release: contextgraph crates 0.1.2, publish contextgraph-trace, restore record.rs to the published types crate - #74
Merged
Conversation
…graph-trace Supersedes 0.1.1, which was published from a tree predating this repo's history re-root and therefore corresponds to no commit on main. The visible consequence: contextgraph-types 0.1.0 and 0.1.1 both shipped without src/record.rs, so the whole ContextRecord lifecycle vocabulary was declared in lib.rs on main but missing from the published crate. 0.1.2 is cut from main and contains it. Also flips contextgraph-trace to publish = true. It was documented as deliberately unpublished, which did not stop anyone depending on it -- it only forced stella to pin the entire workspace by git rev to reach the trace vocabulary (stella#819). The crate stays sketch stage: not part of contextgraph/1.0, wire format may change in any 0.x, gate on TRACE_FORMAT.
There was a problem hiding this comment.
Sorry @macanderson, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
Reviewer's GuideRelease 0.1.2 of the Context Graph Protocol workspace crates: bump workspace version, formally publish contextgraph-trace with docs and metadata, and ensure contextgraph-types is published from main with its previously-missing record.rs lifecycle vocabulary, with changelog updates reflecting the release and stability caveats. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
macanderson
added a commit
to macanderson/stella
that referenced
this pull request
Aug 1, 2026
…819) (#1156) Closes #819. `stella-context`, `stella-graph`, and `stella-cli` took `contextgraph-types`, `-host`, `-trace`, and `-conformance` as git dependencies pinned by commit rev — **six lines repeated across three manifests**. ## The pin was worse than the issue described The rev it named, `c5fb2fec`, was on **no branch and no PR** in the protocol repository. It was reachable only by raw SHA and eligible for garbage collection — one cold cargo cache away from breaking every build, including CI's. It was also on a history line that repository had **re-rooted away from**: `git merge-base origin/main c5fb2fec` returns nothing. `context-graph-protocol` has two roots, and stella was pinned to the abandoned one. And a git rev is invisible to `cargo audit` / `cargo vet`, and carries no checksum in `Cargo.lock`. ## Why this needed an upstream fix first Two of the four crates could not simply be re-pointed at the published 0.1.0: - `contextgraph-host` and `contextgraph-conformance` had **diverged** from 0.1.0 (composition conformance, C7 exported as public API), so 0.1.0 would not compile against this code. - `contextgraph-trace` had **never been published** — `publish = false`, documented as "deliberately NOT published… sketch stage". `stella-cli/src/arena.rs` uses `EventBody`, `TraceEvent`, `Journal`, `run_oracles`, and `ToolStatus` from it, so it could not be inlined away. Fixed upstream in **[context-graph-protocol#74](macanderson/context-graph-protocol#74 (all checks green): 0.1.2 is cut from that repo's `main`, `contextgraph-trace` is published for the first time, and `contextgraph-types` once again ships `src/record.rs` — the `ContextRecord` lifecycle vocabulary that 0.1.0 silently omitted because it too was published from the abandoned line. 0.1.1 was a mistake made while diagnosing that and is **yanked**. ## What changed here - The four crates are declared **once** in `[workspace.dependencies]` at `=0.1.2`; members write `contextgraph-types.workspace = true`. The next bump is a one-line edit instead of six — that scattering is how these drifted onto a rev in the first place. - **Exact `=` requirements, not caret.** `contextgraph-trace` is sketch stage and exempt from the protocol's stability promise; its journal wire format may change in any `0.x`, and `stella arena` writes that format to disk. Gate behaviour on its `TRACE_FORMAT` constant, not on the version. - **`deny.toml`'s `allow-git` exemption is removed** — its own comment scoped it to "until they are published to crates.io." Left as an explicit empty list rather than deleted, so re-introducing a git source is a visible edit to that file and not a silent append to an existing exemption. That exemption is precisely what let the pin drift somewhere unreachable. ## Verification - `make gate` — **exit 0** (fmt, clippy `-D warnings`, full workspace tests, rustdoc, file-size, invariants, licence parity, shellcheck, action pins). - `cargo deny check sources` — **exit 0** with `allow-git = []`, proving the workspace has no git dependencies left at all. - `Cargo.lock` shows all four as `registry+https://github.com/rust-lang/crates.io-index` at `0.1.2`, each now carrying a checksum; `rg 'git\+.*context-graph-protocol' Cargo.lock` returns nothing. - No Rust source files were touched — the diff is manifests, lockfile, `deny.toml`, and a changelog entry. ## Note for the reviewer `contextgraph-types` 0.1.2 **adds** `record.rs`, which the old git rev did not have. It is purely additive and nothing broke, but stella now has CGP's record types in scope alongside its own `record_hash` work — worth a look before building anything new in that area. ## Summary by Sourcery Switch Context Graph Protocol dependencies from pinned git revisions to crates.io registry releases and centralize their version management in the workspace manifest. Enhancements: - Centralize declaration of `contextgraph-types`, `contextgraph-host`, `contextgraph-trace`, and `contextgraph-conformance` in `[workspace.dependencies]` with an exact `=0.1.2` version to avoid drift and simplify future bumps. - Update member crates (`stella-cli`, `stella-context`, `stella-graph`) to consume Context Graph Protocol crates via workspace dependencies instead of direct git sources. - Document the dependency change and auditability improvements in the changelog for the unreleased version. Build: - Ensure all Context Graph Protocol crates are pulled from crates.io with checksummed lockfile entries, eliminating the previous reliance on an unreachable git commit rev. CI: - Tighten `cargo-deny` configuration by clearing the `allow-git` list, so any future git dependency becomes a visible, audited change rather than relying on a lingering exemption. Co-authored-by: Stella Test <ops@oxagen.sh>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cut so stella can depend on these crates by version instead of by git rev (stella#819).
What this fixes
1.
contextgraph-typeswas published withoutrecord.rsThis repository's history was re-rooted at some point:
main(root1990edd1) and the older line (rootf77cca5c) share no common ancestor.contextgraph-types0.1.0 was published from the older line, which does not containcontextgraph-types/src/record.rs.main'slib.rsdeclarespub mod record;and re-exportsContextRecord,RecordBody,RecordProvenance,RecordAttestation,RecordLink,RecordScope,RecordStatus,ContractRequirement,DirectiveKind,Enforcement,KnowledgeKind,OriginClass,RequirementResult,SharingScope,ValidationOutcome,ConstraintEffect, andLIFECYCLE_SCHEMA_VERSION— 758 lines of public lifecycle vocabulary that has never existed in a published crate. 0.1.2 is cut frommainand ships it.2.
contextgraph-tracewas unpublishedIt was
publish = false, documented as "deliberately NOT published… publication is an open question recorded in the sketch." This PR answers that question yes.Leaving it unpublished did not stop anyone depending on it. It only forced its one downstream — stella's
stella arena, which usesEventBody,TraceEvent,Journal,run_oracles, andToolStatus— to pin the entire workspace by raw SHA to reach it.The crate remains sketch stage, and the Cargo.toml, crate docs, README, and changelog all say so: it implements
docs/sketches/host-trace.md, is not part of thecontextgraph/1.0surface, and its journal wire format may change in any0.xrelease. Gate onTRACE_FORMAT, not on the crate version. A published crate with an honest instability caveat is a smaller supply-chain risk than an unpublished one consumed by commit hash.Registry state
contextgraph-typescontextgraph-hostcontextgraph-conformancecontextgraph-trace0.1.1 was a mistake and is yanked. It was published from the pre-re-root line before that divergence was diagnosed, so it corresponds to no commit on
main, and itscontextgraph-typeshad the same missingrecord.rs. Nothing should depend on it. 0.1.2, in this PR, is the version cut frommain.Reversible with
cargo unyankif you disagree.Do not push a
contextgraph-v*tag for this version —release.ymltriggers on it and would attempt a duplicate publish, which crates.io rejects.Also on the remote
feat/host-selfcert-and-c7-preflightwas pushed as a separate branch. Its tipc5fb2fecis the commit stella currently pins, and it was on no branch and no PR — reachable only by raw SHA and eligible for garbage collection, which would have broken stella's build for everyone with a cold cargo cache. Pushing it made it reachable. Its crate-source content turns out to already be onmain(contextgraph-hostandcontextgraph-conformanceare byte-identical between the two), so it needs no merge; it can be deleted once stella is off the rev pin.release/cgp-0.1.1is the superseded orphan-history attempt and can be deleted.Verification
cargo test -p contextgraph-types -p contextgraph-host -p contextgraph-trace -p contextgraph-conformanceon this branch — exit 0.cargo publish --dry-runfor all four — exit 0.cargo package --list -p contextgraph-typesconfirmssrc/record.rsis in the package..DS_Store/ env / credential / key files — clean.Summary by Sourcery
Release version 0.1.2 of the Context Graph Protocol crates from main, including publishing contextgraph-trace and correcting the contents of contextgraph-types.
New Features:
Bug Fixes:
Enhancements:
Documentation: