Skip to content

Eight specs print a pin-verification command with literal <commit>/<path> placeholders, so it cannot be run #32

Description

@phoenix-server

Eight specs tell the implementer how to verify a dependency pin, and the command they print cannot be run:

pin with `curl -s https://raw.githubusercontent.com/cameri/schematics/<commit>/<path> | sha256sum`

<commit> and <path> are literal placeholders. Nothing in any of the eight packages says where to get them, and the format forbids unspecified literals everywhere else: every environment-specific value must be a parameter with a discovery method. An implementer who copies this line gets a 404, and an agent asked to verify a pin has to reverse-engineer the intent from the pin's own link.

Affected: fetch-movies-over-usenet, fetch-music-over-usenet, fetch-series-over-usenet, improve-docker-security, run-a-book-library, run-a-movies-and-series-library, run-a-music-library, run-an-llm-router — one occurrence each, all in the Decisions and Open Questions entry that introduces the pin convention. No occurrences in any modules/.

This is the same class as #26's A-3 and #21's A-7: a verification step that cannot run is worse than a missing one, because the implementer keeps trying.

Proposed

Print a runnable example instead — the sha and the path taken from the pin's own link, which is the pin directly above the sentence — and say in one clause where they come from. Then the recipe works as pasted, and it still teaches the substitution for every other row of the table.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions