Repository navigation
docs(policy): always-current dependency updates + (updates) deed vocabulary - #1110
Merged
Merged
Conversation
Implements owner ruling D269 (standards#787): - DEPENDABOT-POLICY.adoc: majors auto-merge on green where the base branch has a required build/test context; repos with required: [] are never armed. Adds an implementation-status table (only this document, the vocabulary and the cliff group have landed), the deed opt-out, changelog, failure-feedback and rollback sections. Fixes the grouped-hold example: holds inside groups must be exclude-patterns (standards#1037). - 1-formats/deed/vocabulary/updates.adoc: the (updates ...) repo-deed clause, with a fail-closed reader rule. No grammar change. - fixtures/valid/updates-clause_chora.deed: exercises every term. - templates/cliff.toml: a Dependencies group for chore(deps):, build(deps): and Dependabot's unprefixed "Bump X from a to b"; ahead of ^chore (first match wins). Tested with git-cliff 2.13.1 including a "chore(deps)x" negative control. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019nbmPnyCN2ccVhiS7NZD1V
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 8 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Autopilot could not be updated. Open Coding to check access and billing. |
hyperpolymath
added a commit
to hyperpolymath/deed-ecosystem
that referenced
this pull request
Oct 1, 2026
…#70) ## What A new crate, `rs/deed-read`. It is its own Cargo root and does not touch the legacy `a2ml` package in `rs/`. - **`syntax`**: the parser for the normative DEED grammar, extracted from `launch-scaffolder` `crates/launcher-common/src/deed.rs` @ `154b9b61` (#36), together with its vendored corpus and corpus tests. The code is unchanged; only the header, the import path and added one-line `///` docstrings (§5d) differ. - **`updates`**: a reader for the `(updates …)` repo-deed clause, the per-repo switch for automated dependency updates (ruling D269c; spec `standards` `1-formats/deed/vocabulary/updates.adoc`, hyperpolymath/standards#1110). - It **fails closed**: an unknown, repeated, mistyped or missing term is an error, and the caller then arms nothing. - No clause, or no deed, means the defaults. - **`tests/hub_conformance.rs`** runs this hub's own `conformance/*.deed`: the 4 valid deeds must parse and the 5 invalid ones must be rejected. It also reads the updates fixture end to end. Nothing is added to `conformance/`, because `run-deed-tests.sh` asserts exact counts. - **`.github/workflows/deed-read.yml`** runs test, clippy (`-D warnings`) and docs (`-D warnings`). - It reuses the checkout pin already used by this repo's other workflows (`3d3c42e5…`, v7.0.1) with `persist-credentials: false`. - It has no `paths:` filter, so the check can later be made required without deadlocking unrelated PRs. It is **not** required now. ## Why This is the deed reader for the always-current dependency pipeline (D269). `cicd-squabbler`'s `squabble bump`/`rollback` and hypatia's dependabot render sweep consume it, so the repo-deed toggle has one parser rather than three. ## Verified locally (cargo 1.97.1) - `cargo test --locked`: 44 passed, 0 failed. - `cargo clippy --all-targets -D warnings`: clean. - `cargo doc -D warnings`: clean. - Mutation check: three hand-planted mutants were each killed by exactly their own test: - ignoring unknown fields; - making `:reason` optional; - coercing non-booleans. ## Known windows (stated, not hidden) - **Duplication with launch-scaffolder.** Until launch-scaffolder replaces its `deed.rs` with a dependency on this crate, two copies exist. Both are tested against the same `MANIFEST.sha256` corpus. That swap is the follow-up. - **Unmerged fixture.** `tests/fixtures/deed/valid/updates-clause_chora.deed` is vendored from **unmerged** hyperpolymath/standards#1110 (head `70e3e220`). If #1110 changes the fixture before it merges, refresh it here and regenerate `MANIFEST.sha256`. The other files were re-checked byte-identical against standards. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019nbmPnyCN2ccVhiS7NZD1V Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
hyperpolymath
enabled auto-merge (squash)
October 1, 2026 15:19
hyperpolymath
added a commit
that referenced
this pull request
Oct 2, 2026
## What Declares a `(maturity …)` clause for repo deeds, as the owner decided on 2026-10-02: maturity is a clause of its own, not a `:maturity` field on the `status` clause. - `1-formats/deed/vocabulary/maturity.adoc`. `:level` is a symbol from the closed set `experimental | alpha | beta | production | lts`, the set the v1 `[position] maturity` comment already named. `:since "YYYY-MM-DD"` is optional. The page also states reader obligations: unknown field, out-of-set level, string level and duplicate clause are all errors; with no clause, maturity is unstated, never a default. - `1-formats/deed/tools/fixtures/valid/maturity-clause_chora.deed` is a valid fixture. - `mappings/state-v1-decision.adoc`: the maturity row in §3 is marked as ruled. The A/B/C choice stays **open**, and the document's status is unchanged. Same pattern as `vocabulary/updates.adoc` (#1110). The grammar is unchanged: this is a `clause` under `deed.abnf` v1.0.0. The terms move into `estate_chora.deed`'s `(vocabulary …)` clause once that file exists. ## Evidence | Check | Result | |---|---| | Fixture against `deed.abnf` (scratch Bun recogniser, not the canonical validator) | accepted. The `updates-clause` fixture is also accepted as a control | | `scripts/build-registry.sh --check` | in sync; `1-formats/deed` is not a registry spec home | | pre-commit (gitleaks, SPDX, k9, lint) | passed | **Horizon:** no reader enforces the obligations yet. They are declared here, not implemented. ## Consumer `metadatastician/ZeroInflatedCounts.jl#2` already carries `(maturity :level experimental :since "2026-10-02")`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01AJZGNqQsEHjjhzfcNm4pt3 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Oct 8, 2026
## What Declares a `(nostos …)` clause for repo deeds (draft v0.1). _Nostos_ is Greek for the journey home. For each artefact a repo depends on (tool, runtime, SDK, library, game, dataset, model), the clause records every way back to where it came from: | Clause | Records | |---|---| | `(fetch …)` | how to get it again; each fetch names its own `:manager` (mise, asdf, guix, apt, opam, alire, cargo, …), so mise is one manager among several | | `(digest …)` | how to check a fetch (`sha256`/`sha512`); signatures reserved | | `(part …)` | pieces fetchable on their own (binary, source, sdk, docs, symbols, man, completions, sbom, license) | | `(docs …)` | documentation that refreshes independently (the `Update-Help` / `HelpInfoURI` pattern) | | `(kin …)` | the maker's other work | | `(feed …)` | typed change feeds: security, release, deprecation, eol, addon, funding, news | | `(contact …)` | typed channels to the maker, each with `:found-at` so a reader can re-check before sending | Reader obligations include: - refresh-before-send for contacts; - never reporting an artefact without a digest as verified; - reporting, never resolving, disagreement with `.tool-versions`, `mise.toml` or `build/guix.scm`. - `1-formats/deed/vocabulary/nostos.adoc` - `1-formats/deed/tools/fixtures/valid/nostos-clause_chora.deed` exercises every term. Same pattern as `vocabulary/updates.adoc` (#1110) and `vocabulary/maturity.adoc` (#1139). Grammar unchanged: this is a `clause` under `deed.abnf` v1.1.0. The terms move into `estate_chora.deed`'s `(vocabulary …)` clause once that file exists. ## Evidence | Check | Result | |---|---| | `bun deed_lint.js fixtures/valid/nostos-clause_chora.deed` (the linter CI runs) | OK | | `bun deed_lint.js --fixtures fixtures/` | FIXTURES OK (whole corpus) | Correction: the first commit's message says `uuid8-clade_chora.deed` fails on main. That came from running the retired `deed_lint.py`, which predates `#u8`. With the Bun linter the whole corpus passes. A follow-up commit also updates the page to grammar v1.1.0 and to `#u8` (ADR-008 profile C) for any future identifier field. | pre-commit (SHA pins, permissions, CodeQL config, bot directives, canonical names) | passed | | GraalVM security contact | confirmed against https://github.com/oracle/graal/security/policy before recording `:checked` | ## Horizon (declared, not decided here) - a machine-level record (needs a new doc-head, so a grammar change); - per-person feed interest (a separate document); - signatures in `(digest …)`; - an identifier field (`#u8`, ADR-008 profile C) if one proves necessary; - no reader enforces the obligations yet. ## Consumer Planned: odds-and-sods-package-manager imports `.tool-versions` / `mise.toml` into `(nostos …)` and reads `(feed …)` for change detection. Later, kcX can project `(fetch …)` back out to `.tool-versions`, `mise.toml` and `build/guix.scm`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements owner ruling D269 (#787 comment): the estate stays current by default, majors included, gated on a real build check.
What changes
docs/DEPENDABOT-POLICY.adocis rewritten.required: []are never armed. Arming there merges instantly; see cicd-squabbler#121.enablePullRequestAutoMerge(SQUASH), nevergh pr merge --auto.hold).groups:must be anexclude-patternsentry, becauseignoreis not honoured there (48 open Dependabot PRs re-introduce the codeql-action v4.38.1 startup-killer, and the dependabot.yml ignore rule is being bypassed in 15 repos #1037).squabble bump/rollback, the reusable workflow, hypatia UG001/DA005, the render sweep) as specified, not built, so nobody reads the doc as describing live tooling.1-formats/deed/vocabulary/updates.adocis new. It defines the(updates …)repo-deed clause::enabled,:majors,:soak-days,(hold …),(exclude …).clauseunderdeed.abnfv1.0.0.fixtures/valid/updates-clause_chora.deedexercises every term.deed_lint.py --fixturesreports FIXTURES OK.:enabled trueis rejected.templates/cliff.tomlgains aDependenciesgroup forchore(deps):,build(deps):and Dependabot's unprefixedBump X from a to b. It sits before^chore, since the first matching parser wins.chore(deps)xsubject is not filed under Dependencies.Not in this PR
The reusable workflow, the
deed-readcrate, squabblerbump/rollback, hypatia rules and the rsr-template caller follow as separate PRs, in the order the policy's status table lists.🤖 Generated with Claude Code
https://claude.ai/code/session_019nbmPnyCN2ccVhiS7NZD1V