sync: dev -> master - #12
Merged
Merged
Conversation
Registers minspec/fixture-hello 1.0 (bundle registration + config copy carrying the greeting parameter). Fixes a live endpoint defect found while designing the E2E: index.json declared branch "main" — a branch this repository has never had — while recipe_template hit the GitHub contents API with no ref, which serves the DEFAULT branch; after today's dev-trunk switch that meant recipes-in-review could reach real installs. The template now pins ?ref=master and every declaration names master, the stable branch: the road serves stable, review happens on dev. Source: owner 2026-09-01 Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
feat: the fixture-hello recipe; pin the endpoint's serving ref
Measured in the E2E dry run: Flex fetched the fixture-hello recipe and IGNORED it, because this endpoint declared is_contrib: true while the skeleton ships allow-contrib: false — MinSpec's own registry silently no-oped against MinSpec's own skeleton. The org's registry serving the org's packages is first-party; is_contrib is now false. Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
fix: the endpoint is first-party, not contrib
Findings applied from the independent audit (CHANGES verdict): workflow-level permissions contents:read; persist-credentials false on checkout; every action pinned to a reviewed commit SHA with its tag in a comment; Serena pinned in .mcp.json to the audited git commit instead of floating uvx resolution. Finding: [P1] workflows ran with default token permissions Finding: [P1] .mcp.json launched unversioned uvx serena Finding: [P2] mutable action tags across all repositories Verified: python yaml.safe_load + json.load on the changed files Source: original Co-Authored-By: GPT-5 Codex <noreply@openai.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Reviewed-by: GPT-5 Codex <noreply@openai.com> Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
repo: workflow and MCP hardening from the security audit
This repo can break the package road, so its PRs now run the
canonical e2e from minspec/workbench via workflow_call — this PR's
code in its own slot, siblings at dev. One test, owned in one
place, never copied.
Source: owner 2026-09-01 ("make it a real test and stick to it")
Source: original
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
repo: call the org road test on every change here
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230933Z-apply-push-0f6370 Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
repo: run the term wall in CI
`pull_request` without `types` fires on opened, synchronize and reopened only, so a title or body edited after the checks passed reached the merge unscanned. Name the types and add `edited`; the wall then runs against the current text. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T234654Z-apply-push-597506 Patch-SHA256: 5bd4712af8c79fee62fd38b617467cd3bc0c814a188db1a96af657736a143c67
repo: scan a pull request again when its text is edited
minspec/.github#10 pins the content surface to every tracked blob, read from the object store, bytewise, symlinks never followed. Point the wall step at that merge. The e2e job called the reusable workflow in workbench at the mutable `dev`; pin it to the current dev commit. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T004046Z-apply-push-2cfd0c Patch-SHA256: 63cb576da555e6faa8de431db398c22cf34346acb764980d5792b988df5bd105
repo: move the wall to the object-store scan
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release sync: everything on
devsince the last sync, rebased onto the release branch. Today: the term wall in CI, the object-store content scan, theeditedtrigger, pinned actions and reusable workflows, and the review resolution.🤖 Generated with Claude Code
https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY