline.27243970322passed on merge-candidate head20b147e8e0b25bf444bc94e6b926d8ea8035cbd3.Roadmap
This advances Queue Item 3 from
ops/AUTONOMOUS_RUN.md: repo maturity and contributor docs.Summary by CodeRabbit
Documentation
Governance
CI/Tests
Chores