Repository navigation
feat(docs): verify pinned shared sources and local manifests - #7
Merged
Merged
Conversation
This was referenced Sep 25, 2026
itstimwhite
marked this pull request as ready for review
September 25, 2026 04:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an offline Python tool that projects repository manifests and verifies explicitly pinned shared policy/tool bytes. Reconcile shared CI documentation with the workflows actually present and the immutable distribution direction in JOV-6555. Existing CI implementation PRs retain their scope.
The offline updater preserves local entrypoints and the registry, including symlink aliases. It validates pinned imports before mutation and projects updated imported sources consistently. Exact revisions and SHA-256 hashes permit independent consumer updates and rollback; no network service, credentials or second updater bot is added. The parity workflow is nonblocking shadow and existing required gates remain unchanged.
Validation: ten real unittest scenarios pass with 100% statement and branch coverage, including entrypoint/registry overwrite rejection, pending-source updates, rollback and invalid-input preservation. The canonical tool at 285fb2e received independent source review after the regression fixes. Exact hosted checks, merge receipts and runtime certification remain separate evidence.
JOV-6607 tracks qualification across nine PRs and explicit exceptions for Ovie, the public Symphony fork, the metadata-only GBrain Git repository and signing assets. JOV-6555 owns subsequent automated distribution. No Summer commissioning or deployment claim.