From deedc8a728572571937fc38d481a6df10195165b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=90=C3=A1i=20Chung=20Hy?= <112932824+daichunghy@users.noreply.github.com> Date: Fri, 28 Aug 2026 09:10:01 +0700 Subject: [PATCH] docs: refresh portfolio register and status snapshot for 2026-08-28 Record the 2026-08-25 maintainer merge batch across all repositories, the open feature pull requests (#59, #33, #30, #17, #14, #19, #16), the current main-branch CI runs on c9d11cb, and add agentsmd as the fifth registered repository with its outside fork recorded as a lead, not usage. Supersedes the 2026-08-24 register. --- AGENTS.md | 32 +++-- .../2026-08-28-repository-portfolio-audit.md | 121 ++++++++++++++++++ 2 files changed, 142 insertions(+), 11 deletions(-) create mode 100644 docs/reviews/2026-08-28-repository-portfolio-audit.md diff --git a/AGENTS.md b/AGENTS.md index b509f81..7635fcf 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -91,7 +91,7 @@ The repository enforces a clean root structure (maximum 9 files) with well-defin ## Current project status This section is the operating snapshot for the repository. It was revalidated -on 2026-08-23 and must be kept separate from the constitutional definition of +on 2026-08-28 and must be kept separate from the constitutional definition of done below. A local test, a recorded fixture, or a configured remote is not by itself evidence of live GitHub behavior, external adoption, or release readiness. @@ -110,7 +110,9 @@ and follow-ups #15–#21, #23, #25 and #26 were merged on 2026-08-22, and #28, #36 and #40 were merged on 2026-08-23, each by the repository administrator after temporarily lifting `enforce_admins`; the setting was restored immediately after each merge, and every such merge is recorded as a -maintainer decision rather than independent-review evidence. PR #40 closed +maintainer decision rather than independent-review evidence. PRs #46, #47, +#51, #53, #54 and #55 were merged on 2026-08-25 in the same recorded +pattern, bringing `main` to `c9d11cb`. PR #40 closed audit item P1-8: `evaluate` accepts `--output` as an alias of `--report`, conflicting paths fail closed with `REPORT_OUTPUT_CONFLICT`, and the committed Action bundle was rebuilt to catch up with the `evaluator-core` @@ -121,19 +123,27 @@ and CodeQL `32563526929` on `main@e4052f2`, earlier runs through [32559824706](https://github.com/daichunghy/patchgate/actions/runs/32559824706) on `main@c9f643e`, and the first public run [CI 32333914059](https://github.com/daichunghy/patchgate/actions/runs/32333914059). -For the current public `main`, default-branch CI run -[32616034636](https://github.com/daichunghy/patchgate/actions/runs/32616034636) -completed successfully while CodeQL `32616034425` was still in progress when -this snapshot was written. +For the current public `main` at `c9d11cb`, default-branch +[CI 32806576723](https://github.com/daichunghy/patchgate/actions/runs/32806576723) +and CodeQL +[32806576725](https://github.com/daichunghy/patchgate/actions/runs/32806576725) +completed successfully on 2026-08-25. Live branch protection also requires one approving pull-request review, dismisses stale reviews, requires six CI contexts including `CI / Full Verify`, enforces linear history and conversation resolution, and disables force-pushes and branch deletion. The merged feature, documentation and release branches were deleted after their content reached `main`; the stale pre-publication -`test/patchgate-shadow-smoke` draft branch and the open -`dependabot/npm_and_yarn/typescript-7.0.2` branch (PR #12) -remain. Dependabot PRs #11 (`@types/node` 26), #13 (`vitest` 4) and #14 +`test/patchgate-shadow-smoke` draft branch remains, and the open branches are +`codex/tested-sha-interop` (PR #59), `feat/release-rollback-guide` +(PR #52, opened 2026-08-23), the CodeQL 4.37.8 Dependabot branches +(PRs #57 and #58, opened 2026-08-27), and +`dependabot/npm_and_yarn/typescript-7.0.2` (PR #12). PR #59 binds the Action +snapshot and check-run delivery to the exact `pull_request.head.sha` with +fail-closed live-target mismatch handling; on 2026-08-28 every required +context on it was green and it waited only on the one approving review that +branch protection requires. Dependabot PRs #11 (`@types/node` 26), #13 +(`vitest` 4) and #14 (`@vitest/coverage-v8` 4) were merged on 2026-08-22 after local re-verification; PR #12 (`typescript` 7) stays open because `@vercel/ncc` cannot bundle under TS 7. Dependabot Actions PRs #38 (`actions/setup-node` 7) @@ -150,7 +160,7 @@ unusable on real runners [release record](docs/releases/2026-08-23-beta.5.md)); it is beta shadow-evidence scope only — not production, adoption or a `v0.1` claim. -The current milestone audit is [the 2026-08-20 G4/G0 continuation audit](docs/reviews/2026-08-20-g4-g0-audit.md). The newest records are the [2026-08-22 multi-persona review round](docs/reviews/2026-08-22-multi-persona-review.md), the [2026-08-22 live consumer smoke findings](docs/reviews/2026-08-22-live-smoke-findings.md) and the [2026-08-22 Mimosa static-advisory adjudication](docs/reviews/2026-08-22-mimosa-static-advisory-adjudication.md) — re-run the sealed scan after any change to `src/github/client.ts` transport handling. The latest verification command to rerun after a change is: +The current milestone audit is [the 2026-08-20 G4/G0 continuation audit](docs/reviews/2026-08-20-g4-g0-audit.md). The current cross-repository register is the [2026-08-28 repository portfolio audit](docs/reviews/2026-08-28-repository-portfolio-audit.md). The newest review records are the [2026-08-22 multi-persona review round](docs/reviews/2026-08-22-multi-persona-review.md), the [2026-08-22 live consumer smoke findings](docs/reviews/2026-08-22-live-smoke-findings.md) and the [2026-08-22 Mimosa static-advisory adjudication](docs/reviews/2026-08-22-mimosa-static-advisory-adjudication.md) — re-run the sealed scan after any change to `src/github/client.ts` transport handling. The latest verification command to rerun after a change is: ```bash npm run verify @@ -158,7 +168,7 @@ npm run verify ## Shared repository workflow -The Desktop workspace contains four separate public repositories: [PatchGate](https://github.com/daichunghy/patchgate), [contribkit](https://github.com/daichunghy/contribkit), [OpenSheet-AI](https://github.com/daichunghy/opensheet-ai), and [quant-research](https://github.com/daichunghy/quant-research). They are not a monorepo or a combined adoption claim. The live status, evidence limits, and cross-repository working rules are maintained in the [repository portfolio audit](docs/reviews/2026-08-24-repository-portfolio-audit.md). +The Desktop workspace contains five separate public repositories: [PatchGate](https://github.com/daichunghy/patchgate), [contribkit](https://github.com/daichunghy/contribkit), [OpenSheet-AI](https://github.com/daichunghy/opensheet-ai), [quant-research](https://github.com/daichunghy/quant-research), and [agentsmd](https://github.com/daichunghy/agentsmd). They are not a monorepo or a combined adoption claim. The live status, evidence limits, and cross-repository working rules are maintained in the [repository portfolio audit](docs/reviews/2026-08-28-repository-portfolio-audit.md). When working across them, keep each repository's own `AGENTS.md`, constitution, tests, release boundary, and Git history authoritative. Check live GitHub and package-registry signals before writing a status update. Count outside walkthroughs, downstream installs, outside issues, outside pull requests, and consented pilots as usage evidence; count self-authored activity and bot activity as maintenance evidence only. diff --git a/docs/reviews/2026-08-28-repository-portfolio-audit.md b/docs/reviews/2026-08-28-repository-portfolio-audit.md new file mode 100644 index 0000000..c2c86e4 --- /dev/null +++ b/docs/reviews/2026-08-28-repository-portfolio-audit.md @@ -0,0 +1,121 @@ +# Repository portfolio audit — 2026-08-28 + +This is the operating register for the five GitHub repositories kept in the +Desktop workspace. They remain separate projects with separate contracts, +release decisions, and user evidence. The register does not turn them into a +suite and does not imply shared adoption. It supersedes the +[2026-08-24 register](2026-08-24-repository-portfolio-audit.md), which stays +on file as the record of that date's signals. + +## Live snapshot + +The GitHub and npm checks were run on 2026-08-28. A download is a registry +event, not a user count. A self-authored issue, release, discussion, star, +fork, or maintenance log is not external adoption. + +| Local folder | Repository | Current public signal | Package signal | Verified usage | +| --- | --- | --- | --- | --- | +| `Github/` | [`daichunghy/patchgate`](https://github.com/daichunghy/patchgate) | 1 star, 0 forks, 8 open issues (count includes PRs), current Action pre-release `v0.1.0-beta.5`, public `main` at `c9d11cb` | PatchGate remains unpublished (`private: true`); the npm name `patchgate` belongs to another package | No external user, downstream repository, or pilot verified | +| `Github 2/contribkit/` | [`daichunghy/contribkit`](https://github.com/daichunghy/contribkit) | 0 stars, 0 forks, 20 open issues (count includes PRs), pre-release `v0.1.0-alpha.7` | npm `latest` resolves `0.1.0-alpha.3`, `alpha` resolves `0.1.0-alpha.6`; 578 downloads from 2026-08-20 to 2026-08-26 | No external user, downstream repository, or pilot verified | +| `Github 3/` | [`daichunghy/opensheet-ai`](https://github.com/daichunghy/opensheet-ai) | 0 stars, 0 forks, 8 open issues (count includes PRs), pre-release `v0.1.0-alpha.5` | npm `latest` and `alpha` resolve `0.1.0-alpha.4`; 128 downloads from 2026-08-20 to 2026-08-26 | No external user, downstream repository, or pilot verified | +| `Github 4/` | [`daichunghy/quant-research`](https://github.com/daichunghy/quant-research) | 0 stars, 0 forks, 9 open issues (count includes PRs), pre-release `v0.1.0-alpha.5` | npm `@agentbiz/quant-research`: `alpha` resolves `0.1.0-alpha.5`, `latest` resolves `0.1.0-alpha.4`; 254 downloads from 2026-08-20 to 2026-08-26 | No external user, downstream repository, or pilot verified | +| `Desktop/agentsmd/` | [`daichunghy/agentsmd`](https://github.com/daichunghy/agentsmd) | 1 star, 1 fork, 7 open issues (count includes PRs), pre-release `v0.1.0-alpha.2` (2026-08-22) | npm `@daichunghy/agentsmd` not published | One outside GitHub account (`VedantMadane`) forked the repository on 2026-08-23; no issue, pull request, or feedback followed. A fork is not verified usage | + +The contributor lists are maintainer-led everywhere; Dependabot supplies most +open pull requests. No outside human contribution was observed in this +snapshot. + +## What changed since 2026-08-24 + +- On 2026-08-25 the maintainer merged a documentation, test and hardening + batch through the recorded admin-bypass pattern on every repository: + PatchGate #46/#47/#51/#53/#54/#55 (bringing `main` to `c9d11cb`, with + [CI 32806576723](https://github.com/daichunghy/patchgate/actions/runs/32806576723) + and CodeQL + [32806576725](https://github.com/daichunghy/patchgate/actions/runs/32806576725) + completed successfully on that commit), contribkit #29/#31/#32, + OpenSheet-AI #10/#12/#13/#15/#16, quant-research #13/#14/#15/#17/#18, and + agentsmd #10. Every merge remains a maintainer decision rather than + independent-review evidence. +- Open feature work as of this snapshot: PatchGate + [PR #59](https://github.com/daichunghy/patchgate/pull/59) binds the Action + snapshot and check-run delivery to the exact `pull_request.head.sha` with + fail-closed live-target mismatch handling — every required context was + green on 2026-08-28 and the pull request waited only on the one approving + review branch protection requires. contribkit + [PR #33](https://github.com/daichunghy/contribkit/pull/33) adds runtime + adapters and package-first onboarding; its `verify` context was failing at + audit time while clean-room reproducibility fixes were being pushed to the + branch, and [PR #30](https://github.com/daichunghy/contribkit/pull/30) + (Ruby RSpec and PHP PHPUnit adapters) is open. OpenSheet-AI + [PR #17](https://github.com/daichunghy/opensheet-ai/pull/17) ships packaged + examples and a five-minute preview (mergeable, checks green) and + [#14](https://github.com/daichunghy/opensheet-ai/pull/14) documents the + xlsx adapter error boundary. quant-research + [PR #19](https://github.com/daichunghy/quant-research/pull/19) ships a + reproducible service-quality workflow (mergeable, checks green) and + [#16](https://github.com/daichunghy/quant-research/pull/16) adds a workflow + readiness instrument family. +- Dependabot backlog awaiting triage: PatchGate #57/#58 (CodeQL 4.37.8) and + the long-open #12 (`typescript` 7, still blocked by `@vercel/ncc`); + contribkit #1/#2/#3/#8/#9/#11/#12; OpenSheet-AI #1–#5; quant-research + #1–#5; agentsmd #1–#5. +- agentsmd has been quiet since the 2026-08-25 merge apart from Dependabot. + It joins the register because it is an actively released public repository + in the same workspace, and it recorded the portfolio's first outside-human + event: the fork listed above. + +## What this means + +Download counts for the recorded week (contribkit 578, quant-research 254, +OpenSheet-AI 128, windows 2026-08-20 to 2026-08-26) are higher than the +cumulative figures in the 2026-08-24 register, but a download still cannot +tell us whether a person used a package, whether it solved their problem, or +whether the event came from CI, a mirror, or an automated scan. The only +outside-human event in the portfolio remains the agentsmd fork, with no +follow-up contact. + +The per-repository adoption blockers are unchanged: PatchGate is a private, +unpublished package that must be cloned and built before the first CLI +command; the other four publish pre-release packages but have not yet met one +consented external walkthrough, downstream install, outside issue, or outside +merged pull request. More release scaffolding will not answer the usefulness +question; a consented external walkthrough will. + +## Shared working method + +1. Work in the repository that owns the change. Do not vendor or nest one + repository inside another. +2. Before making an adoption or popularity claim, check GitHub and the + relevant package registry, record the date, and separate maintenance from + independent usage. +3. Treat a real external walkthrough, downstream install, outside issue, + merged outside pull request, or consented pilot with feedback as usage + evidence. Treat self-authored activity and bot activity as maintenance + evidence only. Treat a fork, star, or download as a lead to investigate, + never as usage. +4. Start each public description with the user's job, state the hard + boundary, and label the release stage. Do not lead with an AI-shaped + promise or a claim the evidence cannot support. +5. Prefer one completed user interaction over another internal release, + issue, or scheduled post. Record negative results too. + +## Next evidence to pursue + +- PatchGate: one consented non-blocking shadow install by a maintainer + outside `daichunghy/*`, followed by feedback on setup, noise, and + usefulness. +- contribkit: one consumer repository or outside maintainer walkthrough that + exercises the preflight boundary; merge PR #33 only after its `verify` + context is green. +- OpenSheet-AI: one researcher or operator completing the documented local + quickstart and reporting whether the typed plan and receipt match a real + spreadsheet task. +- quant-research: one researcher using an instrument, recode, or emitter in a + real study workflow and reporting what was missing or unnecessary. +- agentsmd: triage the five open Dependabot pull requests, then seek one + outside walkthrough of the lint/score loop; investigate whether the + forking account can be invited to describe what they tried. + +Until those checks exist, the accurate description is: five actively +maintained public pre-release projects with no verified external adoption.