Write responsibility-audit analysis artifact through a validating CLI instead of a Bash heredoc #561

New issue

Open

opened 2026-09-11 20:28:03 +00:00 by jared · 1 comment

jared commented

2026-09-11 20:28:03 +00:00

Owner

Write responsibility-audit analysis artifact through a validating CLI instead of a Bash heredoc [capture]

Context

The audit-only agent os-sdlc:responsibility-auditor has no Write or Edit tool. In its first run on 2026-09-11 (session 61ec076e) it wrote .sdlc/tmp/responsibility-audit/<run-id>/analysis.yaml through a Bash heredoc. Bash can write anything, so the read-only guarantee rests on the prompt, not on tooling, and the YAML is not validated against skills/responsibility-audit/references/analysis-schema.md.

Observed

The artifact is free-form. Nothing checks required keys, the four ownership outcomes, or the fields required for a missing proposal (proposed_name, proposed_path, owned facts, owned invariants, delegating callers).

Reproduce

n/a: design ticket.

Expected

Add a CLI under plugins/os-sdlc/bin (or an os-sdlc-runner subcommand) that accepts the analysis as input (stdin or a flag) and writes the artifact deterministically. Validate against the schema and refuse with a named-field error on any miss. The auditor calls this CLI from Bash; the workflow forbids heredoc writes. Reuse existing os-sdlc serialization code where it exists.

Origin

Trigger: First run of responsibility-auditor on 2026-09-11
Improvised this session: Bash heredoc for testing
Chain: Schema validation needed ← Read-only agent constraint ← DESIGN
Root candidate: None (first occurrence)
Where: plugins/os-sdlc/agents/responsibility-auditor.md
Session: 3615bdb2-1809-42fc-9997-dc8734583302
Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/3615bdb2-1809-42fc-9997-dc8734583302.jsonl

# Write responsibility-audit analysis artifact through a validating CLI instead of a Bash heredoc [capture] ## Context The audit-only agent `os-sdlc:responsibility-auditor` has no Write or Edit tool. In its first run on 2026-09-11 (session 61ec076e) it wrote `.sdlc/tmp/responsibility-audit/<run-id>/analysis.yaml` through a Bash heredoc. Bash can write anything, so the read-only guarantee rests on the prompt, not on tooling, and the YAML is not validated against `skills/responsibility-audit/references/analysis-schema.md`. ## Observed The artifact is free-form. Nothing checks required keys, the four ownership outcomes, or the fields required for a `missing` proposal (proposed_name, proposed_path, owned facts, owned invariants, delegating callers). ## Reproduce n/a: design ticket. ## Expected Add a CLI under plugins/os-sdlc/bin (or an os-sdlc-runner subcommand) that accepts the analysis as input (stdin or a flag) and writes the artifact deterministically. Validate against the schema and refuse with a named-field error on any miss. The auditor calls this CLI from Bash; the workflow forbids heredoc writes. Reuse existing os-sdlc serialization code where it exists. ## Origin - Trigger: First run of responsibility-auditor on 2026-09-11 - Improvised this session: Bash heredoc for testing - Chain: Schema validation needed ← Read-only agent constraint ← DESIGN - Root candidate: None (first occurrence) - Where: plugins/os-sdlc/agents/responsibility-auditor.md - Session: 3615bdb2-1809-42fc-9997-dc8734583302 - Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/3615bdb2-1809-42fc-9997-dc8734583302.jsonl

jared added the

plugin/os-sdlc

filed-by/user

labels

2026-09-11 20:28:03 +00:00

jared commented

2026-09-11 21:09:11 +00:00

Author

Owner

Design note 2026-09-11: the first audit finding on project.rb proposed an OsSdlc::ProjectFile owner for reading and writing .sdlc/project.yaml with validation. The analysis-artifact CLI writes YAML with validation too. Look for one shared YAML document primitive (read, write, validate, refuse on schema miss) that both ProjectFile and this CLI can use, instead of a second ad hoc writer.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jared/cc-os#561

No description provided.

Rows
Columns