Repository navigation
docs(plan): version pinning, piece 1 — pins only (see Consiliency/pmcp#294) - #317
Merged
Merged
Conversation
Piece 1 of the additive split of #294 (proposal 1): a manifest `version:` / overlay `server_version:` pin, one exact version by main's is_valid_package_version, materialised all-or-nothing into args and every install argv for a plain same-name npx registry slot (npa allowlist); refused pins leave the entry unchanged and log fixed text (reason category + server name only). update_server keeps main's reporting and adds pinned_version for a materialised pin; `pmcp update` prints [PINNED]. The self-hosted warning, the judge and per-launcher exactness are piece 2 (#295 stays its reference; its 21 rounds of findings are listed by class in Non-goals). 93 tests (92 red on main with an import shim), 28 of 28 mutants red, npa 12/13 conformance corpus 0/0, full suite with -x on origin/main 7680445: 4800 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M1b7aDmh5mzuiPQQprmsXN
…show only shipped names (see #294) Board round 1 on 602064d (#317). codex B1: with the entry's npm_config_package, real npm 10 and 11 ran the materialised `npx -y pkg@1.2.3` as another package (alternate@9.0.0). A pin is now refused, entry unchanged, when any entry-supplied env key (extra_env, which carries overlay server_env, and an overlay env_var) is not proven inert for npm (shipped-declared keys, locale/terminal, npm logging and timing keys); [PINNED] is withheld for a config running the materialised argv with such an env or a cwd. The host environment stays trusted, and the plan says so. codex B2 / claude N1: a log line names a server only if pmcp's shipped manifest defines it. claude N2: a later refused pin no longer claims "stays unpinned"; `server_version: null` is defined. N3/N4 folded into the text. 141 tests (43 red on 602064d), 36 of 36 mutants red, npa 12/13 corpus 0/0, shipped 77/30 unchanged, full suite with -x on origin/main 7680445: 4848 passed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RiabTgWZRfuqiUQ9siEegF
Round 2 on 2f4f714 (claude AGREE) nits, before the external panel. N1: the loader decided "npx" by basename, so an overlay command such as /tmp/x/npx, ./npx, node_modules/.bin/npx, /proc/self/cwd/npx or ~/bin/npx.cmd got its pin materialised. Only a bare launcher is pinned now (`npx`; `npx.cmd`/`npx.exe` on Windows only), for the command and every install argv; anything else is refused with fixed text. All 79 shipped npx commands and 335 npx install argvs are bare, so shipped cost is unchanged (77/30). Note C: an entry with an allowed npm key such as npm_config_loglevel keeps its materialised pin but `pmcp update` prints main's [FAILED] "Could not determine a registry package" -- the README and plan now say so and that it fails safe. Note B: a host .npmrc can set the allowed keys (host trusted). A direct containment test replaces the one the new launcher check made unreachable. 159 tests (17 red on 2f4f714), 39 of 39 mutants red, full suite with -x on origin/main 7680445: 4866 passed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RiabTgWZRfuqiUQ9siEegF
ViperJuice
added a commit
that referenced
this pull request
Sep 30, 2026
Implements the plan merged in #317, byte-identical to its embedded diff and tests: exact-SemVer pins via an entry's version: or an overlay's server_version:, materialised only into bare-npx registry slots, all-or-nothing across args and every install argv, with fixed-text refusal logs and [PINNED] reported only when the pin is what runs. Panel: claude, codex, gemini delivered with no blocking finding; non-blocking message/doc findings are tracked in #322. Piece 2 (warnings) remains. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RiabTgWZRfuqiUQ9siEegF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Piece 1 of #294. The earlier whole-issue plan (#295) went through 21 review rounds, and nearly every finding came from the self-hosted-drift warning half. That half moves to piece 2, with #295 as its reference and those findings as its test base.
What piece 1 does:
version:or overlayserver_version:must be a single exact version (main'sis_valid_package_version, with no+build metadata).argsand every platform's install argv, all or nothing.update_server/pmcp updatestay as they are on main, apart from a[PINNED] <server>: pinned at <v>line when the materialised pin is exactly what runs.Evidence:
Plan-only PR; it goes through the cross-vendor review panel before merge.
🤖 Generated with Claude Code
https://claude.ai/code/session_01M1b7aDmh5mzuiPQQprmsXN
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.