diff --git a/.github/workflows/scenarios.yml b/.github/workflows/scenarios.yml index e7e5ccb..2f3cb40 100644 --- a/.github/workflows/scenarios.yml +++ b/.github/workflows/scenarios.yml @@ -26,7 +26,7 @@ jobs: base: ac8d294421e1bfc14afa8c6a2a12f1affb5268ee options: "" - lane: advisory-v1.10-candidate - base: 5f316aeddc3680b92bd209fcfe652eac020d02d0 + base: 06715fed19aceff27844aba546ba2a0b4c594ac7 options: --candidate steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 diff --git a/docs/first-success.md b/docs/first-success.md index 06c2103..3573702 100644 --- a/docs/first-success.md +++ b/docs/first-success.md @@ -12,7 +12,7 @@ build, test and demo paths require macOS. Bash must be 4.2 or newer. Contributor need the toolchains declared by the manifest/mise configuration; setup may install tools and change the project environment, so preview it first. -Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md) +Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md) for install and consent decisions, then select the stable inputs above. That document is pinned for reference, not an instruction to substitute its candidate for the stable runtime. The README's checksum-verified [Quick Start](../README.md#quick-start) @@ -56,7 +56,7 @@ an unexplained error. `--yes` does not grant command trust or IDE consent. new project under a separate workspace. Choose one existing, harmless project validation command; do not copy the demo's entire toolchain or service graph. -Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md#adopt-an-external-style-project) +Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md#adopt-an-external-style-project) to declare that command in your own manifest, preview setup, inspect command surfaces, approve the reviewed digest, and run your project's test. Keep command approval, runtime inspection and IDE mutation as separate decisions. The demo's @@ -64,12 +64,12 @@ approval, runtime inspection and IDE mutation as separate decisions. The demo's **Done:** your declared test passes in the intended checkout and a handoff PR contains the manifest, test output, version/provider identities and remaining -warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/json-output-quickstart.md) +warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/json-output-quickstart.md) for machine-readable evidence; check both JSON status and process exit. **Safe failure/recovery:** preview setup with `basectl setup --dry-run` before applying it. A missing prerequisite or stale environment is a diagnostic, not -permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/first-run-troubleshooting.md) +permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/first-run-troubleshooting.md) to repair the specific finding and rerun validation. Review any proposed IDE or shell-profile changes separately. This internal rehearsal is not independent external-adoption evidence. @@ -102,7 +102,7 @@ does not select a service environment or fix other readiness findings. Inspect each remaining finding; do not declare success from the marker alone. Services use `services --env dev` separately; staging/prod are non-operational examples. -For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/downstream-release-smoke-test.md) +For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/downstream-release-smoke-test.md) and the demo's [release policy](release.md). A contributor PR is not permission to tag or publish. The [complete command reference](../README.md#complete-command-reference) remains available after these short paths. diff --git a/docs/trust-scenarios.md b/docs/trust-scenarios.md index e19ebe8..08f23f6 100644 --- a/docs/trust-scenarios.md +++ b/docs/trust-scenarios.md @@ -31,7 +31,7 @@ inspection are demonstrated only against the implemented v1.10 candidate. The stable lane prints this boundary and does not invoke candidate-only flags. The separate advisory lane uses exact Base commit -`5f316aeddc3680b92bd209fcfe652eac020d02d0`. Run the same command with that +`06715fed19aceff27844aba546ba2a0b4c594ac7`. Run the same command with that checkout/commit and add `--candidate`. A published v1.10 release is not required, but a moving branch is not an acceptable substitute for the recorded revision. Both lanes run in [isolated scenario CI](../.github/workflows/scenarios.yml). @@ -62,4 +62,4 @@ that the host is ready. Local temporary paths are redacted from assertion diagnostics. `tests/scenario_harness_test.py` verifies cleanup and redaction. For the authoritative boundaries, see Base's -[command-trust policy](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/manifest-command-trust.md). +[command-trust policy](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/manifest-command-trust.md). diff --git a/docs/workspace-scenarios.md b/docs/workspace-scenarios.md index a98fc00..b92d971 100644 --- a/docs/workspace-scenarios.md +++ b/docs/workspace-scenarios.md @@ -23,7 +23,7 @@ workspace identity, missing-peer reporting and read-only behavior. It prints an explicit supported-version boundary without invoking newer flags. For the implemented 1.10 candidate, select its checkout and exact commit -`5f316aeddc3680b92bd209fcfe652eac020d02d0`, and add `--candidate`. +`06715fed19aceff27844aba546ba2a0b4c594ac7`, and add `--candidate`. [Scenario CI](../.github/workflows/scenarios.yml) runs both lanes. This is advisory candidate evidence, not a stable-release compatibility claim. @@ -46,5 +46,5 @@ The candidate asserts: Each completed assertion group prints `PASS`; fixtures are removed on success or exception. There is no second application stack and no host-readiness claim. -See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/workspace-manifest.md) +See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/workspace-manifest.md) for the authoritative API. diff --git a/services/demo-console/package-lock.json b/services/demo-console/package-lock.json index 5895a22..6f4128d 100644 --- a/services/demo-console/package-lock.json +++ b/services/demo-console/package-lock.json @@ -2040,10 +2040,11 @@ "license": "ISC" }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "dev": true, + "license": "BSD-3-Clause", "engines": { "node": ">=0.10.0" } @@ -2192,9 +2193,9 @@ "optional": true }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "dev": true, "license": "MIT", "engines": { diff --git a/services/demo-console/package.json b/services/demo-console/package.json index cc0ae7c..0fa5882 100644 --- a/services/demo-console/package.json +++ b/services/demo-console/package.json @@ -28,5 +28,8 @@ "jsdom": "28.1.0", "vite": "8.0.16", "vitest": "4.1.11" + }, + "overrides": { + "source-map-js": "^1.2.2" } } diff --git a/tests/dependency_inputs_test.py b/tests/dependency_inputs_test.py index 92c595a..c34a56c 100644 --- a/tests/dependency_inputs_test.py +++ b/tests/dependency_inputs_test.py @@ -1,5 +1,6 @@ """The selection record and its materialized consumers must never drift.""" import json +import re from pathlib import Path import shutil import subprocess @@ -51,6 +52,29 @@ def test_github_outputs_are_only_validated_scalars(self): self.assertEqual(output["base_cli_version"], "0.4.3") self.assertEqual(len(output["base_commit"]), 40) + def test_advisory_candidate_pin_matches_documented_references(self): + workflow = (ROOT / ".github/workflows/scenarios.yml").read_text() + match = re.search( + r"- lane: advisory-v1\.10-candidate\s+base: ([0-9a-f]{40})", + workflow, + ) + self.assertIsNotNone(match) + candidate = match.group(1) + stable = json.loads( + (ROOT / ".release/supported-dependencies.json").read_text() + )["components"]["base"]["commit"] + documented = set() + for filename in ( + "docs/trust-scenarios.md", + "docs/workspace-scenarios.md", + "docs/first-success.md", + ): + with self.subTest(filename=filename): + text = (ROOT / filename).read_text() + self.assertIn(candidate, text) + documented.update(re.findall(r"\b[0-9a-f]{40}\b", text)) + self.assertEqual(documented, {stable, candidate}) + if __name__ == "__main__": unittest.main()