rurl

Internal

• The agent instructions point at the house agent-workflow and fp skills for the git workflow, .Rbuildignore no longer lists the FP_CLAUDE.md file this repository never had, and design/agent-workflow.md records that an anonymous GitLab 404 needs a same-run control before it says anything about this project (SEOR-ipwcbcov, RURL-zrlkftor).
• scripts/bestpractices-url.py is vendored from seor, with a pre-push hook that runs its offline self-test when the script changes. .bestpractices.json now names GitLab as the home of the project and GitHub only as its read-only mirror, and describes today's CI: GitLab pipelines on main run the consistency gates, while the test suite runs in the pre-push gate and in CI only on tags or by hand (SEOR-grrcptww).
• .gitlab-ci.yml now carries a top-level workflow: block that suppresses both the branch pipeline and the merge-request pipeline, leaving exactly one pipeline per merge, on main. A feature-branch push and an API-triggered pipeline on a non-default branch now create no pipeline at all; a pipeline started by hand from Build > Pipelines > Run pipeline still works on any ref and runs gates, citation-version and check there, while pages is pinned to main so a branch can be verified but never published. The local pre-push gate remains the thing that verifies a change before it merges (SEOR-bmgkzhvy).
• The OSS Index dependency audit in tests/testthat/test-security.R now scopes to hard dependencies (Depends + Imports) instead of the Suggests tree, which pulled in oysteR's own dependencies and failed the gate on a curl vulnerability that rurl does not ship (RURL-mafkcwnu).
• The OSS Index audit in tests/testthat/test-security.R now requires every reported advisory to carry an explicit disposition in an allow-list (tests/testthat/helper-security.R, empty today because nothing is reported): an unlisted advisory fails, a listed advisory that is no longer reported fails, and a row past its review date warns. Under OSSINDEX_AUDIT_REQUIRED=true a missing oysteR or missing credentials fail instead of skipping. The pre-push gate's LC_ALL=C test cell no longer runs this audit or the OSV audit in tests/testthat/test-osv.R, so a new upstream advisory cannot block an unrelated push; run them with testthat::test_local(filter = "^(security|osv)$") (SEOR-fftbjnpl).
• scripts/check-bugreports.py, ported from pagerankr, now guards the BugReports split: DESCRIPTION must keep the /-/issues form CRAN's incoming check accepts, codemeta.json, SECURITY.md and .bestpractices.json must link /-/work_items, and no other human-facing file may reintroduce a /-/issues link. It runs as its own pre-push hook next to check-citation and in the citation-version CI job (SEOR-ocbtrrnl).
• .gitlab-ci.yml gains osv-audit and security-audit jobs that run tests/testthat/test-osv.R and tests/testthat/test-security.R against an installed rurl, only in a pipeline schedule that sets SCHEDULE_KIND=dependency-audit; security-audit sets OSSINDEX_AUDIT_REQUIRED=true, so missing OSS Index credentials fail the job instead of skipping. Nothing else runs these audits since they left the pre-push gate, and the schedule and the OSSINDEX_USER/OSSINDEX_TOKEN variables still have to be created on the project. tools/local-ci.sh --all leaves schedule-only jobs out (SEOR-fftbjnpl).
• tools/cran-comments-gate.R no longer requires the cran-comments.md span pin to name the development version in DESCRIPTION. It checks the pin against the release that version names — 3.0.1 while at 3.0.1.9000 — so the release checklist's post-release version bump is executable, and --online compares whichever end of the span CRAN actually serves in each phase (RURL-efbcrhjc).
• tools/curl-zero-gate.R now checks that rurl does not depend on curl, and no longer polices the word. The raw-text scan (C6), its path allowlist, the staleness check on that allowlist (C0) and the oracle-provenance exemption are gone, so a comment, NEWS entry, design note, fixture or inst/WORDLIST entry that names curl or libcurl passes. C5 now fails only on a \link[curl]{...} cross-reference or a curl call in an Rd file's \examples or \usage, not on prose. The DESCRIPTION, NAMESPACE, parsed-code and clean-room checks are unchanged, and the self-test now covers a curl load in the clean room (RURL-dtzvekmf).
• .lintr no longer carries a # comment header: read.dcf() skips comment lines only from R 4.6, so on R 4.5 and older lintr::lint_package() aborted with Invalid DCF format and the package got no lint at all. The rationale for each deviation from the goodpractice linter set now lives in design/verification.md, with the rule to keep .lintr comment-free and ASCII-only (SEOR-qfxolldq).
• tools/local-ci.sh now runs each job script with bash when the job's image has it and with POSIX sh otherwise, as the GitLab runner does. The citation-version job's image, python:3.13-alpine, ships only sh, so the runner failed that job before any of its commands ran. A failing command in a sh-only image still fails the job (RURL-dswufxky).
• tools/local-ci-plan.R now plans a job whose script: holds a block-scalar (- |) entry, so tools/local-ci.sh --all no longer aborts at the pages job with "a script entry spans multiple lines". The block is emitted as one entry, verbatim, the way the GitLab runner writes it into the job shell: it runs as one unit, and a failing command inside it fails the job. --list shows it under a single $, and every job without a block entry plans byte-identically to before. A new --self-test mode pins the single-line and the block rendering, and runs both under bash (RURL-gysfdtcd).
• The check and pages CI jobs install hunspell from CRAN over Debian's r-cran-hunspell. Debian's build drops the bundled dictionaries for the system en_US.aff, whose WORDCHARS keeps digits inside a token, so in the r-base container spelling::spell_check_package() flagged 61 words, such as PV1 and sha256, that a CRAN build of hunspell checks as PV and sha and passes. The spelling step now reads the same dictionaries locally and in CI (RURL-czvqosis).
• The gate now runs Rscript tools/local-ci-plan.R --self-test. tools/verify-manifest.yml declares it as a self-test-only local-ci-plan job, so tools/verify.R selects it whenever tools/local-ci-plan.R changes, runs it on --release and whenever it cannot tell what changed, and fails the run when a case fails. Until now nothing ran it (RURL-fzeadcfc).