Adopt Trust 1 and SpecSync 5 - #9
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request integrates SpecSync 5.0.1 and Trust 1.0.0 into the repository, adding necessary configuration files, agent skill instructions, and updating the Swift package lockfile. The feedback highlights several key improvements: the verify lane in fledge.toml should execute tests to satisfy attestation requirements, the SpecSync source directory configuration needs to be updated to target the Swift Sources directory, core configuration files should be tracked under meaningful_paths in sdd.json, and the empty headings in the markdown skill files should be cleaned up.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| [lanes.verify] | ||
| description = "Build the Augur plugin" | ||
| steps = ["build"] |
There was a problem hiding this comment.
The verify lane currently only runs the build step. Since .attest.json requires tests to pass (requireTestsPassed: true), the verification lane should also execute the test task to ensure that code correctness is validated before attestation/verification is completed.
| [lanes.verify] | |
| description = "Build the Augur plugin" | |
| steps = ["build"] | |
| [lanes.verify] | |
| description = "Build and test the Augur plugin" | |
| steps = ["build", "test"] |
| @@ -0,0 +1,8 @@ | |||
| specs_dir = "specs" | |||
| source_dirs = ["src"] | |||
There was a problem hiding this comment.
The source_dirs is configured to look in ["src"]. However, this is a Swift project where the source files are located in Sources/fledge-augur/ (as indicated in .specsync/sdd.json). Please update source_dirs to include "Sources" so that SpecSync can correctly scan and synchronize the Swift source files.
| source_dirs = ["src"] | |
| source_dirs = ["Sources"] |
| ".specsync/config.toml", | ||
| ".specsync/config.json", | ||
| ".specsync/version", | ||
| "Sources/fledge-augur/" |
There was a problem hiding this comment.
The meaningful_paths array lists various project files but does not include the core configuration files like fledge.toml, .trust.toml, .augur.toml, or .attest.json. Adding these files ensures that any modifications to build tasks, trust gates, or attestation policies are tracked as meaningful changes under the SDD lifecycle.
| "Sources/fledge-augur/" | |
| "Sources/fledge-augur/", | |
| "fledge.toml", | |
| ".trust.toml", | |
| ".augur.toml", | |
| ".attest.json" |
| ## Companion files | ||
|
|
||
| ## Verified SDD change lifecycle (5.0) |
There was a problem hiding this comment.
The ## Companion files heading is currently empty, and the actual description of the companion files is placed under the ## Verified SDD change lifecycle (5.0) section. Reorganizing this content so that the companion files list is directly under its corresponding heading improves document structure and readability.
| ## Companion files | ||
|
|
||
| ## Verified SDD change lifecycle (5.0) |
There was a problem hiding this comment.
The ## Companion files heading is currently empty, and the actual description of the companion files is placed under the ## Verified SDD change lifecycle (5.0) section. Reorganizing this content so that the companion files list is directly under its corresponding heading improves document structure and readability.
| ## Companion files | ||
|
|
||
| ## Verified SDD change lifecycle (5.0) |
There was a problem hiding this comment.
The ## Companion files heading is currently empty, and the actual description of the companion files is placed under the ## Verified SDD change lifecycle (5.0) section. Reorganizing this content so that the companion files list is directly under its corresponding heading improves document structure and readability.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
馃挕 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24a90fc665
鈩癸笍 About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 馃憤.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "require_change_for_meaningful_files": true, | ||
| "meaningful_paths": [ | ||
| "src/", | ||
| "tests/", |
There was a problem hiding this comment.
With require_change_for_meaningful_files enabled, this policy only lists lowercase tests/, but this repo's test evidence is under Tests/ (Tests/plugin_contract_test.sh). On Git's case-sensitive path names, a PR that only changes these tests will not match the meaningful-path policy and can bypass the SpecSync change requirement, so add Tests/ or rename the directory to keep test changes covered by the trust gate.
Useful? React with 馃憤聽/ 馃憥.
|
|
||
| [contract] | ||
| enabled = true | ||
| require_coverage = 0 |
There was a problem hiding this comment.
I checked the CorvidLabs/trust v1.0.0 action: it forwards [contract].require_coverage to SpecSync's require-coverage input, which SpecSync documents as the minimum file coverage percent. Leaving this at 0 means the CI trust gate can pass when a future PR adds a new source file under Sources/ without any spec coverage, despite this adoption change claiming 100% strict SpecSync coverage; set this to 100 if the trust gate is meant to enforce the stable contract.
Useful? React with 馃憤聽/ 馃憥.
| ".specsync/config.toml", | ||
| ".specsync/config.json", | ||
| ".specsync/version", | ||
| "Sources/fledge-augur/" |
There was a problem hiding this comment.
With require_change_for_meaningful_files enabled, the meaningful-path list adds the Swift source tree but omits the root plugin.toml and fledge.toml files. Those files define the plugin command/capabilities and the verification lane that this Trust gate runs, so a later PR can alter the public plugin contract or remove test steps without SpecSync requiring a change workspace; add these root config files to the policy.
Useful? React with 馃憤聽/ 馃憥.
1 participant
Why
Migrate the official Augur Fledge plugin to the released governance contract and align its lockfile with Augur 1.0.0.
What changes
.trust.tomlwith blocking risk, progressive provenance, and Atlas disabled.Package.resolvedto the plugin's declared Augur 1.0.0 dependency.Validation
fledge trust doctortrustchecks