build(vendor): pin hellgraph + sovereign-vendor contract (campaign gap #7) - #319
Merged
Conversation
…act (campaign gap #7) The OS build now asserts its consumed System Graph dependency is vendored, not floating: vendor/hellgraph.lock.json pins hellgraph v0.4.45 (MIT, dbe854f) with a sha512 integrity hash; tools/verify_vendor.py recomputes the deterministic git-archive hash; tests/sovereign-vendor-contract.nix (wired into flake checks) fails the build if the pin is missing/malformed. hellgraph consumed vendored, never forked. Verified: verifier exit 0; drv evaluates; flake checks list includes the contract.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OS build now asserts its consumed dependencies are vendored, not floating — the last-mile hardening toward a sovereign, reproducible build (feature-gaps-zero #267 gap #7).
vendor/hellgraph.lock.json— pins hellgraphv0.4.45(dbe854f, MIT) with a sha512 integrity hash of the deterministicgit archivetar. hellgraph is the System Graph substrate netwatch ingests into and the surface feeds read — consumed vendored, never forked (not our lane to modify).tools/verify_vendor.py— validates lock shape always; recomputes + matches the hash when a checkout is provided.tests/sovereign-vendor-contract.nix— a fast grep+verifierrunCommand, wired into flakechecks, that fails the build if the pin is missing or malformed.Verified locally:
verify_vendor.py --checkout ~/dev/hellgraphrecomputes and matches the pinned sha512; the derivation evaluates (nix eval …drvPath) and appears innix eval .#checks.x86_64-linux. The sandbox build runs on CI's Linux builders (no local Linux builder here).