Skip to content

[finding] docs/qa/platform-checklist pins source LINE NUMBERS that no gate resolves — cli.json's manifest.zod.ts citations rotted silently when #13479 shifted the file #13482

Description

@claude

Observation-class finding, filed unassigned while executing #11330 (text correction in packages/spec/src/kernel/manifest.zod.ts). Not fixed there — out of that card's scope, and the useful fix is systemic rather than two numbers.

What was measured

docs/qa/platform-checklist/areas/cli.json pins source line numbers into manifest.zod.ts:

line 1508: "packages/spec/src/kernel/manifest.zod.ts — ManifestSchema id :140 and version :202
            (both required, version regex-pinned); PluginPackagingSchema :95-97
            ('bundled' | 'manifest-deps', ADR-0025 §3.3); PluginRuntimeSchema :85-86
            (the trust tier, ADR-0025 §3.6)"

Those citations were accurate at 3e31c2691PluginRuntimeSchema began at line 83, PluginPackagingSchema at 94, ManifestSchema at 131. PR #13479 expands two TSDoc blocks and two .describe() strings in that file, which shifts every symbol below them by roughly 20 lines: PluginRuntimeSchema is now at 103, PluginPackagingSchema at 119, ManifestSchema at 156. The citations now point at unrelated lines.

Why it is a finding and not a chore

Nothing validates them. scripts/check-platform-checklist.mjs parses ids, tables and the trap vocabulary; it never resolves a source citation, let alone a line. So this rot is silent and exit-0 by construction — the same shape already recorded for the liveness ledger in #11210 (file validated, line never), #12516 (rot in range) and #11457 (rot within a file), and worklisted in #13003 (migrate to symbol anchors). Those are all scoped to packages/spec/liveness/; the QA platform checklist is a separate file family with the same defect and none of the same gate coverage.

The consequence is worse here than a wrong number: a checklist item's evidence pointer is what a later runner uses to decide whether the item still describes reality. A pointer into the wrong lines reads as "verified against source" while pointing at something else.

Suggested direction (not prejudged)

Same remedy #13003 chose for the sibling ledger: cite symbol anchors rather than line numbers, and give the checklist gate a resolver that fails when a cited symbol is absent from the cited file. A cheaper interim is to drop the :NNN suffixes, which are the only part that rots — the file plus symbol name is already the load-bearing half.

Also noted, no action wanted

cli.json:1497 says "#11330 is open". That is true today and becomes stale when #13479 merges; it is a normal part of closing that card, not a defect. The technical claim beside it — that nothing in this repo dispatches on the trust tier, so a run reading the printed runtime: line as isolation has scored a log line and not a capability — stays true after #13479, which corrects the text without adding load-side enforcement.


Generated by Claude Code

Metadata

Metadata

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions