Repository navigation
fix(GitSync): a module-bearing repo's sources advance only to the commit sealed for this instance (Plugins#1430) - #3600
Merged
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It changes production import gating behavior in a way that can intentionally stall sync sources, so it needs careful human validation of the operational semantics and failure modes despite good test coverage.
Pull request overview
This PR tightens GitSync’s green-build import behavior for module-bearing repositories so that an instance only advances content sources to commits that are sealed for that instance’s own framework identity, preventing “tree compiles somewhere” imports from outrunning the instance’s sealed module set.
Changes:
- Add
SealedPublicationIndex(Hosting) to read per-identity sealed publications (repository/commit + sealed vs torn) from registry marker files. - Add
SealedSyncGate(GitSync) and integrate it intoGitHubWebhookProcessorto hold sync sources when the built commit is not sealed for the instance identity, with clear audit logging. - Extend
publish-bake-bundles.shto emit and upload arepository.txtmarker alongside existing publication markers, and add tests covering both the index reader and the gate decision table.
File summaries
| File | Description |
|---|---|
| test/MeshWeaver.Hosting.Test/SealedPublicationIndexTest.cs | New tests for reading sealed publication markers and seal/torn detection. |
| test/MeshWeaver.Documentation.Test/SealedSyncGateTest.cs | New decision-table tests for proceed/hold/not-applicable behavior and marker parsing. |
| src/MeshWeaver.Hosting/SealedPublicationIndex.cs | New sealed-publication index reader over the published root for one framework identity. |
| src/MeshWeaver.GitSync/SealedSyncGate.cs | New pure gate that decides whether a repo’s sync sources may advance given the instance’s sealed publications. |
| src/MeshWeaver.GitSync/GitHubWebhookProcessor.cs | Applies the gate during green-build targeting and logs held-source warnings with identity. |
| .github/scripts/publish-bake-bundles.sh | Writes and publishes the new repository.txt marker so seals can be attributed to producing repos. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+36
to
+37
| /// <para>Pure over the file system and never throws: an unreadable root reads as "nothing sealed", | ||
| /// which callers treat as "no evidence" — never as permission.</para> |
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
…mit sealed for this instance MeshWeaver.Plugins#1430: an instance pins its module set at boot from the publication sealed under its own framework identity, while its sources followed every green build of the repository. On 2026-09-06 22:39Z #1413's Payments split reached both production Stores' Store/* sources on a platform whose sealed module set had no Payments module; four Store types compile-errored for nine hours. The green build proves the tree compiles somewhere; the seal proves it compiles here. - SealedPublicationIndex (Hosting) reads what the registry sealed for one identity, per source: producing repository, source commit, sealed or torn — the lane's markers, the boot seeder's sealing rule. - SealedSyncGate (GitSync, pure) decides per sync source: no attributable seal → today's behaviour; a seal at the built commit → proceed; otherwise HOLD with the reason (built at S, sealed at C / not sealed). Attribution by the repository marker, or by commit for seals that predate it. - GitHubWebhookProcessor reads the index once per delivery, classifies held sources beside the other skips, and logs a Warning naming how many were held. - publish-bake-bundles.sh writes repository.txt beside source-commit.txt. Builds on #3553 (import at the built sha). Tests: SealedSyncGateTest (both directions, stated as data), SealedPublicationIndexTest (temp seals). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…index doc states what a reading is The publication now carries four marker/index files (repository.txt beside source-commit.txt, architecture.txt and modules/_index), so the overlap harness's per-publication denominator moves from 8 to 9. Copilot: the index's doc no longer implies callers fail closed on an unreadable root — a reading of nothing sealed is "this gate does not apply", never a hold. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
architecture.txt stays the LAST upload before the postcondition and the seal: the overlap harness hooks its second publisher onto that file, and with the new marker uploaded after it the foreign-publication case lost its seal (27/27 green locally with the order restored). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
rbuergi
force-pushed
the
fix/1430-sync-at-sealed-commit
branch
from
September 7, 2026 13:06
0123092 to
7194c4b
Compare
This was referenced Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes MeshWeaver.Plugins#1430 (its instance-side half; builds on #3553, which pinned the import to the built sha). A module-bearing repository's sync sources advance only to the commit sealed for this instance's own framework identity.
SealedPublicationIndex(Hosting) reads what the registry sealed for one identity, per source: producing repository (repository.txt), source commit (source-commit.txt), sealed or torn — judged by the boot seeder's own rule (sentinel present, every listed bundle on disk).SealedSyncGate(GitSync, pure) decides per sync source at the green-build delivery: no seal attributable to the repository → today's behaviour (a course repo, or an instance that runs no publication of it); a sealed source of the repository at the built commit → proceed; otherwise hold, with the reason in the skip line — built at S, not sealed for this instance (identity …; 'plugins' is sealed at C), or … is not sealed (torn: …). "Cannot tell" is never "clear to proceed".GitHubWebhookProcessor.MatchingBuildTargetsreads the index once per delivery, classifies held sources beside the other skips (the audit line still adds up), and logs one Warning naming how many were held and for which identity.publish-bake-bundles.shwritesrepository.txtbesidesource-commit.txt(before the sentinel, listed in the manifest, uploaded like the other markers). Seals that predate it are attributed by commit: the built commit, or the commit the source already sits on — which, once the gate has run, is always a sealed one.Why
2026-09-06 22:39Z: #1413's Payments split reached both production Stores'
Store/*sources through the green-build import while the instances ran a platform whose sealed module set had no Payments module. Four Store types sat in compile Error for nine hours. The green build proves a tree compiles somewhere; the seal proves it compiles here. This makes "the sources an instance runs" and "the module set it runs" the same publication by construction — what Education's disposable mesh already does by hand, which is why it could not reproduce the incident while production could.Landing
Core-side: no Space syncs from core (0 configs on both production portals — measured by meshweaver-7a), so this merge writes into no portal; instances pick the gate up with the next platform roll. The first delivery it governs on a live portal is the next Plugins green build after that roll.
Tests
SealedSyncGateTest— proceed / hold / not-this-gate's-business, each stated as data, both directions; the hold reasons; attribution with and without the repository marker; the marker parser.SealedPublicationIndexTest— sealed, no sentinel, torn, unknown commit, absent root, ordering. 37 + 6 green (with the existingGreenBuildPublishSignalTest).🤖 Generated with Claude Code