From 0ffe8d3f449aa4c49fce08b29404dace906ce568 Mon Sep 17 00:00:00 2001 From: Szymon Chmal Date: Thu, 24 Sep 2026 12:42:43 +0200 Subject: [PATCH] chore: promote mechanism notes to LESSONS.md on first occurrence --- .agents/memory/INBOX.md | 5 ----- .agents/memory/LESSONS.md | 6 +++++- .claude/skills/review-memory/SKILL.md | 10 ++++++---- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/.agents/memory/INBOX.md b/.agents/memory/INBOX.md index c3b4009..f0b4bdc 100644 --- a/.agents/memory/INBOX.md +++ b/.agents/memory/INBOX.md @@ -18,11 +18,6 @@ One note per PR that hit friction, four lines: Would have prevented it: review-pr should check whether the PR author is the current gh user and, if so, post the verdict as a comment review saying "approve" instead of trying the approve event. Cost: review round Seen: 2026-09-24 -- 2026-09-24 #99 skill: implement-issue - What went wrong: the new integration test set NODE_TLS_REJECT_UNAUTHORIZED=0 and rejectUnauthorized: false, copied from older tests, which raised two high CodeQL alerts and a second review round. - Would have prevented it: a daemon integration test trusts the daemon's certificate via `ca: daemon.tls.current().certPem` and never disables TLS verification. - Cost: review round - mechanism: ESLint rule banning NODE_TLS_REJECT_UNAUTHORIZED / rejectUnauthorized: false in test files, filed as #104 - 2026-09-24 #100 skill: work-issue What went wrong: device E2E could not run in the cloud session because the Linux container has no iOS simulator, so both slices waited for a human to run it locally. Would have prevented it: at the start, check for a simulator (xcrun, or an Android emulator with KVM) and, if there is none, ask the human up front to run e2e-device locally. diff --git a/.agents/memory/LESSONS.md b/.agents/memory/LESSONS.md index e923da5..ecc9b43 100644 --- a/.agents/memory/LESSONS.md +++ b/.agents/memory/LESSONS.md @@ -4,7 +4,7 @@ Curated memory for agents working on this repo. Read only the section named afte you are running, plus General. Written only by the `review-memory` skill; everything else goes to [INBOX.md](INBOX.md) first. -Entry format, two lines: +Entry format, two lines, plus a third `Mechanism: #` while a lint rule or test is pending: ``` - YYYY-MM-DD (#PR, #PR) @@ -19,6 +19,10 @@ Caps: 10 entries per section, 40 in total. Over the cap, the next review merges ## implement-issue +- 2026-09-24 (#99) A daemon integration test trusts the daemon's certificate with `ca: daemon.tls.current().certPem` and never disables TLS verification, even where older tests do. + Evidence: copying `NODE_TLS_REJECT_UNAUTHORIZED=0` and `rejectUnauthorized: false` from older tests raised two high CodeQL alerts and cost a review round. + Mechanism: #104 + ## review-pr ## triage-issue diff --git a/.claude/skills/review-memory/SKILL.md b/.claude/skills/review-memory/SKILL.md index 56ac2c9..a76fea8 100644 --- a/.claude/skills/review-memory/SKILL.md +++ b/.claude/skills/review-memory/SKILL.md @@ -33,10 +33,12 @@ Otherwise branch: `git switch -c "memory/$(date +%Y-%m-%d)"`. different PRs, or once when the cost was a wrong merge or a security miss. Merge the notes into one entry citing all PRs. - **Promote to General** only when it applies to every skill. Expect this to be rare. -- **Mark for a mechanism** when the rule could be a lint rule or a test. Keep the entry - and add "mechanism: " to it; file a `type:chore` issue via the `file-issue` skill - so a human can schedule it; skip its interview, the notes are the spec. Once the - mechanism lands, the entry is deleted on the next review. +- **Mark for a mechanism** when the rule could be a lint rule or a test. File a + `type:chore` issue via the `file-issue` skill so a human can schedule it; skip its + interview, the notes are the spec. Then promote the note to its skill section even on a + single occurrence, with a third line `Mechanism: #`, and remove it from the inbox: + agents never read the inbox, and the entry covers the gap until the mechanism lands. Once + it lands, the entry is deleted on the next review. - **Keep** a note that matches nothing yet and has no `Seen:` line. Add `Seen: ` as its fifth line so the next review can pair it with a later note. - **Drop** a note that already carries a `Seen:` line and still matches nothing, or whose