B-CF75-validate-code-references-via-ast-parse-and-re-check-beyond
Status: closed/abandoned
Task bodies cite code (Files-to-touch paths, touchpoint file:line Locations), but those references
are validated only at task-define / ensure-ready time (via sdlc task parse-touchpoints and
scan-placeholders). References that resolve at authoring time rot silently as the codebase churns
under a long-lived branch — PR #469 sat ~40 commits / a week behind main with no re-check.
Separately, the apps-import validator shipped in #469 uses line/regex matching and false-positives on imports that appear inside comments or string literals — the same fragility a task-body reference checker would hit.
Decisions to make:
- Cadence — author/ready only (today) vs. also at PR-open, PR-update, or a pre-merge drift gate
like
docs-drift. - Scope — path existence vs. path+line vs. symbol existence. Line numbers are the most rot-prone (they shift on every edit above them).
- Matching technique — replace string/grep matching with an actual AST parse so comments and
string literals are structurally never mistaken for references/imports: TypeScript compiler API
for
.ts/.tsx/.js/.jsx,@vue/compiler-sfcto extract the<script>block from.vue. On the task-body side, resolve a cited symbol by parsing the target file’s AST rather than trusting a line number. - Severity — hard gate vs. advisory warning. Line-ref rot is common enough that a hard gate would be noisy.
Includes retrofitting the merged apps-import validator
(.claude/skills/project-check/check_apps_imports.ts) to AST-based matching to kill its
comment/string false positives.
Closed 2026-08-16: superseded by D-VSLI-distributed-work-runner-architecture. Ledger phase C1 demotes the universal readiness gate to the implementation process’s private contract, and a work order cites locations instead of restating code state, so the author-time reference set this would re-check shrinks away.