From f33023f8e0afd4601893c5ad50d0a57659fde4cd Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Sat, 10 Oct 2026 01:21:19 +0000 Subject: [PATCH] Resolve standalone build identity from working-tree declarations --- docs/roadmap/module-releases.md | 55 +++++++++++++-------------------- 1 file changed, 21 insertions(+), 34 deletions(-) diff --git a/docs/roadmap/module-releases.md b/docs/roadmap/module-releases.md index 136e998..e1ea7c3 100644 --- a/docs/roadmap/module-releases.md +++ b/docs/roadmap/module-releases.md @@ -1,7 +1,6 @@ # Roadmap: release individual Go modules -Status: planned feature; scope and ownership decisions resolved. The declaration -source for standalone builds remains an [open decision](#open-decisions). +Status: planned feature; scope and ownership decisions resolved. ## Purpose @@ -84,7 +83,8 @@ and complete tag are available throughout candidate handling and public evidence request and profile, with root defaults. Resolve it against the captured repository and source appropriate to the operation once at the operation entry point. Check, publication, and delivery use committed module declarations. -Standalone-build declaration sourcing follows the open decision below. +Standalone builds use the selected module's working-tree `go.mod`, following +the [declaration-source decision](#declaration-source-by-operation). Pass the resolved identity through the operation's validation, publication, build, and delivery collaborators. Standalone operations use the same resolution logic. Derive tags using Go's standard module conventions, including @@ -260,7 +260,9 @@ identity derivation, scope selection, and path conversion focused tests at their owners. Use representative assembled workflows and reuse existing failure coverage where the underlying behavior remains shared. Verify preserved empty lists, contextual findings for equal blobs at different paths, -failure identity, and artifact-verification ownership. +failure identity, and artifact-verification ownership. Cover standalone builds +with modified declarations or new module directories, composite builds using +committed identity, and source verification required for delivery. Update GoDoc, CLI/configuration references, check/publication/build/delivery guides, adoption examples, CI templates, and recovery guidance together. Supply migration @@ -296,8 +298,21 @@ detached checkouts. Ordinary builds retain their support for modified source and operate independently of release-note and publication prerequisites. Composite operations pass resolved identity to their internal collaborators. -Standalone operations use the same resolver at entry. Declaration sourcing for -ordinary builds is the open decision at the end of this document. +Standalone operations use the same resolver at entry, with declaration source +selected by the operation as described below. + +### Declaration source by operation + +Candidate checks, publication, and tagged delivery resolve identity from +committed module declarations. Standalone builds read the selected module's +working-tree `go.mod`, so their identity corresponds to the declaration Go +uses for compilation. This supports local development of changed module paths +and new module directories before commit. + +The operation selects the declaration source and uses shared identity derivation +logic. Composite candidate and delivery builds receive their already resolved +committed identity. Existing source-verification observations remain in place; +delivery requires a build verified against its committed tagged source. ### One validation input set and full repository lookup @@ -459,31 +474,3 @@ outside the implementation scope. Migration means guidance supplied in the next release's documentation. That guidance explains the required consumer changes and the root-module validation scope change; implementation completion covers the new interface directly. - - -## Open Decisions - -### Declaration source for standalone builds - -Candidate checks, publication, and tagged delivery resolve identity from -committed source. Ordinary builds currently permit modified source, including -module-file edits. Select how their identity resolver reads the module -declaration. - -**Recommendation:** Read the selected module's working-tree `go.mod` for -standalone builds. Keep candidate and delivery operations tied to committed -declarations. This makes a local build's identity correspond to the files Go -actually compiles and supports development of a changed module path or a new -module directory before commit. The resolver's source is selected by the -operation, with shared derivation logic and existing source-verification -observations. Delivery continues to require a build verified against its -committed tagged source. - -**Viable alternative:** Resolve standalone-build identity from the committed -`go.mod`, while allowing ordinary source-file edits during compilation. This -provides uniform committed identity across operations and simplifies declaration -access. It supports builds of modified code when the module declaration is -unchanged. Its cost is that module-path changes and newly created module -directories need a commit before identity can reflect them, and local identity -can differ from the declaration used by Go. Document that limitation explicitly -if this alternative is selected.