- .claude/hooks/** joins the always-high row: a hook script runs on the
workstation.
- Bas narrows to **/*.md and LICENSE: a script or an image added under
docs/ or reports/ is no longer low.
- package.json: a package moved between devDependencies and dependencies,
or any line of the dependencies block, is high; the script now tracks
the block each package line belongs to.
- Calibration records the choices Max confirmed on 2026-10-19.
Replay unchanged: 20 haut out of 31.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The escape-sequence pitfall had lost its own example on the way: the
backslash-u002d sequence landed decoded as a plain dash. It is written
back with the backslash built by chr(92) and checked with od -c.
The script's docstring no longer lists the environment and log-line
triggers dropped during calibration, and AUTH no longer matches
timingSafeEqual and createHash, which the Haut table does not name.
Replay unchanged: 20 haut out of 31.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
REVIEW.md sets the review level of a PR from the files it touches
(routing and auth, write surfaces, image, workstation agents, CI and
guards), the rules of each zone with their source, the verification
commands and the review pitfalls. scripts/review-levels.py replays the
levels on the 31 PRs that reached main and checks, offline, that its
patterns match the Haut table.
CLAUDE.md said "no auto-deploy": since 2026-10-12 a push to main
redeploys through the Forgejo webhook. The Deploy section now says so
and points to REVIEW.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The self-check comment of the continue-on-error detector said that
requiring a colon after the word loses the anchor row only. That holds
when a closing quote may sit before the colon; with the colon right
after the word, the quoted-key row goes too. Measured: 2 rows red with
the colon right after the word, 1 with a closing quote allowed, 3 with
the original anchored regex.
The port check of boot-from-copy.sh named NO_PROXY as what keeps a
proxy out, while curl reads no_proxy first: it now names both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Only the port pre-check of scripts/boot-from-copy.sh carried --noproxy.
The wait loop and the two assertions still honoured http_proxy, so on a
workstation with a proxy configured the script talked to the proxy
instead of the server it had just started, and failed loudly.
Export NO_PROXY='*' and no_proxy='*' at the top of the script, which
covers every curl call, and drop the now-redundant --noproxy.
The new test boots the script for real behind a fake proxy that answers
everything and records what reaches it. It first proves the proxy is
live (a bare curl with the same environment reaches it), then requires
that nothing of the boot check reaches it and that the script passes.
Red on the previous script (the wait loop and the first assertion went
through the proxy), red again when the export is removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Forbid `continue-on-error` in ci.yml: that mutation left every test green,
and a failing step would turn the commit status green in silence.
- boot-from-copy.sh refuses a port already held by something else (any curl
exit other than 7). Without it, the wait loop could reach the neighbour and
assert on a server it never started — the new test reproduces exactly that
when the check is removed.
- Pin every require of the COPY'd runtime modules at column 0, with no
dynamic import: the boot check only calls /health, so it only proves the
modules loaded at startup.
Fixes#33
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nothing verified this repository until now. The workflow runs on every pull
request (no branches filter, so intermediate stack links get a status) and on
pushes to main, in node:22-alpine, the Dockerfile's own base: npm ci, npm test,
the socket-level pass, then scripts/boot-from-copy.sh.
The script stands in for a docker build, which would need the Docker socket in
the instance-scoped runner and so root on the production VPS for every
workflow. It starts the CMD from the COPY sources alone and fails on the
MODULE_NOT_FOUND that #11 had to fix by hand. __tests__/ci.test.js pins the
workflow and what the script assumes of the Dockerfile.
Refs #24
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
