wit: pin nexum:host to crate-local wit-deps - #481
Conversation
…t-deps manifest The runtime bindgen and every L1 fixture module already resolve wit/nexum-host inside the nexum group; check in an empty wit/deps.toml plus its lock to pin the leaf, and teach the zero-leak gate to fail if either ever declares a dependency.
lgahdl
left a comment
lgahdl
left a comment
There was a problem hiding this comment.
Small and correct. Checked the new check-5 regex (^\s*[^#[:space:]]) against both files: deps.toml's comment-only line starts with # immediately so it's correctly excluded (pass), and the empty deps.lock blob correctly produces no match (pass, ripgrep exits 1 on empty input). A real future dependency entry (a [dependencies] header or a key = value line, with or without leading whitespace) would correctly match and fail, since neither starts with #. No polarity/stale-pattern bug like the ones in this script's earlier checks. Approving.
|
Closing this stale M5 carve stack (2026-07-21/23) per owner decision. The three-grouping workspace and dep-sync gate landed independently on main (#636 + carve-groups); the WIT flip and remaining carve steps are being redone fresh on current main. |
2 participants
What
Adds a crate-local
wit-depsmanifest (wit/deps.toml+wit/deps.lock) fornexum:host, kept empty since the package is a leaf. Extends the zero-leak gate to fail if the manifest ever declares a dependency.Why
S2a of the split:
bindgen!must resolve WIT crate-locally, not via a workspace-ancestor walk, beforenexum-runtimecan be carved out as L1. An empty, locked manifest proves and pins the leaf property ahead of the cut.Testing
scripts/check-venue-agnostic.sh(new check 5: manifest/lock presence + emptiness)cargo check --workspace --all-featuresAI Assistance
Drafted with Claude Code; reviewed and tested by mfw78.
Closes #404