kayg/infraternal-v0
Archived
Watch
1
0
Fork
You've already forked infraternal-v0
 0
Code Issues 92 Pull requests Projects Releases Packages Wiki Activity Actions

Make supply-chain checks compare notices without rewriting them #70

Open
opened 2026-10-04 17:50:42 +00:00 by kayg · 3 comments
kayg commented 2026-10-04 17:50:42 +00:00
Owner
Copy link

Problem and evidence

scripts/check-supply-chain:55 points generated output at the tracked THIRD_PARTY_NOTICES.md; lines 261-264 write a temporary file and rename it over that tracked path. The review observed the fast supply-chain stage deleting 27 lines on this VM because installed-package data differed. The check restored its own generated change; this is evidence from the report, not a current worktree edit.

Recommendation

Generate notices to a run-local temporary destination and compare with the tracked file. Make writing the committed notice report an explicit generation action.

Payoff and estimate

A passing check stops adding unrelated review noise and preserves reproducible dependency notices. Estimate: 0.5 engineering day.

Priority: Now (≤1 day).

2026-10-04 owner decisions: Matches the requirement that verification output be exact and reviewable; it does not change the single gate entry point.

Report: arch-review report
Source: arch-review 2026-10-04

## Problem and evidence `scripts/check-supply-chain:55` points generated output at the tracked `THIRD_PARTY_NOTICES.md`; lines 261-264 write a temporary file and rename it over that tracked path. The review observed the fast supply-chain stage deleting 27 lines on this VM because installed-package data differed. The check restored its own generated change; this is evidence from the report, not a current worktree edit. ## Recommendation Generate notices to a run-local temporary destination and compare with the tracked file. Make writing the committed notice report an explicit generation action. ## Payoff and estimate A passing check stops adding unrelated review noise and preserves reproducible dependency notices. Estimate: 0.5 engineering day. **Priority:** Now (≤1 day). **2026-10-04 owner decisions:** Matches the requirement that verification output be exact and reviewable; it does not change the single gate entry point. **Report:** [arch-review report](/mnt/hdd/infraternal/jobs/arch-review/report.md) **Source: arch-review 2026-10-04**
kayg commented 2026-10-04 20:15:05 +00:00
Author
Owner
Copy link

Starting issue work on branch gate-tooling-now at base 069059d31fcd91366e76072e6be4871c01e5cde6.

Scope: make the supply-chain check compare notices without rewriting the tracked file and resolve the jiti discrepancy; repair the perf gate's container search and lazy log selectors; align performance budget units/workload definitions and document each source from the perf audit. I will run only INFRATERAL_VERIFY_RUN_ID=gate-tooling-now scripts/verify fast and report its exact output plus final tree status.

Starting issue work on branch `gate-tooling-now` at base `069059d31fcd91366e76072e6be4871c01e5cde6`. Scope: make the supply-chain check compare notices without rewriting the tracked file and resolve the `jiti` discrepancy; repair the perf gate's container search and lazy log selectors; align performance budget units/workload definitions and document each source from the perf audit. I will run only `INFRATERAL_VERIFY_RUN_ID=gate-tooling-now scripts/verify fast` and report its exact output plus final tree status.
kayg commented 2026-10-04 20:28:35 +00:00
Author
Owner
Copy link

Finding: jiti has no resolved package entry in bun.lock; it appears only in Vite's optionalPeers list. Vite is a devDependency of @infraternal/web, and the notice inventory starts from production dependencies. The tracked jiti@2.7.0 row and license text are stale production-notice content; no product dependency should be added to retain them. I will regenerate the tracked notice only through the new explicit write action.

Finding: `jiti` has no resolved package entry in `bun.lock`; it appears only in Vite's `optionalPeers` list. Vite is a `devDependency` of `@infraternal/web`, and the notice inventory starts from production dependencies. The tracked `jiti@2.7.0` row and license text are stale production-notice content; no product dependency should be added to retain them. I will regenerate the tracked notice only through the new explicit write action.
kayg commented 2026-10-04 20:58:52 +00:00
Author
Owner
Copy link

Finished issue #70 on gate-tooling-now.

Head: 459046794cd600c1b890472064b69c76b50c99ba

The normal supply-chain check now renders to a run-local temporary file and diffs it against THIRD_PARTY_NOTICES.md; it never writes the tracked file. Regeneration is explicit via scripts/check-supply-chain --write-notices. The stale jiti production row and license text are removed because jiti is only Vite's unresolved optional peer, and Vite is a web development dependency. The fast run confirmed the tracked report matches 81 frontend packages.

Fast verification output (verbatim; command exited 0):

SUPPLY_CHAIN_NOTICES match THIRD_PARTY_NOTICES.md from 81 frontend packages
SUPPLY_CHAIN_PASS Rust advisory/license checks complete; Bun findings are report-only
PASS fast: supply-chain checks (5.994s)
PASS fast: build web app (13.542s)
PASS fast: cargo fmt --check (2.066s)
PASS fast: cargo clippy (313.855s)
PASS fast: cargo test (375.380s)
PASS fast: svelte-check (30.882s)
PASS fast: UI package svelte-check (10.815s)
PASS fast: stream package typecheck (14.500s)
PASS fast: Vitest (13.575s)
PASS fast: UI package Vitest (11.750s)
PASS fast: stream package Vitest (2.446s)
PASS fast: OpenAPI and TypeScript client drift (79.158s)
PASS fast: terminal TypeScript (2.947s)
PASS fast: terminal Vitest (1.456s)

Bun audit reported one low cookie advisory as report-only. git status was clean after verification.

Finished issue #70 on `gate-tooling-now`. Head: `459046794cd600c1b890472064b69c76b50c99ba` The normal supply-chain check now renders to a run-local temporary file and diffs it against `THIRD_PARTY_NOTICES.md`; it never writes the tracked file. Regeneration is explicit via `scripts/check-supply-chain --write-notices`. The stale `jiti` production row and license text are removed because `jiti` is only Vite's unresolved optional peer, and Vite is a web development dependency. The fast run confirmed the tracked report matches 81 frontend packages. Fast verification output (verbatim; command exited 0): ```text SUPPLY_CHAIN_NOTICES match THIRD_PARTY_NOTICES.md from 81 frontend packages SUPPLY_CHAIN_PASS Rust advisory/license checks complete; Bun findings are report-only PASS fast: supply-chain checks (5.994s) PASS fast: build web app (13.542s) PASS fast: cargo fmt --check (2.066s) PASS fast: cargo clippy (313.855s) PASS fast: cargo test (375.380s) PASS fast: svelte-check (30.882s) PASS fast: UI package svelte-check (10.815s) PASS fast: stream package typecheck (14.500s) PASS fast: Vitest (13.575s) PASS fast: UI package Vitest (11.750s) PASS fast: stream package Vitest (2.446s) PASS fast: OpenAPI and TypeScript client drift (79.158s) PASS fast: terminal TypeScript (2.947s) PASS fast: terminal Vitest (1.456s) ``` Bun audit reported one low `cookie` advisory as report-only. `git status` was clean after verification.
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
main
dev
perf-gates
provider-docker-podman
fix-networkidle
fix-apierror-panics
fix-revoke-panic
wal-race
fix-private-storage
provider-runtime
plugin-design
server-channels
scope-v01
deploy-git-fix
sec-hardening
gates-tiering
sidebar-sync
multi-tab
cli-eof
podman-flake
ssh-reattach
agent-tunnel
process-boundary
shadcn
stream-params
cli-ssh
ssh-product
container-live
flaky-tests
s1-e2e
ssh-test-isolation
cli-stream
research-lxc
container-live-agent
ui-apis
grant-shrink
deploy-o2
ui-redesign
migration-fix
cli
stream
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal-v0#70
No description provided.