Rename

[bartekus]

Spec-Drift-Waiver: install.sh
Spec-Drift-Waiver: kit/README.md
Spec-Drift-Waiver: npm/README.md
Spec-Drift-Waiver: npm/package.json
Spec-Drift-Waiver: npm/scripts/generate-platform-packages.js
Spec-Drift-Waiver: py/pyproject.toml
Spec-Drift-Waiver: py/scripts/generate_wheels.py

[github-actions]

AI Code Review

PR Review: stagecraft-ing → statecrafting Org Rename

---

Bugs / Logic Errors

Over-broad substitution in example paths and URI schemes

Two substitutions replace stagecraft where the original string was not the organization slug stagecraft-ing, meaning the rename logic conflated different strings:

• specs/017-directory-crate-module-units/spec.md: platform/services/stagecraft/api/db → platform/services/statecraft/api/db. This is a YAML example path whose stagecraft segment is almost certainly an independent product/service name, not the org handle. Adopters copying this example verbatim will get a silently wrong path.

• docs/design/00-architecture.md: stagecraft:// → statecraft:// in a comment describing OAP provenance URI schemes. The original scheme stagecraft:// drops the -ing suffix differently than statecrafting; if any implementation or config registers stagecraft:// as a provenance scheme, this comment now lies.

Attestation verification will break for existing releases

docs/releasing.md and specs/021-release-supply-chain-artifacts/spec.md now instruct users to run:

gh attestation verify ... --repo statecrafting/spec-spine

GitHub Artifact Attestations are bound to the repository that generated them. Archives released under stagecraft-ing/spec-spine carry attestations tied to that repo identity. The updated verification command will fail for any release published before the org transfer. The docs need a migration note or a versioned split.

---

Security

curl | sh without prior checksum verification (pre-existing, OWASP A08)

install.sh is fetched and executed without a hash check on the script itself. The script then downloads an archive and verifies that archive's SHA-256, but an active MITM or a compromised raw.githubusercontent.com CDN path can serve a malicious installer before any verification runs. This is pre-existing but the org rename is a natural moment to harden it (e.g., GPG-sign the install script, or document a pinned-hash invocation).

Unpinned uses: in adoption-guide workflow example

website/docs/adoption-guide.md shows:

- uses: actions/checkout@v4

The spec-spine coupling-gate discipline requires new external uses: refs to be SHA-pinned. This is a documentation example, not a live workflow, but spec-spine guides adopters to copy it verbatim — a floating tag is a supply-chain risk for anyone who does.

---

Spec-Spine Compliance

Spec 017 example change without code-path audit

specs/017-directory-crate-module-units/spec.md changed an example kind: directory path. If any integration test or fixture file references platform/services/stagecraft/api/db to exercise spec-017 behaviour, the spec and the test now diverge — a coupling-gate violation. The diff shows no corresponding fixture update.

Spec 021 attestation command mismatch (see Bugs above)

The spec now documents a verification command that is incorrect for pre-transfer releases. A spec must be accurate; this change should either be guarded by a version condition or the spec should note the transition boundary.

---

Performance

Nothing to flag; this is a metadata/documentation rename with no runtime code changes.

---

Automated review by Claude. Diff size: 76 lines.

[github-actions]

AI Code Review

Review

Summary

This PR is a mechanical rename of the GitHub organization from stagecraft-ing to statecrafting across all URLs, repository references, and metadata files. Two spec files (specs/017-directory-crate-module-units/spec.md and specs/021-release-supply-chain-artifacts/spec.md) were updated alongside their derived index shards — the coupling-gate discipline is satisfied for both.

---

Security

Unversioned curl | sh installer pipe (existing, not introduced here)

The install command pattern propagated across all documentation is:

curl -fsSL https://raw.githubusercontent.com/statecrafting/spec-spine/main/install.sh | sh

This fetches main — a moving ref — rather than a pinned commit or tag. A compromised or mis-pushed commit to main reaches every user who re-runs this command. The rename is a good moment to audit this.

The install.sh itself (REPO="statecrafting/spec-spine") is correct after the rename, but the security posture is unchanged: no SHA-pin, no GPG signature on the script itself.

Recommendation: Documentation examples should pin a version, e.g.:

curl -fsSL https://raw.githubusercontent.com/statecrafting/spec-spine/v0.10.0/install.sh | sh

or instruct users to set SPEC_SPINE_VERSION (the variable already exists in install.sh). The website's installation.md shows the pinned-version form for cargo but not for the shell installer.

---

Bugs / Logic Errors

py/scripts/generate_wheels.py — hardcoded URLs in generated metadata

_metadata() builds wheel METADATA as a raw string with hardcoded URLs (lines ~139–156). These are now updated correctly, but the function is not derived from a single source-of-truth variable — any future rename would require another grep-and-replace across this file. Not a bug introduced here, but worth noting as a fragility.

---

Spec-Spine Compliance

• Both changed spec files have co-updated derived index shards (.derived/codebase-index/by-spec/017-*.json, 021-*.json) with new shardHash values. Coupling-gate: satisfied.
• The spec path changes (platform/services/stagecraft/api/db → platform/services/statecraft/api/db in spec 017) are illustrative examples in the spec body, not load-bearing path references — appropriate to rename.
• No new external uses: refs are introduced; no SHA-pinning concern from this diff.
• No [package.metadata.<namespace>].spec annotations or # Spec: headers were added or changed.

---

Performance

Nothing performance-relevant changed. All edits are string literals in documentation, metadata, and config files.

---

Minor

The docs/design/00-architecture.md comment (OAP stagecraft:// → OAP statecraft://) renames a URI scheme that appears to be a namespace example. If stagecraft:// is a real registered provenance scheme used in existing .derived/ data or live configs, renaming the comment without renaming the scheme itself would create a documentation/reality mismatch. Verify this is purely illustrative.

---

Automated review by Claude. Diff size: 80 lines.