Pine/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

docs: unwrap hard-wrapped Markdown to one line per paragraph

Browse Source 
Hard line breaks mid-paragraph make docs harder to edit and diff — a
one-word change reflows and re-diffs the whole paragraph. Reflow all
tracked non-vendor Markdown (plus vendor/AGENTS.md) so each prose
paragraph is a single line; soft-wrapping is the editor's job. Fenced
code, tables, and list structure are preserved (wrapped list items fold
to one line per bullet). Documents the convention in AGENTS.md.
This commit is contained in:
Tianyi Cui
2026-06-13 18:39:20 +08:00
parent e98c1c5d42
commit 066f94c7e0
39 changed files with 348 additions and 1206 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/rfc/007-supply-chain-and-vendor-drift.md
+7 -26
View File
@@ -4,38 +4,19 @@ Status: proposed
## Problem
The vendor manifest (ADR 0001) is enforced at commit time in the *forward*
direction (vendored change ⇒ manifest update) but nothing verifies the
manifest's *claims*: that vendor/ actually equals upstream-at-SHA plus
exactly the logged modifications. And the handful of true npm dependencies
have no advisory monitoring or update cadence.
The vendor manifest (ADR 0001) is enforced at commit time in the *forward* direction (vendored change ⇒ manifest update) but nothing verifies the manifest's *claims*: that vendor/ actually equals upstream-at-SHA plus exactly the logged modifications. And the handful of true npm dependencies have no advisory monitoring or update cadence.
## Proposal
1. **Vendor drift check** (nightly CI): clone the upstream repos at the
manifest SHAs (shallow), copy the corresponding package sources, and diff
against `vendor/*/src`. The job fails unless the diff matches the logged
local modifications (kept as a checked-in patch file per modification —
the log entries become verifiable artifacts rather than prose).
2. **Dependency advisories**: osv-scanner (or `yarn npm audit`) job on the
lockfile, scheduled + on lockfile-touching PRs.
3. **License inventory**: a script asserting every vendored package carries
its LICENSE and that package.json `license` fields match the inventory in
vendor/README.md (we mix vendored MIT with our BSD-3) — CI step.
4. **Renovate** (or a scheduled agent task) proposing npm dependency updates
in small PRs that ride the full gate suite; vendored packages are excluded
(their updates follow the manifest sync procedure, ideally as a
semi-automated agent workflow: fetch upstream, re-apply patches, run
gates, open PR with the manifest table updated).
1. **Vendor drift check** (nightly CI): clone the upstream repos at the manifest SHAs (shallow), copy the corresponding package sources, and diff against `vendor/*/src`. The job fails unless the diff matches the logged local modifications (kept as a checked-in patch file per modification — the log entries become verifiable artifacts rather than prose).
2. **Dependency advisories**: osv-scanner (or `yarn npm audit`) job on the lockfile, scheduled + on lockfile-touching PRs.
3. **License inventory**: a script asserting every vendored package carries its LICENSE and that package.json `license` fields match the inventory in vendor/README.md (we mix vendored MIT with our BSD-3) — CI step.
4. **Renovate** (or a scheduled agent task) proposing npm dependency updates in small PRs that ride the full gate suite; vendored packages are excluded (their updates follow the manifest sync procedure, ideally as a semi-automated agent workflow: fetch upstream, re-apply patches, run gates, open PR with the manifest table updated).
## Plan
3 is trivial — do first. 1 requires network access from CI to the upstream
repos (private — needs a token) and converting the two existing logged
modifications into patch files. 2 and 4 are config.
3 is trivial — do first. 1 requires network access from CI to the upstream repos (private — needs a token) and converting the two existing logged modifications into patch files. 2 and 4 are config.
## Risks
Upstream repos are private mirrors; CI credentials and availability are the
main friction for the drift check. If blocked, run it as a local scheduled
agent task instead of CI.
Upstream repos are private mirrors; CI credentials and availability are the main friction for the drift check. If blocked, run it as a local scheduled agent task instead of CI.