From 5fa43ff7553ec4194ff3dc5b20ef60328b34a884 Mon Sep 17 00:00:00 2001 From: jochen Date: Sat, 3 Oct 2026 21:24:39 +0200 Subject: [PATCH] Issue 212: a toolchain rebuild keeps the SDK it cached --- .../00-report.md | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 04-ISSUES/212-a-toolchain-rebuild-keeps-the-sdk-it-cached/00-report.md diff --git a/04-ISSUES/212-a-toolchain-rebuild-keeps-the-sdk-it-cached/00-report.md b/04-ISSUES/212-a-toolchain-rebuild-keeps-the-sdk-it-cached/00-report.md new file mode 100644 index 0000000..e5da443 --- /dev/null +++ b/04-ISSUES/212-a-toolchain-rebuild-keeps-the-sdk-it-cached/00-report.md @@ -0,0 +1,44 @@ +--- +status: located +opened: 2026-10-03 +located-in: + - mesh-tools + - mesh-controller +fixed-by: +amended-design: +--- + +# 212 — A toolchain rebuild keeps the SDK it cached, and every bundle built on it carries the old one + +## What was observed + +2026-10-03, rolling out [ADR 0193](../../02-DECISIONS/0193-every-bundle-the-runtime-serves-is-launched-and-the-runtime-knows-no-language.md). +SDK 0.1.5 was published, then the TypeScript toolchain image was rebuilt, then node-tools and six +bundles were rebuilt on it and pushed. On every machine the bundles carried SDK 0.1.3: + +``` +bundle SDK: "version": "0.1.3" +``` + +The launched packet filter and intrusion prevention, which register their seat first, then served +their seat's verbs as their own tools, and `node-packet-filter.*` and `node-intrusion-prevention.*` +stopped answering on three machines until fixed. + +## Why it matters beyond this instance + +The toolchain image installs its dependencies from a `package.json` that names the SDK by range. +The file did not change, so the image build reused its cached install layer, and "rebuilt after +the release" did not mean "carries the release". Every TypeScript bundle copies its dependencies +from that image ([design 38](../../03-DESIGN/01-to-be/38-building-the-operators-machine.md) WP3), +so an SDK release reaches no bundle until something else happens to change that file. Nothing +reports it: the build succeeds and records the new commit. + +## Diagnosis + +Owners mesh-tools (the image's recipe) and mesh-controller (the builder that runs it). **Worked +around** on the day by requiring `^0.1.5` in node-tools' `package.json` (mesh-tools #37), which +changes the layer. **Fix direction:** a toolchain build must not trust a cached dependency install — +install from a lockfile that a release updates, or build the install layer without the cache — and +the build should record which SDK version the image carries, so a bundle's record says what it was +compiled against. A check: after an SDK release and a toolchain rebuild, a bundle built on it reports +the released version. -- 2.54.0