Roadmap: architecture review

[DanMat]

Captures the second external review — this one of the codebase rather than the experience. Every claim was checked against the code before being written down; three didn't survive that check and are recorded as such.

The theme

Packkit doesn't eat its own cooking. It generates publint + are-the-types-wrong checks, strict TypeScript, and lint gates for other people's packages — then ships without any of them. check:pkg is something Packkit writes for you, and its own package would fail it.

Verified:

Claim	Status
No types on any export	True — ., ./core, ./cli, ./scaffold, none typed
No root lint / typecheck	True — start, test, check:deps, integration, build:web, update:node, gen:reference, sync:mcp
writeProject doesn't validate paths	True
deepMerge silently last-writer-wins	True — ends in return source
run() discards stdout/stderr	True
shell: true on win32	True, in two places

The path-validation one is worth reading twice: harmless while every feature is trusted first-party code, a security boundary the moment third-party features or MCP-supplied data can contribute paths. It should be fixed before extensibility ships, not after.

Architecture items

Staged resolution returning diagnostics instead of silently disabling options, a resolved domain model to replace ~16 derived booleans, explicit feature ordering, pairwise combination coverage, a dependency version catalog, and unifying the monorepo path — 2.9 added a second early return inside the first, so that one is compounding.

packkit upgrade

Both reviews independently picked this as the highest-value next feature, and 2.9's packkit.json was the prerequisite. Read the provenance, generate current output in memory, diff, classify each difference, emit a patch. It's what turns a one-time generator into something with a durable relationship to the repos it creates.

Checked and not acted on

• "Add shareable configuration URLs" — already shipped in 2.3; the Share link button encodes the diff-from-defaults and restores it on load.
• "Add privacy-preserving analytics" — static Pages site, no backend. Adding third-party tracking to a developer tool is a values call, not a task.
• The two reviews disagree on positioning. The field review's top ask was the full-stack preset (shipped in 2.9); this one argues apps dilute a product whose coherent domain is packages/CLIs/services. I recorded a stance — packages/CLIs/services stay the centre of gravity, fullstack stays a supported track — rather than silently siding with the more recent reviewer.

🤖 Generated with Claude Code