Repository navigation
docs(decisions): Treat settings-only pnpm workspace as root package - #79
Merged
Merged
Conversation
Record the live dogfood classification gap and amend ADR 0018 so an omitted pnpm packages member maps to the existing root-package case. Signed-off-by: Yunseo Kim <git@yunseo.kim>
Narrow malformed workspace metadata while preserving fail-closed handling and pin the implementation fixture follow-up. Signed-off-by: Yunseo Kim <git@yunseo.kim>
Add the decision and its specification mappings to the bilingual ADR and architecture inventories. Signed-off-by: Yunseo Kim <git@yunseo.kim>
Advance ADR numbering and retain the N02 fixture work and vers-js dogfood retry as a standing implementation item. Signed-off-by: Yunseo Kim <git@yunseo.kim>
This was referenced Aug 12, 2026
yunseo-kim
added a commit
that referenced
this pull request
Aug 12, 2026
## Summary - What changed? - Treat a parsed `pnpm-workspace.yaml` object without `packages` as a terminal standalone-root package boundary with zero workspace patterns. - Keep present non-array/non-string `packages` values and unsupported patterns fail-closed. - Add the ADR 0078 accepted and rejected fixture matrix and register it with the F06 harness. - Why is this needed? - The first `vers-js` dogfood run 31622651874 exposed that valid modern pnpm policy settings were incorrectly classified as malformed workspace metadata. ## Related Issues - Closes # - Related #22 Issue #22 remains open for the orchestrator's post-merge dogfood retry. ## Change Type - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [x] Test/CI - [ ] Breaking change - [ ] Other: ## Changelog - Category: Fixed - User-facing note: Standalone pnpm root packages with settings-only `pnpm-workspace.yaml` files now resolve successfully without weakening malformed-workspace rejection. Changelog update: - [x] `CHANGELOG.md` `[Unreleased]` updated - [ ] Not needed because this change is not user-facing ## Checklist ### General - [x] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): Summary` - [x] This PR does not expose backend/internal implementation details in a public repo. - [x] No secrets, tokens, keys, or private endpoints are included. - [x] Changes stay within this repository's intended scope. ### CI/Workflow Changes (if applicable) Not applicable; no workflow files changed. - [ ] All `uses:` references are pinned to full 40-character commit SHAs (with `# vX.Y.Z` comment) - [ ] `step-security/harden-runner` is included as the first step in every job - [ ] Job-level `permissions` are used instead of top-level `permissions` ### Protocol / Compatibility Impact - [x] No protocol/spec impact - [ ] Protocol/spec updated - [x] Conformance tests updated - [ ] Breaking change is versioned and migration notes are included If impacted, describe compatibility impact: ADR 0078 and both architecture specs were already synchronized by #79. This implementation admits only the documented root-only pnpm shape; existing npm/Yarn workspaces and pnpm arrays remain unchanged. ## Testing - [x] Unit tests added/updated - [x] Integration or conformance tests added/updated - [x] Tests pass - [x] Lint and format pass - [ ] Type check passes - [x] Manual verification performed Describe test evidence: - RED: `go test ./internal/npmprofile -run 'TestWorkspaceDiscovery|TestLockfileRules' -count=1` failed because `pnpm settings-only root` emitted `windlass.verify.error.package-resolution-invalid`. - GREEN: `go test ./internal/npmprofile -count=1` passed. - Fixture harness: `go run ./cmd/slsa-builder-internal fixture-check --index testdata/fixtures/index.json --surface npm --phase build-pack` returned pass/exit 0. - Full gates: `go test -race ./...`, `go vet ./...`, `golangci-lint run ./...` (0 issues), and `golangci-lint fmt --diff` (clean) passed. Fixture matrix: | Fixture | Case | Expected | | --- | --- | --- | | `pnpm-settings-only-root-valid` | Settings-only root, omitted `packages` | Pass; root package and root manager directory | | `pnpm-workspace-packages-wrong-type` | Present scalar `packages` | Fail with `windlass.verify.error.package-resolution-invalid` | | `pnpm-settings-only-subdirectory` | Subdirectory beneath settings-only root | Fail with `windlass.verify.error.package-resolution-invalid` | Security review: no new path or pattern input is accepted. The relaxed branch is reachable only after strict YAML object parsing and only when `packages` is absent; it accepts exact candidate-root equality and rejects subdirectories immediately, so farther ancestor discovery and standalone subpackage fallback cannot weaken one-package or ambiguity checks. ## Documentation - [ ] README updated - [ ] Spec/docs updated - [x] Changelog decision completed above Specs were already updated by #79; no ADR/spec files changed here. ## Rollout / Risk - Risk level: Low - Rollback plan: Revert the implementation and additive fixture commits; no persisted data or remote mutation behavior changes. ## Reviewer Checklist - [x] Scope is clear and minimal - [x] Security and boundary checks passed - [x] Tests and docs are sufficient - [x] Compatibility impact is correctly handled --------- Signed-off-by: Yunseo Kim <git@yunseo.kim>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm-workspace.yamlas standalone root package mode.amends/amended-byrelation scoped to pnpm root-package selection.vers-jsdogfood run rejected a valid settings-onlypnpm-workspace.yamlwithwindlass.verify.error.package-resolution-invalid. pnpm documents an omittedpackagesfield as root-only membership, so the existing malformed-metadata clause over-rejects modern pnpm repositories.packagesvalues, unsupported patterns, and genuinely ambiguous resolution. N02 implementation and fixtures remain a follow-up.Related Issues
Change Type
Changelog
Changelog update:
CHANGELOG.md[Unreleased]updatedChecklist
General
type(scope): SummaryCI/Workflow Changes (if applicable)
If this PR modifies GitHub Actions workflows or CI/CD configuration, it must comply with our Supply Chain Integrity requirements:
uses:references are pinned to full 40-character commit SHAs (with# vX.Y.Zcomment)step-security/harden-runneris included as the first step in every jobpermissionsare used instead of top-levelpermissionsProtocol / Compatibility Impact
If impacted, describe compatibility impact:
ADR 0078 narrows an over-broad rejection: an object-form
pnpm-workspace.yamlwith nopackagesmember is root-only package mode. Present malformed members, unsupported patterns, and ambiguous package resolution remain fail-closed under the existing diagnostic taxonomy. The implementation and conformance fixtures are explicitly deferred to N02.Testing
Describe test evidence:
python3 .agents/skills/adr-relations-check/scripts/check_relations.py→79 ADRs, 162 edges — NO PROBLEMSgo test ./internal/diagnostic -run TestRegistryMatchesSpecTaxonomy -count=1→ passpnpm exec prettier --check "AGENTS.md" "docs/**/*.md"→ passpnpm exec markdownlint-cli2 "AGENTS.md" "docs/**/*.md"→ 0 errorsgit diff --check→ passDocumentation
Rollout / Risk
Reviewer Checklist