policy: Bun is tier 1, Deno is being removed — correct local CLAUDE.md - #17
Open
hyperpolymath wants to merge 3 commits into
Open
policy: Bun is tier 1, Deno is being removed — correct local CLAUDE.md#17hyperpolymath wants to merge 3 commits into
hyperpolymath wants to merge 3 commits into
Conversation
|
|
Owner ruling 2026-08-26: "deno is to go and bun is the way we are going, put it
first everywhere unless not possible and explain why if not".
This file is what an agent reads FIRST and it listed Bun as BANNED with Deno as
its replacement. Correcting hyperpolymath/standards (#655) fixes one copy of
~372 - agents read the local one. This is that local copy.
ALLOWED **Deno** "Replaces Node/npm/bun" -> **Bun** tier 1
BANNED | Bun | Deno | -> row REMOVED
BANNED Node.js / npm / pnpm/yarn -> Deno -> -> Bun
rule "No package.json for runtime deps - use deno.json imports"
-> Use package.json + bun.lock; a manifest is REQUIRED
rule "No node_modules in production"
-> bun install --production, pinned via bun.lock
pkg JS deps: Deno -> JS deps: Bun (package.json + bun.lock), bunx
WHY THE MANIFEST RULE MATTERS MOST. "No package.json for runtime deps" did not
express a preference - it told repos not to declare their dependencies at all.
hyperpolymath/ubicity imported zod and glob, shipped NO manifest of any kind,
and could not build under ANY toolchain. Fixed in ubicity#107; the rule that
caused it is fixed here.
ALSO REPAIRED - blanking scars from the ReScript purge, which substituted the
token with an EMPTY STRING rather than removing the text:
| | AffineScript | -> | ReScript | AffineScript |
1. **No new files** ... -> **No new ReScript files** ...
| **JavaScript** | Only where cannot | -> Only where AffineScript cannot
Restoring the NAME in a policy table does not reintroduce the language. Same
root cause as the rm -rf /lib found in wordpress-tools#62.
Policy text only - no code, no workflows, no build files. 1 file(s).
NOT FOLDED IN: "Fallback: Nix (flake.nix)" is stale (Guix superseded Nix per
ADR-2026-STACK-MIGRATION) but that is a separate ruling; flagged, not changed.
hyperpolymath
force-pushed
the
policy/bun-first-deno-removal
branch
from
August 26, 2026 22:48
b01e4db to
3c0d245
Compare
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The transition from Deno to Bun as the Tier 1 runtime is correctly handled in the tool tables and enforcement rules, including the new requirement for package.json and bun.lock manifests. However, the PR fails to fully 'repair' the document as promised in the description.
Several 'blanking scars'—specifically the **** placeholder at line 9 and empty gaps in the Python and Enforcement Rule 5 sections—persist. These should be addressed to maintain the integrity of the CLAUDE.md policy. Additionally, while Deno has been removed from Tier 1, it is not yet listed in the Banned table, which could lead to ambiguity during the transition.
About this PR
- The PR description mentions adding a specific 'ReScript | AffineScript' row to the Banned table, but this change is missing from the diff. The row intended for this seems to have been reused for the Node.js update instead.
Test suggestions
- Verify Bun is listed as the Tier 1 runtime in the Language/Tool table.
- Verify the Banned table points Node.js and npm to Bun instead of Deno.
- Verify enforcement rules require a package.json and bun.lock manifest.
- Verify the 'Primary application code' row in the tools table is repaired (currently shows '****' at line 9).
- Verify missing language references in Enforcement Rule 5 (line 52) are restored.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify the 'Primary application code' row in the tools table is repaired (currently shows '****' at line 9).
2. Verify missing language references in Enforcement Rule 5 (line 52) are restored.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| @@ -7,13 +7,13 @@ | |||
| | Language/Tool | Use Case | Notes | | |||
| |---------------|----------|-------| | |||
| | **** | Primary application code | Compiles to JS, type-safe | | |||
There was a problem hiding this comment.
🟡 MEDIUM RISK
The '****' placeholder remains at line 9 for the 'Primary application code' row. This contradicts the PR's stated intent to repair document scars left by the previous ReScript purge. This should likely be replaced with 'AffineScript' or the appropriate language name.
Up to standards ✅🟢 Issues
|
Review feedback from codacy-production and coderabbitai on the policy wave. Three substantive points, all accepted: 1. ".ts CONTRADICTION" (codacy, MEDIUM, raised on most of the wave). The Bun row said "Executes .ts directly, no build step" in a file whose BANNED table bans TypeScript. OWNER RULING: TypeScript "should not exist at all", so advertising Bun's TypeScript capability is wrong regardless of whether it is true. Every .ts reference is removed from the row, including "JS/TS" in its label. 2. "DENO MISSING FROM BANNED" (codacy, raised repeatedly). The wave removed Deno from ALLOWED but never added it to BANNED, so the ruling was only half expressed. Added | Deno | Bun |. 3. "UNPINNED bunx" (coderabbitai, Security & Privacy). A bare `bunx <tool>` can fetch a package outside package.json/bun.lock, and can start Node via a shebang - both contrary to estate SHA-pinning doctrine and the Node ban. Guidance now requires a declared devDependency plus `bunx --no-install --bun <tool>`. NOT taken: "a npm-compatible" (LanguageTool is wrong, "an" is correct before a vowel sound); "--frozen-lockfile is redundant" (correct - no change needed, and none made); the Nix->Guix point (real, but a separate ruling, deliberately not folded into a Deno/Bun change).
Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
hyperpolymath
enabled auto-merge
August 28, 2026 07:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner ruling, 2026-08-26:
This repo's
.claude/CLAUDE.mdis what an agent reads first. Correctinghyperpolymath/standards(#655) fixes one copy of ~372 — agents read the local one.What this PR actually changes
Every line below was verified present in this PR's own diff — nothing is claimed that isn't here.
| Bun | Deno |row removedpackage.json+bun.lock)bun install --productionreplaces the node_modules rulebunx --no-install --bun**No new files**→ No new ReScript filesOnly where cannot→ Only where AffineScript cannot| **** |→ AffineScriptReview feedback addressed
.tsdirectly" inside a file that bans TypeScript. Owner ruling: TypeScript should not exist at all — so every.tsreference is gone from the row, including JS/TS in its label. It now reads JS runtime, running compiled ESM/JS.bunx(coderabbitai, Security & Privacy): a barebunx <tool>can fetch a package outsidebun.lockand can start Node via a shebang. Guidance now requires a declared devDependency plusbunx --no-install --bun.Not taken: "a npm-compatible" (LanguageTool is wrong — "an" is correct before a vowel sound); "
--frozen-lockfileis redundant" (correct, and no such flag was added); the Nix → Guix point (real, but a separate ruling — deliberately not folded into a Deno/Bun change).Scope
Policy text only — no code, no workflows, no build files.
Related: #655 (governing document), #658 (Deno→Bun assessment: 18 repos blocked on
@affinescript/*npm packages that do not exist), #659 (policy duplicated into ~372 copies).