Skip to content

feat(registry)!: re-mint ten placeholder UUIDs as UUIDv8 and re-register (ADR 0002) - #107

Merged
hyperpolymath merged 3 commits into
mainfrom
fix/uuid-v8-remint
Oct 9, 2026
Merged

hyperpolymath merged 3 commits into
mainfrom
fix/uuid-v8-remint

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Oct 9, 2026 •

Copy link
Copy Markdown
Owner

Summary

Ten packages in this registry were registered under hand-typed placeholder UUIDs, runs of consecutive hex such as d5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b. This PR removes each old binding and the versions under it, then registers the package again under a fresh UUIDv8 (ADR-008 profile T) at a patch bump.

It also removes InvestigativeJournalist 0.1.0 and registers its renamed upstream, InvestigativeJournalism 0.1.1, as a new package. The old entry's Deps.toml binds the retired Causals and ZeroProb UUIDs.

This is a UUID/name binding change, so per docs/REGISTRY-POLICY.adoc it carries an ADR (docs/decisions/0002-uuidv8-remint-and-reregistration.adoc), needs BDFL review, and must not auto-merge. Automerge is not armed.

The owner's rulings:

  • D320, 2026-10-07: UUIDv8 is strict estate-wide.
  • 2026-10-08: re-mint and re-register at a patch bump, under profile T.
  • 2026-10-09: InvestigativeJournalist becomes a new registration; SMTLib is fixed first and keeps 0.2.1.

Note

Merged 2026-10-09T00:24:48Z as e8383fb (signed by web-flow). Its tree, fbbd8f01, is the tree of head b1563013, the head this body describes. This body was updated after the merge; at merge time it still described the earlier head cf67a95.

The merge order held. Both upstream PRs merged first, and each squash commit's root tree is exactly the tree registered here:

  • hyperpolymath/SMTLib.jl#48 merged at 00:23:53Z as 487c7ab4, tree 05a805f3…;
  • hyperpolymath/InvestigativeJournalism.jl#78 merged at 00:24:24Z as 2cc30882, tree 6e624d20….

The other nine trees were already on their default branches.

Checked after merge on main 991a5b7 (this PR plus #110):

  • ci/validate.jl gives rc=0: 41 packages, 0 custom errors.
  • Pkg.add of all 11 packages into a fresh depot that holds only General and main: 11/11, each at its registered UUID, version and tree, fetched from upstream.

#109 (Marid Tier-1) merged before this PR. main 7c52894 was merged into this branch at b1563013, keeping both the re-minted LowLevel binding and the nine Marid entries. No Marid Deps.toml names a retired UUID.

Changes

  • Removed: the old UUID binding, and its version, for each of:
    • HardwareResilience, SiliconCore, ZeroProb, QuantumCircuit, ShellIntegration, FirmwareAudit, ViperPkg and LowLevel (0.1.0);
    • Causals and SMTLib (0.2.0);
    • InvestigativeJournalist (0.1.0).
  • Re-registered under a fresh v8 UUID:
    • the first eight at 0.1.1;
    • Causals and SMTLib at 0.2.1.
  • Added: InvestigativeJournalism 0.1.1 (01a11de2-b9d3-80b4-b616-640df22918c0) at I/InvestigativeJournalism.
  • Dependents rebound:
    • LowLevel → the new HardwareResilience and SiliconCore UUIDs;
    • InvestigativeJournalism → the new Causals and ZeroProb UUIDs.
  • ViperPkg repo → https://github.com/hyperpolymath/jtv-lang.git (subdir viper-pkg). The old julia-the-viper name redirects there.
  • Generator. Every entry comes from RegistryTools v2.4.3, Registrator's library (update_package_file, update_versions_file, check_deps!/update_deps_file, check_compat!/update_compat_file), fed the Project.toml at the registered commit. SMTLib declares nine placeholder weak deps (11111111-… to 99999999-…) that name no package; they are left out of its WeakDeps.toml. No other input was filtered.
  • Docs:
    • ADR 0002, which holds the full old→new UUID, version and tree table; it also records what each new version carries since the previously registered one. Per package that is 88 to 219 files, mostly CI and docs scaffolding; no exported name is removed, and Causals adds three;
    • CHANGELOG.adoc [Unreleased]: Added / Changed (marked breaking) / Removed;
    • README.adoc: the 11 version cells.

📌 New pins

  • Head SHA: b15630137b1d915d42fd1b4013c33089d959e73c. It is a signed merge of main 7c52894 into cf67a95; this branch's own commits, 3eff90f and cf67a95, are signed too.
  • Action pins: no action uses:, actions.lock or container digest changes; no workflow file is touched.
  • Registered trees: the ADR 0002 table. The one that waits on an upstream PR is InvestigativeJournalism 6e624d2077ca172390591328e5faaf894c2b0d21 (InvestigativeJournalism.jl#78). SMTLib 05a805f35b2b6f235e0d0585c58d594a3f2b219e is now on SMTLib.jl main as squash 487c7ab4.

RSR Quality Checklist

Required

  • No banned language patterns: the PR changes only TOML and AsciiDoc. The generator and e2e scripts were Julia, run from scratch space, and are not committed.
  • SPDX license headers on new files: the ADR has CC-BY-SA-4.0.
    • Generated package TOMLs follow the existing convention: on main, 1 of the 47 touched package TOMLs carries a header, and here 1 of 51 does. The one existing header is kept and no new ones are invented, matching Registrator's output.
  • No secrets, credentials or .env files.
  • CI is green: not entirely. The one required context, scan / gitleaks, passes, and so does validate (this repo's registry check) along with 22 other checks. Three non-required checks are red, and each is equally red on main at 9e4dc83 and at 7c52894, so this PR did not cause them. They are deferred below. Codeac analyze results is a legacy status that has not reported.

Deferred checks (§5c)

As Applicable — Registry Changes

  • Registry.toml index updated: 11 entries rebound, IJ-ist→IJ-ism. With feat(registry): register the nine Marid Tier-1 packages at v0.1.0 (D321/D322) #109's nine Marid entries from main, 41 entries, as on main.
  • Per-package TOMLs consistent: ci/validate.jl custom layers report 0 errors and 0 warnings. Two planted positives prove the check can fail (Testing below).
  • Upstream package meets the quality bar in GOVERNANCE.adoc: GOVERNANCE.adoc states no quality bar to tick against (MAINTAINERS.adoc:26 says "SPDX, REUSE, OpenSSF baseline"). Known upstream test debt is disclosed in ADR 0002 and tracked upstream:
    • HardwareResilience.jl#42;
    • SMTLib.jl#47;
    • SiliconCore: a double-include ambiguity on Julia 1.12 only;
    • ShellIntegration: test failures identical on main.
  • Upstream tag exists and matches the registered version: not yet. The tags (v0.1.1, v0.2.1, and ViperPkg-v0.1.1 in jtv-lang) are cut at the registered commits after this merges, as ADR 0002 records.

As Applicable — Documentation / Infra Changes

  • .machine_readable/6a2/*.a2ml: N/A. A2ML is retired estate-wide (D99/D269c), so no .a2ml file is created or edited.
  • TOPOLOGY.md: N/A. No architectural change.
  • Changelog updated. This repo's file is CHANGELOG.adoc.
  • Wiki updated: not yet. Packages.md on the wiki still lists the old versions and the InvestigativeJournalist name. It is edited after merge, so it never advertises versions the registry does not serve.

Testing

All runs used a local depot whose registries/ held General (6d0d42953fb) plus a copy of this branch. That is the same thing Pkg.Registry.add produces; in Julia:

# JULIA_DEPOT_PATH=$D JULIA_PKG_SERVER="" julia
# $D/registries/General                    = General clone
# $D/registries/JuliaProfessionalRegistry  = this branch (git archive)
using Pkg
Pkg.activate(mktempdir()); Pkg.add("HardwareResilience")   # …each of the 11

Rows marked (b156301) were re-run on this head after main was merged in. The rest were measured at cf67a95. The merge brought in #109's nine Marid packages and its Layer 2b change, and touched none of the 11 entries those rows test.

Check Result
RegistryCI v11.0.0 RegistryCI.test with registry_deps = [General], Julia 1.10.10 (b156301) 695/695 pass, 41 packages (main 7c52894: 692/692). Before the merge: 553/553 (main: 550/550)
ci/validate.jl default mode, Julia 1.10.10 (b156301) rc=0, 41 packages, custom checks 0 errors / 0 warnings, 0 owner mismatches. Layer 1 shows 673 pass / 22 fail. The 22 are the packages whose deps live in General, the documented expected_general_gap, and two of them are #109's MaridCodec and MaridTransport. The set is identical to main 7c52894's (670 / 22) apart from InvestigativeJournalist→InvestigativeJournalism
Planted positive A: old HardwareResilience UUID put back in L/LowLevel/Deps.toml rc=1. Layer 2a: dependency "HardwareResilience" has uuid d5f6a7b8… but Registry.toml binds … 01a11d29-d880…
Planted positive B: old SiliconCore UUID put back in its Package.toml rc=1. SiliconCore: Registry.toml uuid 01a11d29-d88c-… != Package.toml uuid c4e5f6a7-…
Retired-UUID grep (the 11 old UUIDs) over Registry.toml + [A-Z]/*/*.toml (b156301) main 7c52894: 26 hits in 14 files. This branch: 0. Only the ADR and CHANGELOG name them
End to end, Julia 1.10.10: Pkg.add of each of the 11 into a fresh env (b156301) 11/11 ADD-OK, each at its new UUID, version and ADR tree; SMTLib resolves to 05a805f3, its merged squash tree
End to end, Julia 1.12.6, same script 11/11 ADD-OK, same UUIDs, versions and trees
InvestigativeJournalism 0.1.1 Pkg.test() against this branch, Julia 1.10.10 Pass, 0 failures: 174/174 (InvestigativeJournalism.jl), 28/28 (E2E Pipeline), 870/870 (Property-Based). The tested tree is 6e624d20, InvestigativeJournalism.jl#78's head ea0faa0, which its Causals 0.2.1 and ZeroProb 0.1.1 dependencies resolve from this registry
Generator re-run over its own output idempotent: diff -r is empty

🤖 Generated with Claude Code

https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX

…ter (ADR 0002)

Ten packages were registered under hand-typed placeholder UUIDs. Remove
each old binding and the versions under it, and register the package
again under a fresh UUIDv8 (ADR-008 profile T) at a patch bump:
HardwareResilience, SiliconCore, ZeroProb, QuantumCircuit,
ShellIntegration, FirmwareAudit, ViperPkg and LowLevel at 0.1.1;
Causals and SMTLib at 0.2.1.

Remove InvestigativeJournalist 0.1.0, whose Deps bind the retired
Causals and ZeroProb UUIDs. Register InvestigativeJournalism 0.1.1, the
renamed upstream, as a new package.

Every new entry is generated with RegistryTools v2.4.3 from the
Project.toml at the registered commit. SMTLib's nine placeholder weak
dependencies are left out of its WeakDeps.toml. ViperPkg's repo URL
moves to hyperpolymath/jtv-lang.

BREAKING CHANGE: a Manifest that pins one of the eleven retired UUIDs no
longer resolves against this registry. Run Pkg.rm and then Pkg.add of
the same name; InvestigativeJournalist users add InvestigativeJournalism.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX
@coderabbitai

coderabbitai Bot commented Oct 9, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 80e73722-0c3f-45a2-9dc1-03b4128aa91f
📥 Commits

Reviewing files that changed from the base of the PR and between 7c52894 and b156301.

📒 Files selected for processing (57)
  • C/Causals/Compat.toml
  • C/Causals/Deps.toml
  • C/Causals/Package.toml
  • C/Causals/Versions.toml
  • C/Causals/WeakCompat.toml
  • C/Causals/WeakDeps.toml
  • CHANGELOG.adoc
  • F/FirmwareAudit/Compat.toml
  • F/FirmwareAudit/Deps.toml
  • F/FirmwareAudit/Package.toml
  • F/FirmwareAudit/Versions.toml
  • H/HardwareResilience/Compat.toml
  • H/HardwareResilience/Deps.toml
  • H/HardwareResilience/Package.toml
  • H/HardwareResilience/Versions.toml
  • I/InvestigativeJournalism/Compat.toml
  • I/InvestigativeJournalism/Deps.toml
  • I/InvestigativeJournalism/Package.toml
  • I/InvestigativeJournalism/Versions.toml
  • I/InvestigativeJournalist/Package.toml
  • I/InvestigativeJournalist/Versions.toml
  • L/LowLevel/Compat.toml
  • L/LowLevel/Deps.toml
  • L/LowLevel/Package.toml
  • L/LowLevel/Versions.toml
  • Q/QuantumCircuit/Compat.toml
  • Q/QuantumCircuit/Deps.toml
  • Q/QuantumCircuit/Package.toml
  • Q/QuantumCircuit/Versions.toml
  • Q/QuantumCircuit/WeakCompat.toml
  • Q/QuantumCircuit/WeakDeps.toml
  • README.adoc
  • Registry.toml
  • S/SMTLib/Compat.toml
  • S/SMTLib/Deps.toml
  • S/SMTLib/Package.toml
  • S/SMTLib/Versions.toml
  • S/SMTLib/WeakDeps.toml
  • S/ShellIntegration/Compat.toml
  • S/ShellIntegration/Deps.toml
  • S/ShellIntegration/Package.toml
  • S/ShellIntegration/Versions.toml
  • S/SiliconCore/Compat.toml
  • S/SiliconCore/Deps.toml
  • S/SiliconCore/Package.toml
  • S/SiliconCore/Versions.toml
  • V/ViperPkg/Compat.toml
  • V/ViperPkg/Deps.toml
  • V/ViperPkg/Package.toml
  • V/ViperPkg/Versions.toml
  • Z/ZeroProb/Compat.toml
  • Z/ZeroProb/Deps.toml
  • Z/ZeroProb/Package.toml
  • Z/ZeroProb/Versions.toml
  • Z/ZeroProb/WeakCompat.toml
  • Z/ZeroProb/WeakDeps.toml
  • docs/decisions/0002-uuidv8-remint-and-reregistration.adoc
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Each new version registers the default-branch tree, not the old tree
under a new UUID, so it carries every change merged since the previously
registered version. Record the measured drift: 88-219 files per package,
mostly CI and docs scaffolding; Julia source changes small; no exported
name removed, three added in Causals; non-Julia src/abi scaffold dropped
in four packages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX
hyperpolymath added a commit that referenced this pull request Oct 9, 2026
…21/D322) (#109)

<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
## Summary

This PR registers the nine Marid Tier-1 packages at **v0.1.0** (owner
rulings D321/D322). Their source is the `metadatastician/marid`
monorepo, and each is registered by `subdir = "packages/<Pkg>"` at
commit `fd139f763a306a7e2eca60d96ea1a1a9f77c1e71`. That commit is the
UUIDv8 profile-T re-mint, merged as metadatastician/marid#78.

Packages: MaridArango, MaridCodec, MaridControl, MaridCRDT, MaridIR,
MaridLive, MaridRaft, MaridStorage, MaridTransport.

The PR also widens `ci/validate.jl` Layer 2b. Marid lives under the
`metadatastician` organisation, and the unpatched validator rejects all
nine packages with an owner mismatch.

This registry is the only target. Nothing here is aimed at
JuliaRegistries/General.

## Merge order: this PR is a draft until both conditions hold

1. **The nine `<Pkg>-v0.1.0` tags exist at `fd139f7`.** They are
owner-signed. The `MaridIR-v0.1.0` canary goes first, because
`release.yml` has never run before.
2. **#107 (UUIDv8 re-mint of ten placeholder UUIDs) has merged.** Both
PRs edit `Registry.toml` and `CHANGELOG.adoc`. A trial merge (`git
merge-tree` of #107's head `cf67a95e` with this branch) conflicts in
both files. Once #107 lands, I will:
- merge `main` into this branch (no rebase, so the signed commit
survives);
   - resolve the two files;
   - re-run the validator;
   - update the head SHA below.

## Type of change

- [x] Registry change (new packages)
- [x] CI change (validator owner allow-list)
- [x] Docs (README package table, CHANGELOG, REGISTRY-POLICY)

## 📌 New pins

- **PR head SHA: `c7f9f64b6aec27412a8d7f76488480f57a3b7cad`**
- **Upstream commit: `fd139f763a306a7e2eca60d96ea1a1a9f77c1e71`**
(metadatastician/marid `main`, #78)
- `git-tree-sha1` per package. Each one equals `git rev-parse
fd139f7:packages/<Pkg>`, checked one by one:

| Package | UUID (v8) | git-tree-sha1 |
|---|---|---|
| MaridArango | `01a115ae-6523-8273-8497-753822252d6a` |
**`5c71ca32eb207776d2dda2969570e8c640bfae14`** |
| MaridCodec | `01a115b0-6977-8194-b1bb-ba277a2ddf75` |
**`122522a80a17e8165d3e0230bcb3196b4b32c7e9`** |
| MaridControl | `01a115b1-6b89-8bc1-b693-306d1d0301d5` |
**`0ef98fceb85a30faa4e7e64a88c23094dfa68948`** |
| MaridCRDT | `01a115af-6777-83e7-bbf4-4312fe84fb45` |
**`432bf84d4b482e84b5a9f0afa6e271e522bdd252`** |
| MaridIR | `01a115b4-723a-8911-b469-7c18b764c41a` |
**`4c76daa8e4ac08d02db18688557e2341b867e1e4`** |
| MaridLive | `01a115b5-7479-8d82-a0d2-d2a681675e27` |
**`367e0e315aa1ab0b767fae6dadbecbd25a21e6a9`** |
| MaridRaft | `01a115b8-7a8a-8f24-baaa-cf06974b0145` |
**`e1e8405aeb1cb5742ee346dbc74c56c7e936baef`** |
| MaridStorage | `01a115b9-7cf4-8463-9dfb-224e0c6ab613` |
**`1177666f911e55c25bfdf3058ea5a49144f8c5d3`** |
| MaridTransport | `01a115ba-7f33-8545-9989-732142b76ec2` |
**`e7ba55688bd13c422628f70f2ba921a4e769d21b`** |

The PR adds or changes no action `uses:` lines and no `actions.lock`
entries, lockfiles or container digests.

## Changes

- `M/<Pkg>/{Package,Versions,Compat,Deps}.toml` for the nine packages.
These are LocalRegistry 0.5.7 output, unchanged. It was run in a
throwaway clone because LocalRegistry refuses a worktree.
- `Registry.toml`: **+9 lines only**, inserted by hand between
`LowLevel` and `PRComms`.
- **Disclosure:** LocalRegistry rewrites the whole `[packages]` table
sorted by UUID. I discarded that rewrite so the diff shows only the nine
new entries.
- The next LocalRegistry run on `main` will therefore produce the
re-sort as unrelated churn. That churn is expected and is not a defect.
- `ci/validate.jl` Layer 2b:
- Adds `ALLOWED_PACKAGE_OWNERS = ("hyperpolymath", "metadatastician")`
and a documented `allowed_package_owner(slug)`. A package's
`Package.toml` `repo` may now be owned by either.
  - The registry's own `repo` must still be `hyperpolymath/…`.
- Also fixes a misplaced docstring: the `check_repo_slug!` docstring sat
on `extract_github_slug`. Each function now has its own, confirmed with
`Docs.doc`.
- `docs/REGISTRY-POLICY.adoc`:
  - The Layer 2b paragraph now names both owners.
- The stale "across all 37 packages currently registered" now reads
"every package registered in `Registry.toml`". The base had 32 packages,
and this PR makes 41.
- `README.adoc` package table and `CHANGELOG.adoc` `[Unreleased]`
updated.

## RSR Quality Checklist

### Required

- [x] No banned language patterns. The PR adds only TOML, Julia and
AsciiDoc; no JS, TS, Python or Go.
- [x] SPDX headers on new or modified source files.
- The modified files (`ci/validate.jl`, both `.adoc` files) keep their
headers.
- The new `M/Marid*/*.toml` files carry none, which matches 29 of the 32
existing package dirs. Registry TOML is generated data, so I did not add
headers by hand.
- [x] No secrets, credentials or `.env` files.
- [ ] CI is green. Not yet run: CI starts when this PR opens. I will
update this box from the real rollup.

### As Applicable — Registry Changes

- [x] `Registry.toml` index updated (+9).
- [x] Per-package TOMLs are consistent. Layer 2a found 0 name↔UUID
errors, and every tree hash matches upstream (see above).
- [x] Upstream meets the GOVERNANCE quality bar.
- Each `packages/<Pkg>` has its own `LICENSE`, which marid's
`release.yml` checks per subdir.
- `[compat]` is upper-bounded for every dep and weakdep (marid#22/D68
gate).
  - The UUIDs are the v8 profile-T re-mint.
- [ ] Upstream tag exists and matches. **Not yet.** The tags
`<Pkg>-v0.1.0` at `fd139f7` are owner-signed (EstateTagging `creation`
rule; GITHUB_TOKEN cannot create tags). They are to be pushed **before
this PR merges**, and I will tick this box once `git ls-remote --tags`
shows all nine.

### As Applicable — Documentation / Infra Changes

- [ ] `.machine_readable/6a2/*.a2ml`: n/a. A2ML is retired estate-wide
(D308), so these boxes are not applicable and no `.a2ml` was created.
- [ ] `TOPOLOGY.md`: n/a, the architecture is unchanged.
- [x] CHANGELOG updated. This repo's changelog is `CHANGELOG.adoc`; the
template's `.md` name is stale.
- [ ] Wiki: not updated in this PR. The Packages wiki page needs the
nine rows added; that is an owner wiki edit.

## Testing

**1. Validator, Julia 1.10.10 (the CI version), this branch:**
```
julia --project=<env: LocalRegistry 0.5.7, RegistryCI 11.0.0> ci/validate.jl <worktree>
rc=0
Layer 1 (RegistryCI, informational): 670 passed, 22 failed
Layer 2b: Checked repo field on 41 package Package.toml files (0 owner mismatches)
Custom-check errors: 0 — VALIDATION PASSED (custom checks)
```

**2. Same validator, base `9e4dc83`:** rc=0, Layer 1 530 passed / 20
failed, 32 packages, 0 mismatches.

- Every Layer 1 failure on both sides is `depuuids ⊆ alluuids`. That is
the known gap for packages that depend on General.
- This PR adds exactly **2** of them: MaridCodec depends on JSON3, and
MaridTransport depends on HTTP. Layer 1 does not gate the exit code.

**3. Controls proving Layer 2b is live (not vacuous):**
- **Mutant:** MaridIR `repo` set to `evilcorp/marid` gives rc=1 with
`MaridIR: Package.toml repo resolves to slug "evilcorp/marid", expected
an owner in ("hyperpolymath", "metadatastician")`.
- **Unpatched validator** (base `ci/validate.jl`) on this tree gives
rc=1 with 9 owner mismatches. So the validator change is necessary, not
cosmetic.

**4. End-to-end install** (fresh depot, Julia 1.10.10, clone of this
branch at `c7f9f64`):
```julia
using Pkg
Pkg.Registry.add("General")
Pkg.Registry.add(Pkg.RegistrySpec(url = "<clone of feat/marid-tier1>"))
P = ["MaridIR", "MaridCodec", "MaridControl", "MaridCRDT", "MaridLive",
     "MaridRaft", "MaridStorage", "MaridTransport", "MaridArango"]
Pkg.add(P)
for p in P; @eval using $(Symbol(p)); println("LOADED ", p); end
```
Result: rc=0. **All nine** resolve at v0.1.0 (`[01a115ae]` …
`[01a115ba]`), precompile, and load (9 × `LOADED`). The General deps
come from General: JSON3 for MaridCodec, and HTTP v1.11.0 for
MaridTransport.


---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01WPSJ7fBhVAMcpSffCBWUDo
https://claude.ai/code/session_013omQK26s4uDjJMkdqNEvEG

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Registry.toml: keep this branch's re-minted LowLevel binding
(01a11d29-d884-…) and main's nine Marid entries.
CHANGELOG.adoc [Unreleased] Added: keep both sides' entries.

Validated on the merged tree: ci/validate.jl rc=0, 41 packages, custom
checks 0 errors / 0 warnings; Layer 1's failure set equals main
7c52894's apart from InvestigativeJournalist -> InvestigativeJournalism.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX
@sonarqubecloud

sonarqubecloud Bot commented Oct 9, 2026

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit e8383fb into main Oct 9, 2026
24 of 28 checks passed
@hyperpolymath
hyperpolymath deleted the fix/uuid-v8-remint branch October 9, 2026 00:24
hyperpolymath added a commit that referenced this pull request Oct 9, 2026
…003 (#110)

<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
## Summary

#109 registered the nine Marid Tier-1 packages and, in the same change,
widened `ci/validate.jl` Layer 2b so a package `repo` may be owned by
`hyperpolymath` **or** `metadatastician`. It carried no ADR. This PR
adds that ADR. It records the decision #109 implemented and makes one
rule explicit: the set of allowed owners is **closed**, so adding an
organisation takes another ADR.

It contains **no code change**. `ci/validate.jl` differs from `main`
only in the comment on `ALLOWED_PACKAGE_OWNERS`.

On 2026-10-09 the owner ruled that the metadatastician widening be
recorded in its own PR with ADR 0003. This PR was opened before #109
merged, with its own implementation. When #109 landed first, I merged
`main` in, kept main's code (`EXPECTED_SLUG_OWNER`,
`ALLOWED_PACKAGE_OWNERS`, `allowed_package_owner`) and dropped my
parallel constants. What remains is the record.

It changes registry policy text, so it needs BDFL review. **Automerge is
not armed.**

> [!NOTE]
> **Merge order:** none. `git merge-tree` of this head against #107's
head `b1563013` is clean (rc=0), so the two land in either order. ADR
numbers do not collide: #107 carries ADR 0002 and this PR carries 0003.

## Changes

- **`docs/decisions/0003-package-repos-in-metadatastician.adoc`** (new):
  - context: D54-A, plus D321 (stage 1 of D67-A on marid#21) and D322;
  - three decisions:
    1. packages may be owned by either organisation;
    2. the set is closed;
    3. Registry.toml's own `repo` stays `hyperpolymath`;
  - three alternatives rejected;
- the consequences. The ADR names #109 / `7c52894` as the
implementation.
- **`docs/REGISTRY-POLICY.adoc`**: one sentence after the Layer 2b
paragraph says the set is closed and links ADR 0003.
- **`ci/validate.jl`**: the comment on `ALLOWED_PACKAGE_OWNERS` gains
the same sentence. No executable line changes.
- **`CHANGELOG.adoc`** [Unreleased] → Added: one entry for the ADR,
directly below #109's Marid entry.

## 📌 New pins

- **Head SHA:** **`8d7eeb362b4b676b27eae1abfffea401af97bf2d`** (a signed
merge of `main` `7c52894`; this branch's other commit, `a4a4bef`, is
signed too).
- **Action pins:** none. No workflow, `actions.lock`, lockfile or
container digest changes.

## RSR Quality Checklist

### Required

- [x] No banned language patterns: AsciiDoc, plus one comment in an
existing Julia file.
- [x] SPDX license headers on new files: the ADR has `CC-BY-SA-4.0`,
matching ADR 0001.
- [x] No secrets, credentials or `.env` files.
- [ ] CI is green: **not entirely**. Three non-required checks are red
on `main` at `7c52894` too (and at `9e4dc83` before it), so this PR does
not cause them. They are deferred below.

### Deferred checks (§5c)

- `actions.lock is in sync with the workflow YAML`: deferred to #108.
Dependabot #106 bumped `smtp-notify-action` to v0.5.0 without refreshing
`.github/workflows/actions.lock`.
- `governance / Allowlist Preflight`: deferred to #105. `GH_TOKEN` is
empty in the step, so it reports `could not read live Actions
permissions`.
- `governance / Workflow security linter`: deferred to #105.
`scripts/update-actions-lock.sh: No such file or directory`, exit 127.

### As Applicable — Registry Changes

- [ ] `Registry.toml` index updated: N/A. No package is added, removed
or rebound.
- [x] Per-package TOMLs consistent: the validator reports 0 custom
errors on this branch (Testing below).
- [ ] Upstream package meets the quality bar: N/A. No package is
registered here.
- [ ] Upstream tag exists and matches: N/A. No version is registered
here.

### As Applicable — Documentation / Infra Changes

- [ ] `.machine_readable/6a2/*.a2ml`: N/A. A2ML is retired estate-wide
(D99/D269c), so no `.a2ml` file is created or edited.
- [ ] `TOPOLOGY.md`: N/A. No architectural change.
- [x] Changelog updated. This repo's file is `CHANGELOG.adoc`.
- [ ] Wiki updated: N/A. The wiki does not describe Layer 2b.

## Testing

Every run is `ci/validate.jl <tree>` on Julia 1.10.10 with RegistryCI
v11.0.0, against a `git ls-files` copy of this head. Each copy is run
with `GIT_CEILING_DIRECTORIES` set, so no enclosing repository's
`origin` leaks into the slug comparison.

| Tree | Result |
|---|---|
| This head (41 packages, nine `metadatastician/marid`) | **rc=0**.
Custom checks 0 errors / 0 warnings |
| Same, MaridIR `repo` → `evilcorp/marid` (planted negative) | **rc=1**:
`MaridIR: Package.toml repo resolves to slug "evilcorp/marid", expected
an owner in ("hyperpolymath", "metadatastician")` |
| ADR claim "every package registered before #109 is
`hyperpolymath`-owned" | `repo` owners of the 32 non-Marid
`Package.toml` files on `main`: **32 × `hyperpolymath`** |
| ADR claim "the old check reported one mismatch per Marid package" |
#109's tree with `main`'s pre-#109 validator (`9e4dc83`): **rc=1, 9
owner mismatches** |

The only executable file touched is `ci/validate.jl`, and only in a
comment. `standards/.githooks/docstring-scan.sh` skips Julia files, so
it gives no verdict here, and no function is added or changed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_016XJoh8YA2sCWQmq93CF8RX

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant