fix: re-pin vendored core to dspack-gen v0.5.0 and re-sync the coupled copies

[ryandmonk]

Both CI jobs have been red since dspack-gen 0.3.2 and dspack 0.4.3 shipped (main last ran green 2026-07-22). They are not separately fixable — and it turned out to be a three-way coupling, not two.

What was actually wrong

#	Stale artifact	Consequence
1	dspack-gen pin at v0.1.2 (c5bfd6d)	core-pin-drift red; S3 could not evaluate requiredCategories
2	examples/shadcn-ui-v04.dspack.json at contract 2.3.0	test job red at "Copy drift check"
3	src/schema/dspack.v0.4.schema.json — untracked by any drift check	the blocker: loader rejected the spec's own example contract

(3) is why re-pin + re-sync alone still failed. The bundled schema predates the §4.3 amendment, so loading the freshly synced contract threw:

dspack schema validation failed:
  /rules/48: must have required property 'requiredSubComponents'

Nothing guarded that file — the schemas were byte copies of the spec repo with no manifest entry. All four are now tracked in scripts/check-sync.mjs; v0.1–v0.3 were already byte-exact, v0.4 was not.

Pin target: v0.5.0, not v0.3.2

dspack-gen released 0.4.0 and 0.5.0 while this was in flight, so v0.3.2 no longer satisfies the repo's own pin == latest release invariant. Pinned to v0.5.0 (5203569).

Exactly four shipped src/core files differ across the whole v0.1.2 → v0.5.0 move, each accounted for:

File	Effect	From
lint/vocabulary.ts	S2 sub-component containment (spec v0.4 §5.1)	gen 0.3.0
contract.ts + lint/rules.ts	S3 requiredCategories (§4.3)	gen 0.2.2
compiler.ts	composition.notes in the generation system prompt	gen 0.5.0

0.4.0/0.5.0's other work (repair loop, casualty-free generation view, join-id view) lives in run/, which ds-mcp does not vendor.

Behavior change (deliberate), confirmed by probe

Gate	Probe	Result
S2	dialog-title with no dialog ancestor	now a vocabulary error
S3	form-control with no interactive descendant	rule.form-control-carries-control fires
prompt	get-generation-context table line	now carries composition.notes (712 chars)

One correction to the prior framing: forbiddenCategories was already evaluated at v0.1.2 and is unchanged. Only requiredCategories was genuinely unevaluatable, and containment is an S2 vocabulary concern, not an S3 rule family. The README reflects this rather than the earlier "two unevaluated S3 rule families" reading.

Surfaces that passed under the old core can fail under this one. That is the point of the move.

Golden-context test: a broken identity, repaired

The test read dspack-gen's compiler golden against examples/shadcn-ui-v04.dspack.json, relying on that file being byte-identical to dspack-gen's own contract fixture. The spec repo has since advanced to contract 3.2.0 (34 components, 49 rules) while dspack-gen's fixture stayed at 2.3.0 (8 components, 8 rules), so the byte compare began failing for reasons unrelated to the compiler.

It now reads dspack-gen's contract fixture — the golden's other half, newly drift-tracked — comparing compiler output against the compiler's own input. Verified: the re-pinned core reproduces the golden byte-for-byte against that contract. Tracking the pair is also what let 0.5.0's prompt change land as one coherent re-sync.

Still a real upstream inconsistency worth its own issue: dspack-gen's fixtures/shadcn.v0_4.dspack.json trails the spec repo's published example.

Verification

• npm ci clean, 94/94 tests — exactly the pre-drift baseline
• bash scripts/smoke.sh — all passed
• node scripts/check-sync.mjs — exit 0, 9/9 in sync
• node scripts/check-core-pin.mjs — exit 0, "the pin is exactly the latest release tag"

Contract 3.2.0 also adds rule.button-carries-text; the textScope: subtree fixture moves its label onto the button accordingly (the trigger still carries no text of its own, which is what that test pins).

Not included: the npm release. Publishing a new ds-mcp version is the owner's call.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR re-pins the vendored @aestheticfunction/dspack-gen/core (and related byte-copied artifacts) to align ds-mcp with dspack-gen v0.3.2 and the updated dspack v0.4 contract/schema expectations, restoring CI and making previously untracked drift detectable.

Changes:

• Re-pin @aestheticfunction/dspack-gen from v0.1.2 to v0.3.2 (commit cbc9e1c) and update lockfile accordingly.
• Re-sync/update the dspack v0.4 schema and extend scripts/check-sync.mjs to drift-track all four dspack schemas plus the compiler-input contract fixture.
• Adjust tests to use the correct contract fixture for golden generation-context comparisons and update validator fixtures to reflect contract evolution.

Reviewed changes

Copilot reviewed 8 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/tests/generation-tools.test.ts	Updates test fixtures/comments and a surface fixture to remain valid under newer contract rules.
src/tests/generation-context-golden.test.ts	Switches the golden test to load dspack-gen’s own contract fixture copy to keep golden/input pairing stable.
src/tests/fixtures/shadcn.v0_4.contract.json	Adds a byte-synced copy of dspack-gen’s shadcn v0.4 contract fixture for golden pairing.
src/schema/dspack.v0.4.schema.json	Re-syncs schema and incorporates the requiredCategories amendment support.
scripts/check-sync.mjs	Expands drift checking to include all dspack schemas and the dspack-gen contract fixture.
README.md	Updates documentation to describe the new pin, behavior changes, and drift checks.
package.json	Updates the git commit pin for @aestheticfunction/dspack-gen.
package-lock.json	Updates resolved version/metadata for the new dspack-gen pin and dependency ranges.
CHANGELOG.md	Documents the behavior change and coupled sync/test updates in Unreleased notes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.