From 27b2161379ffce820b793385a6ccc315283a872c Mon Sep 17 00:00:00 2001 From: jochen Date: Tue, 15 Sep 2026 16:50:40 +0200 Subject: [PATCH] The SDK's delivery is decided; the git URL violates it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ADR 0014 is accepted and unambiguous: each module consumes its dependencies from the private registry, the mesh's own shared library included, and a cross-package change is publish then consume. So the git dependency at a pinned commit is not a mechanism under consideration. It is the shared library being consumed a way the record rules out, and the lock naming a sibling directory is what that looks like when nobody publishes. Issue 053 is reclassified from a question about mechanism to a violation with a direction. What stays open is narrower and real: which software serves the private registry, and that a fresh mesh has none when the first SDK is built — ADR 0014 assumes one exists, and at genesis nothing has installed it. Recorded after arguing at length for a bespoke content-addressed alternative, against a decision that was already made and that I had not read. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx --- 03-DESIGN/01-to-be/20-writing-a-module.md | 10 +++++--- .../00-report.md | 24 +++++++++++++++---- 2 files changed, 27 insertions(+), 7 deletions(-) diff --git a/03-DESIGN/01-to-be/20-writing-a-module.md b/03-DESIGN/01-to-be/20-writing-a-module.md index 836c2c0..5e9bf7d 100644 --- a/03-DESIGN/01-to-be/20-writing-a-module.md +++ b/03-DESIGN/01-to-be/20-writing-a-module.md @@ -163,9 +163,13 @@ knows. Putting the Plex client anywhere else is the shared-library disease with ### What this leaves open -- **Which registry.** The catalogue holds a `verdaccio` module, and a forge typically serves package - registries too. Two answers exist and nothing says which is the mesh's. That has to be settled - before anything publishes. +- **Which private registry.** That there *is* one is settled — + [ADR 0014](../../02-DECISIONS/0014-no-npm-workspace.md) says each module consumes its dependencies + from the private registry, the mesh's own shared library included. Which software serves it is + not: the catalogue holds `verdaccio`, and a git host usually serves package registries too. +- **And the bootstrap does not have one.** ADR 0014 assumes a registry exists; on a fresh mesh + nothing has installed one when the first SDK is built. That is the same pivot as everything else + and it has not been designed. - **Who may publish.** A builder pushing a package needs an account on that registry, which is a credential in the bootstrap path and does not exist yet. - **Versions and ranges.** Everything else the mesh delivers is pinned by digest, and a range is diff --git a/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md b/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md index a38d49d..42e6a0c 100644 --- a/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md +++ b/04-ISSUES/053-the-sdk-is-pinned-twice-and-the-two-disagree/00-report.md @@ -39,12 +39,28 @@ way ([ADR 0074](../../02-DECISIONS/0074-the-wire-is-specified-not-the-types.md)) repository does, the Rust and Python ones will do, so the shape is worth getting right before there are four of them. +## It is a violation, not an open question + +[ADR 0014](../../02-DECISIONS/0014-no-npm-workspace.md) already decided this, and was accepted: + +> Each module is an independent package that declares its dependencies and **consumes them from +> the private registry, including the mesh's own shared library.** A cross-package change is +> therefore two steps: publish the producer, then consume it. + +So a git dependency at a pinned commit is not an alternative mechanism under consideration. It is +the mesh's own shared library being consumed by a means the record rules out, and the lock naming +a sibling directory is what that looks like when nobody publishes. + +**Which makes the fix a direction rather than a discussion**: publish the SDK to the private +registry, consume it by version, and the lock stops being able to name a path that exists on one +machine. + ## Open questions -- **Is a git dependency at a pinned commit the intended mechanism?** It works, needs no package - registry, and reuses the forge a mesh already depends on to exist at all - ([ADR 0071](../../02-DECISIONS/0071-where-genesis-gets-its-source.md)). If so, the lock should say - so and the sibling path should never have been committed. +- **Which private registry, and does the bootstrap have one?** The catalogue holds `verdaccio`; + a git host typically serves package registries too. ADR 0014 says *the* private registry as + though there is one, and today a fresh mesh has neither until something installs it — so the + first SDK build happens before the registry the record assumes. - **Or should the SDK be a published package?** The catalogue holds a private registry module, and a published package is how the rest of the world does this — at the cost of a mesh needing that registry up before it can build anything, which is a bootstrap problem where there is currently