Dependabot: majors are deliberate, never grouped

.github/dependabot.yml

@@ -1,18 +1,31 @@
 # Dependency currency is automated, not remembered (asset convention, 2026-08-24).
 # Pre-release channels are NOT bumped inside groups — beta packages tracking an SDK minor
 # are aligned by hand in the same PR that takes the SDK bump.
+# MAJORS are deliberate, never grouped (2026-08-27): the first weekly sweep tried to ride
+# MassTransit 9 (license change), Roslyn 5 and vitest 4 into one bump each — a major is a
+# decision with a migration story. Groups take minor/patch only; a major arrives as its
+# OWN pull request (visible, individually decidable, and a closed one is not recreated —
+# the mockifyr-proven pattern, which also keeps security majors visible where a blanket
+# ignore would suppress them). Standing deferrals: open-threads T24. GitHub Actions majors
+# stay grouped (runner-driven, CI-proven).
 version: 2
 updates:
   - package-ecosystem: nuget
     directory: /
     schedule: { interval: weekly }
+    open-pull-requests-limit: 3
     groups:
-      nuget-dependencies: { patterns: ["*"] }
+      nuget-dependencies:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: npm
     directory: /ui/console
     schedule: { interval: weekly }
+    open-pull-requests-limit: 3
     groups:
-      console-dependencies: { patterns: ["*"] }
+      console-dependencies:
+        patterns: ["*"]
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     directory: /
     schedule: { interval: weekly }

docs/strategy/open-threads.md

@@ -26,6 +26,7 @@ pending forever.
 | T20 | **The specanchor rehearsal** — the transformation composition's proof ([specanchor-composition](../rfc/specanchor-composition.md)) | specanchor's own chain is proven on its rig (74 tests, mutation 94.8%, first skill eval 7/7), but the COMPOSITION — §9's method running on specanchor's machinery with Goldpath as target — has never run end to end; per the RFC's D4/D5, no profile code is written before it does | the fake-legacy → Goldpath migration rehearsal is scheduled (before the factoring engagement's PoC) | Discovery Zero → dual-track slices → approved specs → `goldpath new` target → parity with Mockifyr equalization → db-compare reconciliation → cutover evidence bundle, with the Discovery Zero playbook written from the rehearsal's diary; only then do ai-sdlc-status's `reverse-engineer`/`differential-test` rows leave NOT BUILT |
 | T21 | **`Goldpath.Approvals`** — human approval workflows: maker-checker, four-eyes, amount-laddered authority, delegation, escalation, and the task worklist/inbox that feeds them | A Ring B candidate surfaced by the factoring-class engagement: SIX of its twelve common processes run approvals over e-mail today, and the amount ladder (expert → deputy → manager → GM) is domain-agnostic across banking/insurance/telco. Distinct from the T19 saga non-goal — these are HUMAN approval chains, not process orchestration. The RFC is ACCEPTED and the build STARTED 2026-08-18 by explicit owner decision (the trigger pulled early — recorded in the RFC header): `Goldpath.Approvals` core landed with 17 deterministic tests, manifest key + CLI recipe wired. 2026-08-18 (later the same day) the database-backed store landed (EF on the app's own DbContext, proven on real storage) and the template flag shipped (a generated app with the flag BUILDS against the train). Open before the thread closes: console federation, dashboard JSON — and the adopter proof below | The engagement's implementation phase needs its first systematized approval flow (the §5.1 by-product rule: born inside a real deliverable, never as a third front) | The RFC through the eight sections; the four Ring B criteria confirmed in review; one real amount-laddered approval flow from the adopter runs end to end on the module, with its audit trail **2026-08-26 addendum:** the api-portal product built the sibling governed-change engine and proved SIX rules the ladder lacks — recorded as [goldpath-approvals-v2](../rfc/goldpath-approvals-v2.md); owner approved 2026-08-26 and the six rules LANDED 2026-08-27 (withdraw, quorum rungs, chain-wide distinct-eyes, mandatory rejection reason, resubmit chain, signature store seam — 17 new facts, mutation-gated). Still open here: console federation, dashboard JSON, and the adopter proof |
 | T22 | **`Goldpath.FileExchange`** — file-based integration rails: scheduled pick-up/drop, validation, idempotent ingestion, reprocessing, archival | Banking file rails (nightly registry FTP batches, 2×/day bank status files, MT940, CSV extraction contracts) recur in THREE of the engagement's common processes; Jobs+Bulk cover pieces but not the rail as a unit. The RFC is ACCEPTED and the build STARTED 2026-08-18 by explicit owner decision (the trigger pulled early — recorded in the RFC header): `Goldpath.FileExchange` core landed with the 7-test planted-fault rig, manifest key + CLI recipe wired. 2026-08-18 (later the same day) the database-backed ledger landed (EF on the app's own DbContext, proven on real storage) and the template flag shipped (a generated app with the flag BUILDS against the train). Open before the thread closes: transport adapters, console federation, dashboard JSON — and the adopter proof below | The first adopter integration that is file-based and bidirectional enters an implementation backlog | One real file rail runs with replay + idempotency + failure reprocessing + its ops runbook, per the module ops-pack shape |
+| T24 | **Deliberate dependency majors** — the first weekly dependabot sweep (2026-08-26) grouped majors the constitution says are decisions, not bumps: **MassTransit 8→9** (v9 moves to a commercial license — an OWNER call on the messaging seam, weighed against the T19/messaging-exit RFC), Roslyn/`Microsoft.CodeAnalysis` 4.8→5.9 with PublicApiAnalyzers 3.3.4→5.6 (the new analyzer demands record-synthesized members in PublicAPI files — every package pays a mechanical migration), xunit.runner 2→4, Microsoft.OpenApi 2→3, and on the console vitest 2→4 + coverage-v8 (coverage is COUNTED differently — the 97% gate must be re-earned under the new counter, not lowered), TypeScript 5.7→7 (the native compiler), jsdom 25→30, @vitejs/plugin-react 4→6, jest-dom 6→7. Dependabot groups now take minor/patch only; a major arrives as its OWN pull request (visible, individually decidable, closed-means-deferred — the mockifyr-proven pattern); PRs #183/#184 closed as major-storms | Majors carry migration stories and, in MassTransit's case, a licensing decision; riding them in a weekly group bypasses the RFC/owner discipline | An owner decision on MassTransit 9 licensing (or the messaging-exit RFC resolving the seam first); each remaining major taken as its own hand-made PR when wanted | Each major lands green through the full gate set with its migration noted; the console coverage gate holds ≥97 under the NEW counter before vitest 4 merges |
 | T23 | **Factoring industry pack + vertical template** — glossary seeds (with false-friend notes), edge-case catalogs, regulatory constraint register skeleton, accounting event dictionary patterns, DMN pricing patterns, integration blueprints (spec + Mockifyr stubs), and a `goldpath new` template pre-setting the domain's bounded-context skeleton | Foundation §6.3's industry-pack layer is the sanctioned home for domain knowledge — the core stays domain-free. The pack is DISTILLED from engagement work, never built up front; the leakage red line holds: public/regulatory knowledge + generalized patterns only, client IP contractually excluded | The engagement's first phase proves the patterns in production AND a second factoring-class prospect appears | The template stands up the domain skeleton via `goldpath new`; the pack's seeds pass the same eval discipline as skills; zero client-confidential content, confirmed by written IP review |
 
 ## Closed threads