Conversation
Consumers pin central Dagger modules at exact SHAs, and fleet policy checked that each pin was well-formed but not that it was new enough. Repos could stay pinned below a mandatory fix (dd19871, #46) without anyone noticing, which blocked the aml-filter release. REQUIRED_MINIMUM in fleet_policy.py holds a reviewed floor per central module, starting with portfolio-foundation -> dd19871. The GitHub reader compares every floored module revision in a consumer's resolved Dagger graph against the floor (compare/<floor>...<pin>) and against central main (compare/<pin>...main). Both must be ahead or identical. Otherwise, including when there is no common history or the evidence is missing, the scan reports pin-below-required-minimum and fails. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
The fleet scan only checked repositories listed by hand in repository_expectations. agentic-saga and agentic-context-service pin hseshadr/ci modules but were never listed, so no fleet rule ran on them. - Add both to repository_expectations with the full consumer contract (sole Dagger check, conversation resolution, no rollout exception; both already declare shared foundation). - New fleet_coverage module: list every public hseshadr repository, read its default-branch dagger.json, and report uncovered-consumer for any active repository that pins a github.com/hseshadr/ci module but is missing from the list. Listing or config read errors fail closed. - scan_repository now turns FleetAccessError into an evidence-unreadable finding, so one unreadable repository (agentic-context-service has no branch protection on main) no longer hides every later result. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
…elease-lineage-module
…ger args
Publisher lineage moves out of consumer `run:` steps into two
portfolio-foundation functions. release-lineage and release-provenance fail
unless GitHub's run records show a successful release-candidate.yml dispatch
for exactly the expected SHA, run by this repository's in-progress main
publish.yml, with main containing both commits. That blocks a dispatch on a
tag named `main` from publishing its own bytes. release-provenance also
returns npm's provenance context, built from the publish run record.
The fleet policy accepts that exact leading step (publisher-lineage for
anything weaker) and a consumer publisher loaded at `@${{ github.sha }}`, so
edgeproc-core and privacy-core can publish with no shell step and no
exemption. It also reports dagger-args-expression for `${{ inputs.* }}`,
`${{ github.event.* }}` or `${{ github.head_ref }}` in any dagger-for-github
input the action pastes into bash.
Fixtures that pasted the workflow_run head SHA into args as compliant now
pass it through env; the policy reports the old shape.
Fixes #49
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
Split evidence construction and the repository part of the provenance context into named helpers (python-quality function-length rule). The provenance JSON keys are now emitted sorted. Behavior is unchanged; lineage.py stays at 100% line and branch coverage. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
ci#50 accepted the module-owned lineage step but did not require it, so a publisher without it (edge-proc, assay) still passed. Every publisher job must now open with the exact release-lineage / release-provenance call; its absence, or placing it after the candidate download, is a `publisher-lineage` finding. The fleet_policy bridge fixtures and the docs' Python publisher example asserted lineage-less publishers as compliant; both now carry the step. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
…tarted docs The README now says what the repo is (shared Dagger modules and a daily cross-repo check for Harish's own repos), shows how a real consumer pins a module, and pastes real output from running one. Technical detail moved to docs/ARCHITECTURE.md; docs/GETTING_STARTED.md walks a new developer from a fresh clone to a first change, with measured times. A new README contract test pins the first line, section order, module names, links to every doc, and a banned-jargon check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
Brings in #47 -> #48 -> #50 -> #52 so this PR merges last without conflicts. Their README lines move to the new layout: the consumer list (now with agentic-context-service and agentic-saga), the uncovered-consumer failure and the required-minimum pin floor go to docs/ARCHITECTURE.md "What dagger call fleet checks", with plain one-line versions in the README intro. Publisher lineage and the dagger-args-expression rule are noted there too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Light pass on the README, as agreed: the voice and every existing section stay as they are. Three additions:
## More detailsection (just above License) that links every technical doc, one plain line each.docs/GETTING_STARTED.mdfor developers, linked from the Technical docs line, from## Contributing / development, and from More detail.Claim touched: "the README is a true map of the repo's docs." No product behaviour changes.
README first 15 lines, before
README first 15 lines, after
Docs now linked from
## More detaildocs/README.md, docs/QUICKSTART.md, docs/GETTING_STARTED.md (new), docs/ARCHITECTURE.md, docs/architecture/ (interactive map), docs/tech-stack.md, docs/edgeproc-browser.md, docs/code-guidelines.md, docs/dependency-policy.md, docs/CLEVERNESS-DEBT.md, docs/rigor-upgrade-spec.md, docs/feedback-setup.md, docs/deploy/almamesh-com.md, docs/deploy/GO-LIVE-almamesh-com.md, docs/releases/ (v0.4.0, v0.3.0), docs/specs/, docs/design/, docs/superpowers/, backend/docs/predictive-engine-plan.md, frontend/README.md, CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, THIRD_PARTY_NOTICES.md.
Spec archives (docs/specs, docs/design, docs/superpowers) are linked as folders, not file by file, to keep the list readable.
Test changes (red first)
backend/tests/test_readme_contract.py, 4 new tests, no existing test changed or removed:test_technical_docs_line_sits_in_the_intro: the line exists before "At a glance", starts with Architecture, includes GETTING_STARTED, 3–5 links.test_developer_section_links_getting_started:## Contributing / developmentlinks it and the file exists.test_more_detail_links_every_technical_doc: every top-leveldocs/*.md, everydocs/subfolder (except assets), and the root docs are linked from More detail. A new doc added later without a README line turns this red.test_more_detail_comes_right_before_the_license.Red on the old README (4 failed, 8 passed):
Green after: 12 passed. Mutation check: deleting the
docs/dependency-policy.mdline from More detail givesAssertionError: assert ['docs/dependency-policy.md'] == [].dagger/src/index.ts: addsCODE_OF_CONDUCT.mdandTHIRD_PARTY_NOTICES.mdto the backend test container's file list, so the existing "every relative link resolves" test can find them in CI.Local check
make gate(backend + frontend, same as CI)bun test tests/(Dagger contract tests)origin/mainlocally (120 s / 180 s timeouts in tests that run Dagger itself), so not from this changeuv sync --extra dev,bun install(10 s),make assets(27 s),make build(87 s), preview served the AlmaMesh page,almamesh-chartoutput, single-file pytest with--no-cov(13 passed), the locale parity red/green walkthroughTwo traps the doc records because I hit them on the fresh clone:
make gatewithoutuv sync --extra devfirst fails mypy (it picks up a global mypy), and on Node 26 one run hit a stray GSAPrequestAnimationFrameerror after all 1769 web tests passed (it did not happen on the rerun).merge-tree vs open PRs
git merge-tree --write-tree origin/<head> HEAD: clean (exit 0, no conflicts) against #165, #166, #167, #168, #169, #170. None of them touch README.md or docs/. This PR can merge before or after any of them. Suggested order: #165 → #170 → #168 → #166 → #167 → #169 (the stack), with this PR at any point.Proposed GitHub About line (not changed)
🤖 Generated with Claude Code
https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a