From 4f89b4ccc23944699e42f85d084a69834c53a131 Mon Sep 17 00:00:00 2001 From: Ancienttwo <215803476+Ancienttwo@users.noreply.github.com> Date: Sat, 11 Jul 2026 02:02:21 +0800 Subject: [PATCH 1/2] Release archctx 0.2.3 without CodeGraph bin collision --- .../archcontext-organization-runner.yml | 2 +- actions/review-action/action.yml | 2 +- bun.lock | 28 ++-- .../github-hosted-runner-workflow.yml | 4 +- .../reusable-organization-runner-caller.yml | 4 +- docs/runbooks/trusted-runner.md | 4 +- .../verification/fg6-npm-release-dry-run.json | 30 ++-- package.json | 4 +- packages/cloud/package.json | 2 +- .../valid/product-version-manifest.json | 12 +- packages/contracts/package.json | 2 +- packages/contracts/src/product-version.ts | 6 +- packages/core/package.json | 2 +- .../core/practice-catalog/assets/catalog.yaml | 4 +- .../codegraph-adapter/src/index.ts | 53 ++++-- .../test/codegraph-adapter.test.ts | 47 +++++- packages/local-runtime/package.json | 4 +- packages/surfaces/cli/test/cli.test.ts | 2 +- .../cli/test/local-product-e2e.test.ts | 2 +- packages/surfaces/package.json | 2 +- ...-0055-codegraph-latest-no-bin-collision.md | 72 ++++++++ ...er-al10-release-packaging-readback.test.ts | 14 +- ...-ledger-al10-release-packaging-readback.ts | 11 +- scripts/fg6-npm-release-dry-run.test.ts | 16 +- scripts/fg6-npm-release-dry-run.ts | 34 ++-- scripts/local-product-tarball-smoke.mjs | 48 +++--- scripts/release-provenance-readback.test.ts | 9 +- ...egraph-latest-no-bin-collision.contract.md | 154 ++++++++++++++++++ ...codegraph-latest-no-bin-collision.notes.md | 44 +++++ ...odegraph-latest-no-bin-collision.review.md | 69 ++++++++ tasks/todos.md | 2 +- 31 files changed, 552 insertions(+), 137 deletions(-) create mode 100644 plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md create mode 100644 tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md create mode 100644 tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md create mode 100644 tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md diff --git a/.github/workflows/archcontext-organization-runner.yml b/.github/workflows/archcontext-organization-runner.yml index 42188a4a..2544eddf 100644 --- a/.github/workflows/archcontext-organization-runner.yml +++ b/.github/workflows/archcontext-organization-runner.yml @@ -27,7 +27,7 @@ on: description: ArchContext runtime version expected by this workflow release. required: false type: string - default: "0.2.2" + default: "0.2.3" fail_on: description: Whether a failing deterministic gate should fail the job. required: false diff --git a/actions/review-action/action.yml b/actions/review-action/action.yml index b704f159..3d3c6e18 100644 --- a/actions/review-action/action.yml +++ b/actions/review-action/action.yml @@ -20,7 +20,7 @@ inputs: runtime-version: description: ArchContext runtime version expected by this action release. required: false - default: "0.2.2" + default: "0.2.3" runtime-artifact-url: description: HTTPS URL for the pinned ArchContext runtime artifact. required: true diff --git a/bun.lock b/bun.lock index 8a26b36b..702b90a6 100644 --- a/bun.lock +++ b/bun.lock @@ -6,7 +6,7 @@ "name": "archcontext", "dependencies": { "@archcontext/surfaces": "workspace:*", - "@colbymchenry/codegraph": "1.0.1", + "@colbymchenry/codegraph": "1.4.0", }, "devDependencies": { "@types/node": "^26.0.0", @@ -16,7 +16,7 @@ }, "packages/cloud": { "name": "@archcontext/cloud", - "version": "0.1.1", + "version": "0.2.3", "dependencies": { "@archcontext/contracts": "workspace:*", "@archcontext/core": "workspace:*", @@ -25,11 +25,11 @@ }, "packages/contracts": { "name": "@archcontext/contracts", - "version": "0.1.1", + "version": "0.2.3", }, "packages/core": { "name": "@archcontext/core", - "version": "0.1.1", + "version": "0.2.3", "dependencies": { "@archcontext/contracts": "workspace:*", "@node-rs/jieba": "^2.0.1", @@ -37,16 +37,16 @@ }, "packages/local-runtime": { "name": "@archcontext/local-runtime", - "version": "0.1.1", + "version": "0.2.3", "dependencies": { "@archcontext/contracts": "workspace:*", "@archcontext/core": "workspace:*", - "@colbymchenry/codegraph": "1.0.1", + "@colbymchenry/codegraph": "1.4.0", }, }, "packages/surfaces": { "name": "@archcontext/surfaces", - "version": "0.1.1", + "version": "0.2.3", "bin": { "archctx": "./cli/src/main.ts", }, @@ -69,19 +69,19 @@ "@archcontext/surfaces": ["@archcontext/surfaces@workspace:packages/surfaces"], - "@colbymchenry/codegraph": ["@colbymchenry/codegraph@1.0.1", "", { "optionalDependencies": { "@colbymchenry/codegraph-darwin-arm64": "1.0.1", "@colbymchenry/codegraph-darwin-x64": "1.0.1", "@colbymchenry/codegraph-linux-arm64": "1.0.1", "@colbymchenry/codegraph-linux-x64": "1.0.1", "@colbymchenry/codegraph-win32-arm64": "1.0.1", "@colbymchenry/codegraph-win32-x64": "1.0.1" }, "bin": { "codegraph": "npm-shim.js" } }, "sha512-Y4ZMk7wxSRI9g2wQTcW21TfLr+fw7td1Dadkll6Udl9Ll8wX3H6qtov7K/VGtHG2AFX2j1e5Lm48PTHi74mImg=="], + "@colbymchenry/codegraph": ["@colbymchenry/codegraph@1.4.0", "", { "optionalDependencies": { "@colbymchenry/codegraph-darwin-arm64": "1.4.0", "@colbymchenry/codegraph-darwin-x64": "1.4.0", "@colbymchenry/codegraph-linux-arm64": "1.4.0", "@colbymchenry/codegraph-linux-x64": "1.4.0", "@colbymchenry/codegraph-win32-arm64": "1.4.0", "@colbymchenry/codegraph-win32-x64": "1.4.0" }, "bin": { "codegraph": "npm-shim.js" } }, "sha512-TuiF8wHsweogJe1ANGHq/yKbwttkShBDFxcpUtTCvKuFlwPWcGghC2vru4QCqNA/T8AVqiBiV+ZxBV9dkZj8GA=="], - "@colbymchenry/codegraph-darwin-arm64": ["@colbymchenry/codegraph-darwin-arm64@1.0.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-4z3aNzR3Ml31MBVzAvFQm+bk83erdHkjnaJ0PoeM6I9T7xuTIcdAGV36i3qYwgBE4tdrghRdR0mP5MNM+OrGFA=="], + "@colbymchenry/codegraph-darwin-arm64": ["@colbymchenry/codegraph-darwin-arm64@1.4.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-/QSI3vvQRyt/H+9NllFlFbL+NwVo7G0V/Z3vay9yMfuMTjjb2p16rlvdkQkFOsO9rpYj1UpAJYsD3lPBuDmVTw=="], - "@colbymchenry/codegraph-darwin-x64": ["@colbymchenry/codegraph-darwin-x64@1.0.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-KBSKl+tLCSIgV4iyi21SqYlpXL0P8DPqAnVHvvStdyYsCmkc2Heqf4oQIko+TYyFmuo65m4VpX989JkYZVGIVQ=="], + "@colbymchenry/codegraph-darwin-x64": ["@colbymchenry/codegraph-darwin-x64@1.4.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-OiFLBfelA7sOgNqdfVKWa5DZbpy1hApNf420+eOseVFqDxl7mcdPmZQsB8sNFjHnomc8W21YDFZyFu70eT7C2g=="], - "@colbymchenry/codegraph-linux-arm64": ["@colbymchenry/codegraph-linux-arm64@1.0.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-2TOeL/Lx3kME+dmv2Q9hbIQFBvT6uKLdZONDRaYto+1Bcl3GrJuIu6bsu3jiJuifPhnYIL2xwUV6y+TZQ8MbTw=="], + "@colbymchenry/codegraph-linux-arm64": ["@colbymchenry/codegraph-linux-arm64@1.4.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-0g816KZeNP0cA0ueGoVmWeUWY2l9V4wjD/PfLda3E7++iA8MZFBqRIzTQsjv1FlTWFN52GcQaDG3pmG3aZtYqQ=="], - "@colbymchenry/codegraph-linux-x64": ["@colbymchenry/codegraph-linux-x64@1.0.1", "", { "os": "linux", "cpu": "x64" }, "sha512-UENXSURJJUhcvdKoYsB5Wj6Z6O9C2afhYfG0LnL13KFWJhGXugqYKjF4KwkaeE8Po8TFul9k3f+8eXjmJwwwaQ=="], + "@colbymchenry/codegraph-linux-x64": ["@colbymchenry/codegraph-linux-x64@1.4.0", "", { "os": "linux", "cpu": "x64" }, "sha512-0E268exwhFx5gZRqxOiWB3tyiT9P853h6nLbMdSooayp2Elo4zBumtnVaeNWN1ma3USww9mkLHxHpkRzelPelw=="], - "@colbymchenry/codegraph-win32-arm64": ["@colbymchenry/codegraph-win32-arm64@1.0.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-ZEG+HOakHiAe1AWMa2LgD52HyIEbWsY2FyNvDmon4Ss2889OghqUyA8BOLu5hNW+EI42JwwSXijVevn2Zn0hlg=="], + "@colbymchenry/codegraph-win32-arm64": ["@colbymchenry/codegraph-win32-arm64@1.4.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Y6G70FVvhGi5Zl1PMzywqZ+NEZ4+WpJQoN/KXU44IeId7PV+UjgN9sei1iK1DTsKXMVXu0bSYcyCIufbjo32+w=="], - "@colbymchenry/codegraph-win32-x64": ["@colbymchenry/codegraph-win32-x64@1.0.1", "", { "os": "win32", "cpu": "x64" }, "sha512-qU6jjyma635qKJ0aaL8XU8QtYUGkWly0Mu4Wm2cSWRcNDL1v6sVoHMElgfUY7E9tK0gnU+/LbZW3MfmtqLG1GA=="], + "@colbymchenry/codegraph-win32-x64": ["@colbymchenry/codegraph-win32-x64@1.4.0", "", { "os": "win32", "cpu": "x64" }, "sha512-i+oGd0zCuXgsbvgfx89F3Fk+1pCoH2cZe+xQAzH0Icz7fyzhyggj9OZ08Og2FPRqf9xgyPe7jUzPBoZtuPGtPg=="], "@emnapi/core": ["@emnapi/core@1.11.1", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ=="], diff --git a/docs/examples/github-hosted-runner-workflow.yml b/docs/examples/github-hosted-runner-workflow.yml index 3a6c0977..09ba2868 100644 --- a/docs/examples/github-hosted-runner-workflow.yml +++ b/docs/examples/github-hosted-runner-workflow.yml @@ -30,8 +30,8 @@ jobs: trust-level: organization fail-on: blocking fork-pr-mode: unsupported - runtime-version: "0.2.2" - runtime-artifact-url: https://archcontext.repoharness.com/releases/archctx-0.2.2.tgz + runtime-version: "0.2.3" + runtime-artifact-url: https://archcontext.repoharness.com/releases/archctx-0.2.3.tgz runtime-artifact-digest: sha256: expected-repository: expected-head-sha: ${{ github.event.pull_request.head.sha }} diff --git a/docs/examples/reusable-organization-runner-caller.yml b/docs/examples/reusable-organization-runner-caller.yml index f3657a1e..bf3dd744 100644 --- a/docs/examples/reusable-organization-runner-caller.yml +++ b/docs/examples/reusable-organization-runner-caller.yml @@ -21,8 +21,8 @@ jobs: expected_repository: ${{ github.repository }} expected_head_sha: ${{ github.event.pull_request.head.sha }} expected_head_tree_oid: - runtime_artifact_url: https://archcontext.repoharness.com/releases/archctx-0.2.2.tgz + runtime_artifact_url: https://archcontext.repoharness.com/releases/archctx-0.2.3.tgz runtime_artifact_digest: sha256: - runtime_version: "0.2.2" + runtime_version: "0.2.3" fail_on: blocking fork_pr_mode: unsupported diff --git a/docs/runbooks/trusted-runner.md b/docs/runbooks/trusted-runner.md index 07e15ab5..e45a87c1 100644 --- a/docs/runbooks/trusted-runner.md +++ b/docs/runbooks/trusted-runner.md @@ -48,8 +48,8 @@ jobs: trust-level: organization fail-on: blocking fork-pr-mode: unsupported - runtime-version: "0.2.2" - runtime-artifact-url: https://archcontext.repoharness.com/releases/archctx-0.2.2.tgz + runtime-version: "0.2.3" + runtime-artifact-url: https://archcontext.repoharness.com/releases/archctx-0.2.3.tgz runtime-artifact-digest: sha256: expected-repository: expected-head-sha: diff --git a/docs/verification/fg6-npm-release-dry-run.json b/docs/verification/fg6-npm-release-dry-run.json index 02da7e02..6e118bdf 100644 --- a/docs/verification/fg6-npm-release-dry-run.json +++ b/docs/verification/fg6-npm-release-dry-run.json @@ -4,10 +4,10 @@ "environment": "npm-release-dry-run", "status": "verified", "ok": true, - "generatedAt": "2026-07-10T16:31:49.602Z", + "generatedAt": "2026-07-10T17:49:37.831Z", "package": { "name": "archctx", - "version": "0.2.2", + "version": "0.2.3", "private": false, "homepage": "https://archcontext.repoharness.com", "license": "Apache-2.0", @@ -16,11 +16,10 @@ "node": ">=24 <26" }, "bin": { - "archctx": "./bin/archctx.mjs", - "codegraph": "./bin/codegraph.mjs" + "archctx": "./bin/archctx.mjs" }, "dependencies": { - "@colbymchenry/codegraph": "1.0.1", + "@colbymchenry/codegraph": "1.4.0", "@node-rs/jieba": "^2.0.1" }, "publishConfig": { @@ -29,13 +28,13 @@ }, "artifact": { "artifactDir": "_ops/npm/fg6-release-dry-run", - "tarball": "archctx-0.2.2.tgz", - "publishDryRunId": "archctx@0.2.2", - "integrity": "sha512-BsY6yMl0eaLm5nTaNLJnlRAXsfNqp30Nm4R5ZYgiO+9lRR2qOwqbPvw2oLU5mjjHo47fiw4/evWv4NbKEzjABg==", - "shasum": "37d3c4ab05658d3cb7739f4bd38927c51d50979f", - "size": 315507, - "unpackedSize": 1633858, - "entryCount": 79, + "tarball": "archctx-0.2.3.tgz", + "publishDryRunId": "archctx@0.2.3", + "integrity": "sha512-KLT4KrqhTSrYLi1zU6l2JZHOZMdMajOVkhtEnldkR25qGKjFVE1pubeMSC26piPXa8DGPnVaof/VIsmRhj38yw==", + "shasum": "0ad264beca1c0d2ee0f993b2604295bcaf3ba37c", + "size": 315660, + "unpackedSize": 1634879, + "entryCount": 78, "files": [ "NOTICE.md", "README.md", @@ -58,7 +57,6 @@ "assets/sources/core.yaml", "assets/sources/s6.yaml", "bin/archctx.mjs", - "bin/codegraph.mjs", "package.json", "schemas/cloud/attestation-v2.schema.json", "schemas/cloud/attestation.schema.json", @@ -197,7 +195,7 @@ "noticeMentionsAllAttribution": true }, "rollout": { - "postPublishInstallCommand": "npm install -g archctx@0.2.2", + "postPublishInstallCommand": "npm install -g archctx@0.2.3", "homeUrl": "https://archcontext.repoharness.com" }, "assertions": { @@ -210,8 +208,8 @@ "nativeTokenizerDependencyDeclared": true, "homeUrlCorrect": true, "noSourceRepositoryUrl": true, - "binExposesArchctx": true, - "binExposesCodeGraph": true, + "binExposesOnlyArchctx": true, + "codeGraphDependencyMatchesRoot": true, "publishRegistryCorrect": true, "npmPackProducedTarball": true, "publishDryRunSucceeded": true, diff --git a/package.json b/package.json index f08745da..80800c56 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "archcontext", - "version": "0.2.2", + "version": "0.2.3", "private": true, "type": "module", "packageManager": "bun@1.3.10", @@ -16,7 +16,7 @@ }, "dependencies": { "@archcontext/surfaces": "workspace:*", - "@colbymchenry/codegraph": "1.0.1" + "@colbymchenry/codegraph": "1.4.0" }, "scripts": { "test": "bun test", diff --git a/packages/cloud/package.json b/packages/cloud/package.json index 4b228776..1f0bd5ed 100644 --- a/packages/cloud/package.json +++ b/packages/cloud/package.json @@ -1,6 +1,6 @@ { "name": "@archcontext/cloud", - "version": "0.2.2", + "version": "0.2.3", "private": true, "type": "module", "exports": { diff --git a/packages/contracts/fixtures/valid/product-version-manifest.json b/packages/contracts/fixtures/valid/product-version-manifest.json index 65996dff..44404113 100644 --- a/packages/contracts/fixtures/valid/product-version-manifest.json +++ b/packages/contracts/fixtures/valid/product-version-manifest.json @@ -2,7 +2,7 @@ "schemaVersion": "archcontext.product-version-manifest/v1", "product": { "name": "archctx", - "version": "0.2.2", + "version": "0.2.3", "distribution": "one-package" }, "packageManager": "bun@1.3.10", @@ -12,25 +12,25 @@ "surfaces": { "cli": { "packageName": "@archcontext/surfaces", - "version": "0.2.2", + "version": "0.2.3", "entrypoint": "archctx" }, "daemon": { "packageName": "@archcontext/local-runtime", - "version": "0.2.2", + "version": "0.2.3", "entrypoint": "archctx daemon start", "rpcSchemaVersion": "archcontext.runtime-rpc/v1" }, "mcp": { "packageName": "@archcontext/surfaces", - "version": "0.2.2", + "version": "0.2.3", "entrypoint": "archctx mcp", "transport": "stdio" } }, "schemas": { "schemaSetVersion": "2026-06-25.al0-ledger", - "contractsPackageVersion": "0.2.2", + "contractsPackageVersion": "0.2.3", "reviewChallenge": "archcontext.review-challenge/v2", "attestation": "archcontext.attestation/v2", "deviceIdentity": "archcontext.device-identity/v1", @@ -44,7 +44,7 @@ "sqliteMigrations": "0001_runtime_state..0004_changeset_journal", "codeGraph": { "packageName": "@colbymchenry/codegraph", - "requiredVersion": "1.0.1", + "requiredVersion": "1.4.0", "adapter": "codegraph-cli" } } diff --git a/packages/contracts/package.json b/packages/contracts/package.json index 3287b9fc..d4220706 100644 --- a/packages/contracts/package.json +++ b/packages/contracts/package.json @@ -1,6 +1,6 @@ { "name": "@archcontext/contracts", - "version": "0.2.2", + "version": "0.2.3", "private": false, "type": "module", "license": "Apache-2.0", diff --git a/packages/contracts/src/product-version.ts b/packages/contracts/src/product-version.ts index e63483c6..aec24359 100644 --- a/packages/contracts/src/product-version.ts +++ b/packages/contracts/src/product-version.ts @@ -1,5 +1,5 @@ export const ARCHCONTEXT_PRODUCT_NAME = "archctx"; -export const ARCHCONTEXT_PRODUCT_VERSION = "0.2.2"; +export const ARCHCONTEXT_PRODUCT_VERSION = "0.2.3"; export const ARCHCONTEXT_PACKAGE_MANAGER = "bun@1.3.10"; export const ARCHCONTEXT_NODE_RANGE = ">=24 <26"; export const LOCAL_RUNTIME_RPC_SCHEMA_VERSION = "archcontext.runtime-rpc/v1"; @@ -41,7 +41,7 @@ export interface ProductVersionManifest { sqliteMigrations: string; codeGraph: { packageName: "@colbymchenry/codegraph"; - requiredVersion: "1.0.1"; + requiredVersion: "1.4.0"; adapter: "codegraph-cli"; }; }; @@ -100,7 +100,7 @@ export function productVersionManifest(): ProductVersionManifest { sqliteMigrations: "0001_runtime_state..0004_changeset_journal", codeGraph: { packageName: "@colbymchenry/codegraph", - requiredVersion: "1.0.1", + requiredVersion: "1.4.0", adapter: "codegraph-cli" } } diff --git a/packages/core/package.json b/packages/core/package.json index f364a39f..702ad3ea 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@archcontext/core", - "version": "0.2.2", + "version": "0.2.3", "private": true, "type": "module", "exports": { diff --git a/packages/core/practice-catalog/assets/catalog.yaml b/packages/core/practice-catalog/assets/catalog.yaml index 683a7954..f3ee7148 100644 --- a/packages/core/practice-catalog/assets/catalog.yaml +++ b/packages/core/practice-catalog/assets/catalog.yaml @@ -1,7 +1,7 @@ { "schemaVersion": "archcontext.practice-catalog-manifest/v1", "catalogVersion": "2026.06.0", - "productVersion": "0.2.2", + "productVersion": "0.2.3", "generatedAt": "1970-01-01T00:00:00.000Z", "entries": [ { @@ -389,5 +389,5 @@ "structurizr.dsl", "twelve-factor" ], - "catalogDigest": "sha256:29ec900ce3f20de0c586c6f7c125135eb9c1f138f05979f9a85bc433909e7b7e" + "catalogDigest": "sha256:4eb838762f60289e014d20a14411e6471d0d4e6ed97fccdf393fdb2a2583c872" } diff --git a/packages/local-runtime/codegraph-adapter/src/index.ts b/packages/local-runtime/codegraph-adapter/src/index.ts index 36da686e..902624ef 100644 --- a/packages/local-runtime/codegraph-adapter/src/index.ts +++ b/packages/local-runtime/codegraph-adapter/src/index.ts @@ -1,14 +1,17 @@ import { execFileSync } from "node:child_process"; -import { closeSync, existsSync, openSync, readSync, realpathSync, statSync } from "node:fs"; -import { basename, delimiter, isAbsolute, join, posix } from "node:path"; +import { accessSync, closeSync, constants as fsConstants, existsSync, openSync, readFileSync, readSync, realpathSync, statSync } from "node:fs"; +import { createRequire } from "node:module"; +import { basename, delimiter, dirname, isAbsolute, join, posix, resolve } from "node:path"; import { buildArchitectureCandidateDelta, type ArchitectureDeltaDeclaredGraph, type ArchitectureDeltaGitChangeMetadata } from "@archcontext/core/architecture-delta"; import { repoScopedArchitectureId, type CrossRepoRelation } from "@archcontext/core/architecture-domain"; import { digestJson, type ArchitectureCandidateDeltaV1, type ArchitectureRepositoryIdentityV1, type ArchitectureWorktreeIdentityV1, type CodeFactsPort, type CodeFactsSnapshot, type ImpactQuery, type Json, type NormalizedCodeContext, type NormalizedEdge, type NormalizedImpact, type NormalizedSymbol, type ObservedEvidence, type SourceSelector, type SymbolQuery, type WorkspaceRef } from "@archcontext/contracts"; export const REQUIRED_CODEGRAPH_PACKAGE = "@colbymchenry/codegraph"; -export const REQUIRED_CODEGRAPH_VERSION = "1.0.1"; +export const REQUIRED_CODEGRAPH_VERSION = "1.4.0"; export const CODEGRAPH_TELEMETRY_ENV = "DO_NOT_TRACK"; export const CODEGRAPH_TELEMETRY_DISABLED_VALUE = "1"; +const DEFAULT_CODEGRAPH_BINARY = "codegraph"; +const requireFromAdapter = createRequire(import.meta.url); type MutableEnv = Record; @@ -31,7 +34,7 @@ export class CodeGraphCliProvider implements CodeGraphProvider { capabilities = ["index", "context", "impact"]; private workspaceRoot: string; - constructor(workspaceRoot = process.cwd(), private readonly binary = "codegraph") { + constructor(workspaceRoot = process.cwd(), private readonly binary = DEFAULT_CODEGRAPH_BINARY) { this.workspaceRoot = workspaceRoot; } @@ -120,32 +123,62 @@ export class CodeGraphCliProvider implements CodeGraphProvider { } } -interface CodeGraphCliInvocation { +export interface CodeGraphCliInvocation { command: string; argsPrefix: string[]; } -function codeGraphCliInvocation(binary: string, cwd: string): CodeGraphCliInvocation { - const resolved = resolveExecutable(binary, cwd); +export function codeGraphCliInvocation(binary: string, cwd: string, pathValue = process.env.PATH ?? ""): CodeGraphCliInvocation { + const resolved = resolveExecutable(binary, cwd, pathValue); if (resolved && isNodeRuntimeScript(resolved)) { return { command: process.execPath, argsPrefix: [resolved] }; } + if (!resolved && binary === DEFAULT_CODEGRAPH_BINARY) { + const packagedShim = resolvePackagedCodeGraphShim(); + if (packagedShim) return { command: process.execPath, argsPrefix: [packagedShim] }; + } return { command: binary, argsPrefix: [] }; } -function resolveExecutable(binary: string, cwd: string): string | undefined { +function resolveExecutable(binary: string, cwd: string, pathValue: string): string | undefined { if (binary.includes("/") || binary.includes("\\")) { const path = isAbsolute(binary) ? binary : join(cwd, binary); return existsSync(path) ? realpathSync.native(path) : undefined; } - for (const dir of (process.env.PATH ?? "").split(delimiter)) { + for (const dir of pathValue.split(delimiter)) { if (!dir) continue; const path = join(dir, binary); - if (existsSync(path)) return realpathSync.native(path); + if (isExecutablePath(path)) return realpathSync.native(path); } return undefined; } +function isExecutablePath(path: string): boolean { + try { + if (!statSync(path).isFile()) return false; + if (process.platform !== "win32") accessSync(path, fsConstants.X_OK); + return true; + } catch { + return false; + } +} + +function resolvePackagedCodeGraphShim(): string | undefined { + try { + const manifestPath = requireFromAdapter.resolve(`${REQUIRED_CODEGRAPH_PACKAGE}/package.json`); + const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as { + version?: string; + bin?: Record; + }; + const relativeBin = manifest.bin?.codegraph; + if (manifest.version !== REQUIRED_CODEGRAPH_VERSION || !relativeBin) return undefined; + const shimPath = resolve(dirname(manifestPath), relativeBin); + return existsSync(shimPath) ? realpathSync.native(shimPath) : undefined; + } catch { + return undefined; + } +} + function isNodeRuntimeScript(path: string): boolean { if (/\.[cm]?js$/i.test(path)) return true; const prefix = readFilePrefix(path, 256); diff --git a/packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts b/packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts index 0aa9fbd8..3b989817 100644 --- a/packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts +++ b/packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts @@ -1,9 +1,9 @@ import { describe, expect, test } from "bun:test"; -import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs"; +import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; import { digestJson, type Json } from "@archcontext/contracts"; -import { CODEGRAPH_TELEMETRY_ENV, CodeGraphAdapter, CodeGraphCliProvider, MultiRepoCodeGraphAdapter, disableCodeGraphTelemetryByDefault } from "../src/index"; +import { CODEGRAPH_TELEMETRY_ENV, CodeGraphAdapter, CodeGraphCliProvider, MultiRepoCodeGraphAdapter, codeGraphCliInvocation, disableCodeGraphTelemetryByDefault } from "../src/index"; import { MockCodeGraphProvider } from "./factories"; describe("@archcontext/local-runtime/codegraph-adapter multi-repo", () => { @@ -45,6 +45,49 @@ writeFileSync(${JSON.stringify(logPath)}, JSON.stringify({ } }); + test("uses PATH before the packaged CodeGraph dependency", () => { + const root = mkdtempSync(join(tmpdir(), "archctx-codegraph-path-precedence-")); + const pathShim = join(root, "codegraph"); + try { + writeFileSync(pathShim, "#!/usr/bin/env node\n"); + chmodSync(pathShim, 0o755); + + expect(codeGraphCliInvocation("codegraph", root, root)).toEqual({ + command: process.execPath, + argsPrefix: [realpathSync.native(pathShim)] + }); + } finally { + rmSync(root, { recursive: true, force: true }); + } + }); + + test("ignores a non-executable PATH collision when resolving the default command", () => { + if (process.platform === "win32") return; + const root = mkdtempSync(join(tmpdir(), "archctx-codegraph-path-collision-")); + const collision = join(root, "codegraph"); + try { + writeFileSync(collision, "not an executable\n", { mode: 0o644 }); + + const invocation = codeGraphCliInvocation("codegraph", root, root); + expect(invocation.command).toBe(process.execPath); + expect(invocation.argsPrefix[0]).toEndWith(join("node_modules", "@colbymchenry", "codegraph", "npm-shim.js")); + } finally { + rmSync(root, { recursive: true, force: true }); + } + }); + + test("uses the packaged CodeGraph dependency only for the unresolved default command", () => { + const packaged = codeGraphCliInvocation("codegraph", process.cwd(), ""); + expect(packaged.command).toBe(process.execPath); + expect(packaged.argsPrefix).toHaveLength(1); + expect(packaged.argsPrefix[0]).toEndWith(join("node_modules", "@colbymchenry", "codegraph", "npm-shim.js")); + + expect(codeGraphCliInvocation("team-codegraph", process.cwd(), "")).toEqual({ + command: "team-codegraph", + argsPrefix: [] + }); + }); + test("extracts import edges from CodeGraph import nodes scoped by changed paths", async () => { const root = mkdtempSync(join(tmpdir(), "archctx-codegraph-import-edge-")); const logPath = join(root, "codegraph-query-log.json"); diff --git a/packages/local-runtime/package.json b/packages/local-runtime/package.json index a152d0a9..a0cc8d0b 100644 --- a/packages/local-runtime/package.json +++ b/packages/local-runtime/package.json @@ -1,6 +1,6 @@ { "name": "@archcontext/local-runtime", - "version": "0.2.2", + "version": "0.2.3", "private": true, "type": "module", "exports": { @@ -16,6 +16,6 @@ "dependencies": { "@archcontext/contracts": "workspace:*", "@archcontext/core": "workspace:*", - "@colbymchenry/codegraph": "1.0.1" + "@colbymchenry/codegraph": "1.4.0" } } diff --git a/packages/surfaces/cli/test/cli.test.ts b/packages/surfaces/cli/test/cli.test.ts index c73dacc4..7867b0ac 100644 --- a/packages/surfaces/cli/test/cli.test.ts +++ b/packages/surfaces/cli/test/cli.test.ts @@ -324,7 +324,7 @@ describe("archctx CLI", () => { expect((doctor.data as any).git).toMatchObject({ ok: true, headSha: "unborn" }); expectSameExistingPath((doctor.data as any).git.root, root); expect((doctor.data as any).permissions.workspace.writable).toBe(true); - expect((doctor.data as any).codeGraph.requiredVersion).toBe("1.0.1"); + expect((doctor.data as any).codeGraph.requiredVersion).toBe("1.4.0"); expect((doctor.data as any).update).toMatchObject({ schemaVersion: "archcontext.update-check/v1", packageName: "archctx", diff --git a/packages/surfaces/cli/test/local-product-e2e.test.ts b/packages/surfaces/cli/test/local-product-e2e.test.ts index 16c9e90d..b263f9dd 100644 --- a/packages/surfaces/cli/test/local-product-e2e.test.ts +++ b/packages/surfaces/cli/test/local-product-e2e.test.ts @@ -234,7 +234,7 @@ async function runFirstExperience( expect(doctor.ok).toBe(true); expect(doctor.data.git).toMatchObject({ ok: true, headSha }); expectSameExistingPath(doctor.data.git.root, repo); - expect(doctor.data.codeGraph.requiredVersion).toBe("1.0.1"); + expect(doctor.data.codeGraph.requiredVersion).toBe("1.4.0"); expect(doctor.data.egress).toMatchObject({ ok: true, defaultOutbound: "local-only", diff --git a/packages/surfaces/package.json b/packages/surfaces/package.json index 0dbb5b03..1c017479 100644 --- a/packages/surfaces/package.json +++ b/packages/surfaces/package.json @@ -1,6 +1,6 @@ { "name": "@archcontext/surfaces", - "version": "0.2.2", + "version": "0.2.3", "private": true, "type": "module", "bin": { diff --git a/plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md b/plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md new file mode 100644 index 00000000..9d33962d --- /dev/null +++ b/plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md @@ -0,0 +1,72 @@ +# Plan: CodeGraph latest compatibility without global bin collision + +> **Status**: Executing +> **Created**: 20260711-0055 +> **Slug**: codegraph-latest-no-bin-collision +> **Artifact Level**: work-package +> **Promotion Reason**: merge_boundary +> **Verification Boundary**: focused tests + typecheck + npm dry-run + installed-tarball smoke + 0.2.3 registry/tag/release readback +> **Rollback Surface**: revert bounded diff from `b0e2d76`; no data migration +> **Spec**: `docs/spec.md` +> **Research**: npm registry readback on 2026-07-11 +> **Task Contract**: `tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md` +> **Task Review**: `tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md` +> **Implementation Notes**: `tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md` + +## Agentic Routing + +- Selected route: implementation +- Routing reason: two independently verifiable surfaces exist: runtime compatibility and release packaging. +- Due diligence: + - P1 map: CodeGraph authority is split across root/local-runtime manifests, the adapter compatibility constant, the product manifest, and generated npm packaging. + - P2 trace: `archctx` creates `CodeGraphCliProvider` -> resolves/spawns `codegraph` -> `CodeGraphAdapter.assertCompatible`; the public tarball currently also re-exports a `codegraph` bin. + - P3 decision rationale: user-facing consumers use `archctx@latest`; source and tarball lock the registry-resolved CodeGraph latest exactly for reproducibility; the package keeps CodeGraph as an internal dependency but no longer owns the global `codegraph` command. + +## Scope + +- Update the current CodeGraph compatibility authority from `1.0.1` to registry latest `1.4.0`. +- Keep the dependency exact in manifests and `bun.lock`; do not use a floating dependency tag inside the release artifact. +- Remove the generated `archctx` package's own `codegraph` bin mapping/shim. +- Let the runtime resolve the packaged CodeGraph dependency when no PATH command is available. +- Update focused tests/readbacks that define the current release shape. +- Do not publish npm, mutate global PATH, or rewrite historical verification evidence. +- Release follow-through authorized on 2026-07-11: align all current product-version surfaces to `0.2.3`, publish npm, create the Git tag and GitHub Release, and regenerate current release readbacks. +- Do not mutate the existing capability registry or ArchContext-generated architecture projections as a release-gate workaround; the pre-existing orphan-module incompatibility is recorded as workflow-tool debt. + +## Verification + +```bash +bun test packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts scripts/fg6-npm-release-dry-run.test.ts scripts/architecture-ledger-al10-release-packaging-readback.test.ts scripts/release-provenance-readback.test.ts +bun run typecheck +bun scripts/fg6-npm-release-dry-run.ts run --out /tmp/archctx-codegraph-latest-dry-run.json --artifact-dir /tmp/archctx-codegraph-latest-artifacts --json +node scripts/local-product-tarball-smoke.mjs +``` + +## Evidence Contract + +- **State/progress path**: this plan's task breakdown plus the linked contract, notes, and review. +- **Verification evidence**: focused test output, generated npm dry-run manifest, and installed-tarball smoke output. +- **Evaluator rubric**: contract exit criteria pass and review recommends pass. +- **Stop condition**: all task rows complete, generated package exposes only `archctx`, and all listed commands pass. +- **Rollback surface**: revert the bounded diff from base `b0e2d76`; no data migration. + +## Promotion Gate + +- **Merge/PR unit**: one bounded compatibility and packaging fix. +- **Rollback surface**: revert the bounded diff; no data migration. +- **Verification boundary**: focused tests, typecheck, npm release dry-run, and installed-tarball smoke. +- **Review/acceptance boundary**: linked review recommends pass; npm publication remains a separate explicit action. +- **High-risk surface**: packaged CodeGraph lookup under a global-style install and CLI compatibility with `1.4.0`. +- **Why not checklist row**: it changes both runtime dependency authority and the public npm bin contract. + +## Task Breakdown + +- [x] Update runtime compatibility and dependency authority to CodeGraph `1.4.0`. +- [x] Remove the public-package `codegraph` bin while preserving internal runtime resolution. +- [x] Verify focused tests, release dry-run, and installed-tarball behavior. +- [x] Record review and implementation evidence. +- [x] Align all current product-version and release-prep surfaces to `0.2.3`. +- [x] Re-run full release preflight and pack/install smoke. +- [ ] Publish `archctx@0.2.3` after browser authorization, then verify registry metadata and bins. +- [ ] Create/push `v0.2.3`, create GitHub Release, and regenerate release readbacks. +- [ ] Record final review and release evidence. diff --git a/scripts/architecture-ledger-al10-release-packaging-readback.test.ts b/scripts/architecture-ledger-al10-release-packaging-readback.test.ts index 0f60a365..acdafd62 100644 --- a/scripts/architecture-ledger-al10-release-packaging-readback.test.ts +++ b/scripts/architecture-ledger-al10-release-packaging-readback.test.ts @@ -33,13 +33,14 @@ describe("AL10 release packaging readback evidence", () => { expect(result.failures).toContain("assertions.AL10-10 must be true"); }); - test("rejects a packaged CLI missing release contract signatures", () => { + test("rejects a packaged CLI with a conflicting bin and missing release contract signatures", () => { const packet = completePacket(); const hookGroup = packet.releasePackage.bundleSignatures.find((group: any) => group.id === "hooks"); hookGroup.passed = false; hookGroup.presentCount = 3; hookGroup.missing = ["archcontext.hook-enqueue-fail-open/v1", "jobsEnqueueGitHook"]; - packet.releasePackage.packageFiles = packet.releasePackage.packageFiles.filter((file: string) => file !== "bin/codegraph.mjs"); + packet.releasePackage.package.bin.codegraph = "./bin/codegraph.mjs"; + packet.releasePackage.packageFiles.push("bin/codegraph.mjs"); packet.releasePackage.assertions.bundleIncludesHooks = false; packet.releasePackage.assertions.packagedCliIncludesRequiredFiles = false; packet.assertions["AL10-11"] = false; @@ -47,7 +48,8 @@ describe("AL10 release packaging readback evidence", () => { const result = inspectArchitectureLedgerAl10ReleasePackagingReadback(packet); expect(result.ok).toBe(false); - expect(result.failures).toContain("package missing bin/codegraph.mjs"); + expect(result.failures).toContain("release package bin must expose only archctx"); + expect(result.failures).toContain("package must not include bin/codegraph.mjs"); expect(result.failures).toContain("bundle signature group failed: hooks: archcontext.hook-enqueue-fail-open/v1,jobsEnqueueGitHook"); expect(result.failures).toContain("assertions.AL10-11 must be true"); }); @@ -97,11 +99,11 @@ function completePacket(): any { version: "0.1.3", private: false, bin: { - archctx: "./bin/archctx.mjs", - codegraph: "./bin/codegraph.mjs" + archctx: "./bin/archctx.mjs" }, engines: { node: ">=24 <26" }, dependencies: { + "@colbymchenry/codegraph": "1.4.0", "@node-rs/jieba": "^2.0.1" } }, @@ -118,7 +120,7 @@ function completePacket(): any { sha256: `sha256:${"c".repeat(64)}`, shebang: "#!/usr/bin/env node" }, - packageFiles: ["bin/archctx.mjs", "bin/codegraph.mjs", "package.json", "README.md"], + packageFiles: ["bin/archctx.mjs", "package.json", "README.md"], bundleSignatures: [ signatureGroup("migrations", 5), signatureGroup("hooks", 5), diff --git a/scripts/architecture-ledger-al10-release-packaging-readback.ts b/scripts/architecture-ledger-al10-release-packaging-readback.ts index 99306352..39d58734 100644 --- a/scripts/architecture-ledger-al10-release-packaging-readback.ts +++ b/scripts/architecture-ledger-al10-release-packaging-readback.ts @@ -312,8 +312,8 @@ async function inspectPackagedRelease() { const bundleSignatures = BUNDLE_SIGNATURES.map((group) => inspectBundleSignatureGroup(bin, group)); const assertions = { packagedCliIncludesRequiredFiles: packageFiles.includes("bin/archctx.mjs") - && packageFiles.includes("bin/codegraph.mjs") - && packageFiles.includes("package.json"), + && packageFiles.includes("package.json") + && !packageFiles.includes("bin/codegraph.mjs"), bundleIncludesMigrations: bundleGroupPassed(bundleSignatures, "migrations"), bundleIncludesHooks: bundleGroupPassed(bundleSignatures, "hooks"), bundleIncludesRenderers: bundleGroupPassed(bundleSignatures, "renderers"), @@ -405,9 +405,14 @@ function inspectReleasePackage(releasePackage: any, failures: string[]): void { if (releasePackage.package?.private !== false) failures.push("release package must be publishable"); if (releasePackage.bin?.shebang !== "#!/usr/bin/env node") failures.push("packaged CLI must use node shebang"); const packageFiles = Array.isArray(releasePackage.packageFiles) ? releasePackage.packageFiles : []; - for (const file of ["bin/archctx.mjs", "bin/codegraph.mjs", "package.json"]) { + for (const file of ["bin/archctx.mjs", "package.json"]) { if (!packageFiles.includes(file)) failures.push(`package missing ${file}`); } + const packageBin = readRecord(releasePackage.package?.bin); + if (Object.keys(packageBin).length !== 1 || packageBin.archctx !== "./bin/archctx.mjs") { + failures.push("release package bin must expose only archctx"); + } + if (packageFiles.includes("bin/codegraph.mjs")) failures.push("package must not include bin/codegraph.mjs"); if (packageFiles.some((path: string) => path.includes("packages/") || path.includes("/src/") || path.endsWith(".ts"))) { failures.push("package must not include workspace source files"); } diff --git a/scripts/fg6-npm-release-dry-run.test.ts b/scripts/fg6-npm-release-dry-run.test.ts index 1b5ecb77..58ce3a94 100644 --- a/scripts/fg6-npm-release-dry-run.test.ts +++ b/scripts/fg6-npm-release-dry-run.test.ts @@ -14,7 +14,8 @@ describe("fg6 npm release dry-run", () => { rootManifest: { name: "archcontext", version: "0.1.5", - engines: { node: ">=24 <26" } + engines: { node: ">=24 <26" }, + dependencies: { "@colbymchenry/codegraph": "1.4.0" } }, packageJson: { name: "archctx", @@ -23,9 +24,9 @@ describe("fg6 npm release dry-run", () => { homepage: "https://archcontext.repoharness.com", license: "Apache-2.0", engines: { node: ">=24 <26" }, - bin: { archctx: "./bin/archctx.mjs", codegraph: "./bin/codegraph.mjs" }, + bin: { archctx: "./bin/archctx.mjs" }, dependencies: { - "@colbymchenry/codegraph": "1.0.1", + "@colbymchenry/codegraph": "1.4.0", "@node-rs/jieba": "^2.0.1" }, publishConfig: { registry: "https://registry.npmjs.org/" } @@ -49,7 +50,6 @@ describe("fg6 npm release dry-run", () => { entryCount: 16, files: [ { path: "bin/archctx.mjs" }, - { path: "bin/codegraph.mjs" }, { path: "assets/catalog.yaml" }, { path: "assets/practices/s6-expanded.yaml" }, { path: "assets/profiles/s6.yaml" }, @@ -84,7 +84,8 @@ describe("fg6 npm release dry-run", () => { rootManifest: { name: "archcontext", version: "0.1.5", - engines: { node: ">=24 <26" } + engines: { node: ">=24 <26" }, + dependencies: { "@colbymchenry/codegraph": "1.4.0" } }, packageJson: { name: "archcontext", @@ -94,9 +95,9 @@ describe("fg6 npm release dry-run", () => { packageManager: "bun@1.3.10", engines: { node: ">=24 <26", bun: ">=1.3.10" }, repository: { type: "git", url: "git+https://github.com/Ancienttwo/arch-context.git" }, - bin: { archctx: "./bin/archctx.mjs" }, + bin: { archctx: "./bin/archctx.mjs", codegraph: "./bin/codegraph.mjs" }, dependencies: { - "@colbymchenry/codegraph": "1.0.1" + "@colbymchenry/codegraph": "1.4.0" }, publishConfig: { registry: "https://registry.npmjs.org/" } }, @@ -126,6 +127,7 @@ describe("fg6 npm release dry-run", () => { expect(recording.assertions.noBunRuntimeDeclared).toBe(false); expect(recording.assertions.homeUrlCorrect).toBe(false); expect(recording.assertions.noSourceRepositoryUrl).toBe(false); + expect(recording.assertions.binExposesOnlyArchctx).toBe(false); const result = inspectNpmReleaseDryRun(recording); expect(result.ok).toBe(false); expect(result.failures).toContain("dry-run must be verified ok"); diff --git a/scripts/fg6-npm-release-dry-run.ts b/scripts/fg6-npm-release-dry-run.ts index a5d5647e..e3327f48 100644 --- a/scripts/fg6-npm-release-dry-run.ts +++ b/scripts/fg6-npm-release-dry-run.ts @@ -124,8 +124,10 @@ export function buildNpmReleaseDryRunReadback(input: { nativeTokenizerDependencyDeclared: readRecord(input.packageJson.dependencies)["@node-rs/jieba"] === "^2.0.1", homeUrlCorrect: input.packageJson.homepage === HOME_URL, noSourceRepositoryUrl: !("repository" in input.packageJson), - binExposesArchctx: readRecord(input.packageJson.bin).archctx === "./bin/archctx.mjs", - binExposesCodeGraph: readRecord(input.packageJson.bin).codegraph === "./bin/codegraph.mjs", + binExposesOnlyArchctx: Object.keys(readRecord(input.packageJson.bin)).length === 1 + && readRecord(input.packageJson.bin).archctx === "./bin/archctx.mjs", + codeGraphDependencyMatchesRoot: readRecord(input.packageJson.dependencies)["@colbymchenry/codegraph"] + === readRecord(input.rootManifest.dependencies)["@colbymchenry/codegraph"], publishRegistryCorrect: readRecord(input.packageJson.publishConfig).registry === REGISTRY, npmPackProducedTarball: tarballName === `${RELEASE_PACKAGE_NAME}-${input.rootManifest.version}.tgz`, publishDryRunSucceeded: (publish.name ?? input.packageJson.name) === RELEASE_PACKAGE_NAME @@ -141,7 +143,7 @@ export function buildNpmReleaseDryRunReadback(input: { context7OptionalNotRequired: !Object.keys(readRecord(input.packageJson.dependencies)).some((name) => name.toLowerCase().includes("context7")) && !Object.keys(readRecord(input.packageJson.optionalDependencies)).some((name) => name.toLowerCase().includes("context7")), packageContentsBounded: packageFiles.includes("bin/archctx.mjs") - && packageFiles.includes("bin/codegraph.mjs") + && !packageFiles.includes("bin/codegraph.mjs") && packageFiles.includes("README.md") && packageFiles.includes("package.json") && !packageFiles.some((path) => path.includes("src/") || path.includes("packages/") || path.includes(".git") || path.includes("_ops")) @@ -208,7 +210,13 @@ export function inspectNpmReleaseDryRun(recording: unknown): { ok: boolean; fail if (readRecord(pkg.engines).node !== ">=24 <26") failures.push("engines.node must be declared"); if ("bun" in readRecord(pkg.engines)) failures.push("engines.bun must not be declared"); if (readRecord(pkg.dependencies)["@node-rs/jieba"] !== "^2.0.1") failures.push("release package must declare native tokenizer dependency"); - if (readRecord(pkg.bin).codegraph !== "./bin/codegraph.mjs") failures.push("release package must expose bundled codegraph bin"); + const packageBin = readRecord(pkg.bin); + if (Object.keys(packageBin).length !== 1 || packageBin.archctx !== "./bin/archctx.mjs") { + failures.push("release package bin must expose only archctx"); + } + if (readRecord(pkg.dependencies)["@colbymchenry/codegraph"] !== "1.4.0") { + failures.push("release package must declare exact CodeGraph dependency 1.4.0"); + } if (!String(artifact.tarball ?? "").startsWith(`${RELEASE_PACKAGE_NAME}-`)) failures.push("tarball must use archctx package name"); const releaseAssets = readRecord(record.releaseAssets); if (Number(releaseAssets.sourceRecordCount ?? 0) <= 0) failures.push("release assets must include source registry records"); @@ -233,8 +241,7 @@ function buildReleaseManifest(rootManifest: Record, coreManifes private: false, type: "module", bin: { - archctx: "./bin/archctx.mjs", - codegraph: "./bin/codegraph.mjs" + archctx: "./bin/archctx.mjs" }, files: [ "bin", @@ -260,7 +267,6 @@ function buildReleaseStage(root: string, stageDir: string, packageJson: Record existsSync(candidate)) ?? candidates[0]; } +function resolveCodeGraphBin(binDir) { + const candidates = process.platform === "win32" + ? [join(binDir, "codegraph.cmd"), join(binDir, "codegraph.exe"), join(binDir, "codegraph")] + : [join(binDir, "codegraph")]; + return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0]; +} + function rewriteShebang(path, shebang) { const source = readFileSync(path, "utf8"); const withoutShebang = source.replace(/^#!.*\n/, ""); writeFileSync(path, `${shebang}\n${withoutShebang}`, "utf8"); } -function writeCodeGraphShim(path) { - writeFileSync(path, [ - "#!/usr/bin/env node", - "import { createRequire } from \"node:module\";", - "import { dirname, join } from \"node:path\";", - "const require = createRequire(import.meta.url);", - "const packageJson = require.resolve(\"@colbymchenry/codegraph/package.json\");", - "require(join(dirname(packageJson), \"npm-shim.js\"));", - "" - ].join("\n"), "utf8"); -} - function assertNodeOnlyReleaseRuntime(stageDir, binPath) { const bin = readFileSync(binPath, "utf8"); assert(bin.startsWith("#!/usr/bin/env node\n"), "release bin must use a node shebang"); @@ -425,17 +422,24 @@ function assertNodeOnlyReleaseRuntime(stageDir, binPath) { assert(manifest.license === "Apache-2.0", "release package must declare Apache-2.0 license"); assert(manifest.engines?.node === rootManifest.engines?.node, "release package must declare the root node engine"); assert(!("bun" in (manifest.engines ?? {})), "release package must not declare a bun engine"); - assert(manifest.bin?.codegraph === "./bin/codegraph.mjs", "release package must expose the bundled codegraph shim"); + assert( + Object.keys(manifest.bin ?? {}).length === 1 && manifest.bin?.archctx === "./bin/archctx.mjs", + "release package bin must expose only archctx" + ); + assert(!existsSync(join(stageDir, "bin", "codegraph.mjs")), "release package must not ship an ArchContext-owned CodeGraph shim"); + assert( + manifest.dependencies?.["@colbymchenry/codegraph"] === rootManifest.dependencies?.["@colbymchenry/codegraph"], + "release package must preserve the exact CodeGraph dependency" + ); assert(manifest.dependencies?.["@node-rs/jieba"] === coreManifest.dependencies?.["@node-rs/jieba"], "release package must declare native tokenizer dependency"); } -function nodeOnlyRuntimeEnv(binDir, stateRoot) { +function nodeOnlyRuntimeEnv(stateRoot) { return { ...process.env, DO_NOT_TRACK: "1", ARCHCONTEXT_STATE_DIR: stateRoot, PATH: [ - binDir, dirname(process.execPath), "/usr/bin", "/bin", diff --git a/scripts/release-provenance-readback.test.ts b/scripts/release-provenance-readback.test.ts index b43029e2..27f9ab02 100644 --- a/scripts/release-provenance-readback.test.ts +++ b/scripts/release-provenance-readback.test.ts @@ -74,8 +74,7 @@ function validInput(): Parameters[0] { version: RELEASE_VERSION, private: false, bin: { - archctx: "./bin/archctx.mjs", - codegraph: "./bin/codegraph.mjs" + archctx: "./bin/archctx.mjs" } } }, @@ -98,8 +97,7 @@ function validInput(): Parameters[0] { shasum: "abc", integrity: "sha512-test", bin: { - archctx: "bin/archctx.mjs", - codegraph: "bin/codegraph.mjs" + archctx: "bin/archctx.mjs" }, engines: { node: ">=24 <26" @@ -122,8 +120,7 @@ function validInput(): Parameters[0] { integrity: "sha512-test" }, bin: { - archctx: "bin/archctx.mjs", - codegraph: "bin/codegraph.mjs" + archctx: "bin/archctx.mjs" }, engines: { node: ">=24 <26" diff --git a/tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md b/tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md new file mode 100644 index 00000000..d4edb62c --- /dev/null +++ b/tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md @@ -0,0 +1,154 @@ +# Task Contract: codegraph-latest-no-bin-collision + +> **Status**: Active +> **Plan**: plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md +> **Task Profile**: code-change +> **Owner**: kito +> **Capability ID**: root +> **Last Updated**: 2026-07-11 01:53 CST +> **Review File**: `tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md` +> **Notes File**: `tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md` + +## Goal + +Make `archctx@latest` compatible with registry-current CodeGraph `1.4.0` without owning a conflicting global `codegraph` bin, then publish the fix as `archctx@0.2.3`, create `v0.2.3` and a GitHub Release, and prove registry/tag/release/bin metadata agree. + +## Scope + +- In scope: + - root/local-runtime CodeGraph dependency and lockfile + - adapter compatibility authority and packaged-dependency resolution + - product-version manifest/fixture and current CLI expectations + - generated npm package bin/files contract and focused release tests + - local installed-tarball smoke + - `0.2.3` version alignment across current product/release surfaces + - npm publish after user-completed browser authorization + - Git tag, GitHub Release, registry/bin readback, and current release evidence regeneration +- Out of scope: + - repo-harness changes + - floating `latest` in reproducibility-sensitive package manifests + - capability-registry or ArchContext projection mutations to bypass the pre-existing orphan-module gate + - global install or PATH mutation + +## Workflow Inventory + +- Source plan: `plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md` +- Deferred-goal ledger: `tasks/todos.md` +- Review file: `tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md` +- Notes file: `tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md` +- Checks file: `.ai/harness/checks/latest.json` +- Run snapshots: `.ai/harness/runs/` +- Scope gate: edit only paths listed under `allowed_paths`; update this contract before widening scope. + +## Allowed Paths + +```yaml +allowed_paths: + - plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md + - tasks/todos.md + - tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md + - tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md + - tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md + - package.json + - bun.lock + - packages/local-runtime/package.json + - packages/local-runtime/codegraph-adapter/ + - packages/contracts/src/product-version.ts + - packages/contracts/fixtures/valid/product-version-manifest.json + - packages/surfaces/cli/test/cli.test.ts + - packages/surfaces/cli/test/local-product-e2e.test.ts + - scripts/fg6-npm-release-dry-run.ts + - scripts/fg6-npm-release-dry-run.test.ts + - scripts/local-product-tarball-smoke.mjs + - scripts/architecture-ledger-al10-release-packaging-readback.ts + - scripts/architecture-ledger-al10-release-packaging-readback.test.ts + - scripts/release-provenance-readback.test.ts + - .github/workflows/archcontext-organization-runner.yml + - actions/review-action/action.yml + - docs/examples/github-hosted-runner-workflow.yml + - docs/examples/reusable-organization-runner-caller.yml + - docs/runbooks/trusted-runner.md + - docs/runbooks/personal-user-install.md + - packages/cloud/package.json + - packages/contracts/package.json + - packages/core/package.json + - packages/core/practice-catalog/assets/catalog.yaml + - packages/surfaces/package.json + - docs/verification/fg6-npm-release-dry-run.json + - docs/verification/architecture-ledger-al10-npm-release-readback.json + - docs/verification/fg6-release-distribution-readback.json + - docs/verification/fg6-release-distribution.md + - docs/verification/release-provenance-readback.json + - docs/verification/release-provenance.md +``` + +## Delegation Contract + +```yaml +delegation: + budget: + tokens: null + tool_calls: null + wall_time_minutes: null + permission_scope: + mode: inherit_allowed_paths + writable_paths: [] + network: inherited + roles: + parent: + mode: narrate_and_gatekeep + purpose: integration_owner + explorer: + mode: read_only + purpose: authoritative_version_surface_audit + worker: + mode: edit_within_allowed_paths + purpose: isolated_runtime_or_packaging_implementation + verifier: + mode: read_only + purpose: exit_criteria_review +``` + +## Exit Criteria (Machine Verifiable) + +```yaml +exit_criteria: + artifacts_exist: + - tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md + files_contain: + - path: package.json + pattern: '"@colbymchenry/codegraph": "1.4.0"' + - path: packages/local-runtime/codegraph-adapter/src/index.ts + pattern: 'REQUIRED_CODEGRAPH_VERSION = "1.4.0"' + - path: package.json + pattern: '"version": "0.2.3"' + - path: packages/contracts/src/product-version.ts + pattern: 'ARCHCONTEXT_PRODUCT_VERSION = "0.2.3"' + tests_pass: + - path: packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts + - path: scripts/fg6-npm-release-dry-run.test.ts + commands_succeed: + - bun run typecheck + - bun test packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts scripts/fg6-npm-release-dry-run.test.ts scripts/architecture-ledger-al10-release-packaging-readback.test.ts scripts/release-provenance-readback.test.ts + - bun scripts/fg6-npm-release-dry-run.ts run --out /tmp/archctx-codegraph-latest-dry-run.json --artifact-dir /tmp/archctx-codegraph-latest-artifacts --json + - node scripts/local-product-tarball-smoke.mjs + - bun test packages/contracts/test/contracts.test.ts packages/surfaces/cli/test/cli.test.ts + qa_scores: + - dimension: functionality + min: 7 + manual_checks: + - "Evaluator review file recommends pass" +``` + +## Acceptance Notes (Human Review) + +- Functional behavior: registry-current CodeGraph `1.4.0` passes adapter and installed-tarball flows. +- Edge cases: a custom/explicit CodeGraph binary still takes precedence; package fallback is used only for the default command when PATH has no executable. +- Regression risks: CodeGraph CLI argument/output compatibility and release readbacks that previously required `bin/codegraph.mjs`. +- Manual acceptance: generated manifest exposes only `archctx`; packaged runtime resolves its internal CodeGraph dependency without requiring an ArchContext-owned global `codegraph` bin. +- Release acceptance: registry `latest`, tarball metadata, `v0.2.3`, GitHub Release, and generated package bins agree; publish/tag/release commands are recorded in the review rather than made replayable contract commands. + +## Rollback Point + +- Commit / checkpoint: `b0e2d76` +- Revert strategy: revert this task's bounded diff; no data migration. diff --git a/tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md b/tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md new file mode 100644 index 00000000..c5b724a0 --- /dev/null +++ b/tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md @@ -0,0 +1,44 @@ +# Implementation Notes: codegraph-latest-no-bin-collision + +> **Status**: Active release closeout +> **Plan**: plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md +> **Contract**: tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md +> **Review**: tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md + +## Registry Grounding + +- 2026-07-11: `archctx@latest` is `0.2.2`, exposes `archctx` and `codegraph`, and depends on CodeGraph `1.0.1`. +- 2026-07-11: `@colbymchenry/codegraph@latest` is `1.4.0`. +- User-facing integration policy is `archctx@latest`; source/release dependencies remain exact after resolving the current tag so builds stay reproducible. + +## Evidence + +- Runtime authority and lockfile now use exact CodeGraph `1.4.0`. +- `CodeGraphCliProvider` keeps executable PATH/custom command precedence and falls back to its package-local dependency only for the unresolved default command. +- Public release staging exposes only `archctx`; the ArchContext-owned `bin/codegraph.mjs` shim was removed while CodeGraph remains an exact internal dependency. +- Focused tests: 17 pass, 0 fail; typecheck passes. +- Temporary npm dry-run: verified with only `bin/archctx.mjs` and exact CodeGraph `1.4.0`. +- Installed-tarball smoke: pass with runtime PATH deliberately excluding CodeGraph, proving `archctx sync` can execute the package-local dependency. +- `0.2.3` source, workspace, product manifest, runner/action example, lockfile, and practice catalog version surfaces are aligned; the catalog digest is `sha256:4eb838762f60289e014d20a14411e6471d0d4e6ed97fccdf393fdb2a2583c872`. +- Full `bun run verify` passes after the version bump. +- Current release dry-run evidence is verified for `_ops/npm/fg6-release-dry-run/archctx-0.2.3.tgz`; registry readback returned `E404` for `archctx@0.2.3` before publication. +- npm Web authorization completed successfully for account `ancienttwo`; `publish-archctx.mjs` preflight reports `ready` with no blockers. +- Release-candidate tarball digests are SHA-1 `0ad264beca1c0d2ee0f993b2604295bcaf3ba37c` and SHA-256 `a85f54bb9027070823ee4d7b65d7dc17184bb480a3330b8b9d9b05c738bd0b81`. + +## Design Decisions + +- `latest` is a consumer selection policy (`archctx@latest`), not a floating source dependency. The repository records the registry resolution (`1.4.0`) exactly so builds and attestations stay reproducible. +- The generated package no longer owns the public `codegraph` command. This removes global bin collision without splitting the one-package Local Core dependency boundary. +- Historical verification evidence remains unchanged because it records previously published artifacts. + +## Residual Risks + +- Registry latest remains `0.2.2` until the authorized publish command succeeds. +- `parseExploreSymbols` still recognizes the older human-readable explore format; current JSON query authority and real 1.4.0 paths pass. +- Windows PATH resolution does not emulate `PATHEXT`, so the package-local fallback may be chosen even when a `.cmd` or `.exe` is available by shell convention. + +## Release Closeout Authorization + +- 2026-07-11: user explicitly requested publication and offered to complete browser authorization. +- Current release target: `archctx@0.2.3` / `v0.2.3` / GitHub Release `v0.2.3`. +- `repo-harness run contract-worktree finish` cannot run because the capability resolver classifies the tracked ArchContext projection `docs/architecture/modules/capability-architecture-context.md` as orphan while `.ai/context/capabilities.json` is empty. Both are outside this contract and remain untouched; the already-passing contract/sprint evidence is retained and the release uses direct Git operations. diff --git a/tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md b/tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md new file mode 100644 index 00000000..f545ffc3 --- /dev/null +++ b/tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md @@ -0,0 +1,69 @@ +# Task Review: codegraph-latest-no-bin-collision + +> **Status**: Ready for release +> **Plan**: plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md +> **Contract**: tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md +> **Recommendation**: pass + +## Human Review Card + +- Verdict: pass +- Change type: code-change +- Intended files changed: runtime CodeGraph authority/adapter, generated npm packaging/readbacks, focused tests, and contract artifacts +- Actual files changed: matches contract `allowed_paths`; historical evidence remains unchanged, while the current `0.2.3` npm dry-run evidence is regenerated +- Commands passed: focused tests, typecheck, current npm dry-run, installed-tarball smoke, full `bun run verify`, and the pre-expansion strict contract/sprint gate +- External acceptance: user explicitly authorized npm publication, Git tag, and GitHub Release; npm Web authorization completed as account `ancienttwo` +- Residual risks: supplemental explore Markdown parser and Windows PATHEXT limitations are recorded below +- Reviewer action required: no pre-publish code action; complete live publish and record the final registry/tag/release readbacks +- Rollback: revert bounded diff from `b0e2d76`; no data migration + +## Verification Evidence + +- `bun test packages/local-runtime/codegraph-adapter/test/codegraph-adapter.test.ts scripts/fg6-npm-release-dry-run.test.ts scripts/architecture-ledger-al10-release-packaging-readback.test.ts scripts/release-provenance-readback.test.ts`: 17 pass, 0 fail, 87 assertions. +- `bun run typecheck`: pass. +- Temporary npm dry-run: verified; generated `bin` contains only `archctx`, dependency is exact CodeGraph `1.4.0`, and `bin/codegraph.mjs` is absent. +- `node scripts/local-product-tarball-smoke.mjs`: pass across install, daemon, sync, MCP, upgrade, and uninstall; runtime PATH excludes both Bun and CodeGraph, proving packaged dependency fallback. +- `bun run verify`: pass across typecheck, boundary/security/governance checks, full tests, packaged CLI smoke, acceptance ledgers, sprint status, and eval checks. +- Current `docs/verification/fg6-npm-release-dry-run.json`: verified for `archctx@0.2.3`; public `bin` is only `archctx`, exact internal CodeGraph dependency is `1.4.0`, and the tarball is `_ops/npm/fg6-release-dry-run/archctx-0.2.3.tgz`. +- `npm view archctx@0.2.3 ...`: returned `E404` before publish, confirming the patch version is available. +- Independent review: no blocker/high/medium finding; scope and rollback surfaces match the contract. +- Sprint gate: `repo-harness run verify-sprint --contract tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md` passed; run snapshot `.ai/harness/runs/run-20260711T012736-5955-20260711-0055-codegraph-latest-no-bin-collision.json`. +- The post-expansion strict contract rerun passed every release command through installed-tarball smoke but hit the helper's 120-second wall-time while repeating the contracts/CLI tests; those exact tests passed directly and inside the full `bun run verify`, so this is retained as workflow-helper timing evidence rather than a product blocker. + +## External Acceptance Advice + +> **External Acceptance**: authorized +> **External Reviewer**: user plus native read-only reviewer +> **External Source**: explicit publish instruction and Codex subagent review +> **External Started**: 2026-07-11T01:09:00+08:00 +> **External Completed**: 2026-07-11T01:21:00+08:00 + +- Live npm publication, tag, and GitHub Release are explicitly authorized; npm Web authentication completed successfully. +- P1 blockers: none +- P2 advisories: registry latest remains `0.2.2` until the authorized publish command succeeds. +- Acceptance checklist: pass +- Manual Override: Native read-only review found no blocker and the unpublished local artifact passed the full contract; an external Claude CLI review is unnecessary for this non-publishing slice. + +## Behavior Diff Notes + +- CodeGraph runtime/source authority moves from `1.0.1` to registry-resolved latest `1.4.0`, recorded exactly in manifests and lockfile. +- The generated public package no longer exports or ships an ArchContext-owned `codegraph` bin. +- Default runtime resolution uses an executable PATH command when present and otherwise resolves the exact package-local CodeGraph shim; explicit/custom commands keep precedence. + +## Residual Risks / Follow-ups + +- Registry `archctx@latest` remains `0.2.2` at the pre-publish checkpoint; the verified `0.2.3` artifact is ready for the authorized publish step. +- CodeGraph 1.4.0 changed the human-readable `explore` Markdown shape. JSON `query` remains the symbol authority and real adapter flows pass, but the legacy supplemental `parseExploreSymbols` path contributes less data. +- Windows PATH lookup still does not emulate `PATHEXT`; package fallback remains functional. +- `contract-worktree finish` is blocked by a pre-existing orphan architecture module (`docs/architecture/modules/capability-architecture-context.md` versus an empty `.ai/context/capabilities.json`). The product contract passed; direct Git ship is used under the user's explicit publish authorization without mutating either architecture authority. + +## Scorecard + +| Dimension | Score | Notes | +| --- | ---: | --- | +| Functionality | 9.4/10 | Version authority, packaged fallback, and bin isolation verified end to end | +| Code quality | 9.1/10 | Small bounded resolution seam with focused negative tests | + +## Summary + +- PASS TO PUBLISH. The source and `0.2.3` tarball satisfy the contract without mutating global PATH; live release readbacks remain the closeout step. diff --git a/tasks/todos.md b/tasks/todos.md index 2d95b7ae..57a6f0b0 100644 --- a/tasks/todos.md +++ b/tasks/todos.md @@ -1,7 +1,7 @@ # Deferred Goal Ledger > **Status**: Backlog -> **Updated**: 2026-07-06 +> **Updated**: 2026-07-11 00:59 > **Scope**: Medium/long-term goals deferred from active plan execution Current plan tasks live in the active plan's `## Task Breakdown`. From 093522a1d9445f7e4e5bf4c00f9af42d5f214dcf Mon Sep 17 00:00:00 2001 From: Ancienttwo <215803476+Ancienttwo@users.noreply.github.com> Date: Sat, 11 Jul 2026 02:15:55 +0800 Subject: [PATCH 2/2] Refresh 0.2.3 deterministic release evidence --- docs/verification/fg4-deterministic-conclusion-readback.json | 4 ++-- docs/verification/fg6-no-provider-deterministic-readback.json | 4 ++-- plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md | 1 + ...0260711-0055-codegraph-latest-no-bin-collision.contract.md | 3 +++ .../20260711-0055-codegraph-latest-no-bin-collision.notes.md | 2 ++ .../20260711-0055-codegraph-latest-no-bin-collision.review.md | 2 ++ 6 files changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/verification/fg4-deterministic-conclusion-readback.json b/docs/verification/fg4-deterministic-conclusion-readback.json index 38ee8ec9..9cace84f 100644 --- a/docs/verification/fg4-deterministic-conclusion-readback.json +++ b/docs/verification/fg4-deterministic-conclusion-readback.json @@ -3,7 +3,7 @@ "environment": "process-fixture", "status": "verified", "ok": true, - "generatedAt": "2026-06-26T20:10:06.924Z", + "generatedAt": "2026-07-10T18:11:43.784Z", "evidence": { "processLevelFixture": true, "providerEnvCleared": { @@ -14,7 +14,7 @@ }, "deterministicGate": { "llmProviderConfigured": false, - "modelDigest": "sha256:243bbf8c6ee8fe07274de912ed3e13a4ed5f2db89baaf2342b00745ccca32547", + "modelDigest": "sha256:d973b7c7f01ad8864d56d1fac0e2ed533b7b9e22ef24c9de420765f86f693701", "result": "pass", "reviewDigestMatchesAttestation": true }, diff --git a/docs/verification/fg6-no-provider-deterministic-readback.json b/docs/verification/fg6-no-provider-deterministic-readback.json index 6bbebc8f..3d9671b5 100644 --- a/docs/verification/fg6-no-provider-deterministic-readback.json +++ b/docs/verification/fg6-no-provider-deterministic-readback.json @@ -4,7 +4,7 @@ "environment": "staging-release-readback", "status": "verified", "ok": true, - "generatedAt": "2026-06-26T20:10:14.539Z", + "generatedAt": "2026-07-10T18:11:44.977Z", "sources": { "localNoCloudSource": "docs/verification/fg6-local-no-cloud-readback.json", "runnerSource": "docs/verification/fg4-github-hosted-runner-readback.json", @@ -55,7 +55,7 @@ }, "deterministicGate": { "llmProviderConfigured": false, - "modelDigest": "sha256:243bbf8c6ee8fe07274de912ed3e13a4ed5f2db89baaf2342b00745ccca32547", + "modelDigest": "sha256:d973b7c7f01ad8864d56d1fac0e2ed533b7b9e22ef24c9de420765f86f693701", "result": "pass", "reviewDigestMatchesAttestation": true }, diff --git a/plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md b/plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md index 9d33962d..f2daf853 100644 --- a/plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md +++ b/plans/plan-20260711-0055-codegraph-latest-no-bin-collision.md @@ -31,6 +31,7 @@ - Update focused tests/readbacks that define the current release shape. - Do not publish npm, mutate global PATH, or rewrite historical verification evidence. - Release follow-through authorized on 2026-07-11: align all current product-version surfaces to `0.2.3`, publish npm, create the Git tag and GitHub Release, and regenerate current release readbacks. +- Governance evidence follow-through authorized on 2026-07-11: regenerate the deterministic no-provider evidence chain whose version-bound model digest changes with `0.2.3`. - Do not mutate the existing capability registry or ArchContext-generated architecture projections as a release-gate workaround; the pre-existing orphan-module incompatibility is recorded as workflow-tool debt. ## Verification diff --git a/tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md b/tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md index d4edb62c..3dca7ee0 100644 --- a/tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md +++ b/tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md @@ -24,6 +24,7 @@ Make `archctx@latest` compatible with registry-current CodeGraph `1.4.0` without - `0.2.3` version alignment across current product/release surfaces - npm publish after user-completed browser authorization - Git tag, GitHub Release, registry/bin readback, and current release evidence regeneration + - deterministic no-provider release evidence digest regeneration required by the `0.2.3` product version - Out of scope: - repo-harness changes - floating `latest` in reproducibility-sensitive package manifests @@ -75,6 +76,8 @@ allowed_paths: - packages/core/practice-catalog/assets/catalog.yaml - packages/surfaces/package.json - docs/verification/fg6-npm-release-dry-run.json + - docs/verification/fg4-deterministic-conclusion-readback.json + - docs/verification/fg6-no-provider-deterministic-readback.json - docs/verification/architecture-ledger-al10-npm-release-readback.json - docs/verification/fg6-release-distribution-readback.json - docs/verification/fg6-release-distribution.md diff --git a/tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md b/tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md index c5b724a0..b9fe577f 100644 --- a/tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md +++ b/tasks/notes/20260711-0055-codegraph-latest-no-bin-collision.notes.md @@ -24,6 +24,8 @@ - Current release dry-run evidence is verified for `_ops/npm/fg6-release-dry-run/archctx-0.2.3.tgz`; registry readback returned `E404` for `archctx@0.2.3` before publication. - npm Web authorization completed successfully for account `ancienttwo`; `publish-archctx.mjs` preflight reports `ready` with no blockers. - Release-candidate tarball digests are SHA-1 `0ad264beca1c0d2ee0f993b2604295bcaf3ba37c` and SHA-256 `a85f54bb9027070823ee4d7b65d7dc17184bb480a3330b8b9d9b05c738bd0b81`. +- PR #93 Governance Verify exposed the version-bound deterministic model digest: `fg6-no-provider-deterministic` consumes `fg4-deterministic-conclusion`, so both generated evidence files must be regenerated in source order for `0.2.3`; the user authorized this bounded evidence expansion. +- The regenerated no-provider model digest is `sha256:d973b7c7f01ad8864d56d1fac0e2ed533b7b9e22ef24c9de420765f86f693701`; both evidence inspections and all 24 `verify:governance` commands pass. ## Design Decisions diff --git a/tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md b/tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md index f545ffc3..4dd4a755 100644 --- a/tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md +++ b/tasks/reviews/20260711-0055-codegraph-latest-no-bin-collision.review.md @@ -24,11 +24,13 @@ - Temporary npm dry-run: verified; generated `bin` contains only `archctx`, dependency is exact CodeGraph `1.4.0`, and `bin/codegraph.mjs` is absent. - `node scripts/local-product-tarball-smoke.mjs`: pass across install, daemon, sync, MCP, upgrade, and uninstall; runtime PATH excludes both Bun and CodeGraph, proving packaged dependency fallback. - `bun run verify`: pass across typecheck, boundary/security/governance checks, full tests, packaged CLI smoke, acceptance ledgers, sprint status, and eval checks. +- `bun run verify:governance`: pass after regenerating the `0.2.3` version-bound deterministic evidence chain; 24/24 governance commands succeeded. - Current `docs/verification/fg6-npm-release-dry-run.json`: verified for `archctx@0.2.3`; public `bin` is only `archctx`, exact internal CodeGraph dependency is `1.4.0`, and the tarball is `_ops/npm/fg6-release-dry-run/archctx-0.2.3.tgz`. - `npm view archctx@0.2.3 ...`: returned `E404` before publish, confirming the patch version is available. - Independent review: no blocker/high/medium finding; scope and rollback surfaces match the contract. - Sprint gate: `repo-harness run verify-sprint --contract tasks/contracts/20260711-0055-codegraph-latest-no-bin-collision.contract.md` passed; run snapshot `.ai/harness/runs/run-20260711T012736-5955-20260711-0055-codegraph-latest-no-bin-collision.json`. - The post-expansion strict contract rerun passed every release command through installed-tarball smoke but hit the helper's 120-second wall-time while repeating the contracts/CLI tests; those exact tests passed directly and inside the full `bun run verify`, so this is retained as workflow-helper timing evidence rather than a product blocker. +- PR #93's initial Governance Verify failure was traced to the old `0.2.2` no-provider model digest. Regenerating `fg4-deterministic-conclusion` and then `fg6-no-provider-deterministic` produced `sha256:d973b7c7f01ad8864d56d1fac0e2ed533b7b9e22ef24c9de420765f86f693701`; the local Governance gate then passed. ## External Acceptance Advice