Package the reproducible Lambdasistemi Spec Kit fork - #5
Draft
paolino wants to merge 4 commits into
Draft
Conversation
The inherited ignore rules hide two paths this ticket needs. `specs/` excluded the directory itself, so the issue #1 planning record could never be staged; replacing it with `/specs/*` plus one negation keeps every other dogfooding spec directory ignored while making this ticket's mandate reviewable. `/gate.sh` is added so the per-ticket runtime gate stays untracked by construction rather than by discipline.
Records the spec, plan, modules/data/functions models, and task list for packaging the reproducible Lambdasistemi Spec Kit fork. Two facts drive the plan. The composition resolvers that already exist in the Bash and PowerShell common libraries have no callers, so preset strategies other than `replace` are never materialized by plan and task setup. And the inherited `*.lock` ignore rule would silently drop `flake.lock`, which the distribution cannot be reproducible without. The mandate carries ten invariants, each with its observable failure mode, and splits the work into a Nix distribution slice and a composition slice.
Package the tracked fork through a locked Nix flake that builds and runs the Specify CLI reproducibly, with the Python suite executed as a flake check. Expose machine-readable distribution identity and upstream ancestry, route the always-present CI workflow through the shared Nix gate, and enforce its complete permitted step set with a closed-world check. Assisted-by: Codex (model: GPT-5.6-sol, autonomous) Tasks: T101, T102, T103, T104, T105, T106, T107
The fourth independent audit of this ticket defeated INV-11 as written. Its
fail clause spoke of workflow *steps*, and over steps the delivered check is
airtight: 15 of 15 step-shape mutations are rejected. The escape was one level
up, in the workflow document — a top-level `defaults: run: shell: 'true {0}'`
neutralises the permitted step, and narrowing `on:` removes the gate from
push and pull_request. Both were demonstrated end to end on clean committed
trees.
That is a defect in the invariant's wording, not in the implementation, so the
invariant is restated at the level it holds rather than left overclaiming.
The residual is recorded in the spec with its measured escapes so a successor
can close the document level deliberately, instead of it being discovered
again by the next audit.
INV-11 was added by the ticket owner mid-ticket after a shipped CI step could
not pass and nothing executed it. It is not among the issue's acceptance
criteria; that is now stated explicitly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1. Parent epic #4.
What this delivers
A reproducible Nix distribution of the Lambdasistemi Spec Kit fork, plus a
generic repair of template composition in the setup scripts.
After this PR a colleague can run
nix run .#specify -- --helpfrom a cleancheckout and get the same CLI locally and in CI, and a project using a preset
that declares
append,prepend, orwrapactually receives the composedtemplate content from plan and task setup.
Why the composition change is here
resolve_template_content(Bash) andResolve-TemplateContent(PowerShell)already exist in the shared script libraries and have no callers.
setup-plancopies the winning layer's file andsetup-tasksreports thewinning layer's path, so every strategy other than
replaceis silentlydiscarded. This PR routes both setup scripts through the resolver that is
already there rather than adding a second composition engine.
Slices
flake.nix, trackedflake.lock, the packagedspecifyapp,machine-readable distribution identity, and an always-present Nix CI gate.
setup-plan/setup-tasks, with focused regressions.Verification
The ticket mandate lives in
specs/1-reproducible-spec-kit-fork/and carriesten invariants, each with its observable failure mode. Both slice gates were
proved able to fail at the base commit before any implementation started.
Notable proofs: the app is invoked from a fresh
git clonerather than theworking tree; the declared upstream base SHA must be declared exactly once and
be an ancestor of HEAD; and the PowerShell regressions must execute — the
gate fails if they skip, and a negative control confirms they genuinely depend
on the PowerShell interpreter.
Scope
This PR does not define the workflow constitution, the policy pack (#3), agent
guidance (#2), or any repository migration, and submits nothing upstream.