Fairy Fox

2026-08-02

Adopt hub 1.6.0 — README structure & cross-linking standard

Ran the fairyfox check/adopt flow on request ("fairyfox system updates").

  • Refreshed the git-ignored hub mirror a6d7e68 → 8c6a50e (clean fast-forward). Hub VERSION 1.5.1 → 1.6.0. Working tree glanced at: clean, on dev, up to date with origin, no unpushed divergence.
  • Scoped off hub/standards/CHANGELOG.md: only 1.6.0 is project-facing (new readme.md standard); 1.5.2/1.5.3 are hub-side (registry.yml, projects.yml, driver onboarding). The standing adopt-standards-by-default ledger grant pre-authorizes it → adopt by default.
  • Applied the readme standard to README.md: worded docs link near the top, an organized "Get it" section (Documentation · Download/Releases · Source; publish targets noted as pending — not yet live), and a mesh footer at the bottom.
  • Verified: ## Verify all pass (live-app N/A for a server plugin), recorded in adoption-manifest.md (readme → implemented, baseline → 1.6.0). check-links green (40 files) before and after.
  • Recorded: changelog entry, this log, process report (fairyfox-reports/2026-07-25-adopting-updates.md). Committed on dev.
  • Shipped as v1.5.1 (PATCH, docs-only) via PR #26 → full CI green → tag → back-merge. (Corrected a stale status.md that had wrongly shown v1.5.0 as unreleased.)

Full compliance audit + v1.5.2 sweep

Ran a full fairyfox compliance audit against v1.5.1 (report: fairyfox-reports/2026-08-02-compliance-audit.md). Node compliant, Scorecard 7.9 (live). Five gaps found and all closed in v1.5.2:

  • My dating error — this session's files were dated 2026-07-25; today is 2026-08-02. Renamed the adopting report, moved the session log here (sessions/2026-08/), moved the changelog to version/2026-08.md, fixed manifest dates.
  • Dockerfile base image SHA-pinned (eclipse-temurin:21-jdk@sha256:da9d3a4f…) — Scorecard Pinned-Dependencies 9→10; digest verified against the local image + a clean docker build.
  • Dependabot backlog (9) triaged — 6 green bumps merged (#31 applied by hand: the OAuth token can't merge workflow-file PRs); #33 (paper-api 26.x), #32 (Kotlin 2.4.10 vs CodeQL pin), #34 (ktlint 14 build-red) closed-with-reason; dependabot.yml now ignores paper-api major/minor + org.jetbrains.kotlin*.
  • main required checks extended to all 7 CI jobs (added Purpur + latest-Paper smoke).
  • Stale release/1.5.0 confirmed already gone from origin.