Found while reviewing #2. Filing it separately because it is not #2's job to fix, and because a gap declared only in a PR body disappears the moment that PR merges.
The gap
src/exporters/html.js renders HTML, so DS §15 requires both the interpolated-JSON rule and its fixture. #2 lands the rule and not the fixture.
Verified at head 237bd6eb:
eslint.config.js carries the rule — the JSON.stringify-into-a-template-literal guard, with its BAD/GOOD comment intact.test/ contains exactly one file: test/pdf-vfs.test.js. No test/fixtures/xss-lint-fixture.js, no test/xss-lint-fixture.test.js, no test/fixtures/xss-lint-covers.json.- Control, so the absence is a fact about the repo rather than about the query: the identical tree listing against
MichalAFerber/gh-office@main returns test/fixtures/xss-lint-fixture.js and test/xss-lint-fixture.test.js. The instrument finds fixtures where they exist.
Why the green lint run proves nothing
The rule currently reports zero findings here, because there is nothing to find: grep -rn 'JSON.stringify' src/ build/ test/ is empty, against a control of grep -rln 'function' src/ → 8 files. §15 is explicit that this is an unproven control, not coverage — a rule that has never fired is indistinguishable from a rule that cannot fire. The fixture is what turns the lint job from an assertion into a measurement.
That distinction has been the estate's dominant defect class this week, in reviews and in my own work, so it is worth stating plainly rather than treating as boilerplate.
What it needs
test/fixtures/xss-lint-fixture.jstest/xss-lint-fixture.test.jstest/fixtures/xss-lint-covers.json, naming product source: src/exporters/html.js, src/core.js, src/common.js. Not build/build.mjs — that is tooling and is globally ignored regardless.
Why it was not folded into #2
templates/xss-lint-fixture.test.js imports vitest, while this repo's suite is node:test. Adopting it means either adding a second test runner or porting the kit — and the kit must be vendored byte-identical, so porting is not available. That is a real decision, not a formality, and it belongs in its own change with its own argument.
Related
MichalAFerber/tgwab-standards#125 — the §15 sweep: five repos ship the rule with no fixture. This makes six.MichalAFerber/mykk.us-extension#39 — same shape.
Found while reviewing #2. Filing it separately because it is not #2's job to fix, and because a gap declared only in a PR body disappears the moment that PR merges.
The gap
src/exporters/html.jsrenders HTML, so DS §15 requires both the interpolated-JSON rule and its fixture. #2 lands the rule and not the fixture.Verified at head
237bd6eb:eslint.config.jscarries the rule — theJSON.stringify-into-a-template-literal guard, with its BAD/GOOD comment intact.test/contains exactly one file:test/pdf-vfs.test.js. Notest/fixtures/xss-lint-fixture.js, notest/xss-lint-fixture.test.js, notest/fixtures/xss-lint-covers.json.MichalAFerber/gh-office@mainreturnstest/fixtures/xss-lint-fixture.jsandtest/xss-lint-fixture.test.js. The instrument finds fixtures where they exist.Why the green lint run proves nothing
The rule currently reports zero findings here, because there is nothing to find:
grep -rn 'JSON.stringify' src/ build/ test/is empty, against a control ofgrep -rln 'function' src/→ 8 files. §15 is explicit that this is an unproven control, not coverage — a rule that has never fired is indistinguishable from a rule that cannot fire. The fixture is what turns the lint job from an assertion into a measurement.That distinction has been the estate's dominant defect class this week, in reviews and in my own work, so it is worth stating plainly rather than treating as boilerplate.
What it needs
test/fixtures/xss-lint-fixture.jstest/xss-lint-fixture.test.jstest/fixtures/xss-lint-covers.json, naming product source:src/exporters/html.js,src/core.js,src/common.js. Notbuild/build.mjs— that is tooling and is globally ignored regardless.Why it was not folded into #2
templates/xss-lint-fixture.test.jsimports vitest, while this repo's suite isnode:test. Adopting it means either adding a second test runner or porting the kit — and the kit must be vendored byte-identical, so porting is not available. That is a real decision, not a formality, and it belongs in its own change with its own argument.Related
MichalAFerber/tgwab-standards#125— the §15 sweep: five repos ship the rule with no fixture. This makes six.MichalAFerber/mykk.us-extension#39— same shape.