fix(deps): consume the Context Graph Protocol crates from crates.io (#819) - #1156
Merged
Conversation
…819) stella-context, stella-graph, and stella-cli took contextgraph-types, -host, -trace, and -conformance as git dependencies pinned by commit rev, repeated across six lines in three manifests. The pin was worse than the issue described. The rev it named -- c5fb2fec -- lived on a history line the protocol repository had since re-rooted away from: it was on no branch and no PR upstream, reachable only by raw SHA, and eligible for garbage collection. A cold cargo cache away from breaking every build, and invisible to cargo audit / cargo vet, which cannot see a git source. Two of the four crates could not simply be re-pointed at the published 0.1.0: -host and -conformance had diverged from it, and -trace had never been published at all. Fixed upstream first (context-graph-protocol#74): 0.1.2 is cut from that repo's main, -trace is published, and contextgraph-types once again ships src/record.rs, which 0.1.0 silently omitted. Here, the four crates are declared ONCE in [workspace.dependencies] at =0.1.2, so the next bump is a one-line edit rather than six. Exact requirements because contextgraph-trace is sketch stage -- a silent minor bump would change a wire format stella arena writes to disk. Also removes deny.toml's allow-git exemption, whose own comment scoped it to 'until they are published to crates.io'. The workspace now has no vetted git sources; cargo deny check sources passes with an empty allow-list.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Reviewer's GuideThis PR replaces fragile git-based dependencies on the Context Graph Protocol crates with pinned crates.io registry versions and centralizes their declaration in the workspace, while tightening supply-chain policy ( File-Level Changes
Assessment against linked issues
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Additional Suggestion:
Migrating contextgraph-* crates off a git rev makes check-normative-home.sh derive an empty cargo_rev, so the drift guard unconditionally hits its skip branch and becomes a permanent no-op, leaving stale @ c5fb2fe doc pins unverified.
…registry-deps # Conflicts: # CHANGELOG.md
macanderson
marked this pull request as ready for review
August 1, 2026 18:16
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Sorry @macanderson, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
This was referenced Aug 2, 2026
macanderson
added a commit
that referenced
this pull request
Aug 2, 2026
…laration (#878) (#1191) ## Summary #878 asked for the four `contextgraph-*` git-rev pins — then scattered across `stella-cli`, `stella-context`, and `stella-graph` — to be centralized so a version bump touches one file. Investigation on this branch confirmed **#1156 already resolved the issue** by moving the crates to crates.io and declaring them once in the root `[workspace.dependencies]`, with members opting in via `.workspace = true`. What was missing is a guard: nothing stopped a future PR from re-introducing a per-member `version`/`git` pin and silently re-creating the multi-manifest drift #878 documented. This PR adds that guard. ## What changed One new file: `stella-cli/tests/cgp_deps_centralized.rs` — a witness test that parses the real manifests and `Cargo.lock`: 1. **`cgp_crates_declared_once_in_workspace_root`** — all four CGP crates are declared in the root `[workspace.dependencies]` as registry versions, never a `git` source. 2. **`no_member_manifest_repeats_the_cgp_version`** — scans every workspace member manifest; fails if any declares a CGP crate with its own `version`/`git` instead of `workspace = true`. 3. **`lockfile_sources_cgp_crates_from_the_registry`** — every CGP entry in `Cargo.lock` has a `registry+` source and all four are present. The test hard-codes no version string, so future bumps never touch it. ## Verification - **Witness check**: temporarily restoring a per-member pin (`contextgraph-types = "=0.1.2"` in `stella-graph/Cargo.toml`) fails test 2 with the offending manifest named; restored after. - `cargo test -p stella-cli`: **1106 passed, 0 failed** (includes the 3 new tests). - `cargo clippy -p stella-cli --tests`: zero warnings. - `cargo fmt --check`: clean. - `cargo check --workspace`: all 20 crates resolve (the issue's explicit acceptance criterion). ## Note on the push Pushed with `SKIP_GATE=1` because the pre-push `wire-schema` gate fails identically on the base commit `0d1f3ebf` (plain main) — `docs/wire/agentevent.*` and `docs/wire/serveframe.*` are stale relative to the current `AgentEvent` docs. That is a pre-existing main breakage unrelated to this test-only change; verified by running `make wire-schema` on a detached checkout of the base. Closes #878 ## Summary by Sourcery Add regression tests to enforce centralized workspace declarations and registry sourcing for contextgraph-* dependencies, preventing reintroduction of per-crate pins and git sources. Tests: - Introduce a manifest-parsing test that ensures all contextgraph-* crates are declared only once in root [workspace.dependencies] and never as git dependencies. - Add a workspace member manifest check that fails if any member declares its own version or git source for contextgraph-* instead of using workspace = true. - Add a Cargo.lock check that verifies all contextgraph-* crates are present and sourced from the crates.io registry. Co-authored-by: Stella Test <test@stella.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #819.
stella-context,stella-graph, andstella-clitookcontextgraph-types,-host,-trace, and-conformanceas git dependencies pinned by commit rev — six lines repeated across three manifests.The pin was worse than the issue described
The rev it named,
c5fb2fec, was on no branch and no PR in the protocol repository. It was reachable only by raw SHA and eligible for garbage collection — one cold cargo cache away from breaking every build, including CI's.It was also on a history line that repository had re-rooted away from:
git merge-base origin/main c5fb2fecreturns nothing.context-graph-protocolhas two roots, and stella was pinned to the abandoned one.And a git rev is invisible to
cargo audit/cargo vet, and carries no checksum inCargo.lock.Why this needed an upstream fix first
Two of the four crates could not simply be re-pointed at the published 0.1.0:
contextgraph-hostandcontextgraph-conformancehad diverged from 0.1.0 (composition conformance, C7 exported as public API), so 0.1.0 would not compile against this code.contextgraph-tracehad never been published —publish = false, documented as "deliberately NOT published… sketch stage".stella-cli/src/arena.rsusesEventBody,TraceEvent,Journal,run_oracles, andToolStatusfrom it, so it could not be inlined away.Fixed upstream in context-graph-protocol#74 (all checks green): 0.1.2 is cut from that repo's
main,contextgraph-traceis published for the first time, andcontextgraph-typesonce again shipssrc/record.rs— theContextRecordlifecycle vocabulary that 0.1.0 silently omitted because it too was published from the abandoned line. 0.1.1 was a mistake made while diagnosing that and is yanked.What changed here
[workspace.dependencies]at=0.1.2; members writecontextgraph-types.workspace = true. The next bump is a one-line edit instead of six — that scattering is how these drifted onto a rev in the first place.=requirements, not caret.contextgraph-traceis sketch stage and exempt from the protocol's stability promise; its journal wire format may change in any0.x, andstella arenawrites that format to disk. Gate behaviour on itsTRACE_FORMATconstant, not on the version.deny.toml'sallow-gitexemption is removed — its own comment scoped it to "until they are published to crates.io." Left as an explicit empty list rather than deleted, so re-introducing a git source is a visible edit to that file and not a silent append to an existing exemption. That exemption is precisely what let the pin drift somewhere unreachable.Verification
make gate— exit 0 (fmt, clippy-D warnings, full workspace tests, rustdoc, file-size, invariants, licence parity, shellcheck, action pins).cargo deny check sources— exit 0 withallow-git = [], proving the workspace has no git dependencies left at all.Cargo.lockshows all four asregistry+https://github.com/rust-lang/crates.io-indexat0.1.2, each now carrying a checksum;rg 'git\+.*context-graph-protocol' Cargo.lockreturns nothing.deny.toml, and a changelog entry.Note for the reviewer
contextgraph-types0.1.2 addsrecord.rs, which the old git rev did not have. It is purely additive and nothing broke, but stella now has CGP's record types in scope alongside its ownrecord_hashwork — worth a look before building anything new in that area.Summary by Sourcery
Switch Context Graph Protocol dependencies from pinned git revisions to crates.io registry releases and centralize their version management in the workspace manifest.
Enhancements:
contextgraph-types,contextgraph-host,contextgraph-trace, andcontextgraph-conformancein[workspace.dependencies]with an exact=0.1.2version to avoid drift and simplify future bumps.stella-cli,stella-context,stella-graph) to consume Context Graph Protocol crates via workspace dependencies instead of direct git sources.Build:
CI:
cargo-denyconfiguration by clearing theallow-gitlist, so any future git dependency becomes a visible, audited change rather than relying on a lingering exemption.