feat(cli): auto-adoption safeguard S2 — provenance sentinel (cli-3.35.0)#359
Merged
Conversation
Second safeguard of AIDEC-2026-07-13-001 (StrayMark self-adoption). `straymark init` now stamps `.straymark/.provenance.yml` with `role: installed-project`, the pinned `framework_version`, `installed_at`, and `source_release`. `resolve_project_root` gains a unified `non_project_reason` check (S1 + S2): refuses the distribution source (S1, unchanged) AND any `.straymark/` whose provenance records a non-install role (S2) — while TOLERATING an absent provenance file so existing adopters (Sentinel, lnxdrive — no sentinel) keep resolving. `provenance_role` is a dependency-light line-scanner (no serde on the hot path). `straymark remove` cleans the file. Design (per the implementation plan, operator-approved): Option A — only `init` stamps installs; the distribution `dist/` is caught by S1's dist-manifest detection (no distribution-source marker shipped). Own file (not config.yml). The `framework_version` is the pinned "yesterday's tail" record the lagged self-adoption is built on. Deferred: `update-framework` refreshing the provenance version (harmless until S3 reads it) — tracked in docs/decisions/AIDEC-2026-07-13-001-implementation-plan.md. Also adds that implementation plan doc, versioned alongside the AIDEC. Full workspace suite green; new unit tests for S2 (init render + resolution tolerate-absent / accept-install / refuse-non-install-role); no new clippy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second safeguard of AIDEC-2026-07-13-001 (StrayMark self-adoption). With S1 (PR #358, merged) + this S2, the gate to a root
straymark initopens.S2 — provenance sentinel
straymark initwrites.straymark/.provenance.yml:resolve_project_rootnow runs a unifiednon_project_reasoncheck (S1 + S2): refuses the distribution source (S1, viadist-manifest.yml) and any.straymark/whose provenance records a non-installrole:(e.g. a test fixture, a hand-marked distribution copy)..provenance.yml= legacy install = operable. Existing adopters (Sentinel, lnxdrive) have none and keep working.provenance_roleis a dependency-light line-scanner (no serde on the hot resolution path).straymark removecleans.provenance.ymlalongside.checksums.json.Design (operator-approved)
initstamps installs;dist/is caught by S1. No distribution-source marker shipped → no adopter-facing change..provenance.yml), not a field in the shippedconfig.yml.Also in this PR
docs/decisions/AIDEC-2026-07-13-001-implementation-plan.md— the safeguard sequence + status + rollback notes, versioned alongside the AIDEC so we can retrace/roll back if self-adoption misbehaves.Deferred (tracked in the plan)
straymark update-frameworkrefreshing the provenance version fields (preservinginstalled_at) — harmless until S3 reads the field.Tests
provenance_roleparsing, resolution: tolerate-absent (legacy) / accept installed-project / refuse non-install-role, plus initrender_provenanceround-trip through the utils reader. Full workspace suite green; no new clippy..gitignore(your local scratch prefs) intentionally excluded from this PR.cli-3.35.0. Not tagged — merge + tag are yours. (Note:cli-3.34.0/ S1 is onmainbut also untagged; you may prefer to tagcli-3.35.0once, covering S1+S2 together.)🤖 Generated with Claude Code