docs: refresh CLAUDE.md "Repository status" section #125

2026-05-14T00:12:28+02:00

julien commented

2026-05-14 00:12:28 +02:00

Summary

The "Repository status" section in CLAUDE.md was frozen at the pre-bootstrap state. It claimed the Nx workspace was "not yet bootstrapped", referenced ADRs only up to 0020, told future contributors that "the next step is to scaffold the workspace", and instructed agents to verify workspace existence before running build/test/run commands — all obsolete since phase-1 was shipped.

This PR rewrites the section to match reality:

The workspace is operational: three apps (portal-shell, portal-admin, portal-bff) and four lib roots (libs/feature/, libs/shared/state, libs/shared/tokens, libs/shared/ui, libs/shared/util) are in place. CI runs format:check / lint / test / build on every PR.
Lists what's shipped on main — phase-1 foundation, phase-2 auth + audit + security (with the right ADR citations).
Lists what's still on the roadmap — DownstreamApiClient + OBO (ADR-0014, no v1 consumer yet), @RequireMfa() / @RequireAdmin() guards (designed-in but no consumer).
Disambiguates the two distinct security ADRs: ADR-0021 is the implementation-level baseline (helmet, CORS, CSRF, rate-limit, error envelope) — accepted. The strategic security baseline ADR (OWASP ASVS reference level, HDS / GDPR / NIS 2 framing, RSSI sign-off) remains paused — when it lands it will either confirm 0021 or supersede pieces of it.

No code or behavior changes. Documentation only.

Why this is its own PR

The stale paragraph has been there since ADR-0021 was being written; both ADR-0021 (in its PR description) and notes/handoff.md flagged it for a dedicated docs PR rather than piggybacking on a code change. Keeping it isolated makes the diff trivially reviewable and avoids mixing documentation refreshes with implementation changes.

Test plan

pnpm exec prettier --check CLAUDE.md — clean.
Section content cross-referenced with ls apps/, ls libs/feature libs/shared, ls docs/decisions/ — workspace structure, lib layout, and ADR count match the rewritten claims.
All ADR links in the rewritten section resolve (0011, 0014, 0020, 0021).
Conventional Commits — docs: type.

## Summary The "Repository status" section in [CLAUDE.md](CLAUDE.md) was frozen at the pre-bootstrap state. It claimed the Nx workspace was "not yet bootstrapped", referenced ADRs only up to 0020, told future contributors that "the next step is to scaffold the workspace", and instructed agents to verify workspace existence before running build/test/run commands — all obsolete since phase-1 was shipped. This PR rewrites the section to match reality: - The workspace is **operational**: three apps (`portal-shell`, `portal-admin`, `portal-bff`) and four lib roots (`libs/feature/`, `libs/shared/state`, `libs/shared/tokens`, `libs/shared/ui`, `libs/shared/util`) are in place. CI runs `format:check / lint / test / build` on every PR. - Lists what's **shipped on `main`** — phase-1 foundation, phase-2 auth + audit + security (with the right ADR citations). - Lists what's **still on the roadmap** — `DownstreamApiClient` + OBO (ADR-0014, no v1 consumer yet), `@RequireMfa()` / `@RequireAdmin()` guards (designed-in but no consumer). - **Disambiguates** the two distinct security ADRs: [ADR-0021](docs/decisions/0021-phase-2-security-baseline.md) is the implementation-level baseline (helmet, CORS, CSRF, rate-limit, error envelope) — **accepted**. The strategic security baseline ADR (OWASP ASVS reference level, HDS / GDPR / NIS 2 framing, RSSI sign-off) remains **paused** — when it lands it will either confirm 0021 or supersede pieces of it. No code or behavior changes. Documentation only. ## Why this is its own PR The stale paragraph has been there since ADR-0021 was being written; both ADR-0021 (in its PR description) and `notes/handoff.md` flagged it for a dedicated docs PR rather than piggybacking on a code change. Keeping it isolated makes the diff trivially reviewable and avoids mixing documentation refreshes with implementation changes. ## Test plan - [x] `pnpm exec prettier --check CLAUDE.md` — clean. - [x] Section content cross-referenced with `ls apps/`, `ls libs/feature libs/shared`, `ls docs/decisions/` — workspace structure, lib layout, and ADR count match the rewritten claims. - [x] All ADR links in the rewritten section resolve (0011, 0014, 0020, 0021). - [x] Conventional Commits — `docs:` type.

julien added 1 commit 2026-05-14 00:12:29 +02:00

docs: refresh CLAUDE.md "Repository status" section

CI / scan (pull_request) Successful in 2m4s

Details

CI / commits (pull_request) Successful in 2m3s

Details

CI / check (pull_request) Successful in 2m10s

Details

CI / a11y (pull_request) Successful in 2m15s

Details

CI / perf (pull_request) Successful in 5m1s

Details

4177295888

The section was frozen at the pre-bootstrap state — it claimed the
workspace was "not yet bootstrapped", referenced ADRs only up to 0020,
and instructed future agents to scaffold the repo before running any
command. Reality: workspace is operational, phase-1 and phase-2 are
shipped on main, 21 ADRs are accepted, phase-3a admin app is in
skeleton state.

Rewrites the section to reflect current state, lists what's shipped vs
what's still on the roadmap, and disambiguates ADR-0021 (implementation
-level security baseline, accepted) from the still-paused strategic
security baseline awaiting RSSI input on ASVS / HDS / GDPR / NIS 2.

julien merged commit 6a6bf90e7f into main

2026-05-14 00:12:46 +02:00

julien deleted branch docs/refresh-claude-md-repository-status

2026-05-14 00:12:48 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: julien/apf_portal#125