shankar0123 54d93e6376 M-029 Pass 1 closure: tighten ci.yml M-009 guard from soft budget to hard zero ...

Pass 1 finished — every src/ useMutation now goes through useTrackedMutation.

Promote the M-009 guard to a hard-zero invariant: any bare useMutation() call

outside web/src/hooks/useTrackedMutation.ts fails CI immediately.

Pre-Bundle-8 the codebase had 56 bare useMutation sites. Bundle 8 shipped the

wrapper. M-029 Pass 1 migrated all 56 sites to the wrapper across 6 batches

(commits 2057e76 / e0a3d50 / ee25f00 / ec3772d / 190a27e / 213b464). With the

soft-budget gate now obsolete, the hard-zero gate prevents drift back into

the discretionary-invalidation pattern that motivated M-009 in the first place.

Rationale: per-site enforcement (the wrapper's discriminated-union invalidates

contract) is strictly stronger than the +5 budget guard. The guard's failure

mode also improves: instead of a count delta the operator has to interpret,

they get the exact file:line(s) of the offending bare useMutation call.

Verification:

  python3 yaml.safe_load            YAML OK

  manual guard simulation           PASS: bare useMutation = 0 outside wrapper

2026-04-27 02:55:35 +00:00

..

ci.yml

M-029 Pass 1 closure: tighten ci.yml M-009 guard from soft budget to hard zero

2026-04-27 02:55:35 +00:00

release.yml

Bundle D: Documentation & transparency sweep — 8 findings closed

2026-04-27 00:47:15 +00:00

security-deep-scan.yml

Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7

2026-04-27 02:27:44 +00:00