Danijel Martinek
90fc2853f2
- New scripts/work/bump-updated-timestamps.mjs stamps the `updated:`
frontmatter field to the current ISO 8601 UTC timestamp on every
staged docs/work/**/*.md file. Idempotent; adds the field after
`created:` if missing.
- .husky/pre-commit invokes the bump script as step 2 (before
rebuild-state) so _state.json sees the fresh timestamp.
- Backfill all existing work docs (4 PRDs + 3 epics + 21 stories):
* created: promoted from \`YYYY-MM-DD\` -> ISO timestamp using
git log --diff-filter=A on each file (first-commit date for
stories that had no \`created:\` line, midnight UTC for PRDs
and epics that had date-only created).
* updated: added from \`git log -1 --format=%aI\` on each file
(last-commit timestamp); will be re-stamped to "now" by the
pre-commit hook on this commit.
Stories that had no \`created:\` line now get one.
2.9 KiB
id, epic, title, type, status, feature, depends-on, blocks, created, updated
| id | epic | title | type | status | feature | depends-on | blocks | created | updated | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 08-reviewer-prompt-update | 2026-05-14-ci-security-and-supply-chain | Sandcastle reviewer prompt update | technical-story | done | tooling |
|
|
2026-05-14T18:59:12+02:00 | 2026-05-14T19:10:35.370Z |
Goal
Extend .sandcastle/reviewer.prompt.md with a "CI security checks" section that instructs the reviewer agent to read Socket CI output and CodeQL findings via gh run view, and reject the slice with specific notes if any critical Socket finding or error-severity CodeQL finding is present.
Why
The sandcastle reviewer is the single composable gate for agent PRs (ADR-019 constraint). Without an explicit section, an agent reviewer has no machine-readable instruction to check Socket + CodeQL outputs and may approve a slice that introduced a flagged dependency or a static-analysis error. Landing this after Stories 02 + 06 ensures the reviewer references gates that actually exist in CI.
External dependency: library-evaluation epic story 06 (sandcastle reviewer prompt) must be complete — the reviewer prompt must exist and have the library-trace check section that this story composes with. That epic is marked done.
Done when
.sandcastle/reviewer.prompt.mdhas a "CI security checks" section added after the existing library-trace check section.- The section instructs the reviewer to: (a) run
gh run view <run-id> --log(or equivalent) for the PR's check suite; (b) scan the output for Socket findings of severitycritical— if found, reject with notes naming the finding and referencing the failure-mode hierarchy indocs/guides/ci-security.md; (c) scan the output for CodeQL findings of severityerror— same rejection pattern. - The reviewer composes these checks with the existing library-trace presence check (both must pass for approval).
pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diffall pass (prose-only change; no executable code).
In scope
.sandcastle/reviewer.prompt.md— new "CI security checks" section only; existing sections unchanged.
Out of scope
- Automated tests for the reviewer prompt — it's a prose runbook for an agent; success is verified manually (PRD testing decisions).
- Extending the reviewer for
pnpm audit signaturesstep failures — those surface as standard CI job failures, already handled by the reviewer's existing "all CI checks must pass" instruction.
Tasks
- Extend
.sandcastle/reviewer.prompt.mdwith a "CI security checks" section after the library-trace check: instruct the reviewer to readgh run viewoutput for Socketcriticalfindings and CodeQLerrorfindings, reject on either with notes naming the finding and citingdocs/guides/ci-security.mdfailure-mode hierarchy; one commit, all gates pass.