Write down shape 8: a PackageVersion the satellite consumes versionless (#3344) by rbuergi · Pull Request #3350 · Systemorph/MeshWeaver

rbuergi · 2026-09-05T11:25:58Z

What happened

#3344 deleted a PackageVersion entry no project in this repository consumes, and every check
here stayed green through the merge. The consumer was MeshWeaver.Plugins'
MeshWeaver.Hosting.Sqlite.csproj, which references it versionless, and whose
src/Directory.Packages.props imports this file. main-cd found it 3.5 minutes later —
NU1010, Plugins: bake + seal skipped — and core sealed no set for the next ~80 minutes, which is
what Plugins#1359, #3327, #3328 and #3345 were all waiting on. The same line was the CVE remedy for
GHSA-2m69-gcr7-jv3q, so it was a security regression too. Fixed in #3348.

Two properties make the class invisible to both repos at once: nothing here consumes the entry, so
no compile can miss it; and the satellite pins this repo at MW_PLATFORM_REF, so its CI still reads
the old list until someone moves the pin. The pair gate sees nothing either — no public surface is
removed.

🚨 This page says the shape is UNCOVERED, and that is deliberate

I wrote the obvious guard first — a test here naming the load-bearing entries — and then measured
what it would have to name:

Plugins carries 49 versionless <PackageReference>s that no project in this repository
references at all;
47 resolve their version from an entry here.

A hand-maintained list of 47 goes red on core PRs whenever Plugins legitimately drops a
dependency — taxing every unrelated change in this repo for a fact that lives in another one. So the
guard was discarded rather than shipped at 1-of-47 coverage wearing the name of a control. The
page states the exposure, says there is no guard, and gives the grep to run by hand when removing an
entry.

The control that actually fits — a restore of the satellite tree in core's PR lane, deriving the
answer instead of remembering it — is filed as #3349 with its design and the constraints it has to
respect.

Verified: DocumentationLinkIntegrityTest passes.

Pairs-with: none — a doc page; removes no public surface.

Refs #3344, #3348, #3349

…ss (#3344) #3344 deleted a PackageVersion entry no project in this repository consumes, and every check here stayed green through the merge. The consumer was MeshWeaver.Plugins' MeshWeaver.Hosting.Sqlite.csproj, which references it VERSIONLESS, and whose src/Directory.Packages.props imports this file. main-cd found it 3.5 minutes later — NU1010, `Plugins: bake + seal` skipped — and core sealed no set for the next hour, which is what Plugins#1359, #3327, #3328 and #3345 were all waiting on. The same line was the CVE remedy for GHSA-2m69-gcr7-jv3q, so it was a security regression too. Two properties make the class invisible to both repos at once: nothing here consumes the entry, so no compile can miss it; and the satellite pins this repo at MW_PLATFORM_REF, so its CI still reads the old list until someone moves the pin. The pair gate sees nothing either — no public surface is removed. 🚨 This documents the shape and states plainly that it is UNCOVERED. I wrote the obvious guard first — a test here naming the load-bearing entries — then measured what it would have to name: MeshWeaver.Plugins carries 49 versionless PackageReferences that no project in this repository references at all, and 47 resolve their version from an entry here. A hand-maintained list of 47 goes red on core PRs whenever PLUGINS drops a dependency, taxing every unrelated change in this repo for a fact that lives in another one. So the guard was discarded rather than shipped at 1-of-47 coverage wearing the name of a control. The control that fits is a restore of the satellite tree in core's PR lane — the same actions/checkout of Systemorph/MeshWeaver.Plugins main-cd already does, then a dotnet restore of the projects that import this file. It derives the answer instead of remembering it, and the failure is a restore diagnostic rather than a build. Filed separately; until it exists the page says what to grep by hand. Verified: DocumentationLinkIntegrityTest passes. Pairs-with: none — a doc page; removes no public surface. Refs #3344, #3328 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

🟢 Approval recommended

The change is documentation-only, the added section is internally consistent, and it matches the described failure mode without introducing code or behavioral risk.

Pull request overview

Documents an additional uncovered “break shape” in the CrossRepoPairGate guidance: a satellite consuming a centrally-managed NuGet PackageVersion via a versionless <PackageReference> that is only pinned in core’s Directory.Packages.props, making it possible for core PRs to delete load-bearing entries while both repos’ PR CI remains green until main-cd (or a later platform pin bump) detects the break.

Changes:

Adds a new section (“eighth shape”) describing how deleting a core PackageVersion can break satellite restores with NU1010 while CI stays green in both repos.
Captures the #3344 incident timeline and why the failure was operationally costly (no sealed set) and security-relevant (NU1903 reintroduced).
Provides the recommended near-term manual check (grep the satellite for versionless references) and points to the intended longer-term control (satellite-tree restore in core PR CI).

File summaries

File	Description
src/MeshWeaver.Documentation/Data/Architecture/CrossRepoPairGate.md	Adds documentation for “shape 8” (versionless satellite package refs relying on core `Directory.Packages.props`) and how/why it evades existing gates.

Review details

Files reviewed: 1/1 changed files
Comments generated: 0
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-05T11:30:15Z