From 7ce512cf9464ef03702d662b807eaa6d0bd8444c Mon Sep 17 00:00:00 2001 From: "marcin p. joachimiak" <4625870+realmarcin@users.noreply.github.com> Date: Tue, 21 Jul 2026 20:19:45 -0700 Subject: [PATCH] Re-converge drift check on CultureMech hub; extend to mech_shared; retire schema-pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TraitMech's check_vendored_sync.sh had diverged to a claw-local-checkout variant that SKIPS (exit 0) when no culturebotai-claw checkout is present — i.e. it enforced NOTHING in CI, silently. Since claw is private, public CI can never fetch from it, so that design can't enforce. Restore the enforcing hub-fetch design used by the other spokes and fold in the schema module: - check_vendored_sync.sh: replace with the canonical CultureMech-fetch version (byte-identical to MIM/CommunityMech) + the src/*/schema/mech_shared.yaml path-mapped entry. Now diffs 6 files against the public hub and fails on drift. - .vendored_canon_ref: reset from the claw commit (1ad5d408) back to the CultureMech canon commit (6be694f3), matching the other spokes. - Retire verify-/refresh-schema-pin + SHARED_SCHEMA_MODULE; delete src/traitmech/schema/.mech_shared.sha256. Verified: check now reports "OK: all 6 vendored files match ...@6be694f3". Co-Authored-By: Claude Opus 4.8 --- justfile | 27 ++---- scripts/.vendored_canon_ref | 2 +- scripts/check_vendored_sync.sh | 108 +++++++++++------------ src/traitmech/schema/.mech_shared.sha256 | 1 - 4 files changed, 62 insertions(+), 76 deletions(-) delete mode 100644 src/traitmech/schema/.mech_shared.sha256 diff --git a/justfile b/justfile index 6111b10e..c1d48c8a 100644 --- a/justfile +++ b/justfile @@ -223,26 +223,13 @@ research-provider provider: # Composite: refresh METPO → seed → build embeddings → render pages. gen-site: seed-apply build-embeddings gen-pages -# Durability guard for the shared LinkML module (Discussion + Dataset), vendored -# byte-identical across the Mech repos — see culturebotai-claw#7. -SHARED_SCHEMA_MODULE := "src/traitmech/schema/mech_shared.yaml" -verify-schema-pin: - #!/usr/bin/env bash - set -euo pipefail - if command -v sha256sum >/dev/null 2>&1; then - sha256sum -c src/traitmech/schema/.mech_shared.sha256 - else - shasum -a 256 -c src/traitmech/schema/.mech_shared.sha256 - fi - -# Intentional sync only: re-pin after a deliberate, all-repos byte-identical update. -refresh-schema-pin: - #!/usr/bin/env bash - set -euo pipefail - f={{SHARED_SCHEMA_MODULE}} - if command -v sha256sum >/dev/null 2>&1; then h=$(sha256sum "$f" | cut -d' ' -f1); else h=$(shasum -a 256 "$f" | cut -d' ' -f1); fi - printf '%s %s\n' "$h" "$f" > src/traitmech/schema/.mech_shared.sha256 - echo "re-pinned $f to $h" +# NOTE: the shared LinkML module (mech_shared.yaml) is vendored byte-identical +# across the Mech repos (package-namespaced path per repo). Its self-generated +# sha256 pin (verify-/refresh-schema-pin) was retired — same self-referential +# flaw as the id-label pin. It is now covered by the shared-reference drift check +# (scripts/check_vendored_sync.sh diffs src/*/schema/mech_shared.yaml against the +# hub's copy at CultureBotAI/CultureMech@) plus the +# hub's nightly vendored-fleet-audit.yml. # Run tests with coverage test: diff --git a/scripts/.vendored_canon_ref b/scripts/.vendored_canon_ref index 5908f354..42852a1a 100644 --- a/scripts/.vendored_canon_ref +++ b/scripts/.vendored_canon_ref @@ -1 +1 @@ -1ad5d4088bd460f069d797a6ef0ff910e7eada1a +6be694f3d6308ac0f4c2e0dcf196e2ff73f6468f diff --git a/scripts/check_vendored_sync.sh b/scripts/check_vendored_sync.sh index 57085c10..10bc4b5c 100755 --- a/scripts/check_vendored_sync.sh +++ b/scripts/check_vendored_sync.sh @@ -1,24 +1,24 @@ #!/usr/bin/env bash -# Drift check for the vendored byte-identical id↔label files. +# Drift check for vendored byte-identical files (hub-and-spoke model). # -# Canonical source: culturebotai-claw, shared/idlabel/. claw is private, so -# rather than a network fetch this diffs against a LOCAL sibling checkout of -# claw. A Mech that edits its vendored copy fails this check because the -# reference lives in another repo. +# THE FIX for the self-referential-pin blind spot: instead of hashing a file +# against a hash generated FROM THE SAME REPO, this fetches the authoritative +# copy from the canonical hub at a pinned commit and diffs. A repo that edits +# its vendored copy now fails CI, because the reference lives elsewhere. # -# Resolution order for the claw checkout: -# 1. $CLAW_ROOT (if set) — must contain shared/idlabel/ -# 2. the usual sibling locations (../culturebotai-claw, ../../…) so this works -# from a flat Mech (TraitMech/) and a nested one (CommunityMech/CommunityMech/) -# -# If no claw checkout is found (e.g. a CI runner without it), the check SKIPS -# and exits 0 — enforcement is LOCAL, for anyone doing cross-Mech work with the -# sibling checkout. It is NOT enforced in CI while claw is private. Making claw -# public again lets this revert to a pinned raw-fetch that CI can run. -# -# Dependency-free: bash + diff only. +# The hub is the PUBLIC CultureBotAI/CultureMech (culturebotai-claw is private, +# so public Mech CI cannot fetch raw content from it). Dependency-free: bash + +# curl + diff only (no uv/OAK), so it runs as a fast blocking CI job before any +# heavy setup. The pinned canonical commit lives in scripts/.vendored_canon_ref; +# the file list is embedded (this script is itself vendored byte-identical across +# the spokes). Bump .vendored_canon_ref in the same PR that syncs a changed file +# from the hub — that bump is the deliberate propagation act. set -euo pipefail +CANON_REPO="CultureBotAI/CultureMech" +REF_FILE="scripts/.vendored_canon_ref" + +# Same-path vendored files: identical relative path in the hub and here. FILES=( scripts/validate_id_label_correspondence.py scripts/chem_formula.py @@ -27,54 +27,54 @@ FILES=( tests/test_id_label_plausibility.py ) -# Locate the canonical claw checkout. -canon_dir="" -if [ -n "${CLAW_ROOT:-}" ] && [ -d "${CLAW_ROOT}/shared/idlabel" ]; then - canon_dir="${CLAW_ROOT}/shared/idlabel" -else - for cand in ../culturebotai-claw ../../culturebotai-claw ../../../culturebotai-claw; do - if [ -d "$cand/shared/idlabel" ]; then canon_dir="$cand/shared/idlabel"; break; fi - done -fi +# Package-namespaced shared files: same bytes, but the local path is namespaced +# by this repo's package while the hub's is culturemech. Format "local_glob|hub". +MAPPED=( + "src/*/schema/mech_shared.yaml|src/culturemech/schema/mech_shared.yaml" +) -if [ -z "$canon_dir" ]; then - echo "SKIP: culturebotai-claw checkout not found (set CLAW_ROOT to its path)." - echo " Cross-repo vendored-drift is NOT enforced here (claw is private)." - echo " Run locally alongside a claw checkout to enforce." - exit 0 -fi - -# If the checkout is a git repo, report which claw commit we're comparing to, -# and warn (do not fail) when it differs from the recorded ref. -ref_note="" -if command -v git >/dev/null 2>&1 && git -C "$canon_dir" rev-parse HEAD >/dev/null 2>&1; then - head="$(git -C "$canon_dir" rev-parse --short HEAD)" - ref_note=" (claw@${head})" - if [ -f scripts/.vendored_canon_ref ]; then - want="$(tr -d '[:space:]' < scripts/.vendored_canon_ref)" - have="$(git -C "$canon_dir" rev-parse HEAD)" - if [ -n "$want" ] && [ "$want" != "$have" ]; then - echo "NOTE: local claw is at ${have:0:8}, .vendored_canon_ref pins ${want:0:8}." - echo " Comparing against the local checkout; 'git -C checkout ${want:0:8}' to match the pin." - fi - fi -fi +[ -f "$REF_FILE" ] || { echo "ERROR: $REF_FILE missing (pinned canonical commit)"; exit 2; } +REF="$(tr -d '[:space:]' < "$REF_FILE")" +[ -n "$REF" ] || { echo "ERROR: $REF_FILE is empty"; exit 2; } +tmp="$(mktemp)" +trap 'rm -f "$tmp"' EXIT fail=0 +checked=0 for f in "${FILES[@]}"; do [ -f "$f" ] || { echo "MISSING: $f not present locally"; fail=1; continue; } - canon="$canon_dir/$f" - [ -f "$canon" ] || { echo "ERROR: canonical $canon missing in claw checkout"; fail=1; continue; } - if ! cmp -s "$canon" "$f"; then - echo "DRIFT: $f differs from claw canonical$ref_note"; fail=1 + url="https://raw.githubusercontent.com/${CANON_REPO}/${REF}/${f}" + if ! curl -fsSL "$url" -o "$tmp"; then + echo "ERROR: could not fetch $f from ${CANON_REPO}@${REF:0:8} ($url)"; fail=1; continue + fi + # byte-exact comparison (temp file preserves the trailing newline that $() would strip) + if ! cmp -s "$tmp" "$f"; then + echo "DRIFT: $f differs from ${CANON_REPO}@${REF:0:8}"; fail=1 + fi + checked=$((checked + 1)) +done + +# Path-mapped files: resolve the single local match via glob, diff the hub copy. +for entry in "${MAPPED[@]}"; do + glob="${entry%%|*}"; hubf="${entry#*|}" + local="" + for cand in $glob; do [ -f "$cand" ] && local="$cand" && break; done + if [ -z "$local" ]; then echo "MISSING: no local file matching $glob"; fail=1; continue; fi + url="https://raw.githubusercontent.com/${CANON_REPO}/${REF}/${hubf}" + if ! curl -fsSL "$url" -o "$tmp"; then + echo "ERROR: could not fetch $hubf from ${CANON_REPO}@${REF:0:8} ($url)"; fail=1; continue + fi + if ! cmp -s "$tmp" "$local"; then + echo "DRIFT: $local differs from ${CANON_REPO}@${REF:0:8}:$hubf"; fail=1 fi + checked=$((checked + 1)) done if [ "$fail" -eq 0 ]; then - echo "OK: all ${#FILES[@]} vendored files match claw canonical$ref_note" + echo "OK: all ${checked} vendored files match ${CANON_REPO}@${REF:0:8}" else echo "" - echo "To resolve: copy the canonical files from ${canon_dir}/, and if claw" - echo "intentionally changed them, bump scripts/.vendored_canon_ref to the new claw commit." + echo "To resolve: copy the canonical files from ${CANON_REPO}@${REF:0:8}, and if the" + echo "hub intentionally changed them, bump ${REF_FILE} to the new hub commit." exit 1 fi diff --git a/src/traitmech/schema/.mech_shared.sha256 b/src/traitmech/schema/.mech_shared.sha256 deleted file mode 100644 index e633a915..00000000 --- a/src/traitmech/schema/.mech_shared.sha256 +++ /dev/null @@ -1 +0,0 @@ -1a5e21eb2ee9f3584ff6af3a6906b1d442e18c41de405b1bf907c20f44eafa2a src/traitmech/schema/mech_shared.yaml