From 05638877d390963c533903d638d5468d4d500685 Mon Sep 17 00:00:00 2001 From: Julian Noble Date: Sat, 8 Aug 2026 17:20:44 +1000 Subject: [PATCH] G-171 note: publish command owns artifact-revision derivation Extends the dirty-bake provenance follow-on's publish-command endpoint with the -r derivation duty (user question 2026-08-08: must -Dlibrev be manual?): the build recipe cannot safely self-derive (deliberate-publish discipline, no configure-time mutable-state inputs, rev-inside-artifact means comparison must build AT the published rev and sha1-compare); publish verdicts current / bump to max+1 / alpha in-situ replace, asserted on a checked claim. Records the recipe-default-as-published-state convention (familyrev precedent) and librev's observed drift as the manual failure mode - default+comment repair due at the r2 publish. goals_lint clean. Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com --- goals/G-171-bake-writes-land-untracked.md | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/goals/G-171-bake-writes-land-untracked.md b/goals/G-171-bake-writes-land-untracked.md index 08f22d86..1bb32672 100644 --- a/goals/G-171-bake-writes-land-untracked.md +++ b/goals/G-171-bake-writes-land-untracked.md @@ -243,7 +243,27 @@ types abort with a stated reason. homes: the stamp/payload (determinism principle - phantom staleness across history, no truthful value in the sanctioned step-(6)-(8) dirty window) and the artifact filename (breaks name-keyed deploy/ledger machinery, - retroactively false mid-sequence). + retroactively false mid-sequence). Extended 2026-08-08 (artifact-revision + derivation - user question "must -Dlibrev be manual?"): the same publish + command owns lib/family -r revision derivation. The build recipe cannot + safely self-derive: revisions bump only on deliberate publish (never per + rebuild - auto-increment mints phantom revisions), configure-time probes of + the punkbin store would add network/mutable-state inputs (the volatility + class the artifacts ban), and the rev rides INSIDE the artifact (the -rN + name seeds build_id and the record's revision key), so content-vs-published + comparison must build AT the published rev and sha1-compare against the + published sidecar - a candidate at rN+1 can never hash-match rN. Publish + command verdicts: current (no-op) / differs -> emit at max+1 / differs -> + alpha in-situ replace (the punkbin dispensation while zero 3rd-party + consumers) - a policy fork the operator asserts on a checked claim, the + -expect-projectversion philosophy applied to revisions. Companion + convention (the repo's existing half-implementation): the recipe's -D + default IS the committed record of published state, bumped in the same + work unit as each publish - the familyrev precedent (default 2, "r1 + published 2026-07-22") - and librev's drift proves the manual failure mode + ("default 1 - nothing published yet" while tcllib2.0-*-r1 is published); + repair librev's default+comment at the r2 publish, and the publish command + stages that default bump inside its one reviewable unit. - Approach 10 message-shape template updated 2026-08-08 (git b729ce07 / fossil 55a54d8b, project 0.65.1): the stale_bootsupport gate it cites now emits via a shared helper, punkboot::lib::bootsupport_stale_warning - mechanism-first