From 7d29f4b2306cefc206a9180deb6c4a1473109521 Mon Sep 17 00:00:00 2001 From: cdeust Date: Mon, 10 Aug 2026 19:11:40 +0200 Subject: [PATCH 1/2] chore(marketplace): move hypermnesia-mcp-viz pin to v3.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The manifest pinned v3.1.0 / 052e4a40 while cortex-viz had shipped v3.1.1 (2026-08-10, bugfix release). A release is not delivered until its pin moves: plugin installs subscribe through this manifest, not through the upstream tag. check_marketplace_pins.py flagged PIN_BEHIND_RELEASE on main. Pin verified against the upstream refs, not inferred: gh api repos/cdeust/cortex-viz/git/ref/tags/v3.1.1 -> 33fa1646… upstream .claude-plugin/plugin.json declares version 3.1.1 Gate: python3 scripts/check_marketplace_pins.py exits 0. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01263uv1QqR8TVzw2jXYUrXn --- .claude-plugin/marketplace.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 66c66382..8ad3c3fd 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -62,11 +62,11 @@ "source": { "source": "github", "repo": "cdeust/cortex-viz", - "ref": "v3.1.0", - "sha": "052e4a40d3e6bddaeb1cec6662e23b451575c481" + "ref": "v3.1.1", + "sha": "33fa1646ec3eb4f9045b4d4df91bc6872ac951a7" }, "description": "Canonical Claude Code publication for the standalone Hypermnesia MCP Viz server — a live neural-graph galaxy of every project, file, symbol, memory, discussion and wiki page, plus a per-session execution trace, a consolidation kanban, and a curated knowledge/wiki browser. Read-only bridge over Cortex's shared PostgreSQL store and the ~/.claude artifacts; it renders, it never remembers. Restores the open_visualization and get_methodology_graph tools removed from Cortex; launch with /cortex-visualize.", - "version": "3.1.0", + "version": "3.1.1", "author": { "name": "Clement Deust", "email": "admin@ai-architect.tools" From 2af30422f1127385116e34616f202efecd93b47a Mon Sep 17 00:00:00 2001 From: cdeust Date: Mon, 10 Aug 2026 19:23:05 +0200 Subject: [PATCH 2/2] test(marketplace): assert the viz pin invariant, not a frozen triple MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit test_claude_marketplace_publishes_pinned_canonical_viz_identity froze version/ref/sha as literals, so moving the pin to v3.1.1 turned the guard red by construction — the test had to be hand-edited on every legitimate release. That makes it a change detector, not a guard: the literal adds no detection the manifest diff does not already give, while adding a second place to get wrong. It now asserts the invariant the #179 defect actually broke — a release pin names its tag (`ref == v{version}`) and pins a full 40-hex sha — and keeps the incident's rationale in a comment so the why survives. Tag existence upstream stays a network question, answered by scripts/check_marketplace_pins.py on every manifest PR and weekly cron. Discrimination shown, not asserted: the #179 shape (sha, no `ref`) is rejected on the missing key; a version/ref disagreement is rejected; the current pin passes. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01263uv1QqR8TVzw2jXYUrXn --- .../scripts/test_codex_plugin_contract.py | 31 +++++++++++++------ 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/tests_py/scripts/test_codex_plugin_contract.py b/tests_py/scripts/test_codex_plugin_contract.py index bd444882..34faeded 100644 --- a/tests_py/scripts/test_codex_plugin_contract.py +++ b/tests_py/scripts/test_codex_plugin_contract.py @@ -3,6 +3,7 @@ from __future__ import annotations import json +import re from pathlib import Path @@ -109,15 +110,27 @@ def test_claude_marketplace_publishes_pinned_canonical_viz_identity() -> None: # "3.0.0"/1c1940e... was the dangling pin from the #179-style incident: # cortex-viz never tagged a v3.0.0 (the rename landed straight on main - # without a release); the first real tagged release carrying it was - # v3.1.0 (cdeust/cortex-viz#130), which is what this pin now targets. - assert canonical["version"] == "3.1.0" - assert canonical["source"] == { - "source": "github", - "repo": "cdeust/cortex-viz", - "ref": "v3.1.0", - "sha": "052e4a40d3e6bddaeb1cec6662e23b451575c481", - } + # without a release), so the entry carried a sha and NO `ref` — a commit + # nobody had released, advertised as a version. + # + # This asserts the invariant that defect broke, not the literal triple it + # was fixed to. A frozen version/ref/sha has to be hand-edited on every + # legitimate pin move, which makes it a change detector rather than a + # guard: it adds no detection the manifest's own diff does not already + # give, and adds a second place to get wrong. Whether the tag actually + # exists upstream is a network question, answered by + # scripts/check_marketplace_pins.py on every manifest PR and weekly cron. + source = canonical["source"] + assert source["source"] == "github" + assert source["repo"] == "cdeust/cortex-viz" + assert source["ref"] == f"v{canonical['version']}", ( + "a release pin names its tag; a sha with no ref, or a ref that " + "disagrees with the advertised version, is the #179 defect" + ) + assert re.fullmatch(r"[0-9a-f]{40}", source["sha"]), ( + "pin the full commit sha — an abbreviated or symbolic value silently " + "re-resolves when the branch moves" + ) assert "standalone Hypermnesia MCP Viz server" in canonical["description"]