openspec: archive automate-version-pins, sync main specs - #41
Merged
Conversation
stefanwb
approved these changes
Sep 1, 2026
27/28 tasks complete; the one open item (8.1, independent hash cross-checks via release attestations) is explicitly deferred to its own dedicated follow-up, matching this repo's convention for archiving with a deliberately out-of-scope item left unchecked. package-managers and version-pin-refresh had drifted since this change's delta was authored: task-pin-reminder archived first and added 3 requirements to version-pin-refresh, so the capability's own sync created the main spec file with only those 3 — the 9 foundational requirements this change defines (soak-aware resolution, per-arch hashing, fragment storage, build consumption, operator report, override, failure safety, re-verification, no runtime deps) were never synced. package-managers' uv requirement was still describing the pre-migration Dockerfile ARG pinning, months after the Dockerfile moved to pins/uv.env. The uv delta itself needed a fix before `openspec archive` would accept it: its MODIFIED block dropped the existing "version bumps require sha256 bumps in the same commit" scenario, which the archive tool refuses to silently drop. Reworded it to reference pins/uv.env instead of the retired ARGs (the underlying guarantee — sha256sum -c fails a build where the two drift apart — still holds under the new mechanism) and kept it alongside the new generation-coupling scenario the delta already added. No Dockerfile/run.sh/README.md changes — this is archiving + spec sync only.
dtump
force-pushed
the
archive/automate-version-pins
branch
from
September 1, 2026 07:52
9336c54 to
c0bf101
Compare
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Archives
automate-version-pins(27/28 tasks complete — 8.1, independent hash cross-checks via release attestations, is explicitly deferred to its own dedicated follow-up, matching the convention already used for e.g.container-git-config-overlay) and syncs its deltas intoopenspec/specs/.This closes a real drift, not just housekeeping:
task-pin-reminderarchived first and added 3 requirements toversion-pin-refresh, so that capability's sync created the main spec file with only those 3 — the 9 foundational requirements this change defines (soak-aware resolution, per-arch hashing, fragment storage, build consumption, operator report, override, failure safety, re-verification, no runtime deps) had never been synced. Separately,package-managers' uv requirement was still describing the pre-migration DockerfileARGpinning, months after the Dockerfile moved topins/uv.env.Delta fix required before archiving
openspec archiverefused the change until itspackage-managersdelta was fixed: theMODIFIEDblock for "uv binary pinned and sha256-verified" dropped the existing "version bumps require sha256 bumps in the same commit" scenario, which the archive tool refuses to silently drop from aMODIFIEDrequirement. Reworded that scenario to referencepins/uv.envinstead of the retiredARGs — the underlying guarantee (sha256sum -cfails a build where version and hash drift apart) still holds under the new mechanism — and kept it alongside the new generation-coupling scenario the delta already added.No
Dockerfile/run.sh/README.mdchanges — archiving + spec sync only.Test plan
openspec validate automate-version-pins --strictpasses (after the scenario fix)openspec validate --specs --strict— all 10 main specs pass post-syncopenspec validate --all --changes— 12/12 pass (both remaining open changes,add-claude-docker-openspecandschedule-pin-refresh, unaffected)cli-help/spec.md) to confirm the MD013/MD012 findings are this repo's existing spec-file convention, not something introduced here