feedBack/docs
topkoa d0626f5618 ci: address review — check writes too, pin deps, harden the spec pin
Review feedback from CodeRabbit and Copilot on #934. All six findings were
valid; one is fixed the other way round from how it was suggested.

Key-coverage now checks manifest WRITES as well as reads. Copilot correctly
spotted that `ast.walk` ignored subscript context, so
`manifest["year"] = ...` (lib/songmeta.py) scored as a read — but the fix is
not to drop writes. A key core *writes* is spec surface pointed outward: it
lands in every pack we emit, so an undeclared one seeds the ecosystem with
non-spec data. Subscripts are now classified by ctx (Store = write, Load =
read) and both sets are checked, with distinct error messages. Today: 19
reads, 2 writes, all declared.

Workflow:
- persist-credentials: false on the repo checkout — the job runs repository
  code and never pushes (CodeRabbit / zizmor artipacked).
- .feedpak-spec-ref must be a full 40-char SHA. actions/checkout resolves
  branches and tags in `ref` too, so a non-SHA there would silently un-pin
  the spec — precisely what the file exists to prevent.
- Pin jsonschema==4.26.0, for the same reason the spec SHA is pinned: an
  upstream release must not redden this job on a PR that changed neither
  this repo nor the spec.

Script:
- check_forward() guards a missing examples/ dir instead of raising an
  unhandled FileNotFoundError.
- TemporaryDirectory() instead of mkdtemp(), so a local run doesn't leak.

Signed-off-by: topkoa <topkoa@gmail.com>
2026-07-12 23:44:15 -04:00
..
benchmarks rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
diagnostics fix(diagnostics): rebuild diagnostic sloppak so song name reads "FeedBack", not "Slopsmith" (#621) 2026-06-28 12:47:12 +02:00
skills rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
3dhighway-open-string-double-sustain.jpg Clean release snapshot 2026-06-16 18:47:13 +02:00
capability-domains.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
capability-recipes.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
capability-review-preflight.md Clean release snapshot 2026-06-16 18:47:13 +02:00
capability-roadmap.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
capability-safety-matrix.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
diagnostics-bundle-spec.md docs: correct plugin URL casing after the feedBack rename (#576) 2026-06-23 11:20:23 +02:00
feedpak-spec-gate.md ci: address review — check writes too, pin deps, harden the spec pin 2026-07-12 23:44:15 -04:00
host-theme-contract.md docs: host theme contract proposal (#645) 2026-06-29 15:48:35 +02:00
library.png Clean release snapshot 2026-06-16 18:47:13 +02:00
NOTE_FAILURE_PLAN.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
NOTE_FAILURE_SPEC.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
note-detect-tuning.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
perf-baseline.md perf(harness): add 2D-highway frame-time measurement + capture the R3c gate (H0) (#848) 2026-07-10 23:15:07 +02:00
player-2d.jpg Clean release snapshot 2026-06-16 18:47:13 +02:00
player-3d.jpg Clean release snapshot 2026-06-16 18:47:13 +02:00
player-3d.webp Clean release snapshot 2026-06-16 18:47:13 +02:00
plugin-capability-inventory.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
plugin-manifest.schema.json rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
plugin-modules.md R0: module-migration rails (src/ serving, live-edit cache, scriptType loading, governance) (#812) 2026-07-08 10:14:40 +02:00
plugin-panes.md docs(panes): the lifecycle traps — isConnected lies, and re-injection duplicates 2026-07-12 22:58:10 -04:00
plugin-styles.md refactor(ui)!: remove the classic v2 shell — v3 is the only UI (R3a) (#871) 2026-07-11 16:33:03 +02:00
plugin-v3-ui.md refactor(ui)!: remove the classic v2 shell — v3 is the only UI (R3a) (#871) 2026-07-11 16:33:03 +02:00
size-exemptions.md refactor(server): extract the artist routes into routers/artist.py (R3) (#870) 2026-07-11 15:49:37 +02:00
sloppak-hand-editing.md docs: correct plugin URL casing after the feedBack rename (#576) 2026-06-23 11:20:23 +02:00
sloppak-spec.md rename: slopsmith → feedBack, byron → got-feedBack (#537) 2026-06-23 11:03:01 +02:00
working-tuning-on-device-tests.md fix(tuner): mic-verify stamps the tuning it actually checked + on-device test plan (#684) 2026-07-01 11:45:26 +02:00