From a22ae9c04bc8393fd2f2ed4c7206d36a3e1723d9 Mon Sep 17 00:00:00 2001 From: Brian Jin <35789537+kikashy@users.noreply.github.com> Date: Thu, 23 Jul 2026 18:29:10 -0400 Subject: [PATCH] feat: re-vendor the specification bundle from Judgment-Pack at neutral identifiers The embedded bundle was pinned to the pre-neutralization upstream tag, whose schema `$id` values point at a temporary repository-hosted URL under the predecessor organization. Two hardcoded constants also named that organization and gated the maintainer tooling: `sync-spec-artifacts` compares the source checkout's `origin` against its own constant, so the documented re-vendor procedure in docs/releasing.md could not run at all against the real specification repository. Re-vendor from Judgment-Pack/judgment-pack-spec. The two schema `$id` members now carry the permanent https://judgmentpack.org/schema/ identifiers. The conformance corpus and manifest are byte-identical to the previous pin, so all 47 cases still pass; only lock.json, schema.json, and manifest.schema.json change. Pin an exact commit rather than a tag. The specification's release tooling binds the tag string to `specVersion` in three assertions, so the permanent identifiers on its `main` branch cannot be republished under a second 0.1.0-draft tag without faking a version bump across the manifest, schema const, 47 conformance cases, and examples. `releasecheck.immutableRef` already accepts a full-length commit digest as immutable, so this is a supported reference, not a relaxation. The pin moves back to a tag once a specification version carrying the permanent identifiers is published. This is machine-visible: `spec schema` now reports a different schemaId, sha256, and bytes (14307 -> 14268), and the bundle digest changes. `outputVersion` stays "1". Also corrects three prose claims. README and CHANGELOG attributed the delay to the specification project not having published a neutral tag; the permanent identifiers were already on its `main` branch, and the real blocker was inside this repository. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Brian Jin <35789537+kikashy@users.noreply.github.com> --- CHANGELOG.md | 18 +++++++++++++++--- README.md | 14 ++++++++------ docs/releasing.md | 9 +++++---- internal/artifacts/artifacts_test.go | 6 +++--- internal/artifacts/jps/0.1.0-draft/lock.json | 16 ++++++++-------- .../jps/0.1.0-draft/manifest.schema.json | 2 +- internal/artifacts/jps/0.1.0-draft/schema.json | 2 +- internal/releasecheck/check.go | 2 +- tools/sync-spec-artifacts/main.go | 2 +- 9 files changed, 43 insertions(+), 28 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eccd971..c8a5613 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,16 @@ All notable changes to tagged releases are documented here. - Record the embedded specification bundle in `THIRD_PARTY_NOTICES`. The bundle is Apache-2.0 material from a separate project and appears in neither `go.mod` nor `go.sum`, so the previous Go-modules-only framing omitted it. +- Re-vendor the embedded specification bundle from `Judgment-Pack/judgment-pack-spec`, replacing the + pre-neutralization pin. The two schema `$id` values now carry the permanent + `https://judgmentpack.org/schema/` identifiers. Machine-visible: `spec schema` reports a new + `schemaId`, `sha256`, and `bytes`, and the bundle digest changes. No validation behavior changes + and all 47 conformance cases still pass — the corpus is byte-identical to the previous pin. +- Pin the bundle to an exact commit rather than a tag. The specification's release tooling requires + a tag string to equal `specVersion`, so the permanent identifiers on its `main` branch cannot be + republished under a second `0.1.0-draft` tag. The release gate already treats a full-length commit + digest as an immutable reference; the pin moves back to a tag once a specification version + carrying those identifiers is published. ## 0.0.1 - 2026-07-23 @@ -30,9 +40,11 @@ All notable changes to tagged releases are documented here. ### Known follow-ups -- The embedded specification bundle is still pinned to the pre-neutralization upstream tag - (`protossai/judgment-pack-spec@v0.1.0-draft`). Re-vendoring to a neutral, digest-locked spec tag - is pending the specification project publishing one. +- The embedded specification bundle is pinned to the pre-neutralization upstream tag + (`v0.1.0-draft`), whose schema `$id` values use temporary repository-hosted URLs. (Resolved in + Unreleased by re-vendoring from `Judgment-Pack/judgment-pack-spec` at an exact commit. The + original entry attributed the delay to the specification project not having published a neutral + tag; the permanent identifiers were in fact already on its `main` branch.) - No `GOVERNANCE`/`MAINTAINERS`/`CODEOWNERS` files exist yet. (The `NOTICE` file is added in Unreleased. `LICENSE` is deliberately left byte-identical to the canonical Apache-2.0 text: its appendix is a template for marking your own files, not a field to fill, and editing it costs a diff --git a/README.md b/README.md index a76a8ef..f77bc46 100644 --- a/README.md +++ b/README.md @@ -201,12 +201,14 @@ The lock records the source repository, exact commit/ref and source state, plus metadata for all 50 imported files. A development snapshot remains visibly labelled `unreleased-local-snapshot` and cannot pass the release gate. -> **Provenance note.** The embedded bundle is currently pinned to the specification's pre-neutral -> upstream tag (`protossai/judgment-pack-spec@v0.1.0-draft`), whose schema `$id`s still use the -> pre-neutralization URLs. Re-vendoring to a neutral, digest-locked spec tag is a reviewed -> follow-up, tracked in [CHANGELOG.md](CHANGELOG.md), pending the specification project publishing -> one. Because validation is fully offline and never dereferences a `$id`, this affects provenance -> labelling only, not validation behavior. +> **Provenance note.** The embedded bundle is pinned to an exact commit of +> `Judgment-Pack/judgment-pack-spec` rather than to a tag. The specification's only tag, +> `v0.1.0-draft`, carries schema `$id`s under a temporary repository-hosted URL; the permanent +> `https://judgmentpack.org/schema/` identifiers exist on `main` but cannot be published under a +> second tag, because the specification's release tooling requires the tag string to equal +> `specVersion`. Pinning the commit is an explicitly supported immutable reference here — the +> release gate accepts a full-length commit digest — and the pin moves to a tag once the +> specification publishes a version carrying the permanent identifiers. Artifact bundle and conformance-corpus digests use `sha256-length-prefixed-v1`: each sorted path and file body is encoded as an unsigned 64-bit big-endian byte length followed by those exact bytes. diff --git a/docs/releasing.md b/docs/releasing.md index c8b4e39..86f7a9f 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -5,8 +5,9 @@ independent: a CLI release may consume a JPS release, but it never creates or ch ## Prerequisites -- The intended JPS artifacts have already been committed and published under an immutable tag in - `protossai/judgment-pack-spec`. +- The intended JPS artifacts have already been committed to `Judgment-Pack/judgment-pack-spec` and + are reachable by an immutable reference: either a published tag or a full-length commit digest. + Prefer a tag when one carries the intended artifacts. - GitHub Release Immutability is enabled for this repository. - `main` is clean, pushed, and passing CI. - The GitHub CLI is authenticated with permission to push and manage releases. @@ -30,8 +31,8 @@ env GO111MODULE=on go run ./tools/sync-spec-artifacts \ ``` Review every imported file and `lock.json`. The lock must contain the official repository URL, -`immutable-git-ref`, the tag, its exact commit, `worktreeDirty: false`, and the expected bundle -digest. Update the embedded registry only when adding a new specification version. +`immutable-git-ref`, the immutable reference used, its exact commit, `worktreeDirty: false`, and the +expected bundle digest. Update the embedded registry only when adding a new specification version. ## Validate locally diff --git a/internal/artifacts/artifacts_test.go b/internal/artifacts/artifacts_test.go index 1f96160..493e9ab 100644 --- a/internal/artifacts/artifacts_test.go +++ b/internal/artifacts/artifacts_test.go @@ -8,10 +8,10 @@ func TestEmbeddedReleaseArtifactIntegrityAndProvenance(t *testing.T) { t.Fatal(err) } lock := set.Lock() - if lock.Source.Repository != "https://github.com/protossai/judgment-pack-spec" || + if lock.Source.Repository != "https://github.com/Judgment-Pack/judgment-pack-spec" || lock.Source.Kind != "immutable-git-ref" || - lock.Source.BaseCommit != "80958f50c851e9809cb8036a23622391cf437c99" || - lock.Source.Ref != "v0.1.0-draft" || + lock.Source.BaseCommit != "5df1f5502a61eed2ce7509d03b00e3d387558183" || + lock.Source.Ref != "5df1f5502a61eed2ce7509d03b00e3d387558183" || lock.Source.WorktreeDirty { t.Fatalf("embedded artifacts must remain pinned to the approved JPS release: %#v", lock.Source) } diff --git a/internal/artifacts/jps/0.1.0-draft/lock.json b/internal/artifacts/jps/0.1.0-draft/lock.json index f93ea73..8cb64bf 100644 --- a/internal/artifacts/jps/0.1.0-draft/lock.json +++ b/internal/artifacts/jps/0.1.0-draft/lock.json @@ -2,15 +2,15 @@ "formatVersion": 1, "specVersion": "0.1.0-draft", "source": { - "repository": "https://github.com/protossai/judgment-pack-spec", + "repository": "https://github.com/Judgment-Pack/judgment-pack-spec", "kind": "immutable-git-ref", - "baseCommit": "80958f50c851e9809cb8036a23622391cf437c99", - "ref": "v0.1.0-draft", + "baseCommit": "5df1f5502a61eed2ce7509d03b00e3d387558183", + "ref": "5df1f5502a61eed2ce7509d03b00e3d387558183", "worktreeDirty": false }, "bundleDigest": { "algorithm": "sha256-length-prefixed-v1", - "value": "507cba8dbe43b70481ae22d48d083423ef08aee22366055ef6ea1dc7dce213c7" + "value": "abc3d3371db5be6c0b63639d399fbe42e3f3e136a162d8d6c2b50503634bbe70" }, "files": [ { @@ -255,13 +255,13 @@ }, { "path": "manifest.schema.json", - "bytes": 3611, - "sha256": "fa3f55f53712253551d6374ff3f06621e936b56c04dabd399703bbb05285c740" + "bytes": 3579, + "sha256": "f073bde8f6f2189edd0334c81c03fecfacf8fae2bd49305a788c75550dcbc2c5" }, { "path": "schema.json", - "bytes": 14307, - "sha256": "81f6986edc8d2bbf6f49c28a9bbec4f9054f7c72cab5a5028130e01d2e7274d8" + "bytes": 14268, + "sha256": "c65c559db33d19d2f327858635266fca7fcc049fb75083a7a8d47517e27224fc" } ] } diff --git a/internal/artifacts/jps/0.1.0-draft/manifest.schema.json b/internal/artifacts/jps/0.1.0-draft/manifest.schema.json index b53d34e..7efedb5 100644 --- a/internal/artifacts/jps/0.1.0-draft/manifest.schema.json +++ b/internal/artifacts/jps/0.1.0-draft/manifest.schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://raw.githubusercontent.com/protossai/judgment-pack-spec/v0.1.0-draft/conformance/manifest.schema.json", + "$id": "https://judgmentpack.org/schema/0.1.0-draft/conformance/manifest.schema.json", "title": "Judgment Pack conformance manifest", "type": "object", "additionalProperties": false, diff --git a/internal/artifacts/jps/0.1.0-draft/schema.json b/internal/artifacts/jps/0.1.0-draft/schema.json index df791f8..29bf458 100644 --- a/internal/artifacts/jps/0.1.0-draft/schema.json +++ b/internal/artifacts/jps/0.1.0-draft/schema.json @@ -1,6 +1,6 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://raw.githubusercontent.com/protossai/judgment-pack-spec/v0.1.0-draft/schema/judgment-pack-core.schema.json", + "$id": "https://judgmentpack.org/schema/0.1.0-draft/judgment-pack-core.schema.json", "title": "Judgment Pack Core", "description": "Research-preview structural schema. Conformance does not establish truth, authority, safety, or operational fitness.", "$comment": "JPS structural conformance requires uri, date, and date-time format assertions even when a general-purpose validator treats format as annotation-only.", diff --git a/internal/releasecheck/check.go b/internal/releasecheck/check.go index c885b8a..e4b8372 100644 --- a/internal/releasecheck/check.go +++ b/internal/releasecheck/check.go @@ -9,7 +9,7 @@ import ( "github.com/Judgment-Pack/judgment-pack-runtime/internal/artifacts" ) -const specificationRepository = "https://github.com/protossai/judgment-pack-spec" +const specificationRepository = "https://github.com/Judgment-Pack/judgment-pack-spec" var ( versionTagPattern = regexp.MustCompile(`^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$`) diff --git a/tools/sync-spec-artifacts/main.go b/tools/sync-spec-artifacts/main.go index a389804..a0efb43 100644 --- a/tools/sync-spec-artifacts/main.go +++ b/tools/sync-spec-artifacts/main.go @@ -20,7 +20,7 @@ import ( "strings" ) -const sourceRepository = "https://github.com/protossai/judgment-pack-spec" +const sourceRepository = "https://github.com/Judgment-Pack/judgment-pack-spec" var fullCommitPattern = regexp.MustCompile(`^(?:[0-9a-f]{40}|[0-9a-f]{64})$`)