nicweyand/argand-site-registry
1
0
Fork 0
Code Issues Pull requests Projects Releases 7 Packages Wiki Activity Actions

docs: record standalone validation and publication policy

Browse source
This commit is contained in:
Nic Weyand 2026-09-12 21:47:36 -04:00
commit 0bcd4a2fc9
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
4 changed files with 88 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/superpowers/plans/2026-09-12-standalone.md
View file

@ -14,24 +14,28 @@ around their existing APIs. Use an isolated build directory.
- [x] Verify signed Argand commit 47911062b00d87f215ba61c41965faf8a7f4b7f7.
- [x] Export only `engine/crates/argand-site-registry` and `engine/crates/argand-atomic`.
- [x] Write `UPSTREAM.json` with original path/blob/hash evidence and a two-crate `Cargo.toml`.
- [ ] Prune the inherited lock with `cargo metadata --offline --format-version 1`; retain exact dependency versions.
- [x] Prune the inherited lock with `cargo metadata --offline --format-version 1`; retain exact dependency versions.
### Task 2: Make standalone use and trust policy concrete
- [ ] Add root README, LICENSE, source-license entrypoint, CONTRIBUTING, SECURITY and governance docs.
- [ ] Add Rust `examples/lookup.rs` and Python `examples/lookup.py` consumers of existing query contracts.
- [ ] Run both consumers on the native fixture and compare full lookup outputs, including attribution.
- [x] Add root README, LICENSE, source-license entrypoint, CONTRIBUTING, SECURITY and governance docs.
- [x] Add Rust `examples/lookup.rs` and Python `examples/lookup.py` consumers of existing query contracts.
- [x] Run both consumers on the native fixture and compare full lookup outputs, including attribution.
### Task 3: Package and verify source releases
- [ ] Add deterministic source archive and verification commands in `scripts/source_release.py`.
- [ ] Test determinism, dirty-tree refusal, no-clobber, tampering and unsafe archive members in `tests/test_source_release.py`.
- [ ] Add `scripts/check.sh` and `.forgejo/workflows/ci.yml` using an isolated runner without release secrets.
- [ ] Document explicit release signing, downstream pins and incident response in `docs/RELEASING.md` and `docs/TRUST.md`.
- [x] Add deterministic source archive and verification commands in `scripts/source_release.py`.
- [x] Test determinism, dirty-tree refusal, no-clobber, tampering and unsafe archive members in `tests/test_source_release.py`.
- [x] Add `scripts/check.sh` and `.forgejo/workflows/ci.yml` using an isolated runner without release secrets.
- [x] Document explicit release signing, downstream pins and incident response in `docs/RELEASING.md` and `docs/TRUST.md`.
### Task 4: Validate and land the bounded task
- [ ] Run `cargo fmt --all -- --check`, `cargo check --workspace --all-targets --locked --offline`,
- [x] Run `cargo fmt --all -- --check`, `cargo check --workspace --all-targets --locked --offline`,
`cargo clippy --workspace --all-targets --locked --offline -- -D warnings`,
`cargo test --workspace --locked --offline` and strict `cargo doc`.
- [ ] Build the native executable and retain the all-five-source CLI fixture outside the repo.
- [ ] Rebuild/run tests from the release archive outside the original workspace.
- [ ] Review every initial tracked file and dependency change, sign the local commit and release receipt.
- [ ] Record exact validation, publication and Argand cutover state; release any coordination window.
- [x] Build the native executable and retain the all-five-source CLI fixture outside the repo.
- [x] Rebuild/run tests from the release archive outside the original workspace.
- [x] Review every initial tracked file and dependency change, sign the local commit and release receipt.
- [x] Record exact validation, publication and Argand cutover state; release any coordination window.
Acceptance and operational limits are recorded in `docs/VALIDATION.md`.
The public repository is created with Actions disabled until an isolated runner
is provisioned. Argand remains on its embedded dependency; no shared window was taken.