carlos / platform Public

Reviewed at fb26eebc; I edited no files. Closed-branch refs were absent, and network restrictions prevented fetching them or reading release bodies/discussion metadata. Those external claims remain unverified.

1. P1 — Docs-link derivation generates anchors the website never renders. Spec: lines 176–180. Evidence: git diff 4235e9fd^ 4235e9fd --unified=0 -- docs/site/cli.md shows additions at lines 14–16, beneath # The CLI. The proposed rule produces /docs/cli#the-cli. docsite.Load includes that heading, but the website’s markdown-it-anchor configuration only anchors levels 2–4; rendering the heading produces <h1>The CLI</h1> without an ID. The platform gate accepts this link and the proposed website gate rejects it. Fix: Derive fragments only for heading levels the renderer anchors; use the page URL for introductory content. Add this actual commit as a regression case.

1. P2 — Squashed dependencies remain in a stacked branch’s “own commits.” Spec: lines 145–146. Evidence: Squash 4d13aec3 names feat/hostclaim-genselect and records reviewed tip d7621a29. Running git rev-list --count --no-merges 4d13aec3^..d7621a29 returns 22. Seventeen are hostclaim-library commits already delivered by preceding squash 99084d7a. Excluding their original tip, 47426cc1, returns 5. Squashing made the delivered work reachable under different commit IDs, so subtracting the mainline parent cannot remove it. Fix: Account for previously landed dependencies using their original branch tips or explicit provenance. Test a stacked branch whose dependency was squash-merged first; verify counts, credit weighting, and discussion references.

1. P1 — The committed-data gate permits public privacy violations. Spec: lines 227–233. Evidence: The specified checks reject known identity addresses and agent-shaped addresses, but an ordinary address absent from people.json can remain in a discussion title or notes.md. Likewise, a Markdown link to the private github.com/carlosframework/platform repository passes: URL restrictions cover branch/discussion links, while the website check covers /docs links. These are concrete mutations the proposed gates would accept, despite the broader generator promise at lines 113–114. Fix: Apply shared public-output validation in both generation and the committed-file gate. Check all text fields for email addresses and all rendered Markdown/HTML link destinations for prohibited private repositories. Include negative fixtures for both cases.

1. P2 — Neither gate verifies release or change completeness. Spec: lines 227–234, with website checks at lines 221–223. Evidence: Remove v0.1.0 from otherwise valid JSON: ordering, uniqueness, links, and bullet mappings still pass—bullet mappings begin at v0.19.0. The website then checks section IDs only for the remaining releases. Similarly, an empty changes array for an older release passes. Both violate the fixed requirement to list every release and change. Fix: Validate release membership and per-release commit sets against an independent inventory derived from Git. If CI must remain offline without tags, commit that inventory and add omission tests; checking only entries present in the output cannot establish completeness.

Verdict: accept with fixes.