[Release tooling] Model the existing nested Meta package contract in shared version/tag helpers #55

New Issue

2026-09-08T03:35:57+02:00

zemion commented

2026-09-08 03:35:57 +02:00

Follow-up

Follow-up to release preparation #51. The generic package-version/tag helpers do not currently model the already documented Meta support-repository release contract. This is a tooling consistency task, not an instruction to invent a root Python/npm package or skip version checks for unversioned repositories.

Reproduced mismatch

repository_version_issues() recognizes root pyproject.toml, root/WebUI npm metadata and module package declarations. The Meta repository instead owns its real developer-package contract at packages/govoplan-meta/pyproject.toml: project.name = "govoplan", selected project.version = "0.1.45". Consequently a generic all-42 tag_repositories(apply=False, push=True) preview reports 41 package repositories ready and Meta blocked with repository has no version metadata.

Existing owning contracts already establish the intended behavior:

tools/release/push-release-tag.sh explicitly includes Meta in SUPPORT_REPOS and treats repositories without a root package as tag-only/support repositories.
tools/release/generate-developer-meta-package.py --check verifies the nested package and exact composition against the Core version and reviewed release requirements.
.gitea/workflows/publish-developer-meta-package.yml validates the protected Meta tag against the nested package version and its exact commit before publication.
docs/operations/PACKAGE_REGISTRY_RELEASES.md, “Developer meta-package”, documents synchronization before release commits/tags.

Bounded current-release route

The reviewed release preparation uses the canonical package gates for all 41 installable source repositories plus an explicit Meta support contract: nested package identity/version, generator check, matching frozen Core tag, exact frozen Meta HEAD, trusted clean registered origin/main, live remote-main ancestry, immutable annotated local/remote tag objects, and atomic branch-plus-tag publication. All 42 are preflighted before any push, and Meta is published last. No broad legacy script is executed and no product helper is weakened.

This discrepancy is not an additional release blocker when that documented Meta-specific contract is validated. It must not be misreported as permission to bypass unknown or missing version metadata for other repositories.

Acceptance criteria

Model registered Meta nested-package/source-support identity explicitly in the shared release planning/version/tag contracts, using the existing nested package rather than synthetic root metadata.
Preserve exact composition synchronization with the generator, the matching Core release, and protected immutable tag/commit checks.
Keep operator-controlled checkout/origin/main, clean/nonbehind state, whole-batch preflight, atomic publication and post-effect remote receipt verification.
Add regressions for nested-version mismatch, stale composition, missing/unknown metadata, conflicting or lightweight tags, changed source receipts, unsafe origins and divergent branches. Unknown repositories must continue to fail closed.
Document and test consistent preview/local-tag/publish behavior between the generic helpers and the existing developer-meta workflow.

Duplicate check: all 54 existing open/closed Meta issue records were scanned before creation; no matching nested-version/support-helper issue was found.

## Follow-up Follow-up to release preparation #51. The generic package-version/tag helpers do not currently model the already documented Meta support-repository release contract. This is a tooling consistency task, not an instruction to invent a root Python/npm package or skip version checks for unversioned repositories. ## Reproduced mismatch `repository_version_issues()` recognizes root `pyproject.toml`, root/WebUI npm metadata and module package declarations. The Meta repository instead owns its real developer-package contract at `packages/govoplan-meta/pyproject.toml`: `project.name = "govoplan"`, selected `project.version = "0.1.45"`. Consequently a generic all-42 `tag_repositories(apply=False, push=True)` preview reports 41 package repositories ready and Meta blocked with `repository has no version metadata`. Existing owning contracts already establish the intended behavior: - `tools/release/push-release-tag.sh` explicitly includes Meta in `SUPPORT_REPOS` and treats repositories without a root package as tag-only/support repositories. - `tools/release/generate-developer-meta-package.py --check` verifies the nested package and exact composition against the Core version and reviewed release requirements. - `.gitea/workflows/publish-developer-meta-package.yml` validates the protected Meta tag against the nested package version and its exact commit before publication. - `docs/operations/PACKAGE_REGISTRY_RELEASES.md`, “Developer meta-package”, documents synchronization before release commits/tags. ## Bounded current-release route The reviewed release preparation uses the canonical package gates for all 41 installable source repositories plus an explicit Meta support contract: nested package identity/version, generator check, matching frozen Core tag, exact frozen Meta HEAD, trusted clean registered origin/main, live remote-main ancestry, immutable annotated local/remote tag objects, and atomic branch-plus-tag publication. All 42 are preflighted before any push, and Meta is published last. No broad legacy script is executed and no product helper is weakened. This discrepancy is not an additional release blocker when that documented Meta-specific contract is validated. It must not be misreported as permission to bypass unknown or missing version metadata for other repositories. ## Acceptance criteria - [ ] Model registered Meta nested-package/source-support identity explicitly in the shared release planning/version/tag contracts, using the existing nested package rather than synthetic root metadata. - [ ] Preserve exact composition synchronization with the generator, the matching Core release, and protected immutable tag/commit checks. - [ ] Keep operator-controlled checkout/origin/main, clean/nonbehind state, whole-batch preflight, atomic publication and post-effect remote receipt verification. - [ ] Add regressions for nested-version mismatch, stale composition, missing/unknown metadata, conflicting or lightweight tags, changed source receipts, unsafe origins and divergent branches. Unknown repositories must continue to fail closed. - [ ] Document and test consistent preview/local-tag/publish behavior between the generic helpers and the existing developer-meta workflow. Duplicate check: all 54 existing open/closed Meta issue records were scanned before creation; no matching nested-version/support-helper issue was found.

zemion added the area/release label 2026-09-08 03:35:57 +02:00

zemion commented

2026-09-08 05:27:54 +02:00

Status reconciliation — 2026-09-08

The bounded current-release route described in the body has now completed: Core/Meta v0.1.45 source, the developer meta-package and the signed catalog Git artifacts are published and verified; see Meta #51. That publication does not implement this shared-helper consistency work or lift the separate runtime/public-site holds.

Source review confirms that adding nested TOML discovery alone is insufficient: git_state / version alignment, source-version mutation planning, generator composition and matching-Core checks, and tag preview/publication all need to agree while preserving the listed trust/immutable-tag/remote-receipt guards. Keep this issue open as decision-free but nontrivial implementation work, not a missing permission to publish the already-completed 0.1.45 artifacts. No existing tag should be rewritten.

## Status reconciliation — 2026-09-08 The bounded current-release route described in the body has now completed: Core/Meta v0.1.45 source, the developer meta-package and the signed catalog Git artifacts are published and verified; see [Meta #51](https://git.add-ideas.de/GovOPlaN/govoplan/issues/51#issuecomment-19949). That publication does not implement this shared-helper consistency work or lift the separate runtime/public-site holds. Source review confirms that adding nested TOML discovery alone is insufficient: `git_state` / version alignment, source-version mutation planning, generator composition and matching-Core checks, and tag preview/publication all need to agree while preserving the listed trust/immutable-tag/remote-receipt guards. Keep this issue open as decision-free but nontrivial implementation work, not a missing permission to publish the already-completed 0.1.45 artifacts. No existing tag should be rewritten.

zemion commented

2026-09-08 08:09:35 +02:00

Implemented and published in govoplan 58d320d9b34a.

The shared contract recognizes the real nested developer package, without inventing root metadata or exempting unknown repositories. Version discovery and full canonical composition preparation agree. Receipt-bound preparation requires matching prepared Core metadata, a separate trusted checkout and explicit out-of-run confirmation. Frozen source/generator/output evidence is rechecked; ambiguous partial writes require manual reconciliation, without retry or rollback. The plan places Meta after Core with explicit manual support steps. It does not promise durable self-update or mutate its running operator.

All selected tag batches now enforce registered ownership/origin/main, tracked metadata, whole-batch preflight, frozen receipts, exact immutable annotations, object-pinned atomic publication and post-effect readback. Meta additionally requires exact composition and matching Core publication evidence. Local module candidate staging remains supported.

Verification: 279 release tests and 68 subtests passed; focused release gates passed 49 tests and 17 subtests. Independent adversarial preparation/batch review and reruns passed. Owning EN/DE operator documentation describes the out-of-run route and reconciliation behavior.

Closing the five acceptance bullets and the linked source-version planning gap. Neither requires an automatic durable self-updater. Runtime publication holds remain separate.

Full implementation, verification and remaining adoption gates. Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment.

Implemented and published in [govoplan 58d320d9b34a](https://git.add-ideas.de/GovOPlaN/govoplan/commit/58d320d9b34a618aab6ce0b9e48daf943961af66). The shared contract recognizes the real nested developer package, without inventing root metadata or exempting unknown repositories. Version discovery and full canonical composition preparation agree. Receipt-bound preparation requires matching prepared Core metadata, a separate trusted checkout and explicit out-of-run confirmation. Frozen source/generator/output evidence is rechecked; ambiguous partial writes require manual reconciliation, without retry or rollback. The plan places Meta after Core with explicit manual support steps. It does not promise durable self-update or mutate its running operator. All selected tag batches now enforce registered ownership/origin/main, tracked metadata, whole-batch preflight, frozen receipts, exact immutable annotations, object-pinned atomic publication and post-effect readback. Meta additionally requires exact composition and matching Core publication evidence. Local module candidate staging remains supported. Verification: 279 release tests and 68 subtests passed; focused release gates passed 49 tests and 17 subtests. Independent adversarial preparation/batch review and reruns passed. Owning EN/DE operator documentation describes the out-of-run route and reconciliation behavior. Closing the five acceptance bullets and the linked source-version planning gap. Neither requires an automatic durable self-updater. Runtime publication holds remain separate. [Full implementation, verification and remaining adoption gates](https://git.add-ideas.de/GovOPlaN/govoplan/src/commit/58d320d9b34a618aab6ce0b9e48daf943961af66/docs/security/SECURITY_FOLLOWUP_2026-09-08.md). Source main was pushed and read back at its exact commit; existing remote tag inventories were verified unchanged. This is source publication, not a new package/image release or deployment.

zemion closed this issue

2026-09-08 08:09:35 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#55