Repository navigation
Carry provenance through package-manager results - #357
gmemuriuki wants to merge 6 commits into
Conversation
1255766 to
d4c26a5
Compare
d4c26a5 to
2e6dc3c
Compare
Couple package identity to its source without claiming resolution. Rename configured registry sources to keep the two concepts distinct.
Preserve Cargo source facts in workspace dependency records. Rebuild older caches instead of inventing provenance, and retain typed workspace members for explicit resolution in the next slice.
Carry Cargo's resolved source through workspace shortcuts, metadata, and Cargo.lock fallback instead of reconstructing it later.
Couple package identity and source provenance across all five package manager result paths. Git registries restamp delegated path results, and explicit workspace members retain workspace provenance. Validated plugins still store only PackageId at this boundary. The next commit moves the complete SourcedPackage into Plugin.
Keep each complete SourcedPackage after validation so activation, deduplication, and later telemetry policy use typed provenance instead of package-manager routing labels. Merge member Cargo metadata through the workspace loader and preserve exact enabled dependencies. Same-named packages from different sources therefore remain distinct.
Use entry paths as package identities so same-named skills stay distinct.
2e6dc3c to
eb2453b
Compare
| plugins | ||
| } | ||
|
|
||
| async fn registry_plugins(&self) -> Result<Vec<UnvalidatedPlugin>> { |
There was a problem hiding this comment.
registry_plugins is the only delegated read that doesn't call restamp, and it's the one load_registry uses. So plugins from a git registry (recommendations included) end up with Path provenance, and once #358's policy is wired they'd all be unnamed instead of symposium-recommendations. The restamp test doesn't cover registry_plugins. Should it restamp too?
| }) | ||
| .cloned(), | ||
| ); | ||
| if enabled_packages.len() == before && !trust_root_names.contains(&normalized) { |
There was a problem hiding this comment.
Behavior change vs main: main skipped an enabled name if a registry plugin already provided it. Now that check only applies to the name-based worklist, so an enabled dependency with the same name as a registry plugin (e.g. a recommendations entry named after a crate that also ships its own skills) loads next to it: both skill sets install and both sets of hooks run. Is that intended? The used_trust_root_does_not_enter_the_cargo_worklist test uses an empty dependency list, so this case isn't covered.
What does this PR do?
This PR carries typed package provenance from every package-manager result into active plugins. It emits no telemetry.
The SDK introduces PackageProvenance and SourcedPackage, and the package-manager result types now return the sourced value rather than a bare PackageId. The breaking SDK change is marked for the next compatible release instead of treating new provenance as an optional default.
Cargo classifies workspace, crates.io, private-registry, Git, path, and unknown sources from resolved metadata. Probe and lockfile results retain the source that actually resolved the package, PathPm stamps local provenance, and GitPm restamps all five delegated operations with its configured URL.
Plugin keeps the complete sourced package through validation and all three construction paths, so later telemetry policy never infers origin from PackageId.pm. Active-plugin resolution also keeps workspace members single and traceable while preserving distinct same-named packages from different sources.
Tests cover the five-operation package-manager contract, Cargo source classification and probes, exact lockfile source matching, Git restamping, workspace-member loading, path and Git dependencies, trust-root activation, duplicate handling, and provenance retention on Plugin.
Disclosure questions
AI disclosure.
Questions for reviewers.
Does provenance remain correct across Cargo shortcuts and probes, Git and path adapters, and plugin activation without letting the package-manager routing name stand in for source identity?