fix: cognitive-stack OGAR deps path -> git; ndarray left path (real hazard found) - #1021
Conversation
…azard found) Same escaping-path shape as lance-graph-ogar before PR #1019: ogar-vocab/ ogar-ontology/ogar-adapter-surrealql all path-depped OGAR crates via ../../../OGAR/crates/..., unresolvable for any external git consumer. Switched to git deps at the exact same URL+branch as lance-graph-ogar's own pin (also a dependency of this crate), so Cargo unifies both into one resolved OGAR source. Safe because lance-graph has no OGAR dependency at all - nothing else in the graph could bring in a competing source. ndarray was deliberately NOT switched. A first attempt was, and directly demonstrated why not: lance-graph (path-depped here) has its own escaping path dep on ndarray behind its default ndarray-hpc feature, unfixed. Switching cognitive-stack's own ndarray dep to git while lance-graph's stayed path produced two distinct ndarray v0.17.2 package instances in one build (visible in cargo check's package list, plus a duplicated fractal sub-crate) - a real type-identity hazard, since Cargo treats path and git sources as different identities even at the same version. It compiled anyway, which is the trap: a clean cargo check does not prove dependency source unification. Reverted before this commit. The real fix is upstream and out of scope here: lance-graph's own ndarray-hpc feature (in its default set) still path-deps ndarray the same escaping way, making the main crate itself latently exposed to the same break lance-graph-ogar had, for any external consumer that ever enables that feature. Flagged in the board entry, not fixed - a bigger change than this follow-up's scope. Verified: cargo check -p cognitive-stack green (4m52s clean build).
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_d754538d-03c9-420c-b8cb-bfb9988a9a71) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ccf7a59de9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # inconsistency. Fixing that properly means fixing lance-graph's own | ||
| # `ndarray-hpc` feature's path dep (`crates/lance-graph/Cargo.toml`) — out | ||
| # of scope here; flagged, not silently worked around. | ||
| ogar-vocab = { git = "https://github.com/AdaWorldAPI/OGAR", branch = "main" } |
There was a problem hiding this comment.
When cognitive-stack is consumed as a Git dependency—the scenario this change is intended to fix—Cargo still fails while loading its manifest because the unconditional ndarray = { path = "../../../ndarray" } dependency on line 53 resolves outside the fetched lance-graph checkout. Switching only the OGAR dependencies therefore cannot make any external Git consumer build; the ndarray dependency (including lance-graph's copy) must first be moved to a source that exists inside or is fetchable from that checkout.
Useful? React with 👍 / 👎.
2 participants
Follow-up to #1019
crates/cognitive-stackcarried the identical escaping-path shape aslance-graph-ogarbefore #1019 —ogar-vocab/ogar-ontology/ogar-adapter-surrealqlallpath = "../../../OGAR/crates/...", from thesame 2026-07-07 "NO-PIN" policy note that also covered
symbiont(confirmed out of scope — deprecated in favor of the kanban +
ogar-locostack).
Fix
Switched to
git = "https://github.com/AdaWorldAPI/OGAR", branch = "main"— identical URL+branch to
lance-graph-ogar's own pin (also a dependencyof this crate), so Cargo unifies both into ONE resolved OGAR source.
Verified: both resolve to the same rev (
719471db), andcargo check -p cognitive-stackis clean (4m52s build).Safe specifically because
lance-graph(also path-dep'd here) has noOGAR dependency at all — nothing else in the graph could bring in a
competing OGAR source.
ndarraydeliberately left aspath— a real hazard found, not an oversightA first attempt switched
cognitive-stack's ownndarraydep togittoo. That directly demonstrated why not to:
lance-graph(path-dep'dhere) has its own escaping path dep on
ndarraybehind its defaultndarray-hpcfeature, unfixed. Switching onlycognitive-stack's directdep produced two distinct
ndarray v0.17.2package instances in onebuild — visible directly in
cargo check's package list(
git...?rev=0129b5c8...alongside a newgit...#80f0b01f), with thefractalsub-crate duplicated the same way. Cargo treats path and gitsources as different identities even at the same version — a real
type-identity hazard if any code path ever passes a value between the two
instances, not a naming inconsistency. It compiled anyway (Rust
tolerates multiple crate instances until a signature unifies them
directly) — the trap: a clean
cargo checkdoes not prove dependencysource unification. Reverted before this commit;
ndarraystayspath.The real fix is upstream, out of scope here:
lance-graph's ownndarray-hpcfeature (in its default feature set) still path-depsndarraythe same escaping way — meaning the mainlance-graphcrateitself is latently exposed to the identical break
lance-graph-ogarhad,for any external consumer that ever enables that feature. Currently
dormant (no observed consumer has needed it — MedCare-rs's break was
specifically about
ogar-loco, an unconditional dependency). Flagged inthe board entry, not fixed — a bigger, more sensitive change than this
follow-up's scope.
Board hygiene
EPIPHANIES.md— follow-up entry toE-GIT-SOURCED-CRATE-CANNOT-PATH-DEP-OUTSIDE-ITS-REPO-1.🤖 Generated with Claude Code
Generated by Claude Code