[BLOCKER] CI cannot install dependencies: lockfile references an unpublished file:../../percolator-sdk

[dcccrypto]

Impact

pnpm install --frozen-lockfile fails on main, so build-and-test cannot run. ~20 open PRs cannot be validated by CI.

Same root cause as percolator-indexer#172 — this is a cross-repo blocker, not an api-specific bug.

Reproduction (against today's origin/main)

Extracting only package.json + pnpm-lock.yaml from origin/main into a scratch directory (i.e. what CI sees — no sibling SDK checkout):

$ pnpm install --frozen-lockfile --ignore-scripts
 ENOENT  ENOENT: no such file or directory, scandir '<parent>/percolator-sdk'
exit 254

This matches the real CI failure on PR #231:

ENOENT: no such file or directory, scandir '/home/runner/work/percolator-sdk'
Process completed with exit code 254

Root cause

package.json looks fine — it depends on @percolatorct/sdk at 1.0.0-beta.34 (npm). The file: path is baked into pnpm-lock.yaml, which carries 7 file:...percolator references, reached transitively through @percolator/shared:

'@percolatorct/shared@https://codeload.github.com/.../percolator-shared/tar.gz/489f5b48...
    (@percolatorct/sdk@file:../../percolator-sdk...)'
  specifier: file:../../percolator-sdk
  version: file:../../percolator-sdk(...)

So the lockfile was generated on a machine where ../../percolator-sdk existed, and it pins that local path. CI has no such directory.

Why it cannot be fixed by regenerating the lockfile alone

The SDK revision this resolves to is not published anywhere:

• local percolator-sdk HEAD 23cb028 (v3.1.0) does not exist on the remote
• local is 17 commits ahead of origin/main (673bc47)
• npm has only 2.0.9

Regenerating the lockfile on the same machine will just re-bake a local path. It needs the SDK side published or pushed first — see percolator-indexer#172 for the options.

Secondary issue (api-specific)

Five CI runs are sitting in action_required and never executed at all:

Run	Branch	Created
28220161644	fix/raw-error-logging	2026-06-26
28219816850	fix/openapi-schema-drift	2026-06-26
28219381790	fix/shared-store-health-ping	2026-06-26
28219145060	fix/ws-health-liveness-check	2026-06-26
28218691179	fix/health-rpc-staleness-check	2026-06-26

These need a maintainer to approve the workflow runs (repo setting requiring approval). Worth resolving alongside, otherwise those PRs stay unverified even after the install is fixed.

Also note: the Vercel check fails on every api PR with "Authorization required to deploy" — a separate integration-auth item for whoever owns the Vercel project.

Net effect

No api PR has had a green build-and-test since at least 2026-06-26 (~3 weeks). Combined with indexer#172, two of the four service repos currently cannot verify any change in CI.

[dcccrypto]

Verified: api CI can be unblocked the same way as the indexer — but the path differs

I flagged in this issue that the indexer's fix (percolator-indexer#174) "likely applies here" and was explicit that I hadn't checked. I've now checked, and it does — with one detail that would have broken a blind copy.

The difference that matters

Repo	SDK dependency	SDK must be placed
percolator-indexer	file:../percolator-sdk	one level up
percolator-api	file:../../percolator-sdk	two levels up

For a runner at /home/runner/work/percolator-api/percolator-api, ../../percolator-sdk resolves to /home/runner/work/percolator-sdk — which matches the ENOENT in the real CI log on #231 exactly (scandir '/home/runner/work/percolator-sdk'). Copying the indexer step verbatim would place the SDK one level too deep and fail identically.

Verified end-to-end

Cloned SDK origin/main (v3.0.0) two levels above a clean api main checkout — replicating the runner layout — then ran this repo's actual CI steps (install → build → test; note api has no pnpm audit gate, unlike the indexer):

pnpm install --frozen-lockfile  ->  exit 0        (ENOENT gone)
pnpm build                      ->  exit 0
pnpm test                       ->  18 files, 228 passed, 0 failed

No publish required — the SDK is not the blocker, contrary to what I said earlier in this issue. SDK origin/main already exports what this repo needs.

Suggested step

- uses: actions/checkout@<pinned>
  with:
    repository: dcccrypto/percolator-sdk
    ref: main
    path: _percolator-sdk
- name: Place @percolatorct/sdk two levels up (#232)
  run: |
    rm -rf ../../percolator-sdk
    mv _percolator-sdk ../../percolator-sdk

actions/checkout cannot write outside GITHUB_WORKSPACE, hence checkout-then-move. percolator-sdk is public, so the default token suffices.

Still outstanding here, separately

The 5 workflow runs stuck in action_required (listed in the original post) need a maintainer to approve them. Fixing install doesn't help a run that never starts.

I have not opened a PR for this. There are already ~20 open PRs here and 6 of mine unmerged elsewhere; adding a 7th unprompted didn't seem like the right call when nothing is currently merging. Happy to open it immediately if wanted — the change is ~8 lines and verified.

[dcccrypto]

CI is green on PR #233 as of run 29778321679.

Two parts to this:

1. Install blocker (the reported issue) — the sibling-checkout fix in ci: check out percolator-sdk as a sibling so pnpm install can resolve it (#232) #233 resolves it. Verified in a CI-identical layout (SDK checked out two levels up, matching file:../../percolator-sdk): pnpm install --frozen-lockfile succeeds.

2. A second failure hiding behind it — once install was unblocked, pnpm test still failed 2/295. tests/sdk-smoke.test.ts asserted that getProgramId("devnet") / getMatcherProgramId("devnet") return a PublicKey. The v17 SDK deliberately removed that: both fail closed while V17_PROGRAMS_DEPLOYED === false, so a v17 encoder can never be handed a legacy address that cannot decode v17 payloads (Phase 7 cutover gate). The test was asserting pre-v17 behaviour, not catching a regression.

Fixed by asserting whichever half of the documented contract is live, keyed on the SDK's exported V17_PROGRAMS_DEPLOYED flag — so it stays honest after cutover instead of needing another edit.

Local verification: pnpm install --frozen-lockfile / pnpm build / pnpm test → 25 files, 295 passed.

Note for follow-up: #234 still applies — the docker job was SKIPPED here and will need the SDK in its build context once it runs. Also, the Vercel check on this repo reports FAILURE; percolator-api deploys to Railway, so that integration looks misconfigured and is unrelated to CI.