chore: repo contract - distilled AGENTS.md, .agents/ layout, verify-temper skill - #440
Merged
Conversation
…l layout, verify-temper skill, cloud wiring - AGENTS.md distilled to kernel-specific substance (global boilerplate now arrives from the stack layer); stale PM-app workflow, .progress/ references, and the outdated two-Codex review bar removed - CLAUDE.md -> symlink to AGENTS.md (was a hand-mirrored 203-line copy) - REVIEW.md: five kernel passes (DST, invariants/spec contract, authz fail-closed, TigerStyle bounds, dependency discipline) - .agents/ is the neutral source of truth: agents/ (3 reviewers), commands/, skills/ (verify-temper new; desloppify + temper-agent.md moved as-is, dedup vs stack pending); .claude/* and .cursor/skills are symlinks - .claude/settings.json + hooks/global-context.sh + global.md: cloud sessions get the global layer only when ~/.claude/CLAUDE.md is absent Proof run of verify-temper follows on this branch before the PR leaves draft. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VLPhB9kjLeE48kLUyAXXq2
…enant-Id on metadata, TEMPER_API_KEY before serve, verify --specs-dir) Proof: healthz 200, CSDL metadata 200 (117KB), cascade PASS on os-apps/project-management, platform_e2e_dst 6/6, keyless entity read 401 (fail-closed). Evidence: /tmp/verify-temper/2026-08-26/. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VLPhB9kjLeE48kLUyAXXq2
rita-aga
marked this pull request as ready for review
August 26, 2026 16:49
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+10
to
+11
| curl -sf -H 'X-Tenant-Id: default' 'http://localhost:3600/tdata/$metadata' | head -c 400 # CSDL XML | ||
| ``` |
There was a problem hiding this comment.
The governed entity-read and action-dispatch instructions send only X-Tenant-Id, so contributors following this flow receive 401 responses even after bootstrapping TEMPER_API_KEY; include the corresponding bearer credential in these requests.
…simulation skill; DST-driven development in AGENTS.md and REVIEW.md - scripts deleted (no references anywhere): bench.sh, demo.sh, e2e-trusted-issuer.sh, set-branch-protection.sh, verify-all.sh - latency-observability package deleted (completed May effort): verify-latency-observability-package.sh, temper_agent_e2e_proof.py, the HTML report, and its release runbook; the operational DBM runbook and its SQL stay - docs deleted: internal/crate-refactor-plan.md and internal/GAP_TRACKER.md (stale trackers; Linear is the tracker of record), docs/proofs/, ui/landing/*.bak junk - .agents/skills/deterministic-simulation/ vendored from stack, with the wrong 'temper-dst' crate name corrected to the real locations (temper-runtime sim, temper-store-sim, platform DST suites) - AGENTS.md: DST-driven development loop (harness first, failing invariant, many seeds, regression seeds, root-cause fixes); REVIEW.md pass 1 extended with the matching findings Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VLPhB9kjLeE48kLUyAXXq2
…idge, observe-ui added; unmapped verbs listed with reasons) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VLPhB9kjLeE48kLUyAXXq2
…/_admin - now listed (route trees verified from server source) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VLPhB9kjLeE48kLUyAXXq2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AGENTS.md and CLAUDE.md were two hand-mirrored 203-line files mixing kernel facts with global boilerplate and stale workflow (PM-app issue pickup, .progress/ fallbacks, an outdated review bar). This PR distills the contract to kernel-specific substance and adopts the layout piloted in temperpaw (nerdsane/temperpaw#470).
Decisions & Tradeoffs
Verification
Proof run complete (2026-08-26, local). The skill was executed end to end; four wrong instructions it shipped with were caught and corrected in-branch: the health route is
/healthznot/observe/health,$metadatarequiresX-Tenant-Id,TEMPER_API_KEYmust be set before serve for governed reads (a keyless boot 401s, which is the fail-closed proof), andtemper verifytakes--specs-dirnot a file path.Final pass: build -> serve on :3600 -> healthz 200 -> CSDL metadata 200 (117KB) -> verification cascade PASS (os-apps/project-management) -> platform_e2e_dst 6/6 -> keyless entity read 401 (fail-closed) -> teardown by captured PID. Evidence:
/tmp/verify-temper/2026-08-26/.Authored by Fable 5 via Claude Code.
🤖 Generated with Claude Code
https://claude.ai/code/session_01VLPhB9kjLeE48kLUyAXXq2
Greptile Summary
This PR replaces duplicated agent instructions with a distilled repository contract, centralizes agent assets under
.agents/, and adds a Temper verification skill.CLAUDE.mdand tool-specific agent directories resolve to shared sources.Confidence Score: 4/5
The PR is not yet safe to merge because the verification skill’s governed OData flow still produces 401 responses when followed as written.
The outstanding instructions set up TEMPER_API_KEY server-side but never transmit it in the Authorization header required by governed entity reads and action dispatches, leaving the advertised end-to-end verification path unusable.
Files Needing Attention: .agents/skills/verify-temper/features/serve-and-odata.md and .agents/skills/verify-temper/SKILL.md
Important Files Changed
Reviews (4): Last reviewed commit: "fix: verify-temper enumeration missed th..." | Re-trigger Greptile