Plans index¶
Every planning document in this repository, oldest first. The plans here are about the fleet's tooling rather than about a product: what the consistency audits check, how they are run, and how whole-codebase human review is tracked.
None of these plans has separate phase files. Where a plan is phased its phases are sections inside it, tracked in its own Execution table; this page carries only the one-line status.
Status cells use the shared vocabulary from
templates/shared-blocks/plan-status-vocabulary.md, which is the same
list the plan-index audit enforces across the fleet. A status says
whether the plan still wants attention and nothing else -- the dates,
the phase arithmetic and the summary of what happened live in the plan.
| Date | Plan | Intent | Status |
|---|---|---|---|
| 2026-02-18 | Project consistency | The original per-project audit of every Shaken Fist repository, and the cleanup backlog it produced | Superseded |
| 2026-02-18 | stestr / testtools pin | Pin stestr and testtools around an upstream incompatibility, and record the conditions for removing the pin | Blocked |
| 2026-03-08 | Consistency audits v2 | Rebuild the audit as modular specs, a CI runner and GitHub issue automation, so criteria can be added without re-auditing everything | In progress |
| 2026-07-09 | Code review tracking | Systematic whole-codebase human review: weAudit, signed review state, staleness pruning against blob SHAs | In progress |
| 2026-08-02 | Review coverage steady state | Take review tracking from a manual loop to a steady state: CI pruning on the default branch, and coverage alerting from the daily audit. Both halves have been running in five repositories since August; the verification phase and the push audit have both run, and the audit's six findings have all landed -- three in development#158 and three in ryll#389 | Complete |
| 2026-08-15 | LLM doc structure | An audit keeping AGENTS.md and ARCHITECTURE.md a summary and an index rather than a second copy of docs/ | Complete |
| 2026-08-16 | Plan template blocks | Shared blocks for PLAN-TEMPLATE.md, so plans are written to the conventions rather than corrected against them afterwards | In progress |
| 2026-08-24 | Push audit phase | Give the pre-push audit a trigger: a mandatory final phase in every master plan, and a consistency check that nothing drops the reference. The review point confirmed the phase stays mandatory; the fleet backfill swept six repositories and recorded each plan's landing commits in those and this one, and found that the survey's repository list was narrower than the fleet. The push audit ran over the union of the phases' merge commits and direct landings rather than a span; it found two blocking defects in the plan checks -- a symlink escape and a quadratic link regex, both fixed -- and a defect in the runbook it was reading, which assumed the work under audit had not yet merged | Complete |
| 2026-08-27 | Audit compliance split | Move the generated compliance tables out of the criterion specifications, so the prose that defines the standards can hold a human review mark | In progress |
| 2026-09-01 | Audit scripts restructure | Turn the 6,657-line audit checker into a package of check classes with a GitHub seam, so a criterion is one module and every check is testable | Complete |
| 2026-09-04 | Scope coverage | Reconcile the audit scope against the organisation every morning, so a repository in neither the matrix nor the excluded list stops being invisible. The criterion is live and reports compliant, and the push audit of what landed has run and its four fixes have merged | Complete |
| 2026-09-11 | TypeScript onboarding | Bring hunkydory, the fleet's first TypeScript repository, under the consistency audits and human review, deciding what the conventions mean for npm, linting and the runner images. Phases 1 to 6 have landed and 7a packages the extension; a probe on the publish lane found it carries neither node nor npm, so the merged release workflow could not publish as written and 7b.1 repairs it. Marketplace publishing is held on an operator standing up an Entra federated credential, and the push audit is planned across all three repositories the plan touched | In progress |
| 2026-09-13 | Image supply chain | Close the end-of-life migration and the five silent image-production failures behind it, in an order that does not break CI, and stop the audit being blind to the producers. All seven phases have landed, the sixth adding the eol-producers criterion that closed the audit's blind spot. The seventh, the push audit, read forty-three landings in seventeen repositories rather than the eleven in four it was scoped for, and found the record it audits from holding branch commits instead of merge commits, eight plan references in code, a deployment host in a public README, and a phase 4 mitigation whose check could not fail. What each phase found is in the plan |
Complete |
| 2026-09-20 | Review unit size | Cut what a whole-file review session has to re-read: a source-file-size shared block framed as re-review cost, enforcement of it and of plan-phase-landing across the fleet, then finishing the CheckTestCase migration that PLAN-audit-scripts-restructure left half done | Complete |
| 2026-09-24 | Review import | Count a review done here wherever the same bytes appear in another adopted repository: an import step beside prune that follows each imported mark to its signed commit here, the review tracking CI as a byte-identical template, and converging drifted template copies so more files qualify |
Complete |
| 2026-10-02 | Workflow ref trust | Settle #153: finish the secrets: inherit rollout, require a pull request and CI on shakenfist/actions main rather than sha-pinning first-party refs, pin third-party actions to a sha under Renovate and a new criterion, and replace copied workflow templates with callers of shared workflows |
In progress |
| 2026-10-03 | Renovate cadence | Cut the pull requests Renovate opens, and the CI they cost, by about half without slowing security fixes: one central runner instead of a copy per repository, the fleet policy in a shared preset with tiered schedules, and CI-tooling updates grouped monthly | Not started |
| 2026-10-07 | Bot bypass identity | Settle #211: make the only automation bypass on default-branch rulesets a GitHub App whose key only default-branch code can read, and take the bypass away from shakenfist-bot, whose PATs every Renovate run and several pull-request jobs carry |
Not started |
| 2026-10-10 | Plan references in code | Settle #239: make the plan-references-in-code block enforceable -- a push-audit grep for added references, a criterion measuring the existing backlog in source, and this repository cleaned first | Complete |
| 2026-10-18 | Release gating | Settle client-python-ova#19 fleet-wide: a criterion that every release environment has a reviewer and a tag-only policy, a shared gate that stops a release whose tagged commit did not pass CI, a shared wheel check that keeps tests off PyPI, which eight of nine packages ship today, and a merge queue and one release shape per language (Python and Rust) on every release repository, all measured by the audit | In progress |