4dafad4db6
Eight proposals grouped by category, each with problem statement, concrete plan, and risks: property-based testing over the protocol-shaped core (chunk streams, event logs, schema DSL); mutation testing as the counterweight to the 100%-coverage gate; deterministic tests + a universal replay-invariant fixture + nightly race stress; architectural conformance (dependency-cruiser rules and the LlmAdapter conformance kit); runtime arg validation at the model boundary with a structured error taxonomy and dev-mode invariants; doc-sync enforcement (typechecked doc snippets, API reports); supply-chain checks and nightly vendor-drift verification against the manifest; and deep-readonly public surfaces (logged-vs-in-flight mutability boundary). AGENTS.md points at docs/adr and docs/rfc.
42 lines
1.9 KiB
Markdown
42 lines
1.9 KiB
Markdown
# RFC 007: Supply chain checks and vendor drift verification
|
|
|
|
Status: proposed
|
|
|
|
## Problem
|
|
|
|
The vendor manifest (ADR 0001) is enforced at commit time in the *forward*
|
|
direction (vendored change ⇒ manifest update) but nothing verifies the
|
|
manifest's *claims*: that vendor/ actually equals upstream-at-SHA plus
|
|
exactly the logged modifications. And the handful of true npm dependencies
|
|
have no advisory monitoring or update cadence.
|
|
|
|
## Proposal
|
|
|
|
1. **Vendor drift check** (nightly CI): clone the upstream repos at the
|
|
manifest SHAs (shallow), copy the corresponding package sources, and diff
|
|
against `vendor/*/src`. The job fails unless the diff matches the logged
|
|
local modifications (kept as a checked-in patch file per modification —
|
|
the log entries become verifiable artifacts rather than prose).
|
|
2. **Dependency advisories**: osv-scanner (or `yarn npm audit`) job on the
|
|
lockfile, scheduled + on lockfile-touching PRs.
|
|
3. **License inventory**: a script asserting every vendored package carries
|
|
its LICENSE and that package.json `license` fields match the inventory in
|
|
vendor/README.md (we mix vendored MIT with our BSD-3) — CI step.
|
|
4. **Renovate** (or a scheduled agent task) proposing npm dependency updates
|
|
in small PRs that ride the full gate suite; vendored packages are excluded
|
|
(their updates follow the manifest sync procedure, ideally as a
|
|
semi-automated agent workflow: fetch upstream, re-apply patches, run
|
|
gates, open PR with the manifest table updated).
|
|
|
|
## Plan
|
|
|
|
3 is trivial — do first. 1 requires network access from CI to the upstream
|
|
repos (private — needs a token) and converting the two existing logged
|
|
modifications into patch files. 2 and 4 are config.
|
|
|
|
## Risks
|
|
|
|
Upstream repos are private mirrors; CI credentials and availability are the
|
|
main friction for the drift check. If blocked, run it as a local scheduled
|
|
agent task instead of CI.
|