Repository navigation
ci(flow): one file per claim; deterministic verification report - #1344
Merged
Merged
Conversation
public-artifacts.json pinned the SHA-256 of every public data/config file, so each pull request that edited claims.yaml, verification.json or a fixture rewrote the same hash rows, and parallel pull requests conflicted on them. The committed file is now the reviewed path list (schema 2). Pull requests and main still fail on any unlisted or missing artifact path, and every open-core path, signature and license check is unchanged. The release workflow runs --stamp-release-inventory on the exact commit it builds, which rewrites the list as schema 1 (path + SHA-256), and then validates the wheel and sdist with --validate-dist-dir. Archives that embed the unstamped list are refused. release-package.yml did not run the flow archive checks at all before this. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claims.yaml held every claim in one list, and docs/VERIFICATION.md and docs/verification.json stamped the HEAD commit date on line one and listed all claim ids on one summary line with counts. Any two pull requests that added a claim conflicted on all three files. - claims/<id>.yaml: one claim per file; the file must be named after its id. The old header contract moves to claims/README.md. Parsed content of all 25 claims is unchanged. - The report carries a fixed stamp, groups claims by tier and sorts them by id, and lists one id per line with no counts. Every claim's entry is identical to main's. - tests/test_validate_claims.py now fails when the committed report is stale and checks that the render does not depend on registry order. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-on-prs # Conflicts: # packages/flow/public-artifacts.json
…to ci/claims-one-file-each
…ed list in archive tests The archive tests built their stamped inventory by walking packages/flow, so a symlink another test left under runs/ failed them (flow core unit shard 3/4). They now hash the committed path list directly. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…to ci/claims-one-file-each # Conflicts: # packages/flow/claims.yaml # packages/flow/docs/VERIFICATION.md # packages/flow/docs/verification.json
…-on-prs # Conflicts: # packages/flow/public-artifacts.json
…to ci/claims-one-file-each
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge after #1342. This branch is stacked on it. Until #1342 merges, this diff also shows #1342's commit. This PR targets
mainso that dependency-review and CodeQL, which run only on PRs intomain, still report.Why
Any two pull requests that added a claim conflicted on three files:
claims.yaml: every claim lived in one list, and new claims were appended at the end of the same section.docs/VERIFICATION.mdanddocs/verification.json: line one held the HEAD commit date, which changed on every regeneration. The summary listed all claim ids, with counts, on one line per tier.Since 2026-10-17, PR branches have made 8 commits to
claims.yamland 12 todocs/verification.json, not counting the PR merges themselves.What changes
claims/<id>.yaml, one claim per file. The loader refuses a file whoseiddoesn't match its file name, which also keeps ids unique. The header contract fromclaims.yamlmoves toclaims/README.md. The parsed content of all 25 claims is unchanged.validate-claims.ymlsync check already used this same stamp.verification.jsonis identical tomain's; only the order and the stamp changed.tests/test_validate_claims.py:The tier/evidence gate is unchanged (
test_real_registry_passes,--check --structure-only).Verified
python scripts/validate_claims.py --check --structure-only: passes, 25 claims, 16 supported.tests/test_validate_claims.py: 29 passed.check_release_consistency.pypassed.maintoday, the same two branches conflict onclaims.yaml, both report files and the inventory hash rows.Savings
A PR that adds a claim no longer forces a rebase, push and full PR pipeline rerun (about 40 jobs) on every other PR that adds or edits a claim.
A conflict can still happen when two new claims are in the same tier and sort next to each other (no existing claim between them). That is now the exception rather than the rule, and the fix is to run
--reportagain.One-time cost: open PRs that edit
claims.yamlwill conflict once. Move the claim intoclaims/<id>.yamland runpython scripts/validate_claims.py --report.No changes to
packages.yml,desktop-release.ymlormain.yml.🤖 Generated with Claude Code