Convention shift: epic folders + PRD filenames + frontmatter id
fields are now bare slugs. The created: timestamp (Phase 2) carries
the date; folder names don't repeat it. A future <task-id>-<slug>
shape (e.g. ClickUp) lands cleanly when that integration ships.
Renames (git mv preserves history):
- docs/work/2026-05-13-binder-wrap-helper/
-> docs/work/binder-wrap-helper/
- docs/work/2026-05-14-library-evaluation-policy/
-> docs/work/library-evaluation-policy/
- docs/work/2026-05-14-ci-security-and-supply-chain/
-> docs/work/ci-security-and-supply-chain/
- docs/work/prds/2026-05-13-binder-wrap-helper.prd.md
-> docs/work/prds/binder-wrap-helper.prd.md
- docs/work/prds/2026-05-13-coverage-architecture.prd.md
-> docs/work/prds/coverage-architecture.prd.md
- docs/work/prds/2026-05-14-library-evaluation-policy.prd.md
-> docs/work/prds/library-evaluation-policy.prd.md
- docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md
-> docs/work/prds/ci-security-and-supply-chain.prd.md
Frontmatter updates inside the renamed files: epic id, epic prd,
story epic, PRD id, PRD builds-on all drop date prefixes.
System folder + state file move:
- New docs/work/_system/ holds framework-managed state.
- docs/work/_state.json -> docs/work/_system/_state.json.
- state-builder.mjs adds _system to SKIP_FOLDERS.
- cli.mjs + state-sync-guard.mjs + .husky/pre-commit point at the
new path.
template-reset-v1 epic deleted entirely (one-off cleanup epic from
the pre-date-convention era; status was already done).
Generator-template updates (so new artifacts ship in the right
shape):
- .sandcastle/decomposer.prompt.md emits bare-slug folder names +
ISO created: timestamp.
- .claude/skills/to-prd/SKILL.md template uses bare-slug filename +
bare-slug id field + ISO created: timestamp.
Doc reference updates: glossary, runbook, agent-first-workflow-
and-conformance, reviewer prompt, ADR-020, ADR-022, ADR-023 all
point at the new paths/slugs.
3.1 KiB
3.1 KiB
id, epic, title, type, status, feature, depends-on, blocks, created, updated
| id | epic | title | type | status | feature | depends-on | blocks | created | updated | ||
|---|---|---|---|---|---|---|---|---|---|---|---|
| 02-pre-commit-check-script | library-evaluation-policy | Pre-commit check script for library trace presence | technical-story | done | scripts |
|
|
2026-05-14T06:52:02+02:00 | 2026-05-14T19:16:52.691Z |
Goal
Write scripts/library-decisions/check.mjs — the script that walks staged package.json diffs, derives the tier of each affected package, and fails the commit when a new runtime dependency in a feature- or core-tier package has no sibling approved trace staged. Wire it into .husky/pre-commit as step 4.
Why
Human and agent reviewers cannot reliably check trace presence during code review. The pre-commit hook is the last mechanical gate before a dep reaches the repo; it runs unconditionally, composes with --no-verify protection already in the bash-guard hook, and gives the committer immediate actionable feedback.
Done when
scripts/library-decisions/check.mjsexists and: (1) readsgit diff --cached --name-only -- '**/package.json'; (2) for each stagedpackage.json, derives tier from path (apps/*→ app,packages/core-*→ core,packages/*→ feature); (3) for each newly added line independencies(notdevDependencies/peerDependencies), checks thatdocs/library-decisions/*-<name>.mdis also staged withdecision: approved; (4) exits 1 with a per-package error report + pointer to the skill when any check fails; (5) app-tier and devdep additions exit 0 silently..husky/pre-commitinvokesnode scripts/library-decisions/check.mjsafter the existing state-sync guard.scripts/library-decisions/check.test.mjscovers (using a temp git repo fixture): new feature-tier dep without trace → exit 1; new feature-tier dep with approved trace staged → exit 0; new feature-tier dep with rejected-decision trace staged → exit 1; new app-tier dep → exit 0; new devdep → exit 0; multi-file diff with mixed pass/fail → exit 1 with per-package report;peerDependencies-only change → exit 0.pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diffall pass.
In scope
scripts/library-decisions/check.mjs— the check script (importsschema.mjsfrom Story 01 for trace validation).scripts/library-decisions/check.test.mjs— integration tests using a temp git repo fixture (mirror pattern fromscripts/work/state-sync-guard.mjstests)..husky/pre-commit— one added line.
Out of scope
- Sandcastle reviewer prompt integration — Story 06.
--staged-against <base>flag for CI/sandcastle use — added in Story 06 when the reviewer prompt is written.pnpm libs checkergonomic wrapper — deferred per PRD.
Tasks
- Write
scripts/library-decisions/check.mjs(imports schema from Story 01; parsesgit diff --cachedoutput; tier derivation from path; staged-trace presence +decision: approvedcheck; exit-1 report with skill pointer); wire into.husky/pre-commit; writecheck.test.mjsintegration tests with temp git repo fixture covering all 7 cases from Done when; all gates pass on this single commit.