41 lines
2.7 KiB
Markdown
41 lines
2.7 KiB
Markdown
# Standalone Site Registry Implementation Plan
|
|
|
|
> **For agentic workers:** Use superpowers:executing-plans inline. No subagents or Argand worktrees.
|
|
|
|
**Goal:** Produce a reusable standalone repository and verifiable source release.
|
|
|
|
**Architecture:** Retain the registry and atomic helper as two workspace crates.
|
|
Preserve runtime bytes and wire packaging, consumer examples and release gates
|
|
around their existing APIs. Use an isolated build directory.
|
|
|
|
**Tech Stack:** Rust, SQLite, Python 3.11 standard library tooling, OpenSSH, Forgejo Actions.
|
|
|
|
### Task 1: Extract the verified baseline
|
|
- [x] Verify signed Argand commit 47911062b00d87f215ba61c41965faf8a7f4b7f7.
|
|
- [x] Export only `engine/crates/argand-site-registry` and `engine/crates/argand-atomic`.
|
|
- [x] Write `UPSTREAM.json` with original path/blob/hash evidence and a two-crate `Cargo.toml`.
|
|
- [x] Prune the inherited lock with `cargo metadata --offline --format-version 1`; retain exact dependency versions.
|
|
|
|
### Task 2: Make standalone use and trust policy concrete
|
|
- [x] Add root README, LICENSE, source-license entrypoint, CONTRIBUTING, SECURITY and governance docs.
|
|
- [x] Add Rust `examples/lookup.rs` and Python `examples/lookup.py` consumers of existing query contracts.
|
|
- [x] Run both consumers on the native fixture and compare full lookup outputs, including attribution.
|
|
|
|
### Task 3: Package and verify source releases
|
|
- [x] Add deterministic source archive and verification commands in `scripts/source_release.py`.
|
|
- [x] Test determinism, dirty-tree refusal, no-clobber, tampering and unsafe archive members in `tests/test_source_release.py`.
|
|
- [x] Add `scripts/check.sh` and `.forgejo/workflows/ci.yml` using an isolated runner without release secrets.
|
|
- [x] Document explicit release signing, downstream pins and incident response in `docs/RELEASING.md` and `docs/TRUST.md`.
|
|
|
|
### Task 4: Validate and land the bounded task
|
|
- [x] Run `cargo fmt --all -- --check`, `cargo check --workspace --all-targets --locked --offline`,
|
|
`cargo clippy --workspace --all-targets --locked --offline -- -D warnings`,
|
|
`cargo test --workspace --locked --offline` and strict `cargo doc`.
|
|
- [x] Build the native executable and retain the all-five-source CLI fixture outside the repo.
|
|
- [x] Rebuild/run tests from the release archive outside the original workspace.
|
|
- [x] Review every initial tracked file and dependency change, sign the local commit and release receipt.
|
|
- [x] Record exact validation, publication and Argand cutover state; release any coordination window.
|
|
|
|
Acceptance and operational limits are recorded in `docs/VALIDATION.md`.
|
|
The public repository is created with Actions disabled until an isolated runner
|
|
is provisioned. Argand remains on its embedded dependency; no shared window was taken.
|