Engineering требует npm ci/full verify каждого code change/worker. Pre-commit всегда builds packages/full graph, даже Markdown-only, после staged lint. Plain npx lint-staged допускает installation fallback; состоявшаяся установка не подтверждена.
Expected Behavior
Install только по environment/manifest/lock/Node need; targeted iteration и один final full gate. Hook проверяет actual staged input, full graph остаётся final/required CI, tools не скачиваются при commit.
Existing gate guidance и minimal hook change; package declarations подготовлены для relevant lint consumers.
Out of scope
Hash/cache/staged graph analyzer, removal graph/coverage/Chromium/app/catalog final proof, изменение standard OpenSpec skills.
Proposed Approach
Убрать mandatory npm run deps из hook, existing full graph в final/CI. npx --no для installed tool. Standalone wrappers self-contained; direct runner iteration только после explicit current preparation.
Acceptance Criteria
Markdown-only commit: staged redacted Gitleaks и commitlint, без package build/full graph.
Secret fixture fail-closed до downstream; staged JS/TS autofix/index handling сохранены, отсутствующий lint tool не устанавливается.
Import cycle/catalog reachability error всё ещё fails final verify/required CI.
Code-only task в prepared checkout не делает unconditional npm ci/worker full gate; final same-diff full verify и auth/money/contract/UI risk evidence сохранены.
Verification
Existing hook synthetic regression + controlled missing-tool PATH/cache, meaningful staged TS lint на fresh declarations; одна bounded task invocation comparison. Финальный full frontend gate после последнего relevant edit, без repeated unchanged reruns.
<!-- wealthledger-audit:2026-10-11:frontend-verification-workflow -->
## Problem
Engineering требует npm ci/full verify каждого code change/worker. Pre-commit всегда builds packages/full graph, даже Markdown-only, после staged lint. Plain npx lint-staged допускает installation fallback; состоявшаяся установка не подтверждена.
## Expected Behavior
Install только по environment/manifest/lock/Node need; targeted iteration и один final full gate. Hook проверяет actual staged input, full graph остаётся final/required CI, tools не скачиваются при commit.
## Evidence
Audit date `2026-10-11`; [11](https://git.personal.ksv741.ru/WealthLedger/main/src/commit/d07fbfabb1295780952a554185989d2d5b5c8349/audits/2026-10-11/reports/11-validation-and-ci-cd-efficiency-report.md), [14](https://git.personal.ksv741.ru/WealthLedger/main/src/commit/d07fbfabb1295780952a554185989d2d5b5c8349/audits/2026-10-11/reports/14-ai-agent-workflow-efficiency.md). IDs VERIFY-004, TOOL-002, AGENT-001 (frontend), CA-H01, CA-H06, RC-01, RC-03, RC-07, RC-08, RC-15. Revision `c8821200ce699dab1ce65360d1968d5877a2e78b`; Confidence High; Verification status static; savings unmeasured.
Affected: [.husky/pre-commit:1–3](https://git.personal.ksv741.ru/WealthLedger/frontend/src/commit/c8821200ce699dab1ce65360d1968d5877a2e78b/.husky/pre-commit#L1-L3); package.json:14–38; engineering.md:58–66; scripts/test-pre-commit.mjs:38–74.
## Scope
### In scope
Existing gate guidance и minimal hook change; package declarations подготовлены для relevant lint consumers.
### Out of scope
Hash/cache/staged graph analyzer, removal graph/coverage/Chromium/app/catalog final proof, изменение standard OpenSpec skills.
## Proposed Approach
Убрать mandatory npm run deps из hook, existing full graph в final/CI. npx --no для installed tool. Standalone wrappers self-contained; direct runner iteration только после explicit current preparation.
## Acceptance Criteria
- [ ] Markdown-only commit: staged redacted Gitleaks и commitlint, без package build/full graph.
- [ ] Secret fixture fail-closed до downstream; staged JS/TS autofix/index handling сохранены, отсутствующий lint tool не устанавливается.
- [ ] Import cycle/catalog reachability error всё ещё fails final verify/required CI.
- [ ] Code-only task в prepared checkout не делает unconditional npm ci/worker full gate; final same-diff full verify и auth/money/contract/UI risk evidence сохранены.
## Verification
Existing hook synthetic regression + controlled missing-tool PATH/cache, meaningful staged TS lint на fresh declarations; одна bounded task invocation comparison. Финальный full frontend gate после последнего relevant edit, без repeated unchanged reruns.
## Dependencies
Нет; P1 backend не ждёт этого улучшения.
## Traceability
Campaign https://git.personal.ksv741.ru/WealthLedger/main/issues/23 . Findings VERIFY-004, TOOL-002, AGENT-001, CA-H01, CA-H06, RC-01, RC-03, RC-07, RC-08, RC-15. WealthLedger/frontend; T14 frontend.
codex-bot
added this to the Technical Audit Remediation — 2026-10-11 milestone 2026-10-11 21:50:28 +03:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
Engineering требует npm ci/full verify каждого code change/worker. Pre-commit всегда builds packages/full graph, даже Markdown-only, после staged lint. Plain npx lint-staged допускает installation fallback; состоявшаяся установка не подтверждена.
Expected Behavior
Install только по environment/manifest/lock/Node need; targeted iteration и один final full gate. Hook проверяет actual staged input, full graph остаётся final/required CI, tools не скачиваются при commit.
Evidence
Audit date
2026-10-11; 11, 14. IDs VERIFY-004, TOOL-002, AGENT-001 (frontend), CA-H01, CA-H06, RC-01, RC-03, RC-07, RC-08, RC-15. Revisionc8821200ce699dab1ce65360d1968d5877a2e78b; Confidence High; Verification status static; savings unmeasured.Affected: .husky/pre-commit:1–3; package.json:14–38; engineering.md:58–66; scripts/test-pre-commit.mjs:38–74.
Scope
In scope
Existing gate guidance и minimal hook change; package declarations подготовлены для relevant lint consumers.
Out of scope
Hash/cache/staged graph analyzer, removal graph/coverage/Chromium/app/catalog final proof, изменение standard OpenSpec skills.
Proposed Approach
Убрать mandatory npm run deps из hook, existing full graph в final/CI. npx --no для installed tool. Standalone wrappers self-contained; direct runner iteration только после explicit current preparation.
Acceptance Criteria
Verification
Existing hook synthetic regression + controlled missing-tool PATH/cache, meaningful staged TS lint на fresh declarations; одна bounded task invocation comparison. Финальный full frontend gate после последнего relevant edit, без repeated unchanged reruns.
Dependencies
Нет; P1 backend не ждёт этого улучшения.
Traceability
Campaign WealthLedger/main#23 . Findings VERIFY-004, TOOL-002, AGENT-001, CA-H01, CA-H06, RC-01, RC-03, RC-07, RC-08, RC-15. WealthLedger/frontend; T14 frontend.