Repository navigation
docs(agents): describe the tree as it is now - #7
Conversation
AGENTS.md said the tree held only README.md, LICENSE and .gitignore, with no workflows and no SECURITY.md. The repository now has the org CVD policy, security.txt, the CRA and Mbed TLS docs and a docs-check workflow. Name the one verified command (ci/check_docs.py) and point the Security section at SECURITY.md.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
|
ⓘ Your Qodo trial ends soon. Ask your workspace admin to set up billing to keep reviews running after the trial. Manage billing |
You've used all your free Kodus-paid PR reviews 🎁Your trial is still active — this just means the PR reviews we cover during the trial are used up. Connect your own AI key to keep Kody reviewing — unlimited reviews, on any plan (Free included). Want more trial reviews to finish evaluating before adding a key? Talk to our founders. 😎 |
Reviewer's GuideDocumentationUpdate AGENTS.md to describe the repository’s current security and documentation files, the docs-check command, and the current vulnerability-disclosure policy.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary by QodoAlign AGENTS.md with the current repository and security policy
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require review |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="AGENTS.md" line_range="22" />
<code_context>
+```
+
+It needs only the Python standard library. It checks that each doc under
+`docs/` and the README has one H1, that relative links resolve, and that
+`.well-known/security.txt` has `Contact` and `Expires` and has not expired.
+Do not invent other commands.
</code_context>
<issue_to_address>
**Sidebar H1 coverage is overstated**
When an agent relies on the stated H1 coverage for `docs/wiki/_Sidebar.md`, `check_h1` exempts `docs/wiki/_Sidebar.md`, so the check passes even when that file has no H1 and agents get a false validation guarantee.
Document that `docs/wiki/_Sidebar.md` is exempt from the H1 check.
</issue_to_address>
### Comment 2
<location path="AGENTS.md" line_range="4-6" />
<code_context>
-tests, or automation exist on `master` yet. The code that will become eSec
-lives in [`embeddedos-org/eos`](https://github.com/embeddedos-org/eos) at
+Placeholder repository (Status: Planned). No implementation, build manifests
+or tests exist on `master` yet. The repository holds the org security policy
+(`SECURITY.md`, `.well-known/security.txt`) and security docs under `docs/`.
+A docs workflow checks those docs, the README and `security.txt` (not
+`SECURITY.md` or this file). The code that will become eSec lives in
+[`embeddedos-org/eos`](https://github.com/embeddedos-org/eos) at
</code_context>
<issue_to_address>
**Docs describe an available CI command**
AGENTS.md now says the repository has a docs workflow and names a verified docs-check command, contradicting the entry's claims that there are no workflows or verified commands and that the tree holds only three files.
Update the knowledge entry to reflect the repository's current contents and docs-check workflow.
Also at `AGENTS.md:15-18`.
</issue_to_address>
### Comment 3
<location path="AGENTS.md" line_range="5" />
<code_context>
-lives in [`embeddedos-org/eos`](https://github.com/embeddedos-org/eos) at
+Placeholder repository (Status: Planned). No implementation, build manifests
+or tests exist on `master` yet. The repository holds the org security policy
+(`SECURITY.md`, `.well-known/security.txt`) and security docs under `docs/`.
+A docs workflow checks those docs, the README and `security.txt` (not
+`SECURITY.md` or this file). The code that will become eSec lives in
</code_context>
<issue_to_address>
**Security policy is now referenced**
AGENTS.md now identifies `SECURITY.md` as the organization's disclosure policy, contradicting the entry's claim that the file does not exist.
Update the knowledge entry to reflect the current presence of `SECURITY.md`.
Also at `AGENTS.md:33-34`.
</issue_to_address>Linked issues
#6 AGENTS.md says the tree has only README/LICENSE/.gitignore, no workflows and no SECURITY.md · 3 of 3 met
| # | Requirement | Status | Notes |
|---|---|---|---|
| 1 | Describe the current tree instead of claiming it contains only README.md, LICENSE and .gitignore or has no workflows. | ✅ Met | The intro now names the policy, security.txt and docs, and describes the docs workflow and what it checks. |
| 2 | State that there is no code or tests and name the verified command, python3 ci/check_docs.py. | ✅ Met | The Build / test / lint section says there is no source code or tests and documents the command run by CI. |
| 3 | Identify SECURITY.md as the security policy. | ✅ Met | The Security section describes SECURITY.md as the organization’s coordinated vulnerability disclosure policy. |
Sourcery assessment
Approval pending. 2 findings to address first.
Blocking findings: AGENTS.md:6, AGENTS.md:5
| ``` | ||
|
|
||
| It needs only the Python standard library. It checks that each doc under | ||
| `docs/` and the README has one H1, that relative links resolve, and that |
There was a problem hiding this comment.
⚪ Low · Sidebar H1 coverage is overstated
When an agent relies on the stated H1 coverage for docs/wiki/_Sidebar.md, check_h1 exempts docs/wiki/_Sidebar.md, so the check passes even when that file has no H1 and agents get a false validation guarantee.
Document that docs/wiki/_Sidebar.md is exempt from the H1 check.
Prompt for AI agents
In `AGENTS.md` at line 22:
**Sidebar H1 coverage is overstated**
When an agent relies on the stated H1 coverage for `docs/wiki/_Sidebar.md`, `check_h1` exempts `docs/wiki/_Sidebar.md`, so the check passes even when that file has no H1 and agents get a false validation guarantee.
Document that `docs/wiki/_Sidebar.md` is exempt from the H1 check.| or tests exist on `master` yet. The repository holds the org security policy | ||
| (`SECURITY.md`, `.well-known/security.txt`) and security docs under `docs/`. | ||
| A docs workflow checks those docs, the README and `security.txt` (not |
There was a problem hiding this comment.
🟡 Medium · Docs describe an available CI command
AGENTS.md now says the repository has a docs workflow and names a verified docs-check command, contradicting the entry's claims that there are no workflows or verified commands and that the tree holds only three files.
Update the knowledge entry to reflect the repository's current contents and docs-check workflow.
Also at AGENTS.md:15-18.
Prompt for AI agents
In `AGENTS.md` at lines 4-6:
**Docs describe an available CI command**
AGENTS.md now says the repository has a docs workflow and names a verified docs-check command, contradicting the entry's claims that there are no workflows or verified commands and that the tree holds only three files.
Update the knowledge entry to reflect the repository's current contents and docs-check workflow.
Also at `AGENTS.md:15-18`.From AGENTS.md L8-13:
## Build / test / lint
No verified commands exist: the tree holds only `README.md`, `LICENSE`, and
`.gitignore` — no manifest (`package.json`, `pyproject.toml`,
`CMakeLists.txt`), no workflows, no tests, and the README documents no
commands. Do not invent commands; re-check the README before running anything.| lives in [`embeddedos-org/eos`](https://github.com/embeddedos-org/eos) at | ||
| Placeholder repository (Status: Planned). No implementation, build manifests | ||
| or tests exist on `master` yet. The repository holds the org security policy | ||
| (`SECURITY.md`, `.well-known/security.txt`) and security docs under `docs/`. |
There was a problem hiding this comment.
🟡 Medium · Security policy is now referenced
AGENTS.md now identifies SECURITY.md as the organization's disclosure policy, contradicting the entry's claim that the file does not exist.
Update the knowledge entry to reflect the current presence of SECURITY.md.
Also at AGENTS.md:33-34.
Prompt for AI agents
In `AGENTS.md` at line 5:
**Security policy is now referenced**
AGENTS.md now identifies `SECURITY.md` as the organization's disclosure policy, contradicting the entry's claim that the file does not exist.
Update the knowledge entry to reflect the current presence of `SECURITY.md`.
Also at `AGENTS.md:33-34`.From AGENTS.md L17, AGENTS.md L22:
No `CONTRIBUTING.md` exists. Keep changes scoped and follow the repository's
|
Premise: pass — master AGENTS.md stale: SECURITY.md, .well-known/security.txt, docs/, ci/ exist; ci/check_docs.py checks one-H1 + links as cited; fixes #6. |
What changed
AGENTS.mdstill described the first version of the repository: onlyREADME.md,LICENSEand.gitignore, no workflows, noSECURITY.md. This PR updates three passages; onlyAGENTS.mdchanges.SECURITY.md,.well-known/security.txt, docs underdocs/) and exactly what the docs workflow checks: the docs, the README andsecurity.txt, but notSECURITY.mdor AGENTS.md.python3 ci/check_docs.py, which is what.github/workflows/ci.ymlruns, and says what it checks (taken from the script's docstring).SECURITY.md,docs/cvd-intake.mdand.well-known/security.txtinstead of saying no policy exists. It keeps "do not report in public issues". It does not name a reporting channel;SECURITY.mdis the single source for that.This PR removes the Security section's
Background: [docs/wiki/Security.md](docs/wiki/Security.md)link. That page still says "No rootSECURITYfile was found", which is now wrong, so linking to it as background would repeat the stale claim. The file itself is not changed: it is a mirror of the wiki and records the commit it inspected.The "Status: Planned" wording is kept as it was; whether it should change is a maintainer decision.
Fixes #6
Previews
Validation
agents-check.sh fda68eb1agents-check.sh <head>python3 ci/check_docs.pygit diff --check fda68eb1 HEADagents-check.shlists the tree at a ref and fails when AGENTS.md at that ref states something the tree contradicts.Summary by Sourcery
Bring AGENTS.md up to date with the repository’s current documentation, automation, and security guidance.
Enhancements:
Documentation: