mirror of
https://github.com/dtzp555-max/olp.git
synced 2026-07-21 21:15:10 +00:00
cold-audit catch from 2026-05-23 Retroactive contract sync addressing cold-audit Finding 4 (P2 governance). D10 (commit2cfd0b1) added `maxSpawnTimeMs` to all three plugins + spawn-timeout enforcement loop but did not amend ADR 0002 § Provider contract in the same merge. ALIGNMENT.md Rule 1 (Cite First) + CLAUDE.md § "Hard requirements" item 1 (Authority citation) both require contract additions to be authority-cited at landing. Changes (single file, ADR 0002 only): 1. New `## Amendments` section after the header block documenting: - Cold-audit Finding 4 as the originating finding - Commit2cfd0b1as the already-landed code - CC 开发铁律 v1.6 § 10.x as the procedural mechanism that caught it - ADR 0004 § Trigger taxonomy — Hard triggers bullet 4 as the authority 2. Expanded `hints` documentation from bare-key list to indented sub-bullets with one-line description per key. All four keys now documented: - requiresTTY (boolean fingerprint) - concurrentSpawnSafe (boolean fingerprint) - maxConcurrent (declarative hint only at v0.1; type-validated at startup, no runtime enforcement wired — separate tracking issue to be filed) - maxSpawnTimeMs (new — milliseconds, default 600000, ADR 0004 cited) Diff-review (Iron Rule v1.6 § 10.x Mode A, fresh-context opus, independent of drafter) flagged two issues on first pass: - **B1 blocking**: original draft claimed maxConcurrent was "enforced by the spawn-concurrency guard in server.mjs" — grep verified zero such guard exists. Folded in: replaced with honest declarative-only framing. The irony of D11 itself shipping the same class of documentation–implementation drift it was opened to remediate was caught by the reviewer; the fold-in closes the loop cleanly. - **N1 non-blocking**: original draft cited ALIGNMENT.md Rule 2(c) as primary authority, but Rule 2(c)'s literal wording is scoped to IR fields. Folded in: cite Rule 1 (Cite First) + CLAUDE.md § "Hard requirements" item 1 as primary, noting Rule 2(c)'s spirit extends to Provider-contract additions. Follow-up tracked separately: actual runtime enforcement of maxConcurrent (semaphore / in-flight counter / spawn queue) — declarative→actual closure to be filed as GitHub issue. Authority: - ADR 0002 self-amendment (in-place) - ADR 0004 § Trigger taxonomy bullet 4 https://github.com/dtzp555-max/olp/blob/main/docs/adr/0004-fallback-engine.md - ALIGNMENT.md Rule 1 + CLAUDE.md § "Hard requirements" item 1 - CC 开发铁律 v1.6 § 10.x (procedural authority for cold-audit catch tag) https://github.com/dtzp555-max/cc-rules/blob/main/CC_DEV_IRON_RULES.md Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>