feat: dialing in all sorts of stuff #3
No reviewers
Labels
No labels
Agent
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
joshtronic/igor!3
Loading…
Reference in a new issue
No description provided.
Delete branch "development"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Code and per-host config now live in separate trees. The runtime checkout sits at ~/.local/share/tick/ (XDG_DATA_HOME). Secrets (.env) and project topology (projects/*.conf) move to ~/.config/ tick/ (XDG_CONFIG_HOME), where they survive git pull, can have tighter permissions, and don't risk accidental commits. - bin/tick.sh and bin/validate.sh source .env and read projects/ from $TICK_CONFIG_DIR (default ${XDG_CONFIG_HOME:-~/.config}/tick) - systemd/tick.service now points at %h/.local/share/tick - bin/install.sh scaffolds the config dir, seeds .env from .env.example (chmod 600) on first run, idempotent on re-run - bin/uninstall.sh comment updated to reflect new layout - .env.example loses the misleading "loaded via EnvironmentFile=" claim (tick.sh sources it directly) - .gitignore drops state/ (state was never in the code tree) - README documents the new install flow and the host-side layout This also unblocks dogfooding tick on itself: the runtime copy at ~/.local/share/tick is distinct from any ~/Code/tick worktree the harness might create while working a tick-on-tick issue. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>Two improvements based on dogfood feedback: 1. Maintenance auto-detect, no per-repo declaration required. Previously tier 2 required each repo's CLAUDE.md to have a "Maintenance" section declaring routine checks. Too much ceremony for the common case -- the audit tool is obvious from the stack. New default: Claude detects the stack and runs the standard audit + dep-freshness commands for the ecosystem: package.json -> npm audit + npm outdated Cargo.toml -> cargo audit + cargo outdated pyproject / -> pip-audit + pip list --outdated requirements go.mod -> govulncheck + go list -m -u all Gemfile -> bundle audit + bundle outdated If a tool isn't installed, Claude installs it within the session. Per-repo Maintenance section is now optional -- use only when you want non-default behavior (custom thresholds, extra checks like link audit / SEO scan, non-standard tooling). 2. /security-review as a pre-push check on every PR. AGENTS.md's PR-mode rules now require Claude to run the built- in /security-review slash command on the diff before exit. If it flags anything material (injection, leaked secret, unsafe deserialization, auth bypass), fix or block. Trivial findings can be exited past. This is Claude reviewing its own diff for security before push, distinct from tier 2's dep-CVE scan (which has no diff to review). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>