Sylvain Duchesne
c3d64555d9
`package.json` named `#main`, where the renamed `packages/polyfill` does not exist, and `pnpm-lock.yaml` still named the package as it was called in July. `pnpm install --frozen-lockfile` -- the Dockerfile's install step -- refused on exactly that mismatch, so the image could not build at all. Both now name the commit the branch was pushed at, and the frozen install passes. The dependency is now genuinely external: installed from git into pnpm's store, with no local overlay anywhere in the resolution. The invariant that justified the overlay in the first place holds -- `@ng-org/web` resolves to the same realpath from the application and from the installed package, so one instance and one verifier. A git-installed package does not carry its own `@ng-org`, where a symlink to the checkout would have. `.project/contracts.yaml` names the same commit as the dependency, so the surface the app is coded against and the package it installs designate one state, and a drift between them becomes visible instead of silent. A tag will replace the commit once the provider settles a convention; the invariant is that the two agree, whatever the ref. Deployment doctrine now carries what a deployer needs and did not have: the pinning discipline, that the frozen install only verifies, the wallet arriving through the environment with its one-directional precedence and its loud failure on a malformed value, that neither the wallet nor its password is a secret, that tailwindcss is a devDependency the server needs at serve time, and that a deployed origin's embedding in the broker's iframe is covered by no test. Nothing has been deployed in this shape yet, and the doctrine says so.
23 lines
1.3 KiB
YAML
23 lines
1.3 KiB
YAML
# Inter-repo contracts. Festipod is a CONSUMER only: it publishes no interface of its own,
|
|
# and it consumes exactly one — the SDK surface `@ng-eventually/polyfill` engages toward the
|
|
# applications built on it.
|
|
#
|
|
# The pulled copy under `into:` IS the specification Festipod codes against. An agent
|
|
# working here reads that copy and never opens the provider's own source: a gap is raised
|
|
# upstream (see `data-layer/rule_app-uses-sdk-surface-only`), never peeked around.
|
|
#
|
|
# `pullFrom:` names the canonical identity of the provider (its git remote URL + the
|
|
# repo-relative path of the leaf), so the manifest travels with the branch. Per-developer
|
|
# access to a local checkout lives in `.project/contracts.local.yaml`, which is never
|
|
# committed.
|
|
|
|
consume:
|
|
- contract: polyfill-surface
|
|
into: concepts/data-layer
|
|
type: git
|
|
pullFrom: https://gitea.reconnexion.apps.gueraud.net/Reconnexion/ng-eventually.git/.project/concepts/app-contract/contract_polyfill-surface.md
|
|
# The contract is published from the branch that carries it while that branch is still
|
|
# in flight; it moves to `main` once the provider lands it there. Flip this line then,
|
|
# and re-pull — the stamp records which commit the local copy actually came from.
|
|
ref: a8d53010c227462cc9317e9be499c2100ca8d533
|