base-layer/promptkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Record final validation and repair audit links

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-05 20:19:06 +00:00
parent 96c619f7d4
commit 5ee602cc4b
13 changed files with 168 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/roadmap/audit/09-interfaces.md
View File

@@ -33,9 +33,9 @@ to change those behaviors.
**Priority:** P2. A documented ownership permission permits data races and
inconsistent input snapshots.
**Relevant interfaces/code:** [ArtifactReader GoDoc](../../../types.go:294),
[public reader adapter](../../../artifact_reader.go:19), and
[copyBytes](../../../convert.go:490).
**Relevant interfaces/code:** [ArtifactReader GoDoc](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/types.go#L294),
[public reader adapter](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/artifact_reader.go#L19), and
[copyBytes](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/convert.go#L490).
**Contract defect:** The interface says that `Read` may be called concurrently
and that the reader may reuse or mutate the returned artifact and body after
@@ -72,11 +72,11 @@ the selected lifetime, without globally serializing unrelated engine work.
**Priority:** P2. The public inspection contract describes valid results as
impossible and incorrectly limits the sources that can satisfy a requirement.
**Relevant interfaces/code:** [Engine.InspectProfile](../../../engine.go:313),
[ProfileInspection.APIKeyRequired](../../../types.go:372),
**Relevant interfaces/code:** [Engine.InspectProfile](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/engine.go#L313),
[ProfileInspection.APIKeyRequired](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/types.go#L372),
[profile-inspection consumer example](../../consumers/pkg-promptkit.md#inspect-a-profile-before-prompt-work),
[effective-target construction](../../../internal/configuration/targets.go:99),
and [credential availability check](../../../internal/usecase/runner.go:611).
[effective-target construction](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/internal/configuration/targets.go#L99),
and [credential availability check](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/internal/usecase/runner.go#L611).
**Contract defect:** Both method and field GoDoc claim that `APIKeyRequired`
is mutually exclusive with a nonblank `EffectiveModelParams.APIKeyEnv`. They
@@ -97,7 +97,7 @@ reject this valid combination or report credential readiness incorrectly.
**Evidence:** A temporary public-API diagnostic demonstrated that combination
and successful preparation. The existing
[effective-target test](../../../internal/configuration/targets_test.go:88)
[effective-target test](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/internal/configuration/targets_test.go#L88)
also includes a required profile with an explicit environment source.
**Potential remediation:** Describe the flag as a local credential-availability
@@ -114,8 +114,8 @@ provider parameters.
**Relevant interfaces/code:** [integration request-body contract](../../integrations/openai-compatible-chat.md#request-body),
[profile defaulting reference](../../formats.md#defaults-and-overrides),
[overlayProviderMap](../../../internal/configuration/targets.go:133), and
[runtime override merge](../../../internal/usecase/runner.go:562).
[overlayProviderMap](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/internal/configuration/targets.go#L133), and
[runtime override merge](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/internal/usecase/runner.go#L562).
**Contract defect:** The integration document says backend, profile, and request
extra-parameter maps all use whole-map replacement. Actual configured profile
@@ -135,7 +135,7 @@ only `request_only: true` does remove the configured entries.
**Evidence:** A temporary public-API diagnostic observed both forms through an
injected client and confirmed the configured merged fields through a controlled
built-in HTTP transport. No external request was made. The existing
[effective-target test](../../../internal/configuration/targets_test.go:70)
[effective-target test](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/internal/configuration/targets_test.go#L70)
also exercises recursive configured overlay.
**Potential remediation:** Replace the stale configuration-precedence claim
@@ -148,9 +148,9 @@ do not add another merge policy or duplicate its full configuration reference.
**Priority:** P3. Small but concrete public-contract inconsistencies.
**Relevant interfaces/code:** [ProfileInspection.ProfileID](../../../types.go:364),
[ListPrompts GoDoc](../../../listing.go:90), and
[literal profile identity test](../../../profile_inspection_contract_test.go:13).
**Relevant interfaces/code:** [ProfileInspection.ProfileID](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/types.go#L364),
[ListPrompts GoDoc](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/listing.go#L90), and
[literal profile identity test](https://forge.maximumdirect.net/base-layer/promptkit/src/commit/31f1e6a/profile_inspection_contract_test.go#L13).
**Contract defect:** `ProfileInspection.ProfileID` is described as trimmed,
but configured IDs and lookups preserve meaningful whitespace exactly.