docs(evidence): record the frozen fleet ledger for the atomic bundle migration - #25
Merged
Merged
Conversation
…migration Every gate in the atomic-bundle migration asserts against a fleet ledger, but no ledger existed, so each gate would have re-derived its inputs by hand from whatever ref happened to be checked out. Three of the four canonical workspace checkouts sit on non-PR-head branches and the lvis-app checkout does not even contain the authoritative merged main SHA, so hand-derivation is how the wrong ref gets frozen. This records block 1, the tag-derivable half, measured read-only from the GitHub Contents and Git Refs APIs at exact refs: released tag and source SHA, frozen main SHA, keyword counts at both refs, minAppVersion, installPolicy, manifest and lockfile blob digests, and the resolved SDK object SHA. Two measurements are worth calling out. The released keyword total is exactly 93 while the frozen-main total is exactly 0, so the migration's bridge artifacts derive from main plus pin and version corrections rather than from a keyword-stripping pass. And every SDK pin in this fleet resolves through bun.lock to an annotated tag object rather than to a commit, so both the object SHA and its peeled commit SHA are recorded; a crossing comparison that mixes the two would produce a false result. Blocks 2 to 4 are declared with their columns and prerequisites but left unrecorded, because the catalog block needs Marketplace read access and the bridge blocks do not exist yet. Constraint: ep-api is visibility="internal" in production and internal-ness is decided solely from CF-Connecting-IP against corporate CIDRs, so its catalog row needs an authorized internal requester and a positive control before any absence assertion. Rejected: recording named authority holders and cutover machine identities here — this file is public, so they belong in a private operator record referenced by identifier. Confidence: high for block 1; every value was read from an exact ref. Scope-risk: none — this adds an evidence file and changes no workflow or code. Tested: values re-read from the API after writing. Not-tested: no catalog value is recorded, so nothing here is yet cross-checked against what the Marketplace actually serves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JUxWDLEU9zprdSPiUxSqtB
ken-jo
marked this pull request as ready for review
July 25, 2026 09:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every gate in the atomic-bundle migration asserts against a fleet ledger — released versions, source SHAs, keyword counts, SDK pins, minimum Host versions — but no ledger existed. Each gate would have re-derived its inputs by hand, and hand-derivation is exactly how the wrong ref gets frozen: three of the four canonical workspace checkouts sit on non-PR-head branches, and the
lvis-appcheckout does not even contain the authoritative mergedmainSHA.What this records
Block 1, the tag-derivable half, measured read-only from the GitHub Contents and Git Refs APIs at exact refs. Blocks 2–4 are declared with their columns and prerequisites but left unrecorded: the catalog block needs Marketplace read access, and the bridge blocks do not exist yet.
Two measurements worth calling out:
The released keyword total is exactly 93; the frozen-
maintotal is exactly 0.mainlvis-plugin-gitlocal-indexermeetingms-graphep-apiSo the bridge artifacts derive from current
mainplus pin and version corrections, not from a keyword-stripping migration.Every SDK pin in this fleet resolves through
bun.lockto an annotated tag object, not to a commit. For example#45ccbe3is the tag object45ccbe36eb982c27d6da87d3cf7199e590bbde20, whose peeled commit isd25cb18af4a4ea1cea2fb448536b2bb1432514f1. Both are recorded, because a crossing comparison that mixes object types produces a false result. On this measurementlvis-plugin-gitresolves to the same object at both refs and does not cross;ep-apiis the only crossing row.Also recorded:
installPolicyper row, since it decides whether a publish is auto-approved into the live public catalog or parks inpending_review. Four of five areadmin; onlylvis-plugin-gitisuser.Verification
Every value was read from an exact ref and re-read from the API after writing. No local working checkout was consulted.
Not verified: no catalog value is recorded, so nothing here is yet cross-checked against what the Marketplace actually serves. GitHub's "latest release" pointer disagrees with the newest tag for every plugin in this fleet, so the tag-derived rows are corroborating evidence, not proof of what is served.
Notes
ep-apiisvisibility="internal"in production and internal-ness is decided solely fromCF-Connecting-IPagainst corporate CIDRs, so its catalog row will need an authorized internal requester — and a positive control before any absence assertion, so a not-found caused by network position is distinguishable from one caused by a yank.Named authority holders and cutover machine identities are deliberately not in this file, which is public; they belong in a private operator record referenced by identifier.
🤖 Generated with Claude Code
https://claude.ai/code/session_01JUxWDLEU9zprdSPiUxSqtB