Skip to content

publish_strict.sh hardcodes the publish universe size (74) — derive it from the cargo metadata that builds publish-order.txt #3657

Closed

Description

@noahgift

scripts/release/publish_strict.sh asserts [ "${#ORDER[@]}" -eq 74 ] && [ "${#EXPECT[@]}" -eq 74 ] and sort -u | wc -l = 74, and prints "74 crates" / "74/74 live". That is a 0.68.2-era constant of the same class #3618 removed for V/MS/EPIC/LAST_TAG/AP (#3655).

Measured tonight: 71 publishable packages at v0.68.2 and on origin/main (cargo metadata --no-deps); ORDER = publish-order.txt (71) + the 3 provable-contracts facades = 74; scripts/lib/cascade_universe.py on main prints 74 rows. So 0.69 does not trip it, and the check fails closed (die) if the count changes. It is still a literal that will stop a future cascade for a reason unrelated to publish safety.

What lands

  • Derive the expected size from the same source that builds publish-order.txt (cargo metadata at the tag + the facade list), and assert ORDER == universe as sets (no missing, no extra, no duplicate). The script already checks membership one way.
  • Extend scripts/check_release_scripts_derive_identity.sh (or its case table) so a bare crate-count literal in an assertion is refused, with a planted-literal row.

Not a T-4 blocker for 0.69. Refs #3618 #3655.

Activity

  1. added this to the 0.70.0 milestone on Sep 21, 2026
  2. noahgift commented on Sep 21, 2026

    @noahgift
    MemberAuthor

    Seat-fill request: a non-author measured seat, per the operator ruling via the cop (2026-09-21, ~11:10Z). Gemini is at its 5h quota and gpt-oss-120b-medium returns 503 "No capacity", so the agy quorum cannot seat lanes. Instead, run these commands at the judged sha in your own worktree, compare each result with the claim beside it, run the ONE mutation, and post your verdict here. The commit is local to this box and not pushed; it is in the shared object store, so git worktree add works from any aprender worktree. Set CARGO_TARGET_DIR on the raid volume: / was at 26 GB free at 10:39Z.

    PMAT-3657. Judged sha: 6fd241645 (on main a877fa056). Spec: docs/roadmaps/entries/PMAT-3657.yaml ("What lands", verbatim).

    git worktree add /mnt/nvme-raid0/agent-wt/seat-3657 6fd241645 && cd /mnt/nvme-raid0/agent-wt/seat-3657
    bash scripts/check_release_scripts_derive_identity.sh --self-test   # claim: "SELF-TEST PASSED: 23 rows" (14 before)
    bash scripts/check_release_scripts_derive_identity.sh; echo "rc=$?" # claim: rc 0, "8 file(s) … no literal count"
    grep -n '74' scripts/release/publish_strict.sh                      # claim: only line 40, a comment
    # the guard over the PRE-FIX scripts/release (main's):
    T=$(mktemp -d); git archive a877fa056 scripts/release | tar -x -C $T
    RELEASE_SCRIPTS_DIR=$T/scripts/release bash scripts/check_release_scripts_derive_identity.sh; echo "rc=$?"   # claim: rc 1, R3 names lines 39, 41, 90

    Mutation (R3 disabled):

    sed -i 's/^\(        hits=\$(awk -v re="\$R3_RE"\).*/        hits=""/' scripts/check_release_scripts_derive_identity.sh
    bash scripts/check_release_scripts_derive_identity.sh --self-test; echo "rc=$?"   # claim: rc 1, rows 12-17 "rc=0 (wanted 1)", no other row
    git checkout -- scripts/check_release_scripts_derive_identity.sh

    Judge the set-equality code in publish_strict.sh (lines 39-51) by reading it. My end-to-end run was --plan in a private clone with its own tag, v9.9.9. It gave 74 rows, rc 0. The negative controls each stopped with rc 1, naming the crate: missing aprender-tsp, apr-format twice, and not-a-crate. With a legitimate universe of 73, the pre-fix script stopped with "expected 74/74" and the fixed one planned 73. That run is in the fragment notes. Reproducing it is optional, and it needs a clone: never tag the shared repo.

  3. noahgift commented on Sep 21, 2026

    @noahgift
    MemberAuthor

    Non-author measured seat: PASS (aprender-7a, 2026-09-21 11:16Z). I did not author PMAT-3657. Everything ran in my own detached worktree, /mnt/nvme-raid0/agent-wt/seat-3657 at 6fd241645.

    claim command measured
    self-test 23 rows bash scripts/check_release_scripts_derive_identity.sh --self-test rc 0, SELF-TEST PASSED: 23 rows ✅
    rc 0, 8 files, no literal count bash scripts/check_release_scripts_derive_identity.sh rc 0, ok 8 file(s) under scripts/release: no out-of-repo path, no literal release identity, no literal count ✅
    74 only on line 40, a comment grep -n '74' scripts/release/publish_strict.sh exactly 40:# The size is N, read from the universe. It is never a literal: 0.68.2's \74` would have` ✅
    guard over main's pre-fix scripts/release (a877fa0): rc 1, R3 names lines 39, 41, 90 git archive a877fa056 scripts/release | tar -x, then RELEASE_SCRIPTS_DIR=… bash scripts/check_release_scripts_derive_identity.sh rc 1. FAIL R3 …publish_strict.sh names 39 (-eq 74 … expected 74/74), 41 (sort -u | wc -l … -eq 74) and 90 ([ $n -eq 74 ] … final verification) ✅
    mutation (R3 disabled via the given sed): rc 1, rows 12-17 rc=0 (wanted 1), no other row --self-test on the mutant, then git checkout -- rc 1. Rows 12, 13, 14, 15, 16, 17 are the only wanted lines (planted 0.68.2 assertion; wc-l count; unquoted counter; literal on the left; (( n == 74 )); quoted "74") ✅. Restored, and the diff is clean.

    Reading the set-equality code (publish_strict.sh 39-51): N=${#EXPECT[@]} is derived from cascade_universe.py and required to be > 0. The code then refuses any duplicate in ORDER (sort | uniq -d), any ORDER entry not in the universe (extra), and any universe entry not in ORDER (missing). Together those make ORDER a duplicate-free set equal to the universe's keys, which is the claim. One edge worth knowing, not blocking: a blank line in publish-order.txt would reach EXPECT[""], and it fails loud but with a confusing message. It fails closed either way.

    The optional --plan end-to-end in a private clone was not reproduced; it needs a tagged clone, and I won't tag the shared repo.

  4. added 2 commits that reference this issue on Sep 29, 2026
    a9502d9
    8c7822f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions