Skip to content

docs(specs): mark 013 G-04 closed-unproven (T033) #686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ValgulNecron merged 5 commits into from
Oct 13, 2026
Merged

docs(specs): mark 013 G-04 closed-unproven (T033) #686

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dc21123
docs(specs): mark 013 G-04 closed-unproven after #676 (T033)
claude Oct 12, 2026
d226f19
chore: merge master into claude/013-g04-closed-unproven
claude Oct 12, 2026
043d729
chore: merge master into claude/013-g04-closed-unproven
claude Oct 12, 2026
5190b46
docs(specs): state the OD-4 exception in the 013 US1 goal and checkpoint
claude Oct 12, 2026
4b5ccd4
docs(specs): note the OD-4 exception in the 013 US1 independent test
claude Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions specs/013-expand-test-coverage/coverage-gaps.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
# Coverage Gap Record

**Summary**: 9/24 closed · 0 closed unproven · 1 in progress · 13 open · 1 unit-only by design
**Summary**: 9/24 closed · 1 closed unproven · 1 in progress · 12 open · 1 unit-only by design
**Last updated**: 2026-10-12

| ID | Category | Gap | Story | FR | Priority | Status | Evidence | Notes |
|---|---|---|---|---|---|---|---|---|
| G-01 | static | govulncheck gate | US1 | FR-001 | P1 | closed | `vuln (go)` https://github.com/GameplanePanel/Gameplane/actions/runs/38312206591 | Green on #673 after the Go patch, cosign v3 and rekor v1.5.4 bumps (T021); the proof shows the gate fails on a vendored vulnerable fixture. |
| G-02 | static | container image scan gate | US1 | FR-001 | P1 | open | | |
| G-03 | static | Dockerfile lint gate | US1 | FR-001 | P1 | closed | `workflow lint` https://github.com/GameplanePanel/Gameplane/actions/runs/38286000942 | First run on #674 flagged DL3008/DL3018/DL4006 in 13 Dockerfiles; pinned apk/apt versions and pipefail SHELL fixed them, and every game image still builds (run 38286000940). |
| G-04 | static | dependency-review gate | US1 | FR-001 | P1 | open | | |
| G-04 | static | dependency-review gate | US1 | FR-001 | P1 | closed-unproven | `dependency review` job, added in https://github.com/GameplanePanel/Gameplane/pull/676 | OD-4: proven by configuration review only (`fail-on-severity: high`, PR-only); no throwaway PR, no fixture branch, no local act run. |
Comment thread
ValgulNecron marked this conversation as resolved.
| G-05 | static | codegen / tidy drift gate | US1 | FR-001 | P1 | closed | `codegen drift` https://github.com/GameplanePanel/Gameplane/actions/runs/38189397259 | First run on #672 found no drift; the proof shows the job fails on injected drift. |
| G-06 | static | submodule pointer freshness gate | US1 | FR-001 | P1 | closed | `submodule freshness` https://github.com/GameplanePanel/Gameplane/actions/runs/38189409720 | First run on #675 green; the proof covers a stale and a fresh pointer. |
| G-07 | e2e-dashboard | live: notification webhook config | US2 | FR-002 | P1 | open | | |
Expand Down
8 changes: 4 additions & 4 deletions specs/013-expand-test-coverage/tasks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,9 +97,9 @@ description: "Task list for 013-expand-test-coverage"

## Phase 3: User Story 1 – Static gates (Priority: P1) 🎯 MVP

**Goal**: six blocking gates, each proven able to fail, with zero pre-existing findings left (contracts/static-gates.md G1–G6).
**Goal**: six blocking gates, each proven able to fail except `dependency-review`, which OD-4 proves by configuration review only, with zero pre-existing findings left (contracts/static-gates.md G1–G6).

**Independent Test**: for each gate, its `hack/check-<gate>_test.sh` step is green, the gate job is green, and the gap record links a run where the gate was red on a real violation (quickstart.md, "US1").
**Independent Test**: for each gate, its `hack/check-<gate>_test.sh` step is green, the gate job is green, and the gap record links a run where the gate was red on a real violation (quickstart.md, "US1") `dependency-review` is the OD-4 exception: no test script or red run, only a configuration review.

**PR boundaries**: one PR per gate, in the order G5 → G1 → G3 → G2 → G4 → G6 (plan "Phase sequencing").

Expand Down Expand Up @@ -201,7 +201,7 @@ description: "Task list for 013-expand-test-coverage"
- uses `actions/dependency-review-action`, SHA-pinned, with `fail-on-severity: high` and `comment-summary-in-pr: on-failure`

Register it in `report`, and make the report treat `skipped` on push events as neutral, the same way other PR-only jobs are tallied.
- [ ] T033 [US1] Once the T032 PR merges, set G-04 to `closed-unproven` in `coverage-gaps.md`: Evidence names the `dependency review` job and that PR, and Notes cite OD-4 (configuration review only; no throwaway PR, no fixture branch, no local act run).
- [X] T033 [US1] Once the T032 PR merges, set G-04 to `closed-unproven` in `coverage-gaps.md`: Evidence names the `dependency review` job and that PR, and Notes cite OD-4 (configuration review only; no throwaway PR, no fixture branch, no local act run).

### G6 submodule freshness: PR `ci: submodule freshness gate` (OD-1 ruled)

Expand All @@ -219,7 +219,7 @@ description: "Task list for 013-expand-test-coverage"

Register it in `report`. Depends on T007, T034 and T035. Flip G-06.

**Checkpoint**: all six gates are blocking and proven. The gap rows G-01 to G-06 are `closed` with run links (quickstart.md "US1" items 1–4).
**Checkpoint**: all six gates are blocking. G-01, G-02, G-03, G-05 and G-06 are `closed` with run links; G-04 is `closed-unproven` under OD-4 (quickstart.md "US1" items 1–4).

---

Expand Down
Loading