Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

feat: the public @ekklesia package release train, built, reproduced, and proven (ADR 0053)
CI / verify (pull_request) Successful in 1m2s
Details
CI / infrastructure-smoke (pull_request) Successful in 35s
Details
CI / migration-smoke (pull_request) Successful in 1m52s
Details
CI / package-release (pull_request) Failing after 16s
Details
CI / image-build (pull_request) Successful in 29s
Details
CI / deploy-smoke (same-origin) (pull_request) Successful in 44s
Details
CI / deploy-smoke (split) (pull_request) Successful in 1m29s
Details

Browse Source 
Produces the exact public package tarballs of a platform release, validates
them, and proves a standalone module consumes those artifacts end to end.
Nothing is published and no credential is configured.

- scripts/package-release.ts (pnpm packages:release) is the canonical
  release builder: from a clean commit it rebuilds the nine public
  packages from clean output, packs each, inspects every tarball, checks
  the release set and coordinated versions, and only then writes
  ekklesia-packages-<version>/ with the tarballs, SHA256SUMS, and a
  provider-neutral manifest (ekklesia-package-train.json: version,
  revision, and each package's file, size, SHA-256, npm integrity).
- Packing uses a pack-only pnpm beforePacking hook (passed with
  --config.pnpmfile, never the workspace's install settings). pnpm inserts
  rewritten workspace: dependencies in async completion order, so two
  checkouts of one commit packed module-pack's package.json with keys in a
  different order; the hook restores the source key order (and the
  inspection enforces it). It also drops devDependencies, which named
  private packages outside the train.
- scripts/test-package-release.sh (pnpm test:package-release, the CI
  package-release gate) builds the train twice, the second time from a
  separate worktree, requires byte-identical release directories, then
  runs the standalone consumer proof on the release: manifest checked,
  offline install from the tarballs only, lockfile integrity equal to the
  manifest's, frozen-lockfile reinstall, no Drizzle, one React, contracts
  only transitive, every @ekklesia package and module-pack at the release
  version, skipLibCheck: false, UI build, pack, and Core verification.
- docs/development/releases.md documents the release order, the train,
  the artifacts, and the reproducibility findings; registry publication
  remains unimplemented.
- ADR 0053 is Accepted: everything it decides that does not need a
  registry is now proven, and registry provisioning is on its own
  Deferred list.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
ekklesia
2026-10-08 08:02:41 -05:00
co-authored by Claude Opus 5.5
parent 7ea2d7883f
commit 9debe4e891
17 changed files with 1253 additions and 370 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/module-development/README.md
+5 -4
View File
@@ -157,10 +157,11 @@ Packaging and verification work exactly as for a module in this repository
their identity, not by where they are installed, so they are recorded under `incorporates` and never
credited as third-party software, wherever they came from.
Ekklesia proves this before any release: `pnpm packages:pack` builds, packs, and inspects the public
packages, and `bash scripts/test-standalone-module.sh` installs them into a module outside the
repository (`tests/fixtures/standalone-module`), with no workspace link and no Ekklesia registry,
then typechecks, builds, packages, and verifies it.
Ekklesia proves this on every CI run: `pnpm test:package-release` builds the public packages of a
release as one train of tarballs, proves two builds identical, and installs exactly those tarballs
into a module outside the repository (`tests/fixtures/standalone-module`), with no workspace link
and no registry, then typechecks, builds, packages, and verifies it. Those artifacts are what a
future publication step publishes ([Releases and the public package train](../development/releases.md)).
### An installed module is self-contained