From e67b7298280eddb5651b7a209ebfb96f9e5adc6f Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 31 May 2026 08:22:35 +0100 Subject: [PATCH] docs(npm-exemptions): mirror hypatia#412 /bindings/rescript/ carve-out (post #275 closeout cleanup) Surfaced during the standards#275 STEP 7 closeout estate-wide hypatia scan: proven-servers/bindings/rescript/package-lock.json was the single uncarved hit across 20 estate-wide package-lock.json files. hypatia#412 extends the :nodejs_detected rule's class 5c (`/bindings/{javascript,typescript}/`) to also cover `/bindings/rescript/`. This PR mirrors that to the LANGUAGE-POLICY.adoc Node.js narrative row, matching the docs-vs-rule parity pattern from hypatia#405 + standards#320. ## Change `rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc` Node.js banned-language row: - Updated header note: "nine carve-out classes (six original + three added during the migration via hypatia#405 + one added post-closeout via hypatia#412 for `/bindings/rescript/` symmetry)" - Class (5) extended: `**/bindings/{javascript,typescript,rescript}/**` (was `{javascript,typescript}` only) - Added rationale: "the `rescript` variant is host-required for the rescript-to-js compile chain" ## Why post-closeout The standards#253 closeout PR (#325) merged 2026-05-31T07:11Z. The campaign is officially complete. This PR makes the closeout declaration "zero `:nodejs_detected` flags outside carve-outs" exactly true (was 19/20 prior) without re-opening #253 or #275. Pairs with hyperpolymath/hypatia#412 (rule update + test). Refs hyperpolymath/standards#253 (umbrella, CLOSED 2026-05-31) Refs hyperpolymath/standards#275 (STEP 7, CLOSED 2026-05-31) Refs hyperpolymath/standards#320 (predecessor mirror PR pattern for hypatia#405) Co-Authored-By: Claude Opus 4.7 (1M context) --- rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc b/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc index 43f5603..661c5f3 100644 --- a/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc +++ b/rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc @@ -191,7 +191,8 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r | Insecure by default. Detection via hypatia `cicd_rules/nodejs_detected` (matches `package-lock.json`) with `path_allow_prefixes` covering nine carve-out classes (six original - + three added during the migration via hypatia#405): + + three added during the migration via hypatia#405 + one added + post-closeout via hypatia#412 for `/bindings/rescript/` symmetry): (1a) `**/vscode/**` VSCode extension host-required toolchain; (1b) `vscode-` substring (extension repos/subdirs); (1c) `tree-sitter-` substring (grammar npm-publish targets, Class C @@ -201,8 +202,9 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r forks; (4) `hyperpolymath-archive/**` archived repos; (5) `**/deps/**`, `**/node_modules/**`, `**/.lake/**` (Lean4), - `**/office-addin/**`, `**/bindings/{javascript,typescript}/**` - vendored / host-required / consumer-export deps; + `**/office-addin/**`, `**/bindings/{javascript,typescript,rescript}/**` + vendored / host-required / consumer-export deps (the `rescript` + variant is host-required for the rescript-to-js compile chain); (6) `**/example/**`, `**/examples/**`, `**/test-fixtures/**`, `**/fixtures/**` example/test fixtures. *Migration substantially complete 2026-05-31* under umbrella