Skip to content

chore(registry): vendor research snapshots as reference + privacy gate - #21

Merged
caio-pizzol merged 2 commits into
mainfrom
caio-pizzol/reproducible-registry
Jun 5, 2026
Merged

chore(registry): vendor research snapshots as reference + privacy gate#21
caio-pizzol merged 2 commits into
mainfrom
caio-pizzol/reproducible-registry

Conversation

@caio-pizzol

Copy link
Copy Markdown
Contributor

This started as "make import-research.ts authoritative again" and turned into the opposite conclusion, which is the useful part. Validating the regenerated output against the committed registry showed the generator would overclaim three rows: Cambria (face-scoped visual_only, ~23% worst face), Georgia (near_metric, 1.84%), and Arial Narrow (visual_only, ~50%) - all of which the apryse 1-best summary rounds to "metric-safe". Those verdicts depend on face-scoped and runner-measured evidence the CSV snapshots do not carry, so records.json stays hand-curated and the importer stays demoted. No verdicts change here.

What this lands:

  • Vendored, public-safe snapshots of the research sources under scripts/research-sources/, as reference/provenance only. import-research.ts reads them for a dry run and now documents exactly why it cannot be authoritative (and is not wired into CI).
  • A public-repo hygiene test that fails the build on internal markers (Slack/dashboard URLs, cross-repo PR # refs, SD-/IT- ticket IDs, internal jargon) in the snapshots or the generated registry notes.
  • Two pre-existing leaks in committed public data that the hygiene test caught and this fixes: a PR #... / T4 note on the Calibri record, and a family-status.json reference in the Calibri measurement.

A CI workflow (typecheck/test/lint/build, deliberately no import-research --check) is part of this change but is not in this push yet - the bot token lacks the GitHub workflow scope. It will be added to this branch once that scope is granted.

Verified locally: bun test -> 85 pass / 0 fail (incl. the 3 hygiene checks); tsc --noEmit -> clean; biome check -> clean; site build -> 22 pages. records.json diff is a single line (the Calibri note); no verdict changes.

…a privacy gate

Originally meant to make import-research.ts authoritative again. Validation
killed that plan: the curated registry is deliberately MORE honest than the
coarse research summaries can reproduce. Regenerating would overclaim three
rows - Cambria (face-scoped visual_only, ~23% worst face), Georgia
(near_metric, 1.84%), and Arial Narrow (visual_only, ~50%) - all of which the
apryse 1-best rounds to "metric-safe". Those verdicts rest on face-scoped and
runner-measured evidence the CSVs do not carry, so records.json stays
hand-curated and the importer stays demoted.

What this keeps:
- Vendored, public-safe snapshots of the research sources under
  scripts/research-sources/ (reference only; the importer reads them for a dry
  run and is NOT wired into CI). import-research.ts now documents exactly why it
  cannot be authoritative.
- A first CI workflow (typecheck, test, lint, build). No import --check gate -
  it would force the overclaims above.
- A public-repo hygiene test that fails the build on internal markers
  (Slack/dashboard URLs, cross-repo PR refs, SD-/IT- ticket IDs, internal
  jargon) in the snapshots or the generated registry notes.

It also fixes two pre-existing leaks the hygiene test caught in committed
public data: a "PR #3608 ... T4" note on the Calibri record and a
"family-status.json" reference in the Calibri measurement.
@caio-pizzol
caio-pizzol merged commit 298bf08 into main Jun 5, 2026
1 check passed
@caio-pizzol
caio-pizzol deleted the caio-pizzol/reproducible-registry branch June 5, 2026 09:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants