Phase 2: shared-reference vendored-file drift check#176
Merged
Conversation
… drift check The per-repo sha256 pin compared each vendored file against a hash generated FROM THE SAME REPO, so all four Mech repos passed `verify` while holding divergent copies — a local echo, not a shared source of truth. This swaps it for a check against the canonical hub (CultureMech) at a pinned commit (scripts/.vendored_canon_ref): scripts/check_vendored_sync.sh fetches each vendored file from raw.githubusercontent at that ref and diffs the local copy, failing CI on any drift. The reference now lives in another repo, so an edit to a local vendored copy is detected. Kept as a fast, dependency-free CI job (bash + curl, no uv/OAK) so it blocks early. Bump scripts/.vendored_canon_ref in the same PR that syncs a changed file from the hub — that bump is the deliberate propagation act. The check already earned its keep: it caught test_id_label_plausibility.py diverging across the fleet (hydrate-separator cases synced to chem_formula.py but not its tests), which the self-pin never saw. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR replaces the previous self-referential sha256 “pin” check with a shared-reference drift check that compares vendored files against canonical copies in CultureMech at a pinned commit, and wires that check into CI.
Changes:
- Add
scripts/check_vendored_sync.shto fetch canonical copies fromraw.githubusercontent.com/CultureBotAI/CultureMech/<ref>/...and byte-compare with local vendored files. - Add
scripts/.vendored_canon_refto pin the canonical hub commit used for comparisons. - Update
.github/workflows/label-correspondence.yamlto run the new drift check as a fast, dependency-free blocking job.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| scripts/check_vendored_sync.sh | New bash-based drift checker that fetches canonical files and compares them locally. |
| scripts/.vendored_canon_ref | Pins the CultureMech commit SHA used as the canonical reference. |
| .github/workflows/label-correspondence.yaml | Replaces the old sha256 verification step with the new vendored-sync drift check job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
31
to
+35
| # Cross-repo durability guard: the validator is vendored byte-identical across | ||
| # the Mech repos, so fail fast if this copy drifts from its pinned sha256. | ||
| # Fast and dependency-free (no uv / OAK), so it blocks even though the drift | ||
| # report below is non-blocking. | ||
| validator-pin: | ||
| vendored-sync: |
Comment on lines
+9
to
+13
| # Dependency-free: bash + curl + diff only (no uv/OAK), so it runs as a fast | ||
| # blocking CI job before any heavy setup. The pinned canonical commit lives in | ||
| # scripts/.vendored_canon_ref; the file list is embedded (this script is itself | ||
| # vendored byte-identical across the spokes). Bump .vendored_canon_ref in the | ||
| # same PR that syncs a changed file from the hub — that bump is the deliberate |
Comment on lines
+28
to
+31
| [ -f "$REF_FILE" ] || { echo "ERROR: $REF_FILE missing (pinned canonical commit)"; exit 2; } | ||
| REF="$(tr -d '[:space:]' < "$REF_FILE")" | ||
| [ -n "$REF" ] || { echo "ERROR: $REF_FILE is empty"; exit 2; } | ||
|
|
Comment on lines
+37
to
+40
| url="https://raw.githubusercontent.com/${CANON_REPO}/${REF}/${f}" | ||
| if ! curl -fsSL "$url" -o "$tmp"; then | ||
| echo "ERROR: could not fetch $f from ${CANON_REPO}@${REF:0:8} ($url)"; fail=1; continue | ||
| fi |
realmarcin
added a commit
that referenced
this pull request
Jul 22, 2026
…#179) The `vendored-sync` CI job (scripts/check_vendored_sync.sh, shared-reference diff against CultureBotAI/CultureMech@<.vendored_canon_ref>, merged in #176) has replaced the self-generated sha256 pin, which could only compare a copy to a hash from the same repo — so all four repos could pass verify-validator-pin while diverged. Remove the redundant second mechanism: - delete verify-/refresh-validator-pin recipes + VENDORED_IDLABEL_FILES manifest - delete scripts/.validate_id_label_correspondence.sha256 - fix a stale "validator-pin job below" CI comment + reword the vendored-sync guard comment (no longer a self-pinned sha256) - refresh NEXT_TASKS + the next-tasks skill note (keep the out-flow caveat: TraitMech has originated cross-repo validator fixes before) schema-pin is a separate vendored set with no drift-check replacement — kept. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces the self-referential sha256 pin with a shared-reference drift check
against the canonical hub (CultureMech) at a pinned commit.
scripts/check_vendored_sync.shfetches each vendored file fromraw.githubusercontent.com/CultureBotAI/CultureMech/<scripts/.vendored_canon_ref>and diffs the local copy, failing CI on drift. Because the reference lives in
another repo, an edit to a local vendored copy is now detected — the old pin
compared a file to a hash generated from the same repo, so all four repos passed
verifywhile diverged.Kept as a fast dependency-free CI job (bash + curl, no uv/OAK). Bump
scripts/.vendored_canon_refin the same PR that syncs a changed file from thehub.
The check already caught a real drift the self-pin missed:
test_id_label_plausibility.pyhad diverged (hydrate-separator cases synced tochem_formula.pybut not its tests).🤖 Generated with Claude Code