mirror of
https://github.com/dtzp555-max/ocp.git
synced 2026-07-21 21:15:09 +00:00
* docs(constitution): establish OCP alignment constitution + CI guardrails (PR A) Introduces the OCP project constitution to structurally prevent the kind of scope drift that produced commitb87992fon 2026-04-11 (the fabricated "/api/oauth/usage" endpoint, which does not appear in cli.js and broke the dashboard usage bar for nine days). This PR is governance-only. It does not modify server.mjs, package.json, or any runtime code. It is intentionally shipped as one reviewable unit per Iron Rule 11 (governance is one layer). Files added: - ALIGNMENT.md Supreme scope document. Core principle: OCP is a proxy layer for Claude Code, not an extension layer. Five binding Rules: grep cli.js first; no invention; match the implementation; unalignable features are deleted; commits cite cli.js line numbers. Includes the 2026-04-11 drift postmortem, the Unalignable Policy, and an Annual Alignment Audit fixed to 11 April each year. - CLAUDE.md Project session instructions. Flags ALIGNMENT.md as required reading before any code. Codifies three hard requirements for server.mjs changes: cli.js citation, CI blacklist pass, and an independent reviewer per Iron Rule 10. References CC 开发铁律 Rules 10, 11, and 12. - .github/PULL_REQUEST_TEMPLATE.md Mandatory "Claude Code Alignment Evidence" section. Three author checkboxes (cli.js citation, scope justification if cli.js does not perform the op, commit-message citations). Reviewer checklist requires opening cli.js at the cited lines before approval. A PR with this section blank receives request-changes. - .github/workflows/alignment.yml Hard-fail blacklist on server.mjs for tokens "api/oauth/usage" and "api/usage" (scan restricted to server.mjs; ALIGNMENT.md and CLAUDE.md may quote them as historical references). Soft check over all PR commit messages for "Claude Code uses X" / "cli.js uses X" assertions lacking a cli.js:NNNN or cli.js vE4 <fn> citation. Historical reference:b87992f("fix: use dedicated /api/oauth/usage endpoint for reliable plan data") asserted the endpoint was used by Claude Code CLI. The string does not occur in cli.js. Root cause was LLM hallucination accepted without grep verification. See ALIGNMENT.md -> Historical Lesson for the full record. Merge precondition: this PR must be approved by an independent reviewer (Iron Rule 10). The drafter of this commit may not self-approve. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs(alignment): pin first audit to 2026-04-20 (cli.js 2.1.89, SHA-256 a9950ef6) First annual alignment audit pin. Records the cli.js version and content hash that the current ALIGNMENT.md codified implementations mirror. - Claude Code version: 2.1.89 - cli.js SHA-256: a9950ef6407fdc750bddb673852485500387e524a99d42385cb81e7d17128e01 - Audit date: 2026-04-20 - Auditor: Tao Deng Next audit: 2027-04-11 (drift anniversary). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * ci(alignment): narrow blacklist to full host+path + strip comments before grep Two false positives discovered during PR #20 bootstrap CI: 1. /api/usage is a legitimate OCP dashboard route (per-key quota, added in v3.8, server.mjs:1472). The bare token "api/usage" was too broad. 2. The ANCHOR warning comment in server.mjs (added by PR #21) references /api/oauth/usage as a DO-NOT-USE example, triggering the scanner. Fix: require full host "api.anthropic.com/api/oauth/usage" to ensure only real outbound fetch calls trip the guard, and strip line comments with sed before grep so historical ANCHOR warnings pass. Amendment procedure (ALIGNMENT.md) still governs future blacklist changes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Oracle Public Cloud User <opc@instance-20230820-1333.subnet07301351.vcn07301351.oraclevcn.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
dtzp555-max
co-authored by
Oracle Public Cloud User
Claude Opus 4.6
Oracle Public Cloud User
Claude Opus 4.6
parent
fd7973addb
commit
2853088261
@@ -0,0 +1,40 @@
|
||||
# Pull Request
|
||||
|
||||
## Summary
|
||||
|
||||
<!-- One or two sentences describing the change and why it is in scope for OCP. -->
|
||||
|
||||
## Claude Code Alignment Evidence (REQUIRED)
|
||||
|
||||
Per `ALIGNMENT.md`, every PR that touches `server.mjs` or any network-facing surface must fill out this section. PRs with this section blank or unchecked will receive a `request changes` review and cannot be merged.
|
||||
|
||||
- [ ] **Corresponding `cli.js` reference.** I have identified the `cli.js` function and line range that performs the operation this PR forwards. Citation (format `cli.js:NNNN` or `cli.js vE4 <functionName>`):
|
||||
<!-- e.g. cli.js:18423-18467 (function: sendUserMessage) -->
|
||||
|
||||
- [ ] **If `cli.js` does not perform this operation**, I have stated this explicitly below and justified the scope under `ALIGNMENT.md` Rule 2. (Note: in almost all cases this means the PR should be closed, not merged. Proxy layers do not invent endpoints.)
|
||||
<!-- Justification, if applicable. Empty is fine when cli.js does perform the operation. -->
|
||||
|
||||
- [ ] **Commit message citations.** Every "Claude Code uses X" or "cli.js uses X" assertion in every commit of this PR is immediately followed by a `cli.js:NNNN` or `cli.js vE4 <functionName>` citation. I have verified this by rereading each commit message.
|
||||
|
||||
## Type of change
|
||||
|
||||
- [ ] Bug fix (alignment with existing `cli.js` behavior)
|
||||
- [ ] Feature (new `cli.js` behavior now surfaced through OCP)
|
||||
- [ ] Refactor (no wire-level behavior change)
|
||||
- [ ] Deletion (unalignable feature removal per `ALIGNMENT.md` Unalignable Policy)
|
||||
- [ ] Documentation / governance
|
||||
|
||||
## Reviewer checklist
|
||||
|
||||
Reviewers: this section is for you, not the author. Do not approve until every box is checked.
|
||||
|
||||
- [ ] I opened `cli.js` at the cited line range and confirmed the operation matches.
|
||||
- [ ] I ran (or confirmed CI ran) `.github/workflows/alignment.yml` and it passed.
|
||||
- [ ] I am not the commit author of any commit in this PR (Iron Rule 10).
|
||||
- [ ] If the PR asserts scope without a `cli.js` citation, I confirmed the justification is sound per `ALIGNMENT.md` Rule 2.
|
||||
|
||||
## Related
|
||||
|
||||
- `ALIGNMENT.md` Rule(s) invoked: <!-- e.g. Rule 3 -->
|
||||
- Related issue / prior PR: <!-- #NNN -->
|
||||
- Historical lesson reference (if relevant): <!-- e.g. 2026-04-11 drift, b87992f -->
|
||||
@@ -0,0 +1,123 @@
|
||||
name: Alignment Guardrail
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
paths:
|
||||
- 'server.mjs'
|
||||
- '.github/workflows/alignment.yml'
|
||||
|
||||
jobs:
|
||||
blacklist:
|
||||
name: server.mjs blacklist (hard fail)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Scan server.mjs for hallucinated tokens
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
if [ ! -f server.mjs ]; then
|
||||
echo "server.mjs not found; nothing to scan."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Known-hallucinated tokens. Extend only via an ALIGNMENT.md amendment PR.
|
||||
# Each token is matched as a fixed string against server.mjs only.
|
||||
BLACKLIST=(
|
||||
"api.anthropic.com/api/oauth/usage"
|
||||
)
|
||||
|
||||
FAIL=0
|
||||
for token in "${BLACKLIST[@]}"; do
|
||||
if sed "s|//.*\$||" server.mjs | grep -n -F "$token"; then
|
||||
echo "::error file=server.mjs::Blacklisted token '$token' detected in server.mjs."
|
||||
FAIL=1
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$FAIL" -ne 0 ]; then
|
||||
cat <<'EOF'
|
||||
|
||||
============================================================
|
||||
ALIGNMENT GUARDRAIL FAILURE
|
||||
============================================================
|
||||
server.mjs contains a token on the OCP alignment blacklist.
|
||||
|
||||
These tokens were introduced by LLM hallucinations and do
|
||||
not appear in cli.js at any shipped Claude Code version.
|
||||
See ALIGNMENT.md -> "Historical Lesson: The 2026-04-11 Drift"
|
||||
(commit b87992f) for the full incident record.
|
||||
|
||||
Required action:
|
||||
1. Remove the token from server.mjs.
|
||||
2. grep the reference cli.js for the operation you
|
||||
intended and cite the real line numbers.
|
||||
3. See ALIGNMENT.md Rules 1, 2, and 5.
|
||||
|
||||
Do not add allowlist entries to this workflow without an
|
||||
amendment PR to ALIGNMENT.md (see Amendment Procedure).
|
||||
============================================================
|
||||
EOF
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Blacklist scan clean."
|
||||
|
||||
commit-citation:
|
||||
name: commit message citation (soft check)
|
||||
runs-on: ubuntu-latest
|
||||
# Soft check: reports a warning but does not block merge. Reviewers
|
||||
# are expected to enforce per CLAUDE.md. Escalate to hard-fail via
|
||||
# an ALIGNMENT.md amendment if drift recurs.
|
||||
continue-on-error: true
|
||||
steps:
|
||||
- name: Checkout full history
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Scan PR commits for uncited assertions
|
||||
shell: bash
|
||||
env:
|
||||
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
||||
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
if [ -z "${BASE_SHA:-}" ] || [ -z "${HEAD_SHA:-}" ]; then
|
||||
echo "No PR context; skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Collect commit messages in range.
|
||||
MSGS="$(git log --format=%B "${BASE_SHA}..${HEAD_SHA}")"
|
||||
|
||||
# Look for assertions of the form "Claude Code uses ..." or
|
||||
# "cli.js uses ..." (case-insensitive). For each hit, require
|
||||
# a citation in the same commit message in one of the forms:
|
||||
# cli.js:NNNN (line-number citation)
|
||||
# cli.js vE4 <name> (version + function-name citation)
|
||||
# Absence of a citation is a soft finding.
|
||||
|
||||
WARN=0
|
||||
# Split log into per-commit blocks for precise matching.
|
||||
git log --format="%H" "${BASE_SHA}..${HEAD_SHA}" | while read -r sha; do
|
||||
BODY="$(git log -1 --format=%B "$sha")"
|
||||
if echo "$BODY" | grep -E -i -q '(claude[[:space:]]+code|cli\.js)[[:space:]]+uses'; then
|
||||
if echo "$BODY" | grep -E -q '(cli\.js:[0-9]+|cli\.js[[:space:]]+v[A-Za-z0-9]+[[:space:]]+[A-Za-z_][A-Za-z0-9_]*)'; then
|
||||
echo "OK $sha: assertion cited."
|
||||
else
|
||||
echo "::warning::Commit $sha asserts 'Claude Code uses ...' or 'cli.js uses ...' but does not cite a cli.js line number or versioned function name. See CLAUDE.md -> Commit message conventions."
|
||||
WARN=1
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$WARN" -ne 0 ]; then
|
||||
echo "Soft check raised warnings. Reviewer: please enforce per CLAUDE.md."
|
||||
else
|
||||
echo "Commit citation soft check clean."
|
||||
fi
|
||||
@@ -0,0 +1,91 @@
|
||||
# OCP Alignment Constitution
|
||||
|
||||
**Status:** Active. This document is the supreme source of truth for OCP scope decisions. Conflicts with other documents (README, issues, prior commit messages) resolve in favor of this file.
|
||||
|
||||
---
|
||||
|
||||
## Core Principle
|
||||
|
||||
OCP (Open Claude Proxy) is a **proxy layer** for the Claude Code CLI. It forwards, observes, and multiplexes the traffic that `cli.js` already emits. It is **not** an extension layer. If `cli.js` does not perform a given operation, or performs it differently, OCP does not invent one.
|
||||
|
||||
---
|
||||
|
||||
## Rules
|
||||
|
||||
1. **Rule 1 (Grep First).** Before adding, renaming, or changing any endpoint, header, parameter, or response shape, the author must `grep` the reference `cli.js` and record the exact line numbers in the commit message and PR body. An absent grep hit is itself a finding and must be declared.
|
||||
|
||||
2. **Rule 2 (No Invention).** OCP must not introduce endpoints, headers, request fields, or response fields that are not present in `cli.js`. Speculative "Claude Code probably uses X" statements are prohibited. If the behavior is not observable in `cli.js`, the feature is out of scope.
|
||||
|
||||
3. **Rule 3 (Match the Implementation).** When `cli.js` does perform a given operation, OCP must match it byte-for-byte on the wire: same path, same method, same headers (including casing and ordering constraints), same body schema, same auth scheme. Deviations require an explicit, reviewed exception recorded in this file.
|
||||
|
||||
4. **Rule 4 (Unalignable Features Are Deleted).** Any existing OCP feature that cannot be traced to a concrete `cli.js` reference is deleted. There is no "grandfathering" and no "keep it disabled." The policy is removal, not deprecation. See the Unalignable Policy section below.
|
||||
|
||||
5. **Rule 5 (Cite Line Numbers in Commits).** Every commit that touches `server.mjs` must reference `cli.js` by line number or function name in the form `cli.js:NNNN` or `cli.js vE4 <functionName>`. Commits asserting "Claude Code uses X" without such a citation are blocked by CI and must be reverted on detection.
|
||||
|
||||
---
|
||||
|
||||
## Golden Reference: `cli.js`
|
||||
|
||||
`cli.js` is the Claude Code CLI JavaScript bundle shipped inside the `@anthropic-ai/claude-code` npm package. It is the single source of truth for "what Claude Code actually does."
|
||||
|
||||
### Canonical paths per machine
|
||||
|
||||
| Machine / environment | Path |
|
||||
| --- | --- |
|
||||
| macOS (npm global) | `/usr/local/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
|
||||
| macOS (nvm) | `~/.nvm/versions/node/*/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
|
||||
| Linux (npm global) | `/usr/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
|
||||
| Linux (OCI opc user) | `~/.npm-global/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
|
||||
| Windows (npm global) | `%APPDATA%\npm\node_modules\@anthropic-ai\claude-code\cli.js` |
|
||||
| Raspberry Pi (nvm) | `~/.nvm/versions/node/*/lib/node_modules/@anthropic-ai/claude-code/cli.js` |
|
||||
|
||||
### Current audit pin
|
||||
|
||||
- **Claude Code version under audit:** `2.1.89`
|
||||
- **`cli.js` SHA-256:** `a9950ef6407fdc750bddb673852485500387e524a99d42385cb81e7d17128e01`
|
||||
- **Audit date:** `2026-04-20`
|
||||
- **Auditor:** `Tao Deng`
|
||||
|
||||
The audit pin is updated once per year (see Annual Alignment Audit) and whenever a drift incident forces a re-verification.
|
||||
|
||||
---
|
||||
|
||||
## Historical Lesson: The 2026-04-11 Drift
|
||||
|
||||
On 2026-04-11, commit `b87992f` ("fix: use dedicated /api/oauth/usage endpoint for reliable plan data") was merged. The commit message asserted that `/api/oauth/usage` was "the dedicated usage endpoint that Claude Code CLI uses."
|
||||
|
||||
**This assertion was false.** The string `/api/oauth/usage` does not appear in `cli.js` at any version shipped up to that date. The endpoint was fabricated by an LLM-assisted authoring pass that generalized from adjacent OAuth paths without verifying against `cli.js`. A follow-up commit `cb6c2a8` ("fallback to stale cache on usage API 429 + extend cache to 15min") compounded the error by caching the fabricated response to hide the 4xx failures.
|
||||
|
||||
**Impact:** The `/usage` progress bar in the dashboard was broken for nine days (2026-04-11 through 2026-04-20) before the drift was isolated.
|
||||
|
||||
**Root cause:** LLM hallucination accepted without `grep cli.js` verification, compounded by the absence of a CI blacklist and the absence of this constitution.
|
||||
|
||||
**Fix commit:** `<to be filled when repair PR lands>`
|
||||
|
||||
**Lesson codified:** Rules 1, 2, and 5 of this document; the CI blacklist in `.github/workflows/alignment.yml`; and the PR template evidence section exist to make the 2026-04-11 drift structurally impossible to repeat.
|
||||
|
||||
---
|
||||
|
||||
## Unalignable Policy
|
||||
|
||||
A feature is **unalignable** if, after a good-faith search, it cannot be mapped to a specific `cli.js` line range or function.
|
||||
|
||||
- Unalignable features are **deleted**, not disabled, not feature-flagged, not deprecated.
|
||||
- Deletion is the default outcome of an alignment audit finding. The burden of proof is on the feature, not on the auditor.
|
||||
- A deletion PR does not require user-facing deprecation notice, because the feature was never legitimately in scope.
|
||||
- If a user workflow depended on an unalignable feature, the correct remediation is to upstream the behavior into `cli.js` or to move it out of OCP into a separate tool. OCP does not retain it.
|
||||
|
||||
---
|
||||
|
||||
## Annual Alignment Audit
|
||||
|
||||
- **Date:** 11 April each year (the anniversary of the `b87992f` drift).
|
||||
- **Scope:** Diff the current `cli.js` against the pinned SHA-256 in the Golden Reference section. For every network call in `server.mjs`, re-verify that the corresponding `cli.js` reference still exists at the cited line numbers (adjust citations if line numbers shifted across Claude Code versions).
|
||||
- **Output:** A signed audit note committed to `docs/alignment-audits/YYYY-04-11.md`, updating the pin.
|
||||
- **Failure mode:** Any audit finding that cannot be reconciled triggers an immediate deletion PR per the Unalignable Policy.
|
||||
|
||||
---
|
||||
|
||||
## Amendment Procedure
|
||||
|
||||
This constitution is amended only by a PR that (a) cites the evidence motivating the amendment, (b) is reviewed by an independent reviewer per CC Iron Rule 10, and (c) updates the Historical Lesson section if the amendment was driven by an incident. Amendments never retroactively legitimize previously unalignable features.
|
||||
@@ -0,0 +1,58 @@
|
||||
# OCP Project Session Instructions
|
||||
|
||||
> **WARNING — READ BEFORE WRITING ANY CODE IN THIS REPO**
|
||||
>
|
||||
> Before touching `server.mjs` or any network-facing surface, read [`./ALIGNMENT.md`](./ALIGNMENT.md) in full. The constitution is binding. Non-compliant commits are reverted.
|
||||
|
||||
---
|
||||
|
||||
## Before starting any task
|
||||
|
||||
1. Read `./ALIGNMENT.md`. Internalize the five Rules and the 2026-04-11 drift lesson.
|
||||
2. Run `/dev-start <task description>` to get a pre-flight plan that incorporates the iron rules, `SKILL_ROUTING.md`, this file, and `ALIGNMENT.md`.
|
||||
3. If the task touches `server.mjs`, locate the corresponding `cli.js` reference **before** drafting any code. No code is written ahead of the `grep cli.js` evidence.
|
||||
|
||||
---
|
||||
|
||||
## Hard requirements for `server.mjs` changes
|
||||
|
||||
Every PR that modifies `server.mjs` must satisfy all three of the following. A PR missing any one of them is blocked from merge.
|
||||
|
||||
1. **`cli.js` citation.** The commit message and PR body declare the corresponding `cli.js` function name and line number range, using the format `cli.js:NNNN` or `cli.js vE4 <functionName>`. If `cli.js` does not perform the operation, the PR must state this explicitly and justify scope under `ALIGNMENT.md` Rule 2 (in practice, this almost always means the PR should be closed).
|
||||
2. **CI blacklist pass.** The `alignment.yml` workflow must pass. The workflow greps `server.mjs` for known-hallucinated tokens (including `api/oauth/usage` and `api/usage`) and fails the build on any hit. Do not suppress the workflow. Do not add allowlist entries without an amendment PR to `ALIGNMENT.md`.
|
||||
3. **Independent reviewer (Iron Rule 10).** The implementation author may not self-approve. A separate reviewer — human or a subagent spawned with a fresh context — must read the diff, verify the `cli.js` citation by opening `cli.js` at the cited lines, and explicitly approve. A review comment that does not confirm the `cli.js` citation was checked is not a valid approval.
|
||||
|
||||
---
|
||||
|
||||
## Iron rules in force
|
||||
|
||||
This repo operates under the CC Development Iron Rules (CC 开发铁律) v1.3. Three rules are load-bearing for OCP work:
|
||||
|
||||
- **Iron Rule 10 (Code Review).** Every implementation phase has an independent reviewer. Self-review does not count. See `server.mjs` hard requirement #3 above.
|
||||
- **Iron Rule 11 (Incremental Diff Review).** Non-trivial work is split into the minimum reviewable unit — one PR per layer per severity. `ALIGNMENT.md`, `CLAUDE.md`, the PR template, and the CI workflow are therefore shipped as the same constitutional PR (they are one layer: governance), but any subsequent `server.mjs` remediation lands as its own PR.
|
||||
- **Iron Rule 12 (Pre-Brainstorm Prior-Art Search).** Before proposing any new endpoint or header, search GitHub, Anthropic docs, and the `cli.js` bundle. For OCP specifically, the `cli.js` grep is the decisive search: if it does not hit, Rule 2 of the constitution applies.
|
||||
|
||||
The full iron rules are at `~/.claude/CC_DEV_IRON_RULES.md` (symlinked from the cc-rules repo on Tao's workstations). Load them into session context with `/cc-rules` when needed.
|
||||
|
||||
---
|
||||
|
||||
## Skills relevant to this repo
|
||||
|
||||
- `/dev-start` — pre-flight planning, always first.
|
||||
- `/cc-rules` — load the iron rules into context.
|
||||
- `/agent-dispatch` — pick the correct model (opus for design and review, sonnet for straightforward edits, haiku for mechanical chores) before spawning any subagent.
|
||||
- `/cc-mem search <keyword>` — look up cross-machine memory for prior decisions, especially prior drift incidents.
|
||||
|
||||
---
|
||||
|
||||
## Commit message conventions
|
||||
|
||||
- Subject line uses Conventional Commits (`fix:`, `feat:`, `docs:`, `refactor:`, `chore:`).
|
||||
- Any assertion of the form "Claude Code uses X" or "cli.js uses X" in the body must be immediately followed by a citation in the form `cli.js:NNNN` or `cli.js vE4 <functionName>`. CI performs a soft check for this pattern on all commits in the PR.
|
||||
- Co-author trailer is required for LLM-assisted commits (`Co-Authored-By: Claude <model> <noreply@anthropic.com>`).
|
||||
|
||||
---
|
||||
|
||||
## Project-level escalation
|
||||
|
||||
If a design decision cannot be resolved by reference to `cli.js` and `ALIGNMENT.md`, escalate to Tao (老大) via `/cc-chat` rather than guessing. Silent guessing is what produced the 2026-04-11 drift.
|
||||
Reference in New Issue
Block a user