Preserve DevTools package contract in release and PR snapshots - #1456
Closed
schickling-assistant wants to merge 2 commits into
Closed
Preserve DevTools package contract in release and PR snapshots#1456schickling-assistant wants to merge 2 commits into
schickling-assistant wants to merge 2 commits into
Conversation
schickling-assistant
added
bug
Contributor
PR preview
Report historyPR 1456 · 2026-07-25 16:38 UTC
PR 1456 · 2026-07-19 15:39 UTC
PR 1456 · 2026-07-18 13:24 UTC
|
schickling-assistant
added
type:bug
schickling
marked this pull request as ready for review
July 19, 2026 15:12
schickling-assistant
changed the title
schickling-assistant
enabled auto-merge (squash)
July 19, 2026 15:13
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f3640a2945
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
schickling-assistant
disabled auto-merge
July 19, 2026 15:21
schickling-assistant
added
area:tooling
schickling-assistant
force-pushed
the
schickling-assistant/fix/devtools-artifact-peer-deps
branch
from
July 25, 2026 16:13
f3640a2 to
e6daa04
Compare
This was referenced Jul 25, 2026
Collaborator
Author
|
Superseded by the DevTools source-available migration — tracked in epic #1497. The external-artifact machinery this PR extends is retired once Posted on behalf of @schickling
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The DevTools artifact repacker discarded the verified artifact's peer contract: it moved Vite and LiveStore core packages into runtime dependencies and widened Vite to
*. Separately, trusted PR snapshots packed only the 14 workspace-owned packages, so@livestore/devtools-vitecould not be installed at the exact snapshot version used by downstream integration tests.Goal
Preserve the artifact-owned host compatibility contract, exact-pin its LiveStore peers, and publish DevTools as part of the same immutable 15-package trusted PR snapshot cohort.
Decisions
@livestore/adapter-weband@livestore/utils; bind those two peers to the exact target version.@parcel/watcherpackage as a runtime dependency and fail closed if it is absent.snapshotPackageNamestopology.Verification
node --test .github/scripts/pr-snapshot-artifact.test.mjs: 13/13 passed, including negative DevTools peer/runtime-boundary cases and generated workflow/topology checks.vitest run scripts/src/commands/devtools-artifact.test.ts: 15/15 passed for snapshot and release manifest rewrites.devenv tasks run check:quick --no-tui --show-output: passed after merging currentmain, including TypeScript, formatting, oxlint, Genie, lockfile, source-policy, and megarepo checks.release:snapshot:pack:git-shaproof: packed 15 packages as0.0.0-snapshot-pr.1447.1d789fbcaaef68b2fef50936410a578e18d164b2; trusted manifest creation accepted all 15.f9ced6987ddbbec23b4c194ce72f80073ea8f9fcd7665e06f34f98885b79b04b.@parcel/watcher@^2.5.0in runtime dependencies, exact snapshot peers for adapter-web/utils, and the artifact's unchangedvite@^8.0.16peer range. Embedded release metadata bound it to builddt-20260718-51c22febwithci-snapshotcertification.No package was published during local verification.
Complexity
The release topology now distinguishes workspace-published packages from externally repacked snapshot packages. The distinction is necessary because DevTools is built in a separate artifact pipeline but must participate in the same immutable npm cohort.
Concerns
The checked-in artifact currently declares Vite 8 only. This PR deliberately preserves that source contract; a refreshed artifact must widen the source peer range before Vite 7 consumers can install the cohort.
The trusted topology change must merge before any PR head expecting a 15-package candidate can be promoted. Older 14-package candidates remain valid only against the older trusted topology digest.
Friction & bottlenecks
The real snapshot proof takes about two minutes because it rebuilds and packs the complete release group. No persistent product bottleneck was introduced.
Follow-ups
References
Closes #1454.
Related: #1458.
No changeset or changelog entry: this changes repository-local release tooling and does not itself publish or alter a package version.
Posted on behalf of @schickling
agent_nameagent_session_idagent_toolagent_tool_versionagent_runtimeagent_modelruntime_profileskills_manifestworktreemachinetooling_profile