From a8dcf886ccbf18f211b6fb5f18852ab67e26ddf2 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Thu, 30 Jul 2026 00:25:14 -0400 Subject: [PATCH] ssot: declare the one path-scoped link policy waiver MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fleet link-policy scan renders this repo three published views and reports any URL whose host is not a WAVE publish domain. One finding stands: the npm page for @anthropic-ai/claude-agent-sdk, the optional peer dependency the SDK-server section documents. Scoped to that one package path, not to the npm host. A host-wide waiver would excuse every npm link in this repo permanently, including one added later by someone who never saw the waiver — which is the case most worth catching in a public repo. Verified: 0 unwaived with the scoped waiver; an arbitrary npm package link still BLOCKS (3 unwaived); with no waiver at all both block (6), so both were being detected. The waiver is scanner metadata, not content. All three rendered views are byte-identical before and after: README.md 11148 chars, llms.txt 9054, manifest.json 17116 — unchanged. --- .wave/repo.json | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.wave/repo.json b/.wave/repo.json index f40940a..eff9cef 100644 --- a/.wave/repo.json +++ b/.wave/repo.json @@ -479,5 +479,12 @@ "heading": "License", "body": "MIT" } + ], + "policyWaivers": [ + { + "host": "www.npmjs.com", + "pathPrefix": "/package/@anthropic-ai/claude-agent-sdk", + "reason": "The optional peer dependency documented in the SDK-server section. Path-scoped to that one package, so a link to any other third-party package is still reported." + } ] } \ No newline at end of file