diff --git a/docs/consumers/guide.md b/docs/consumers/guide.md index d5c6bae..8187a57 100644 --- a/docs/consumers/guide.md +++ b/docs/consumers/guide.md @@ -25,8 +25,10 @@ ckconfig or ckprompt v0.2.0 release together. Published ckconfig v0.4.0 uses core v0.4.0 and ConfigKit v1.1.0. The ckprompt v0.3.0 candidate targets those releases and PromptKit v0.20.0. A Go 1.27.0 -workspace may compose the three local modules; independent tests also use the -declared released dependencies. +workspace may compose the three local modules. Current ckprompt source uses a +diagnostic helper introduced in local ckconfig source that is absent from +released ckconfig v0.4.0; independent ckprompt builds require release and +dependency alignment described in [future work](../roadmap/future.md#pending-release-and-integration-work). The two integrations are independent optional imports. `ckprompt` uses the public scope and error contracts from `ckconfig`; importing it does not add the diff --git a/docs/development.md b/docs/development.md index 1e486de..d1c7ecc 100644 --- a/docs/development.md +++ b/docs/development.md @@ -109,6 +109,9 @@ The root module does not traverse nested modules. Preserve the ignored `go.work` and `go.work.sum`; use `GOWORK=off GOTOOLCHAIN=local` for dependency preparation and independent module suites. The integrations select released core v0.4.0; ckprompt also selects released ckconfig v0.4.0. +Current ckprompt source requires a ckconfig helper absent from that release, so +its independent suite remains pending release and dependency alignment; the +aligned workspace exercises the current source together. Run `GOWORK=off GOTOOLCHAIN=local go test ./...` separately from each module directory. From the repository root, a workspace containing all three modules can also run: diff --git a/docs/roadmap/audit-remediation.md b/docs/roadmap/audit-remediation.md index 13f46d1..80dafeb 100644 --- a/docs/roadmap/audit-remediation.md +++ b/docs/roadmap/audit-remediation.md @@ -1,15 +1,15 @@ # Audit remediation roadmap -Status: target and decisions finalized; the [implementation plan](implementation.md) -defines the sprint. No remediation is implemented by these documents. +Status: source remediation complete; the [implementation plan](implementation.md) +records the sprint and verification. Release and dependency alignment remain +separate work in [future work](future.md#pending-release-and-integration-work). Baseline: `d131999c7c474010a4814bb81601cd32920e6c83`. The -[catalog](audit/catalog.md) contains 27 distinct open findings, five P2 and 22 P3, +[catalog](audit/catalog.md) records 27 distinct findings, five P2 and 22 P3, from seven audits. Its accepted decisions and the [remediation analysis](audit/remediation-analysis.md) supply the scope and -rationale for this roadmap. The implementation is unchanged since the audited -state `db732e3a1de55c844f77870e1c6db683c2685d5d`; subsequent commits recorded -the review and decisions. +rationale for this roadmap. The audited state was +`db732e3a1de55c844f77870e1c6db683c2685d5d`. This roadmap owns the target, scope, and completion criteria. The implementation plan owns ordered stages, dependencies, concrete changes, and verification steps. @@ -251,22 +251,22 @@ removes migration work, not the need for coherent module requirements. ## Completion criteria -- [ ] Every finding F01–F27 has its selected remediation implemented and recorded +- [x] Every finding F01–F27 has its selected remediation implemented and recorded with relevant evidence; related findings remain individually accountable. -- [ ] The five P2 defects have focused behavioral protection, including error +- [x] The five P2 defects have focused behavioral protection, including error identity, retained evidence, and the deferred acceptance boundary. -- [ ] F06 and F08's maintained consumers work, with actual completion checks +- [x] F06 and F08's maintained consumers work, with actual completion checks distinguished from unavailable or skipped shell checks. -- [ ] F11 and F21's selected API changes and F09/F10's clarified contracts are +- [x] F11 and F21's selected API changes and F09/F10's clarified contracts are reflected in canonical GoDoc and affected integration guidance. -- [ ] Obsolete production wrappers/plumbing and duplicate adaptation/bookkeeping +- [x] Obsolete production wrappers/plumbing and duplicate adaptation/bookkeeping are removed at the agreed boundaries, with useful tests retained. -- [ ] F13–F15 and F22 remove the identified repeated work while preserving +- [x] F13–F15 and F22 remove the identified repeated work while preserving behavior, without a new performance guarantee or measurement prerequisite. -- [ ] F17–F20 improve responsibility separation within their bounded scope; +- [x] F17–F20 improve responsibility separation within their bounded scope; public behavior and necessary ordering remain protected. -- [ ] Documentation corrections F25–F27 are complete and local links resolve. -- [ ] Relevant module and aligned-workspace results are recorded. Independent +- [x] Documentation corrections F25–F27 are complete and local links resolve. +- [x] Relevant module and aligned-workspace results are recorded. Independent results identify the exact dependency selection; any release-alignment work still pending is explicitly distinguished from completed source work. diff --git a/docs/roadmap/future.md b/docs/roadmap/future.md index 148e7a6..73dae7c 100644 --- a/docs/roadmap/future.md +++ b/docs/roadmap/future.md @@ -5,7 +5,7 @@ No delivery dates are selected here. ## Purpose and authority -Completed roadmaps, implementation plans, and review findings have been retired. +Earlier completed roadmaps, implementation plans, and review findings have been retired. This document preserves unfinished work and unselected ideas under the [release policy](../policy/release.md#release-documentation-and-preparation). The completed PromptKit v0.18.0 adoption roadmap and implementation plan remain @@ -26,11 +26,20 @@ an idea here does not select its syntax, API, priority, or delivery date. ## Pending release and integration work +### Audit remediation release alignment + +The audit remediation is complete in source. The released ckconfig v0.4.0 does +not include `AdaptDiagnostics`, which current ckprompt source uses. Select and +publish appropriate releases in dependency order, align module requirements and +checksums, and rerun independent module suites under the +[release procedure](../release.md). No publication is implied by source completion. + ### ckprompt release The PromptKit v0.20.0 adoption is complete. The [ckprompt v0.3.0 candidate](../../integrations/ckprompt/docs/releases/v0.3.0.md) -remains unpublished. Publication and hosted delivery remain separate operations +remains unpublished and needs revalidation against the current source and aligned +dependencies. Publication and hosted delivery remain separate operations under the [release procedure](../release.md). The published ckprompt v0.2.0 retains its earlier dependencies; see the [consumer guide](../consumers/guide.md#module-selection) for module selection. diff --git a/docs/roadmap/implementation.md b/docs/roadmap/implementation.md index 049b3fa..caa29c2 100644 --- a/docs/roadmap/implementation.md +++ b/docs/roadmap/implementation.md @@ -1,6 +1,7 @@ # Audit remediation implementation plan -Status: in progress; Stages 1–22 complete. +Status: source sprint complete; Stages 1–23 complete. Release and dependency +alignment remain separate work. Baseline: `d492c7747175c01a53261206c2b4356e53453621`. Before this sprint, intervening changes recorded decisions and retired the completed older @@ -713,6 +714,27 @@ Complete when present guidance and useful historical navigation have clear owner ## Stage 23 — Verify the assembled sprint and record completion +**Complete.** The full aligned workspace suite passed with Go 1.27.0 using +`GOTOOLCHAIN=local GOPROXY=off go test -mod=readonly ./... ./integrations/ckconfig/... ./integrations/ckprompt/...`. +Focused reporter tests passed with `-race -count=1`. Independent `GOWORK=off` +root and ckconfig suites passed; root selects Cobra v1.10.1, pflag v1.0.9 and +YAML v4.0.0-rc.6, and ckconfig selects core v0.4.0 and ConfigKit v1.1.0. +Independent ckprompt selects ckconfig v0.4.0, core v0.4.0, ConfigKit v1.1.0 +and PromptKit v0.20.0; its suite fails to compile because released ckconfig lacks +`AdaptDiagnostics`. This is pending release alignment, not a passed independent +check. No manifests, checksums, workspace files, or Go requirements were changed. + +Core's default reporting example, ckconfig ordinary show and two-sided diff, +composed all-scope show, prepared preview and local fixture-backed aggregate smoke +completed. Bash interactive backend and consumer checks passed; full opt-in runs +reported missing Zsh and Fish executables, so those interactive checks are +unavailable. The five P2 regressions reproduced their original defects before the +fixes. All 27 catalog findings have completion evidence, including both F02 +boundaries, F14/F15 traversal costs, F21 callers and F24 wrappers. Go formatting, +changed Markdown local links and fragments, the tagged historical fragment, and +tracked and staged Markdown whitespace checks passed. Source completion does not +publish any module; pending release alignment is recorded in future work. + Findings: all F01–F27; no new feature work. 1. Review the full diff against this baseline and all roadmap completion criteria.