From ed007b3d7fbe3cfcfae29cea3a6a0b89cb3b92d4 Mon Sep 17 00:00:00 2001 From: GenericJam Date: Wed, 26 Aug 2026 23:07:25 -0600 Subject: [PATCH] Policy: code review before publishing, on by default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every release now gets a code review of everything that landed since the last published version, before publishing. Applies to mob, mob_dev, and mob_new. Skipped only when the user says so. Scoped at the release, not the PR. What a user pulls from Hex is the accumulated diff since the last published version, which is rarely the shape of any one PR that went into it — per-PR review misses what only shows up at the seam: a fix landing on top of an earlier one and partly undoing it, two individually-fine PRs interacting badly, and work that merges after a version bump and so never reaches the release that bump produced. That last one is not hypothetical. It just happened twice: - mob master carried the MOB-102 frame-registry fix merged *after* the 0.7.29 bump, with 0.7.29 already published — so the fix could not be in any published artifact. - mob_new merged the entire Android Sheet renderer on top of an already-published 0.4.23 with no bump at all, leaving published mob_new generating apps with no Sheet renderer while published mob 0.7.29 shipped Mob.UI.sheet/2. So the gate also carries two version-sanity checks: confirm the version you are about to publish is not already published, and confirm nothing you intend to ship is sitting in commits after the bump. Plus the cross-repo note that mob and mob_new ship in lockstep for anything spanning a runtime change and its generator template. Canonical text lives in mob/RELEASE.md ("Review gate" + a new step 1 in the step-by-step, remaining steps renumbered); mob_dev and mob_new reference it from their own CLAUDE.md as they do the rest of the release flow. Co-Authored-By: Claude Opus 5 (1M context) --- CLAUDE.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 2150524..7b93c3c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -168,7 +168,16 @@ Canonical process lives in [`mob/RELEASE.md`](https://github.com/GenericJam/mob/blob/master/RELEASE.md) — trigger model (mix.exs as source of truth), patch-bump default with mandatory permission, CHANGELOG conventions, per-step idempotency of -`release.yml`. **mob_dev specifics:** +`release.yml`. + +> **Review gate is on by default.** Everything that landed since the +> last published version gets a code review *before* you publish — +> scoped at `v..HEAD`, not per-PR — plus the +> version-sanity checks (is this version already published? did +> anything merge after the bump commit?). Skip only if the user says +> so. See RELEASE.md → "Review gate". + +**mob_dev specifics:** - The pre-push hook (below) additionally runs `mix mob.security_scan` in this repo — the scanner ships from here, so we get the