packaging: vendor cross-group wit into shepherd and gate tag sync#483
packaging: vendor cross-group wit into shepherd and gate tag sync#483mfw78 wants to merge 4 commits into
Conversation
scripts/check-dep-sync.sh asserts the crate DAG points strictly up across nexum, videre and shepherd for every workspace member (path deps and wit/ symlinks included), and that the carve dependency artefacts agree wherever they exist: umbrella [patch] entries target the owning grouping's in-tree crates and neutralise every written git-tag pin with no orphans, pins agree on one tag per upstream repo, each Cargo.repo.toml member list mirrors the umbrella, and wit-deps manifests and locks stay key-synced with tags matching the Rust pins. Artefacts a train wave has not written yet skip visibly and enforce the moment they land. Wired as the blocking dep-sync CI job and a just check-dep-sync recipe; the git-tag to crates.io and wkg/OCI convergence path is documented in docs/design/cross-repo-deps.md.
…t-deps manifest The runtime bindgen and every L1 fixture module already resolve wit/nexum-host inside the nexum group; check in an empty wit/deps.toml plus its lock to pin the leaf, and teach the zero-leak gate to fail if either ever declares a dependency.
Replace the cross-group nexum-host symlink with a wit-deps vendor: wit/deps.toml pins the package to an exact nexum-runtime git tag, wit/deps.lock records the content digests, and wit/deps/nexum-host is checked in so the group resolves WIT crate-locally and offline. The videre-host and videre-sdk bindgens now read wit/deps/nexum-host.
Replace the symlinked nexum-host and videre packages with vendored copies under wit/deps, pinned by wit/deps.toml release-tag sources, and point the layering gate at the vendored tree.
lgahdl
left a comment
lgahdl
left a comment
There was a problem hiding this comment.
The mechanics of this PR are sound: the 12 vendored WIT files under shepherd/wit/deps/* are byte-for-byte identical to their real sources (verified via git hash-object on the base commit's blobs), all 4 old symlinks are actually deleted with zero stale references left anywhere in the diff's touched files, videre-host/videre-sdk's bindgen paths correctly retarget only the vendored nexum-host path while leaving the videre-native packages untouched, and wit_layering.rs's retarget is well-guarded — it adds assert!(seen > 0, ...) so a wrong/empty vendor path now fails loudly instead of vacuously passing, which is exactly the right defensive instinct at this scale of path churn. The new cross-group tag-drift check in check-dep-sync.sh is genuinely correct too: it tracks tag-per-slug across ALL groups (not scoped to one file, not piggybacking on the Rust-pin check), so if videre and shepherd ever pinned the same upstream repo at different tags, this would catch it.
But the PR's core claim — "fixes the nexum-host tag prefix... to match the real nexum-runtime release tag shape" — only fixes the NAMING FORMAT, not the underlying problem from #482. I checked again: neither nullislabs/nexum-runtime nor the newly-added nullislabs/videre-nexum-module pin (v0.1.0 for both) has any tags at all on the real repos (gh api .../tags returns empty for both, and both archive URLs 404 after the redirect). So the cross-group consistency check I just praised above is currently checking that multiple manifests consistently agree on a tag that doesn't exist anywhere — internally consistent, but not actually resolvable. wit-deps update/resolution will fail the moment anyone runs it against either upstream. Since both nullislabs/nexum-runtime and nullislabs/videre-nexum-module already exist as real, separate repos, this needs an actual v0.1.0 tag pushed to both before these pins can work.
2 participants
What
Vendors shepherd's cross-group WIT (
nexum:host,videre:types,videre:value-flow,videre:venue) undershepherd/wit/depsviawit-deps, replacing the four
wit/symlinks. Retargets theshepherd:cowlayering test at the vendored tree. Extendscheck-dep-sync.shto require one tag per upstream repo across allgroups, not just against the Rust pin. Fixes the
nexum-hosttagprefix in
videre/wit/deps.{toml,lock}to match the realnexum-runtimerelease tag shape.Why
Closes the last generic-WIT symlink in shepherd so every group
resolves WIT crate-locally and offline ahead of the carve, per
docs/design/videre-split-plan.md section 5 (Phase S2).
Testing
CI gate: fmt, check, clippy -D warnings, nextest, doctest, plus
scripts/check-dep-sync.sh and scripts/check-venue-agnostic.sh.
AI Assistance
Drafted with Claude Code under review.
Closes #405