Cut the scaffolding that had no audience - #47
Merged
Conversation
This repo carried the release, evidence, and governance apparatus of a widely-depended-upon artifact: supply-chain proofs, an auditable traceability matrix, and a controlled vocabulary. Those controls answer "how do I prove this to someone who doesn't trust me?", and nobody is asking. The plugin itself is unchanged. Removed: - Attempt-level resumability. The candidate and manifest jobs no longer look up artifacts from earlier attempts of the same run; re-running from scratch is cheaper than the code that avoided it. Managed-D1 evidence reuse stays, since that one avoids re-provisioning real Cloudflare resources. - The hand-rolled S3 client and two-phase publish (~1,700 lines). Publication is now three steps in the workflow: a create-only `aws s3api put-object --if-none-match '*'`, a public-URL re-download compared to the candidate digest, then `gh release create`. The immutable-version-key guarantee is unchanged; it was always the conditional write doing the work. - The 6-check publication preflight, and with it the 9-step manual audit that existed because three of those checks could never pass from inside a workflow. - The release dry-run mode. To rehearse a release, cut the next patch version. This is what forced the rehearsal-object and teardown machinery to exist. - verification/coverage-manifest.json and its catalog: a 1,439-line hand-maintained traceability matrix over this repo's own tests. - All seven JSON Schemas. Every producer and consumer of those files is a script in this repo at the same commit. The semantic equality checks that already compared every field were doing the real work; the schemas were a third encoding of shapes the TypeScript types now own. - The tests that linted prose — AGENTS.md line counts, backticked-path existence, and a ban on version-shaped strings in documentation. - CONTEXT.md's 14-term controlled vocabulary and the eight docs/agents/ files it fed. AGENTS.md is now one self-contained document. Changed: - scripts/ is TypeScript, run directly by Node 24's type stripping. No build step and no hand-written .d.mts twins (718 lines). scripts/tsconfig.json sets erasableSyntaxOnly so a violation fails typecheck instead of at runtime in CI. - package.json is "type": "module", required to make .ts unambiguously ESM for both Node and tsc. - The workflow contract tests keep the three checks that each caught a real failure — unknown permission scopes, downloads by artifact ID without merge-multiple, and packages imported before npm ci — and drop the assertions that only transcribed the YAML back into regexes. One property is genuinely lost: additionalProperties:false on the release manifest and compatibility evidence. The equivalent guard for managed-D1 evidence, which is the one that keeps SQL, rows, bookmarks, and credentials out of published artifacts, survives as inspectKeys in managed-d1-contract.ts. make verify-local passes: build, drift, 128 root tests, candidate, types, Miniflare, and the canonical example worker. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mkuznets
added a commit
that referenced
this pull request
Aug 15, 2026
Removes eight pieces of release, evidence, and governance apparatus that were sized for a widely-depended-upon artifact rather than for this repo. The plugin itself (`src/`) is unchanged. **Net: 91 files changed, −7,123 lines.** | Removed | Detail | |---|---| | Attempt-level resumability | Candidate and manifest jobs no longer reuse artifacts from earlier attempts. Managed-D1 evidence reuse stays — it avoids re-provisioning real Cloudflare resources. | | Hand-rolled S3 client + two-phase publish | ~1,700 lines replaced by `aws s3api put-object --if-none-match '*'`, a public-URL digest re-check, and `gh release create`. | | Publication preflight | The 6-check job and the 9-step manual audit that compensated for the three checks it could never verify. | | Release dry-run | What forced the rehearsal-object and teardown machinery to exist. | | `coverage-manifest.json` | A 1,439-line hand-maintained traceability matrix over this repo's own tests. | | Seven JSON Schemas | Every producer and consumer is a script in this repo at the same commit. | | Prose-linting tests | `AGENTS.md` line counts, backticked-path existence, version-string bans. | | `CONTEXT.md` + `docs/agents/` | Folded into one self-contained `AGENTS.md`. | **Also changed** - `scripts/` is now TypeScript run directly by Node 24's type stripping — no build step, no hand-written `.d.mts` twins (718 lines). `erasableSyntaxOnly` makes a violation a typecheck failure rather than a CI runtime failure. - `package.json` is `"type": "module"`, required to make `.ts` unambiguously ESM for both Node and `tsc`. - Workflow contract tests keep the three checks that each caught a real failure (unknown permission scopes, downloads by artifact ID without `merge-multiple`, packages imported before `npm ci`) and drop the ones that only transcribed YAML into regexes. **One property genuinely lost:** `additionalProperties: false` on the release manifest and compatibility evidence. The equivalent guard for managed-D1 evidence — the one keeping SQL, rows, bookmarks, and credentials out of published artifacts — survives as `inspectKeys` in `managed-d1-contract.ts`. **Verification:** `make verify-local` passes locally — build, drift, 128 root tests, candidate, types, Miniflare (33), example worker (5). Untouched: the eight-layer verification pyramid and managed-D1 verification, both still wired into CI and the release gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes eight pieces of release, evidence, and governance apparatus that were sized for a widely-depended-upon artifact rather than for this repo. The plugin itself (
src/) is unchanged.Net: 91 files changed, −7,123 lines.
aws s3api put-object --if-none-match '*', a public-URL digest re-check, andgh release create.coverage-manifest.jsonAGENTS.mdline counts, backticked-path existence, version-string bans.CONTEXT.md+docs/agents/AGENTS.md.Also changed
scripts/is now TypeScript run directly by Node 24's type stripping — no build step, no hand-written.d.mtstwins (718 lines).erasableSyntaxOnlymakes a violation a typecheck failure rather than a CI runtime failure.package.jsonis"type": "module", required to make.tsunambiguously ESM for both Node andtsc.merge-multiple, packages imported beforenpm ci) and drop the ones that only transcribed YAML into regexes.One property genuinely lost:
additionalProperties: falseon the release manifest and compatibility evidence. The equivalent guard for managed-D1 evidence — the one keeping SQL, rows, bookmarks, and credentials out of published artifacts — survives asinspectKeysinmanaged-d1-contract.ts.Verification:
make verify-localpasses locally — build, drift, 128 root tests, candidate, types, Miniflare (33), example worker (5).Untouched: the eight-layer verification pyramid and managed-D1 verification, both still wired into CI and the release gate.
🤖 Generated with Claude Code