jschoubben
f151de103f
The builder cloned a repository and read the manifest at its root, which means one repository per module. Nothing we have is shaped that way, so the builder could be asked to build nothing that exists (novox/hq ADR 0069). The path travels the whole way — named when asking, carried in the request, used to read the manifest and as the context everything is produced from, echoed back in the result, and recorded as part of where a module came from. Without that last part the mesh could notice a module was behind its source and then be unable to rebuild it, which is the worst of both. A path climbing out of the clone is refused: a machine whose job is building other people's repositories must not read whatever else is on its disk. Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx
17 lines
1.0 KiB
SQL
17 lines
1.0 KiB
SQL
-- Where inside its repository a module lives.
|
|
--
|
|
-- novox/hq ADR 0069. A module is a repository and a path within it. The mesh recorded the
|
|
-- repository and the ref and not the path, which was survivable only while every module was
|
|
-- assumed to sit at a repository's root — an assumption that matched nothing that exists. The
|
|
-- catalogue holds its modules one to a directory, and the system this replaces has always built a
|
|
-- module from a repository and a path.
|
|
--
|
|
-- Without this column the mesh can record that a module's source has moved ahead of what it holds
|
|
-- and then be unable to rebuild it, because it cannot say which part of the repository the module
|
|
-- is. That is the failure this prevents: noticing, and then not being able to act.
|
|
--
|
|
-- Empty rather than null, and defaulted, because "the repository's root" is a real answer and the
|
|
-- ordinary one — not an absence. Every module recorded before this keeps exactly the meaning it
|
|
-- had.
|
|
alter table module add column source_path text not null default '';
|