Repository navigation
fix(release): depend on the published quipu-ai 0.16.6, not a git pin (aegis-67v3) - #217
Merged
Merged
Conversation
…(aegis-67v3) crates.io refuses a git-only dependency, so the crates rehearsal failed with "dependency quipu-ai does not specify a version" and no seeds release could carry the signed push reader (#216). Seeds now depends on the registry crate quipu-ai =0.16.6, published from quipu ad8de357 (its .cargo_vcs_info.json), which contains the signed bootstrap and signed transaction bodies (quipu #930). The lock pins its registry checksum dc5bd50f. Every quipu API Seeds uses is unchanged between ad8de357 and the former pin d707ec62, and the stream wire is identical. Against the registry crate, the read-stream (12) and stream-projection (5) tests pass, including the signed transaction tamper/replay controls. Negative controls: with the bare trust_stream the tampered body applies; pinning the pre-#930 registry 0.16.3 fails to compile (no BootstrapTrust, no replica_manifest). CI now packages the crate on every PR and refuses a git dependency or a non-registry quipu-ai in the emitted manifest and lock, so this surfaces before a release run. Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_014TTLDB79GE5UuX6TbsDT8N
…-67v3) Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_014TTLDB79GE5UuX6TbsDT8N
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
crates.io refuses a git-only dependency, so the seeds crates rehearsal failed (
dependency quipu-ai does not specify a version, exit 101) and no release could carry the signed push reader from #216. This PR:quipu-ai =0.16.6instead of the git pin. 0.16.6 was published from quipuad8de357(the crate's.cargo_vcs_info.json), which contains the signed bootstrap and signed transaction bodies (quipu #930). The lock pins the registry checksumdc5bd50f…, identical to the crate whose provenance was read.cargo package --no-verify --locked) and refuses a git dependency or a non-registryquipu-aiin the emitted manifest and lock. A regression is then caught on the PR, not first in a release run.There is no version bump here: release-plz owns that. The
seeds-ai-v0.10.1draft (29b96677, without #216) is untouched.Evidence (local, focused, against the actual registry crate)
cargo packagefails, exit 101, the same as rehearsal 41336386508's crates failure. New: packages 297 files; the emitted manifest hasversion = "=0.16.6"with no git, and the emitted lock has a registry source plus that checksum.ad8de357and the former pind707ec62(8 commits; no diff in applier/stream/wire/asof/feed/sparql files), so the stream wire to the served quipu is identical.cargo test --lib native::read_stream12/0 andcargo test --test stream_projection5/0, including the signed tamper/replay/positive controls.trust_streamwith registry 0.16.6 applies a tampered body (test fails as it should). Pinning the pre-#930 registry 0.16.3 fails to compile (BootstrapTrust,replica_manifestmissing).The full suite, wasm32 and clippy were not run locally (host build hold); hosted CI is authoritative. The pre-existing lock entry
yoke-derive 0.8.3is reported as yanked by cargo; it is unchanged by this PR.🤖 Generated with Claude Code
https://claude.ai/code/session_014TTLDB79GE5UuX6TbsDT8N