chore: point pins at the commits their version labels claim (0.2.10) - #23
Merged
Conversation
Found by a logic ↔ documentation consistency audit across the mirror family. The `action-mirror` and `provenance-mirror` pins were both commented `# v0.2.0` while sitting TWO commits before that tag. The two missing commits were: docs: update self-references bhyi4/ -> mirror-stack/ after org migration docs: point SPEC references to v1.1 (seal-width amendment) So anyone installing this package received pre-org-migration docs — stale `bhyi4/` self-references and SPEC v1.0 — under a "v0.2.0" label. A pin whose comment names a release it does not point at is a claim the installer cannot check, which is the defect class this stack exists to catch. Also bumps `measure-mirror` v0.28.1 → v0.29.0, which adds ㉘ `subspace_claim_check` and fixes a latent KeyError in the finding formatters on INFO/N-A levels. `tests/test_pins_are_releases.py` checks each pin's SHA against the GitHub tag its comment names, and offline that every pin is a full 40-hex lowercase SHA with a version label. It skips rather than fails when the API is unreachable. Reverse-verified: restoring the old action-mirror pin makes it fail, so the guard has real discriminative power rather than passing on everything. No new tool: this server exposes a curated 19, not all 28 probes — `mm_verify` is the umbrella for the rest, and ㉘ is reachable through it by design. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ame fix as yeoul#2)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by a logic ↔ documentation consistency audit across all five mirror repos.
The defect
Two pins named a release they did not point at:
action-mirrorfa1fc499# v0.2.015b0c5b7— 2 commits laterprovenance-mirror321f84ab# v0.2.02d1d52d2— 2 commits laterThe two missing commits in both cases:
So an install of this package received pre-org-migration docs — stale
bhyi4/self-references and SPEC v1.0 — under av0.2.0label. A pin whose comment names a release it does not point at is a claim the installer has no way to check, which is precisely the defect class this stack exists to catch.Changes
action-mirror→15b0c5b7(now actually v0.2.0)provenance-mirror→2d1d52d2(now actually v0.2.0)measure-mirrorv0.28.1 → v0.29.0 (b3b6dec8) — adds ㉘subspace_claim_check,Finding.data, and a fix for a latentKeyErrorin the finding formatters onINFO/N/AlevelsGuard
tests/test_pins_are_releases.py:Reverse-verified: restoring the old
action-mirrorpin makes the test fail. A guard that only ever passes has no discriminative power, so it was checked in both directions before being committed.Not changed, on purpose
This server exposes a curated 19 tools, not all 28 measure-mirror probes —
mm_verifyis the umbrella for the rest. ㉘ is reachable through it, so no new tool was added.52 tests pass.
🤖 Generated with Claude Code