topkoa d806d12c22 ci: close two blind spots in the key scan ... Review found the gate was scanning less than it claimed. READERS missed two modules that genuinely touch feedpak manifests: lib/routers/ws_highway.py (reads `authors`) and lib/gp2notation.py (loads manifest.yaml, stamps feedpak_version, writes the file back). Keys touched there were going entirely unchecked. The scan also only recognised writes done via subscript, so `manifest.setdefault("k", v)` — exactly how gp2notation.py stamps feedpak_version — was invisible. setdefault with a literal key now counts as a write. The deeper problem is that READERS is hand-maintained, and a hand-maintained list rots; that is how both modules went unnoticed. check_readers_complete() now re-derives the set: any module under lib/ (or server.py) that both touches manifest keys and shows a feedpak signal must be listed, or the build fails. It is a guard on the gate itself. The list stays explicit rather than becoming a glob, because `manifest` is overloaded here: lib/loosefolder.py (the loose-folder manifest.json) and lib/diagnostics_bundle.py (the diagnostics bundle manifest) have their own unrelated manifests, and scanning those would flag *their* keys as feedpak drift. Both score zero on the feedpak signals, which is what keeps them out. Now scanning 5 modules: 20 reads, 2 writes, all spec-declared. Signed-off-by: topkoa <topkoa@gmail.com>		2026-07-13 00:23:36 -04:00
..
check_spec_conformance.py	ci: close two blind spots in the key scan	2026-07-13 00:23:36 -04:00