pdurlej/fallow-py

Fork 0

Triage DeepSeek v4 Pro audit into actionable backlog #35

New issue

Closed

opened 2026-05-12 08:04:15 +02:00 by codex · 1 comment

codex commented

2026-05-12 08:04:15 +02:00

Collaborator

Context

DeepSeek v4 Pro produced a broad repository audit on 2026-05-11/2026-05-12. The audit is useful as input, but it mixes actionable findings, deferred design work, roadmap ideas, and several false claims. This issue is the durable index for the triage so the work survives chat/context compaction.

Current ADR / issue references checked

ADR 0008: Phase B/C execution is evidence-gated and dogfood-bounded.
ADR 0009: three-bucket classification is accepted design, but implementation is explicitly deferred.
Forgejo #27 / B13: tracks ADR 0009 implementation (manual_only removal, review_needed -> decision_needed, mandatory trade_offs). Do not duplicate it.

Accepted actionable follow-ups

#36 — CLI --changed-only non-git UX: create one clear warning path instead of a confusing deprecation + unavailable combination.
#37 — Config TOML strict type validation: invalid types should produce field-specific ConfigError before dataclass values leak into analysis.
#38 — Source-root discovery ordering: replace string-length ordering with an explicit specificity policy.
#39 — Curated audit triage note: record accepted/deferred/rejected DeepSeek findings without treating the raw audit as canonical truth.

Deferred / research follow-ups

#40 — MCP report-cache signature: investigate content/config/schema-aware invalidation beyond mtime+size.
#41 — Parallel AST indexing: benchmark first; do not implement concurrency before measuring real bottlenecks.
#11 — Graph/cycle canonicalization: existing B8 covers fingerprint stability under cycle traversal order; treat DeepSeek's nondeterminism claim as related but overstated.
#27 — ADR 0009 implementation remains B13, gated by ADR 0008 unless the operator explicitly pulls it forward.

Rejected / no issue unless a repro appears

DEFAULT_IMPORT_MAP missing django, fastapi, pydantic as a direct bug: weak claim; direct import names already match distribution names.
_normalize_package_name treating _, -, . equivalently: expected package-name normalization, not a bug.
ExportRecord tuples with None being non-hashable: factually false; None is hashable.
.pyi stubs as a near-term requirement: inline typing is sufficient for current alpha.
_dedupe_fragments() dropping non-overlapping same-file duplicates: not supported by current code reading; requires a concrete repro before tracking.

Execution order when operator says “execute this backlog”

Default order:

#39 first, so the audit triage is committed as durable repo docs.
#36, because it is the smallest user-facing friction fix.
#37, because config validation is broad enough to deserve isolated tests.
#38, because discovery ordering can affect module identity and needs careful regression coverage.
#40 only after #9/B6 cache lifecycle work is considered, or if implemented as a focused invalidation-only PR.
#41 as a benchmark-only PR before any concurrency implementation.
#27 remains Phase B/B13 and should not be pulled into this batch unless the operator explicitly overrides ADR 0008 gating.

Acceptance for this meta-issue

All accepted actionable follow-ups have dedicated issues or are linked to existing issues.
Deferred/research items have either dedicated issues or an explicit existing issue reference.
Rejected items are listed here with the reason, so they do not keep resurfacing as vague backlog.

## Context DeepSeek v4 Pro produced a broad repository audit on 2026-05-11/2026-05-12. The audit is useful as input, but it mixes actionable findings, deferred design work, roadmap ideas, and several false claims. This issue is the durable index for the triage so the work survives chat/context compaction. ## Current ADR / issue references checked - ADR 0008: Phase B/C execution is evidence-gated and dogfood-bounded. - ADR 0009: three-bucket classification is accepted design, but implementation is explicitly deferred. - Forgejo #27 / B13: tracks ADR 0009 implementation (`manual_only` removal, `review_needed` -> `decision_needed`, mandatory `trade_offs`). Do not duplicate it. ## Accepted actionable follow-ups - #36 — CLI `--changed-only` non-git UX: create one clear warning path instead of a confusing deprecation + unavailable combination. - #37 — Config TOML strict type validation: invalid types should produce field-specific `ConfigError` before dataclass values leak into analysis. - #38 — Source-root discovery ordering: replace string-length ordering with an explicit specificity policy. - #39 — Curated audit triage note: record accepted/deferred/rejected DeepSeek findings without treating the raw audit as canonical truth. ## Deferred / research follow-ups - #40 — MCP report-cache signature: investigate content/config/schema-aware invalidation beyond `mtime+size`. - #41 — Parallel AST indexing: benchmark first; do not implement concurrency before measuring real bottlenecks. - #11 — Graph/cycle canonicalization: existing B8 covers fingerprint stability under cycle traversal order; treat DeepSeek's nondeterminism claim as related but overstated. - #27 — ADR 0009 implementation remains B13, gated by ADR 0008 unless the operator explicitly pulls it forward. ## Rejected / no issue unless a repro appears - `DEFAULT_IMPORT_MAP` missing `django`, `fastapi`, `pydantic` as a direct bug: weak claim; direct import names already match distribution names. - `_normalize_package_name` treating `_`, `-`, `.` equivalently: expected package-name normalization, not a bug. - `ExportRecord` tuples with `None` being non-hashable: factually false; `None` is hashable. - `.pyi` stubs as a near-term requirement: inline typing is sufficient for current alpha. - `_dedupe_fragments()` dropping non-overlapping same-file duplicates: not supported by current code reading; requires a concrete repro before tracking. ## Execution order when operator says “execute this backlog” Default order: 1. #39 first, so the audit triage is committed as durable repo docs. 2. #36, because it is the smallest user-facing friction fix. 3. #37, because config validation is broad enough to deserve isolated tests. 4. #38, because discovery ordering can affect module identity and needs careful regression coverage. 5. #40 only after #9/B6 cache lifecycle work is considered, or if implemented as a focused invalidation-only PR. 6. #41 as a benchmark-only PR before any concurrency implementation. 7. #27 remains Phase B/B13 and should not be pulled into this batch unless the operator explicitly overrides ADR 0008 gating. ## Acceptance for this meta-issue - All accepted actionable follow-ups have dedicated issues or are linked to existing issues. - Deferred/research items have either dedicated issues or an explicit existing issue reference. - Rejected items are listed here with the reason, so they do not keep resurfacing as vague backlog.

codex added the

source:deepseek-v4-pro

severity:low

area:docs

labels

2026-05-12 08:04:15 +02:00

codex referenced this issue

2026-05-12 08:04:29 +02:00

CLI: make --changed-only non-git feedback unambiguous #36

codex referenced this issue

2026-05-12 08:04:44 +02:00

Config: add strict type validation for pyfallow TOML values #37

codex referenced this issue

2026-05-12 08:04:56 +02:00

Discovery: replace source-root length ordering with explicit specificity policy #38

codex referenced this issue

2026-05-12 08:05:08 +02:00

Docs: add curated DeepSeek audit triage note #39

codex referenced this issue

2026-05-12 08:05:22 +02:00

MCP: harden report-cache signature beyond mtime+size #40

codex referenced this issue

2026-05-12 08:05:37 +02:00

Performance: benchmark before parallel AST indexing #41

codex referenced this issue from a commit

2026-05-12 08:37:07 +02:00

Docs: record DeepSeek audit triage

codex referenced this issue from a commit

2026-05-12 08:37:07 +02:00

CLI: clarify changed-only non-git fallback

codex referenced this issue from a commit

2026-05-12 08:37:07 +02:00

Config: reject malformed TOML value types

codex referenced this issue from a commit

2026-05-12 08:37:07 +02:00

Discovery: make source-root ordering explicit

codex referenced this issue

2026-05-12 08:37:36 +02:00

Execute DeepSeek audit triage backlog first wave #42

codex referenced this issue

2026-05-12 11:07:53 +02:00

MCP: harden cached report signatures #43

codex referenced this issue

2026-05-12 11:30:32 +02:00

Bench: profile analyzer phases before parallelism #44

codex commented

2026-05-16 00:30:56 +02:00

Author

Collaborator

Closing as completed after the DeepSeek audit backlog was triaged and executed/parked into durable follow-ups.

Status:

#36 closed — --changed-only non-git UX
#37 closed — strict TOML type validation
#38 closed — explicit source-root specificity policy
#39 closed — curated DeepSeek audit triage note
#40 closed — MCP report-cache signature hardening
#41 closed — benchmark-first perf note
#27 remains the existing ADR 0009 / B13 implementation ticket, intentionally Phase B-gated
rejected audit claims remain recorded in this issue body for traceability

No remaining standalone action lives in this meta-issue.

Closing as completed after the DeepSeek audit backlog was triaged and executed/parked into durable follow-ups. Status: - #36 closed — `--changed-only` non-git UX - #37 closed — strict TOML type validation - #38 closed — explicit source-root specificity policy - #39 closed — curated DeepSeek audit triage note - #40 closed — MCP report-cache signature hardening - #41 closed — benchmark-first perf note - #27 remains the existing ADR 0009 / B13 implementation ticket, intentionally Phase B-gated - rejected audit claims remain recorded in this issue body for traceability No remaining standalone action lives in this meta-issue.

codex closed this issue

2026-05-16 00:31:01 +02:00