Docs/ATR 260904 prose sweep - #60
Merged
Merged
Conversation
Four files stated that every change to a shipped skill or subagent bumps `x-ai-tools-version`, which had already carried the technical-docs skill two increments past the released value inside a single cycle. A host installs released packages only, so the version the seeder compares against a live copy is meaningful per release; the first edit of a cycle bumps it and later edits leave it alone. The policy keeps one home in shipped-assets.rule.md, with the seeder header and the two asset READMEs pointing at it.
…an see The three shape checks greped a vocabulary for a rule about meaning, and reported correct prose on most of what they flagged across this tree: `cannot` fired on every sentence that already named its guard, `rather than` on every plain contrast, and `is no` on the existential the fronted-quantifier check deliberately excludes. Each now carries a second condition -- a word stem repeated across the pivot for the two mirror rules, an absolute in a sentence with no subordinating conjunction for the guard rule -- which takes the tree's `--all` report from 3610 findings to 1723 while still catching the figures the standard names. Checks read rejoined sentences instead of single lines, because wrapped prose puts the guard clause of an absolute on the following line and the mirror rules compare the two halves of a pivot. Findings gained a line number, fenced code in a document is skipped, and `no longer` left the history check: it describes a current state as often as a change.
…number to arity The checker read `#` comments and whole documents only, so a Python docstring or a JSDoc block was invisible to it -- and doc comments are an artifact this standard covers. It now reads `//`, `/* */` and triple-quoted blocks as well, which is what caught `shares no stem` in the checker's own source. The rule to pluralize an indefinite object under `any` read as a grammar preference, but `does not take any path arguments` and `does not take a path argument` are different claims about arity, so it now sends the writer to the signature. The paragraph on the fronted quantifier names its antecedent instead of conceding brevity to the form it rules out.
Both files carried the figures the writing standard rules out, most often where they made a security claim: fronted quantifiers (`names no agent`, `holds no sudo rule`), absolutes with the guard left in the next sentence, and a definitional negation the standard itself lists as off style. Each rewrite states what the component does. `ai-tools-run` is agent-agnostic rather than naming no agent, `--stop` sweeps every cgroup under the account rather than exempting none, and the trust table's one-line summary of `--project-remove` drops the restatement that followed it. The facts are unchanged; the arity of each negated object now matches the code it describes.
Three slips in one session came from the same move: repairing the word the checker flagged instead of restating the claim from the code. `grants nothing` became `confers no authority`, which clears the grep, trades a domain term for a legal one, and still fronts the quantifier. The final pass now names that move and points at the code as the place a rewrite starts, which is also what settles the questions a rule cannot answer in the abstract -- the arity of a negated object among them.
…tions The rule sat in two places and the universal copy -- the one a writer reads first -- said only "resolve against the code". Read alone it licenses conforming an invariant to whatever the code currently does, which retires a guarantee by editing prose, and it had no answer for a refactoring, where prose describing the target state is supposed to lead the code. One section now carries all three directions: the code decides a description, the invariant decides where code contradicts a guarantee, and a migration records the gap instead of resolving it either way. The reference-docs section keeps the three-altitude point and links here, and the final pass points here for which side a rewrite starts from.
Every rule file carried the same two figures, densest wherever it made a security claim: a fronted quantifier (`names no agent`, `holds no sudo rule`, `takes no target`) and `nothing` standing in for the input that is absent. Both hide which input a reader should go look for. Each one is restated as what the component does -- `ai-tools-run` is agent-agnostic, `--stop` sweeps every cgroup under the account, a skipped provider does not contribute a fragment -- and the number of each negated object now follows the arity in the code. Filler and one history clause went with them. The claims are unchanged; `prose-check.py` reports none of the two default checks across the directory.
…sentence The hook reported a fronted quantifier the whole-file pass does not, because the existential "there is" that excuses it sat on an unchanged line the diff never showed.
The guides and the three man pages leaned on `nothing` and on fronted quantifiers to describe what a command leaves alone -- `spares nothing`, `takes no target`, `changes nothing at all` -- which tells an operator that something is absent without saying which thing. Each is restated as the mechanism: `--stop` covers every cgroup under the account, `--project-unclaim --dry-run` applies none of the changes it lists, and a `--force` run leaves every path as it found it. The exit-status tables now name what was not stopped rather than reporting `nothing`. All three pages still render warning-free under `man --warnings`.
`/*|./*|../*)` is a `case` branch in `ai-tools.sh`, and the checker read its leading `/*` as a C block comment, so every line to the next `*/` -- the rest of the file -- was checked as prose. It reported hits inside `say` and `die` strings and inside shell code, which is how it surfaced. A comment opener now needs a space, a second `*`, or the line end after `/*`, and the ` * ` margin is stripped only inside a block that is already open, so a `*)` branch stays code. Javadoc, C block comments, and `//` lines still read.
… libraries The file headers and inline comments carried the same figures the rules did, and the densest were the ones explaining a security property: `nothing is exempt`, `takes no target`, `holds no sudo rule`, `the stamp gates NOTHING`. A reader met the fact that something is absent without being told which thing. Each is restated as the mechanism it describes -- the stop sweep covers every cgroup in the account's slice, `ai-tools-run` is agent-agnostic, and a stamp accessor documents an empty string as its empty result -- and each negated object now carries the number the code has. Behaviour is untouched; every file still parses under `bash -n`.
…ports a drop Rewriting `carries no secret` as `contains only settings` clears the style rule and retires the guarantee: the first says the contents and the secrets do not intersect, the second says the contents are settings, and a setting can be a token. Only the first justifies the 644 mode it was written to justify. The affirmative-framing rule invites exactly that substitution, so it now carries the bound -- carry the boundary through the edit unchanged, and keep the negation where the positive form would denote a different set. `--kept` is the mechanical half: it compares the two sides of a diff and reports a security term the rewrite dropped. Disjointness is not a property a regex can decide, so it reports and leaves the judgement to a reader.
…rlier commits weakened The helpers, the shared libraries, the provider manifests and the two shipped config files get the same treatment as the CLI: a fronted quantifier becomes `does not <verb>`, and `nothing` gives way to the input that is absent. The second half is a correction. Rewriting `carries no secret` as a positive statement over a different set -- `holds only code`, `holds only patterns`, `contains only settings` -- reads better and stops justifying the 644 mode the sentence was written to justify, because code and settings can both contain a token. Those five now state the boundary normatively: the file must not hold a secret. `prose-check.py --kept develop` does not report a dropped term across the branch, and every file still parses under `bash -n`.
Same pass over `install.sh`, the spec and its container files, the Makefile, and the SELinux install and AVC scripts: a fronted quantifier becomes `does not <verb>`, and `nothing` gives way to the absent input -- no rule matched, no entrypoint to label, an empty ausearch result. Five comments in `install.sh` justified a `644` mode with `carries no secrets`; those keep the boundary and state it normatively. `prose-check.py --kept develop` stays quiet, and both shell entry points parse under `bash -n`.
The suite's headers describe what each case proves, and leaned on the same two figures to do it. Each now names the thing that is absent -- the process that is not signalled, the path that is not touched -- so a reader learns which input a case withholds. Two lines quote runtime output verbatim and carry `prose-check: allow`. Comments only: every file parses under `bash -n`, and shellcheck stays quiet at error severity. The suite itself needs root, so it has not been run here.
… and the shipped skills The last file types the earlier passes missed: the policy `.te`/`.fc` comment blocks, the two handback Python files, `CONTRIBUTING.md`, and the other two shipped skills. The tree is now clean on both default checks. One of these was a correction. The governance framework's clause on self-verification said that verification a system performs against a key it can reach `provides no assurance`; rewriting it positively inverted the clause into its opposite. It reads `does not provide assurance`, and the pre-commit hook's note about a backlog of findings goes with the backlog.
`ai-tools --stop` accepts `--dry-run`, `--yes`, `--force` and `--all`; the README had it accepting no arguments at all, where the true claim is the narrower one it replaced -- no path and no authorization input. The session-end sweep reaches a SUBSET of what the per-turn hooks reach, since both pass the same chown validation and the sweep also skips the heavy trees. Three copies said the two reaches were equal. The updater's stamp is described by what reads it rather than as `advisory`, and the relabel verdict table gets back the consequence its third column had.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.