parity: enforce ADR 0023 with an analyzer, so no shipped string carries an internal code or reference #516

New issue

Open

opened 2026-09-15 23:09:35 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-15 23:09:35 +00:00

Owner

What happens

ADR 0023 says every shipped string states its rule in plain language, and never names ADR numbers, internal issue or PR numbers, or other internal references. v0.19.0 shipped adr check output such as docs/decisions/x.md: C7: number 0002 is also used by 0002-b.md, and help text that lists "the MADR rules C1 to C11 and T1". The codes came from a build spec, and no check stopped them.

Ask

A go/analysis analyzer, the framework go vet uses, that walks the string literals in non-test code under internal/ and cmd/ and reports:
- ADR numbers (ADR 0013, ADR-0013) outside records and docs,
- internal issue or PR numbers (#1964),
- bare letter-plus-digit codes used as labels (C7, T1),
  with an explicit allow list for real, reader-visible IDs (version strings, ADR-NNNN as a MADR status value, vulnerability IDs).
Run it in scripts/gate.sh like the other analyzers.
It reports the rule by name in plain words, per ADR 0023 itself.

Acceptance

Adding a shipped string "C7: bad" fails the gate.
The current tree passes after #492 removes the adr check codes.

Related: #492.

## What happens ADR 0023 says every shipped string states its rule in plain language, and never names ADR numbers, internal issue or PR numbers, or other internal references. v0.19.0 shipped `adr check` output such as `docs/decisions/x.md: C7: number 0002 is also used by 0002-b.md`, and help text that lists "the MADR rules C1 to C11 and T1". The codes came from a build spec, and no check stopped them. ## Ask - A `go/analysis` analyzer, the framework `go vet` uses, that walks the string literals in non-test code under `internal/` and `cmd/` and reports: - ADR numbers (`ADR 0013`, `ADR-0013`) outside records and docs, - internal issue or PR numbers (`#1964`), - bare letter-plus-digit codes used as labels (`C7`, `T1`), with an explicit allow list for real, reader-visible IDs (version strings, `ADR-NNNN` as a MADR status value, vulnerability IDs). - Run it in `scripts/gate.sh` like the other analyzers. - It reports the rule by name in plain words, per ADR 0023 itself. ## Acceptance - Adding a shipped string `"C7: bad"` fails the gate. - The current tree passes after #492 removes the `adr check` codes. Related: #492.

hexajon added the

enhancement

label

2026-09-15 23:09:35 +00:00

hexajon referenced this issue

2026-09-15 23:09:55 +00:00

Epic: accepted decisions are enforced by checks, not only recorded #518

hexajon added a new dependency

2026-09-15 23:09:59 +00:00

#518 Epic: accepted decisions are enforced by checks, not only recorded