FL4WRITE retroactive gauntlet: full-tree review of published HEAD - #209
Closed
simongonzalezdc wants to merge 346 commits into
Closed
FL4WRITE retroactive gauntlet: full-tree review of published HEAD#209simongonzalezdc wants to merge 346 commits into
simongonzalezdc wants to merge 346 commits into
Conversation
Expand adversarial dialect certification coverage
Sentence-level certification can miss document-level regressions in markdown, API docs, and locale JSON flows. This adds dialect:certify:documents with long README/API/locale fixtures and assertions for placeholders, URLs, code fences, dialect traits, taboo terms, and document outputs. Constraint: Reuse existing CLI surfaces where possible and keep the harness dependency-free Rejected: Rely on sentence fixtures for launch readiness | product usage includes full docs and locale files Confidence: medium Scope-risk: moderate Directive: Expand document-adversarial fixtures before claiming document-level launch readiness Tested: pnpm build; pnpm -r exec tsc --noEmit; pnpm test (692 passing); pnpm audit --audit-level low; npm pack dry-run guard; mock document certification 7/7
Add long document certification harness
Live document certification can fail before writing output files because CLI path guards, provider errors, or partial section failures stop a document command. The harness now records missing outputs and command stderr as certification failures instead of crashing, and its assertions accept documented valid Spain/voseo variants seen in live output. Constraint: Keep this as a harness fix; do not weaken document certification’s placeholder, URL, taboo, or dialect trait checks Rejected: Ignore live document cert failure as environment-only | missing output handling is part of reliable certification Confidence: high Scope-risk: narrow Tested: pnpm build; pnpm -r exec tsc --noEmit; document-certify-script.test.ts; pnpm audit --audit-level low; live glm-4.5-air document certification 7/7 with ALLOWED_LOCALE_DIRS configured
Live document certification can fail before output files are written due path policy, provider, or partial translation errors. The harness now reports missing output files and command stderr in results.json rather than crashing, and accepts valid documented Spain/Argentina variants observed in live output. Constraint: Keep placeholder, URL, taboo, and dialect-trait assertions active Rejected: Treat missing outputs as harness crashes | they are certification failures and should be recorded Confidence: high Scope-risk: narrow Tested: pnpm build; pnpm -r exec tsc --noEmit; pnpm test (693 passing); pnpm audit --audit-level low; npm pack dry-run guard; live glm-4.5-air document certification 7/7 with ALLOWED_LOCALE_DIRS configured
…put-fix Record document certification command failures
Live document certification can fail before output files are written due path policy, provider, or partial translation errors. The harness now reports missing output files and command stderr in results.json rather than crashing, and accepts valid documented Spain/Argentina variants observed in live output. Constraint: Keep placeholder, URL, taboo, and dialect-trait assertions active Rejected: Treat missing outputs as harness crashes | they are certification failures and should be recorded Confidence: high Scope-risk: narrow Tested: pnpm build; pnpm -r exec tsc --noEmit; pnpm test (693 passing); pnpm audit --audit-level low; npm pack dry-run guard; live glm-4.5-air document certification 7/7 with ALLOWED_LOCALE_DIRS configured
…put-fix Stabilize document certification failure test
The project now has passing unit, package, basic certification, expanded adversarial certification, local-model, cloud-model, and long-document certification evidence. This records the RC1 launch decision, model policy, known limitations, and machine-readable certification matrix. Constraint: Do not include secrets; reference artifact paths and command shapes only Confidence: high Scope-risk: narrow Directive: Update this RC report or add a new one before tagging future release candidates Tested: pnpm build; pnpm -r exec tsc --noEmit; pnpm test (693 passing); pnpm audit --audit-level low; npm pack guard; certification artifacts listed in audits/release-candidate-2026-04-22/model-matrix.json
Record v0.1.0 release candidate evidence
Certification artifacts are useful internally, but monetization needs a customer-facing deliverable. This adds dialect:report to convert certification JSON into an executive Markdown report with launch grade, matrix, failure details, limits, and commercial packaging guidance. Constraint: Keep report generation dependency-free and avoid embedding secrets Confidence: high Scope-risk: narrow Directive: Use dialect:report as the paid launch-audit deliverable surface Tested: pnpm build; pnpm -r exec tsc --noEmit; pnpm test (695 passing); pnpm audit --audit-level low; npm pack guard; generated /tmp/dialectos-customer-report-final.md from RC model matrix
Add customer certification report generator
Customers need a standards-aligned localization certification deliverable, not just raw pass/fail JSON. This adds MQM-style issue categories/severities, dialect validation metadata, certification levels, and report sections for issue distribution plus validation status. Constraint: Keep report generation dependency-free and avoid formal compliance claims beyond MQM-aligned wording Rejected: Claim ISO/MQM certification | the current scope is an MQM-aligned automated report, not accredited human LQA Confidence: high Scope-risk: moderate Directive: Use certification.ts as the canonical place for certification levels and validation status Tested: pnpm build; pnpm -r exec tsc --noEmit; pnpm test (700 passing); pnpm audit --audit-level low; npm pack guard; dialect-report generated MQM-aligned report
Align certification reports with MQM
DialectOS now has the certification/reporting machinery for paid audits, but buyers need a clear offer and sample deliverable. This adds the Spanish Launch Certification page, beta package details, and a public sample customer report. Constraint: Position as MQM-aligned automated QA, not legal or accredited certification Confidence: high Scope-risk: narrow Tested: pnpm build; dialect-report-script.test.ts; generated audits/sample-customer-report.md
Publish Spanish launch audit offer
The GitHub Pages demo is a deterministic browser-side rule explorer, not the LLM-backed certification engine. Its previous wording promised translation and claimed no-change text was compatible, which made short inputs look like product failures instead of rule-table misses. Constraint: GitHub Pages demo must remain static/offline. Rejected: Wire cloud LLM calls directly from browser | would expose provider keys and bypass certification controls Confidence: high Scope-risk: narrow Directive: Do not call this page a translator unless it is backed by certified LLM/provider execution. Tested: node --test docs/__tests__/*.test.mjs; pnpm build; pnpm test; pnpm audit --audit-level low; npm pack dry-run guard
Stop presenting static demo as full translation
The public demo needs to prove the actual product path rather than a browser-side rule table. This adds a local demo backend, a reusable web-demo translation service, browser calls to /api/translate, and a Docker Compose path with an Ollama sidecar for local-model testing. Constraint: Browser JavaScript must not receive provider keys or call paid/local model endpoints directly. Rejected: Keep a static substitution fallback | it hides provider failures and repeats the original launch-testing problem Rejected: Bake model weights into the app image | large, slow, and harder to update than a model sidecar plus persistent volume Confidence: high Scope-risk: moderate Directive: Do not reintroduce static translation fallback in docs/index.html; provider errors must stay visible. Tested: pnpm build; pnpm test; pnpm audit --audit-level low; node demo-server smoke for /api/status and /api/translate 503; docker compose --profile setup config; docker compose build demo; npm pack dry-run guard
Make the browser demo exercise the real app
Dialect quality was still too thin around coger/tomar/agarrar-style ambiguity. This adds explicit lexical ambiguity rules, inserts them into semantic prompts, and makes certification fixtures assert multi-trait output groups so outputs must preserve both the object and the correct action sense. Constraint: Provider quality must be tested through executable fixtures, not prose-only dialect notes. Rejected: Keep requiredOutputAny only | it allowed one token to satisfy a multi-part semantic requirement Confidence: high Scope-risk: moderate Directive: Add new ambiguous verbs as lexical ambiguity rules plus required output groups; do not bury them only in free-text notes. Tested: pnpm build; pnpm test; pnpm audit --audit-level low; focused lexical/dialect fixture tests; live qwen3.5-9b and qwen3.6-35b es-MX adversarial eval; npm pack dry-run guard
Deepen lexical ambiguity handling
The coger/tomar/agarrar issue was a category failure, not a single Mexican term bug. This extends lexical ambiguity handling into reusable rule expectations that attach to any matching fixture across dialects, including Puerto Rican recoger el cuarto as a room-tidying sense. Constraint: Ambiguity fixes must be executable across eval/certification scripts, not one-off prompt prose. Rejected: Add only a Puerto Rico fixture | would repeat the one-off remediation pattern Rejected: Treat recoger as a universal safe replacement | Puerto Rican room cleanup shows object/sense/dialect matters Confidence: high Scope-risk: moderate Directive: For new overloaded verbs, add guidance plus expectations in lexical-ambiguity.ts so every matching eval/certification sample gets gated. Tested: pnpm build; pnpm test; pnpm audit --audit-level low; deterministic default/adversarial dialect eval; qwen3.5-9b live es-PR adversarial eval; npm pack dry-run guard
Generalize semantic ambiguity gates
The previous full-app demo path still had two high-risk launch surfaces: it returned the internal semantic prompt/context to the browser and it could fall through to generic non-semantic providers if those were the only configured providers. This keeps the public API result clean and requires semantic providers for the demo. Constraint: Public browser APIs must not expose internal prompt contracts or silently downgrade from semantic LLM behavior. Rejected: Allow LibreTranslate/MyMemory in the demo path | repeats the fake-working product-surface problem when users expect semantic dialect behavior Confidence: high Scope-risk: narrow Directive: The browser demo is a semantic-provider proof surface; do not reintroduce generic provider fallback or prompt/context leakage. Tested: pnpm build; pnpm test; pnpm audit --audit-level low; focused web-demo and demo-server tests; npm pack dry-run guard
Keep full-app demo on semantic providers
Recent failures point to three recurring risks: low-confidence surfaces pretending certainty, generated browser assets drifting from source, and soft warnings or swallowed errors passing silently. This makes low-confidence dialect detection explicit, adds generated-demo drift checking, adds launch-style fail-on-warnings, and rate-limits/validates the demo API. Constraint: Public product surfaces must show uncertainty and provider errors instead of guessing or silently degrading. Rejected: Keep es-ES as default detection for neutral text | it overclaims and misleads users testing short inputs Rejected: Rely on line-number generated docs extraction | source edits can silently stale the browser demo Confidence: high Scope-risk: moderate Directive: Any generated demo source change must pass node scripts/build-demo.cjs --check; do not remove unknown/low-confidence detection without replacing it with stronger evidence. Tested: pnpm build; pnpm test; pnpm audit --audit-level low; dialect eval default/adversarial; npm pack dry-run guard; git diff --check
Harden detection generated docs and launch gates
Provider outputs can still pass loose fixture gates while leaking prompts, returning explanations, dropping placeholders, or leaving English unchanged. This adds a deterministic output judge for provider protocol, prompt leakage, placeholder preservation, unchanged English, forbidden terms, and semantic trait groups. Constraint: Judge checks must run on live/provider output without requiring another model. Rejected: Use only semantic similarity | word overlap is too weak for prompt leakage and placeholder loss Confidence: high Scope-risk: moderate Directive: Add new provider-output failure classes to output-judge.ts, not ad hoc script checks. Tested: pnpm build; pnpm test; pnpm audit --audit-level low; deterministic default/adversarial eval; live qwen3.5-9b es-PR eval; npm pack dry-run guard
Add model agnostic output judge
Wave 2/2b compressed this public face. Restore the larger pre-compress README on Forgejo (source of truth); GitHub mirrors this host. Source blob: 7d1065b (~21196 bytes; was ~801). README-only; no product code changes.
Forgejo-first dual-host face: entity, TL;DR, FAQ, audience, status.
…s/splus-seo-geo-40946 into main
Phase 1 of MCP 2026-07-28 stateless migration. Rewrote tool descriptions with what/returns/when-to-use pattern.
…nomics' (#22) from chore/mcp-stateless-uplift into main
pnpm-workspace.yaml pins qs@>=6.11.1 <=6.15.1 to 6.15.3, but the lockfile recorded 6.15.2, so every fresh 'pnpm install --frozen-lockfile' failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Regenerated with pnpm@11.12.0 (the packageManager pin); the fresh resolution also picked up in-range updates (vitest 4.1.8->4.1.10, side-channel 1.1.0->1.1.1). Full suite green after regeneration: 1,498 passed, 1 skipped.
All active-path workflows (ci.yml x2 jobs, pages.yml, validate-pr.yml, release.yml) ran on the paid blacksmith-2vcpu-ubuntu-2404 label. Moved them to ubuntu-latest so CI runs on free GitHub-hosted runners. agent-law.yml already defaults to ubuntu-latest (vars.RUNNER_LABEL override), no change needed. blacksmith-probe.yml is left as-is with an explanatory note: its entire purpose is probing the paid Blacksmith runner, so it cannot run on ubuntu-latest; it stays disabled_manually. Workflows will be re-enabled via 'gh workflow enable' in a follow-up step.
The boilerplate appendix still read 'Copyright [yyyy] [name of copyright owner]'. Set to 'Copyright 2026 Kyanite Labs' per the owner's standing branding.
CITATION.cff claimed BSL-1.1 and date-released 2026-04-27; the project is Apache-2.0 (LICENSE, package.json) and v0.3.0 was actually published 2026-06-03 (git tag 2026-06-02T19:41-07:00, GitHub release published 2026-06-03T03:16Z). Corrected both fields.
git rm three internal-only files that should never ship with the public repo: docs/handoff-2026-04-30.md (internal handoff notes), GITHUB_GUARDIAN_AUDIT.md (internal audit), docs/SEO-AI-SEO-MASTERPLAN.md (internal marketing plan). They remain in git history; the working tree is what publishes. docs/__tests__/public-claims.test.mjs already tolerates missing collateral files (try/catch skip), so the suite is unaffected.
…placeholder The test hardcoding a real Tailscale endpoint (100.66.225.85) shipped the private address it was written to prevent. Swapped for documentation placeholder 100.64.0.1 in RFC 6598 shared address space (100.64.0.0/10, the range Tailscale assigns from) — the detection logic is unchanged and still flags any tracked file naming a 100.64/10 endpoint. Suite passes.
Numbers had drifted far behind the tree: '662+ tests' -> 1,498 (measured on main, matches CI), per-package test counts (types 54->207, providers 152->304, markdown-parser 74->79, mcp 93->95, locale-utils 55->58, verified from a full suite run), benchmark corpus 205 -> 250 samples (counted from packages/benchmarks/dialect-detection-corpus/samples.json), pnpm badge 9.15.0 -> 11.12.0 (matches packageManager), and the stale 'Planned — version pinning unavailable until first release' caveat replaced with the real @v0.3.0 pin (v0.3.0 shipped 2026-06-03, same form as docs/github-action.md).
'dialectos translate' fails with zero env because the provider registry registers nothing without configuration — the Quick Start never said so. Added a short provider table (verified against packages/providers/src/factory.ts): MyMemory ENABLE_MYMEMORY=1 (keyless, easiest), local OpenAI-compatible LLM via LLM_API_URL+LLM_MODEL+LLM_ALLOW_LOCAL=1, LM Studio via LM_STUDIO_URL+LLM_MODEL+LLM_API_FORMAT=lmstudio, DeepL DEEPL_AUTH_KEY, LibreTranslate LIBRETRANSLATE_URL. Documentation-only; no behavior change.
Both were hardcoded shields.io badges claiming 'passing'/'hardened' while CI was disabled — unearnable status. The live CI workflow badge already reports test status, so the Tests badge is redundant and removed. The Security badge has no badgeable workflow: CodeQL runs via GitHub default setup (dynamic/github-code-scanning/codeql), which exposes no repo workflow file, so actions/workflows/codeql.yml/badge.svg returns 404. Removed it rather than pointing at a dead badge.
…x TL;DR The s-plus-geo block misdescribed DialectOS as 'a operating system for multi-dialect / multi-agent product work' and stuffed keyword lists, a fake FAQ, and a duplicated 'What is DialectOS?' section into the README tail. Replaced the whole block (markers included, so it will not be regenerated) with one short factual paragraph: what the tool is, who it serves, key capabilities. The TL;DR line carried the same false description and keyword list — rewritten factually as well.
Removed the duplicated empty '#### Dialectal Dictionary Overhaul' heading (two adjacent copies under [Unreleased]). Also corrected the [0.3.0] date: the changelog said 2026-04-27 but v0.3.0 was tagged 2026-06-02 19:41-07:00 and the GitHub release published 2026-06-03T03:16Z — recorded as 2026-06-03 to match CITATION.cff. ([0.2.0]'s 2026-04-27 is correct: tagged 2026-04-26 17:13-07:00 = 2026-04-27 UTC.)
The Andean Spanish region basis string read '...vowel distinctions,高地
s-aspiration (variable)' — two stray hanzi ('gaodi') left over from an
accidental IME insertion. Removed them; the description now reads
'...vowel distinctions, s-aspiration (variable)'. Types suite passes (207).
The GitHub repo formerly named mcp-video is now kinocut; the old URL only works via redirect. Updated the label and pointed at the canonical KyaniteLabs/kinocut URL.
CI only ran on push/pull_request, so it cannot be started manually (gh workflow run) — needed for verification while the workflow was disabled and for ad-hoc runs in general. Pushes already cover automation; this only adds a manual trigger.
CI shakedown finding (run 33599975292): pnpm/action-setup's self-switch to
pnpm@11.12.0 crashes with 'Cannot use in operator to search for integrity
in undefined' during pnpm's own self-install (installPnpmToGlobalDir ->
createFullPkgId), killing every job before checkout completes. The npm
registry deprecates 11.12.0 outright: 'This release is broken. Please
upgrade to v11.13.1 or newer.' Moved the packageManager pin to pnpm@11.25.0
(latest 11.x, stays on the major the project chose) and synced the README
pnpm badge to match. Lockfile verified unchanged by 11.25.0 ('Already up to
date'); frozen install re-proven on a fresh clone.
The grep-clean verification standard (no trace of the removed internal-only files anywhere in the tree) flagged two leftover pointers to docs/SEO-AI-SEO-MASTERPLAN.md: the launch-remediation plan listed it as collateral to modify/include/commit, and public-claims.test.mjs still listed it in collateralFiles (dead entry now that the file is gone). Removed the references; plan history otherwise preserved. public-claims.test.mjs passes 7/7.
…l stale numbers The documented 'uses: KyaniteLabs/DialectOS/action@v0.3.0' cannot work: the 3-segment form requires an action/ subdirectory at the tag, but action.yml lives at the repo root. Root-action form is 'KyaniteLabs/DialectOS@v0.3.0'. README + docs + the public-claims test now assert the working form. Same sweep: 205→250 adversarial samples in ROADMAP/.llm (corpus holds 250), pnpm 9.15.0→11.25.0 in CONTRIBUTING + Dockerfile.demo (matches packageManager; 9.x and 11.12.0 are broken/deprecated).
simongonzalezdc
force-pushed
the
gauntlet/full-review
branch
from
September 2, 2026 06:52
11f511b to
eba5a99
Compare
simongonzalezdc
force-pushed
the
gauntlet/target
branch
from
September 2, 2026 06:52
1123f5f to
c37f7a9
Compare
Contributor
🔍 FL4WRITE review
The diff's own tests FAIL (verified: cmd='python3 -m pytest tests/ -x -q --tb=line'; files=['packages/cli/src/tests/adversarial-dialect-fixtures.test.ts', 'packages/cli/src/tests/adversarial-fixtures.test.ts', 'packages/cli/src/tests/checkpoint.test.ts', 'packages/cli/src/tests/corpus.test.ts', 'packages/cli/src/tests/dialect-eval-script.test.ts', 'packages/cli/src/tests/dialect-eval.test.ts', 'packages/cli/src/tests/dialect-report-script.test.ts', 'packages/cli/src/tests/dialects.test.ts', 'packages/cli/src/tests/document-certify-script.test.ts', 'packages/cli/src/tests/e2e-verify-fixes.test.ts', 'packages/cli/src/tests/eval-harness.test.ts', 'packages/cli/src/tests/glossary-diff.test.ts', 'packages/cli/src/tests/glossary-suggest.test.ts', 'packages/cli/src/tests/glossary.test.ts', 'packages/cli/src/tests/grammar-detection-torture.test.ts', 'packages/cli/src/tests/grammar-detection.test.ts', 'packages/cli/src/tests/i18n/apply-gender-neutral.test.ts', 'packages/cli/src/tests/i18n/batch-translate.test.ts', 'packages/cli/src/tests/i18n/check-formality.test.ts', 'packages/cli/src/tests/i18n/detect-missing.test.ts', 'packages/cli/src/tests/i18n/manage-variants.test.ts', 'packages/cli/src/tests/i18n/translate-keys.test.ts', 'packages/cli/src/tests/lexical-ambiguity.test.ts', 'packages/cli/src/tests/output-judge.test.ts', 'packages/cli/src/tests/provider-factory.test.ts', 'packages/cli/src/tests/regional-research.test.ts', 'packages/cli/src/tests/resilient-translation.test.ts', 'packages/cli/src/tests/semantic-backstop-torture.test.ts', 'packages/cli/src/tests/semantic-backstop.test.ts', 'packages/cli/src/tests/semantic-context.test.ts', 'packages/cli/src/tests/semantic-similarity.test.ts', 'packages/cli/src/tests/telemetry.test.ts', 'packages/cli/src/tests/token-protection.test.ts', 'packages/cli/src/tests/translate-api-docs.test.ts', 'packages/cli/src/tests/translate-readme.test.ts', 'packages/cli/src/tests/translate.test.ts', 'packages/cli/src/tests/translation-policy.test.ts', 'packages/cli/src/tests/validate.test.ts', 'packages/cli/src/tests/web-demo-service.test.ts', 'packages/locale-utils/src/tests/locale-utils.test.ts', 'packages/markdown-parser/src/tests/parser.test.ts', 'packages/mcp/src/tests/config.test.ts', 'packages/mcp/src/tests/docs.test.ts', 'packages/mcp/src/tests/error-handler.test.ts', 'packages/mcp/src/tests/i18n.test.ts', 'packages/mcp/src/tests/index.test.ts', 'packages/mcp/src/tests/security.test.ts', 'packages/mcp/src/tests/translator.test.ts', 'packages/providers/src/tests/agreement-validator.test.ts', 'packages/providers/src/tests/cached-provider.test.ts', 'packages/providers/src/tests/capitalization.test.ts', 'packages/providers/src/tests/circuit-breaker.test.ts', 'packages/providers/src/tests/dialect-output-pipeline.test.ts', 'packages/providers/src/tests/false-friends.test.ts', 'packages/providers/src/tests/lexical-substitution.test.ts', 'packages/providers/src/tests/postprocessing.test.ts', 'packages/providers/src/tests/providers.test.ts', 'packages/providers/src/tests/quality-gates.test.ts', 'packages/providers/src/tests/sentinel-extraction.test.ts', 'packages/providers/src/tests/translation-corpus.test.ts', 'packages/providers/src/tests/translation-memory-bounds.test.ts', 'packages/providers/src/tests/translation-memory-torture.test.ts', 'packages/providers/src/tests/typography.test.ts', 'packages/providers/src/tests/voseo-adapter.test.ts', 'packages/providers/src/bulk/tests/engine.test.ts', 'packages/providers/src/bulk/tests/semaphore.test.ts', 'packages/providers/src/providers/tests/llm-prompts.test.ts', 'packages/providers/src/providers/tests/llm-response.test.ts', 'packages/security/src/tests/security.test.ts', 'packages/types/src/tests/certification.test.ts', 'packages/types/src/tests/dialect-profiles.test.ts', 'packages/types/src/tests/dialect-quality.test.ts', 'packages/types/src/tests/dialect-regions.test.ts', 'packages/types/src/tests/dialectal-dictionary.test.ts', 'packages/types/src/tests/dialectal-vocabulary.test.ts', 'packages/types/src/tests/glossary-data.test.ts', 'packages/types/src/tests/noun-gender.test.ts', 'packages/types/src/tests/types.test.ts', 'packages/types/src/tests/verb-conjugations.test.ts']; head=c37f7a932e): no tests ran in 0.00s | | ERROR: file or directory not found: tests/ 🚨 Do NOT merge until this is addressed. Reviewed by FL4WRITE · tone: assertive · org law |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CEO order 2026-09-01: every published repo passes the hardcore FL4WRITE review+fix loop, retroactively. Base = empty tree anchored to the repo root; head = marker carrying the default-branch tree; the diff is the ENTIRE published tree. Findings get fixed on main; the target branch is refreshed after each fix so the PR re-reviews; loop until a full cycle returns zero Critical and zero Major. This PR never merges — it is the standing review vehicle.