Claims: GT-706 — nothing asserts a package's own exports resolve in its own tarball - #597
Merged
Merged
Conversation
… resolve in its own tarball The class that cost this release two failed publish attempts, registered with what it actually is rather than with the symptom that surfaced. WHAT HAPPENED. contracts@1.1.0 declared an export subpath it did not ship. That did not fail at its own publish. It failed at infra-providers@1.2.1's clean-room smoke -- AFTER core-domain@1.3.1 was already irreversibly on the registry. The release stopped half-shipped, and npm forbids unpublishing after 72 hours, so the only recovery was a new contracts version. THE CHECK THAT EXISTS IS REAL AND IS THE WRONG SHAPE. npm-release.yml:213 computes "promised" as `[pkg.main, ...Object.values(pkg.bin)]`. `exports` is not in that list, so the assertion answers a narrower question than the manifest asks. PROVEN FALSIFIABLE, OBSERVED GREEN -- not argued. A two-file package declaring `"./ingest": "./dist/ingest/index.js"` with only dist/index.js on disk, run through that assertion VERBATIM from :208-220: 2 file(s) packed; entry points declared: dist/index.js packlist assertion exit=0 <-- green, with a phantom export declared require phantom-proof/ingest -> MODULE_NOT_FOUND The clean-room smoke does not cover it either, and that is not its defect: it resolves what a package IMPORTS, so a producer's phantom stays invisible until a consumer's turn -- which is after the irreversible step. WHAT THE ROW REFUSES TO CLAIM, because it was measured and is false: there is no phantom on the registry today. Installing the published contracts@1.2.0, core-domain@1.3.1 and agent-runtime@1.2.0 into a clean prefix and resolving every declared subpath gives 22 resolve, 0 phantom. The registry is healthy; what is missing is anything that keeps it that way. "There are broken exports" would have been a row that closes itself by accident on the next release. Exposure: 3 of 8 publishable packages declare 23 export subpaths, none asserted; two also declare an unbounded `./*`. Id GT-706 allocated by UNION OF BRANCHES -- 39 remote refs carrying the board, max GT-705 -- not from the local maximum. Verified: 08 (704 gaps, 680/680 sections, debt economics 32/32) / 49 / 01 / 04 / 41 / 57 green, 46 at a fixed point, and every board row splits into exactly 9 cells under the parsers' own splitRow in both languages. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: aarroyo <beyondnet.peru@gmail.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The class that cost this release two failed publish attempts, registered as what it is rather than as the symptom that surfaced.
What happened
contracts@1.1.0declared an export subpath it did not ship. That did not fail at its own publish. It failed atinfra-providers@1.2.1's clean-room smoke — aftercore-domain@1.3.1was already irreversibly on the registry. The release stopped half-shipped, and npm forbids unpublishing after 72 hours, so the only recovery was a newcontractsversion.The check that exists is real, and it is the wrong shape
npm-release.yml:213computes "promised" as[pkg.main, ...Object.values(pkg.bin)].exportsis not in that list, so the assertion answers a narrower question than the manifest asks.Proven falsifiable, observed green — not argued
A two-file package declaring
"./ingest": "./dist/ingest/index.js"with onlydist/index.json disk, run through that assertion verbatim from:208-220:The clean-room smoke does not cover it either, and that is not its defect: it resolves what a package imports, so a producer's phantom stays invisible until a consumer's turn — which is after the irreversible step.
What the row refuses to claim, because it was measured and is false
There is no phantom on the registry today. Installing the published
contracts@1.2.0,core-domain@1.3.1andagent-runtime@1.2.0into a clean prefix and resolving every declared subpath gives 22 resolve, 0 phantom. The registry is healthy; what is missing is anything that keeps it that way. "There are broken exports" would have been a row that closes itself by accident on the next release.Exposure: 3 of 8 publishable packages declare 23 export subpaths, none asserted; two also declare an unbounded
./*.Id allocated by union of branches — 39 remote refs carrying the board, max
GT-705— not from the local maximum.Verified:
08(704 gaps, 680/680 sections, debt economics 32/32) /49/01/04/41/57green,46at a fixed point, and every board row splits into exactly 9 cells under the parsers' ownsplitRowin both languages.Claims: GT-706
🤖 Generated with Claude Code