release: gate crates.io currency so the sidecar publish can't rot again - #36
Open
singhpratech wants to merge 1 commit into
Open
release: gate crates.io currency so the sidecar publish can't rot again#36singhpratech wants to merge 1 commit into
singhpratech wants to merge 1 commit into
Conversation
notepatra-mcp 0.1.118 and 0.1.119 were published to crates.io by hand on 2026-07-18. Nothing in CI or scripts/ mentions the registry, so the step simply stopped happening: for eight releases `cargo install notepatra-mcp` served 0.1.119 — the one version whose Windows named-pipe transport deadlocked on every verb and had never completed a single tool call. 0.1.127 is now published, but publishing once does not fix the hole. The check has to compare against the PREVIOUS tag, not the version being cut: the sidecar is published after tagging, so demanding that crates.io already carry vN would fail on every release by construction. Requiring that it carry vN-1 would have fired on v0.1.121, the very next release after the drift began. Tier: hard-fail on a stale registry (it ships a known-broken sidecar to anyone running cargo install), soft-warn when crates.io is unreachable — being offline is not a reason to block a release. Verified in both directions with the real block driven by a stubbed registry: current -> pass; stuck at 0.1.119 -> fail with the publish command; unreachable -> warn, no failure. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W6BGY2dFUSujZeS3vTDikq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
notepatra-mcpwas published to crates.io by hand on 2026-07-18 (0.1.118, then 0.1.119) and never again. Nothing in CI orscripts/references the registry, so the step just stopped happening.The result: for eight releases,
cargo install notepatra-mcpserved 0.1.119 — the single version whose Windows named-pipe transport deadlocked on every verb and had never completed a tool call (fixed in 0.1.120, the very next release). 36 downloads, so the blast radius was small, but the channel was serving the one build guaranteed not to work on Windows.To be precise about what was not affected: the credential deny-list is editor-side C++, not in this crate, so a stale sidecar against a current editor was never leaking keys.
0.1.127 is now published. This PR is the part that matters — making it a gate.
The check
It compares crates.io's
max_versionagainst the previous tag, not the version being cut. The sidecar is published after tagging, so requiring the registry to already carryvNwould fail on every release by construction. RequiringvN-1would have fired on v0.1.121 — the first release after the drift started.cargo publishcommandnotepatra-mcp/Cargo.toml!= tag being cutTiering follows the existing rule: a stale registry ships a known-broken artifact to real users, so it is Tier 1; being offline is not a release blocker.
Verification
The gate was driven in all four directions using the real block extracted from the real file, with
curlstubbed to a controlled registry response — not a reimplementation:✓✗pluscrates.io serves 0.1.119 but the last release was 0.1.127⚠, zero failuresCargo.tomlcheck✓, currency warns (HEAD is the tag, nothing earlier to compare)The script was copied to scratchpad before testing and diffed identical afterwards, so no stub leaked into the committed file.
Also
MAINTAINING.mdgainscargo publishin the release flow,notepatra-mcp/Cargo.tomlin the version bump step, and a CI-traps entry recording why this happened.🤖 Generated with Claude Code
https://claude.ai/code/session_01W6BGY2dFUSujZeS3vTDikq