From 73385e90a9816d9a02f6042481e170d1c88306e7 Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Fri, 28 Aug 2026 03:44:17 +0200 Subject: [PATCH] =?UTF-8?q?fix(varve):=20pin=20the=20layer=20by=20digest?= =?UTF-8?q?=20=E2=80=94=20the=20rolling=20channel=20republished=202026.08.?= =?UTF-8?q?4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `varve which ` in this repo exits 1 and resolves nothing: error: layer 2026.08.4 is installed more than once under different digests (2 entries) and the pin carries no digest to disambiguate The rolling channel republished `2026.08.4` under a second manifest digest (`7e48ccc3…` installed 27 Aug 00:35, `c1e6a418…` 27 Aug 23:45), so a name-only pin no longer identifies one artifact. Every varve-shimmed tool invocation in gale has been failing since. The two manifests carry IDENTICAL payloads — `varve inspect` returns the same 47-line inventory under each, byte-identical apart from the layer's own digest line, and synth/loom/meld/witness/rivet all hash the same under both. This is a re-publication, not a content change. Pin the later digest (what the channel serves now) and record the evidence in docs/toolchain-pin.md, including the negative control: strip the digest line and `varve which synth` must exit 1 again. This also falsifies a claim that doc used to rest on. On the rolling channel a layer NAME is not a stable identifier — "layer = 2026.08.4" resolved to one manifest on 27 Aug and to two by 28 Aug. Only the digest pins the artifact. varve's refusal is the feature working: it exited non-zero and named the fix rather than guessing. A shim that fell back to an ambient binary would have produced a build attributable to no layer at all — which is exactly the failure this pin exists to prevent. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_011QG86sovTbfnPNY9SfhSmo --- docs/toolchain-pin.md | 47 +++++++++++++++++++++++++++++++++++++++++++ varve.toml | 1 + 2 files changed, 48 insertions(+) diff --git a/docs/toolchain-pin.md b/docs/toolchain-pin.md index 47dfc05..2288dd5 100644 --- a/docs/toolchain-pin.md +++ b/docs/toolchain-pin.md @@ -65,3 +65,50 @@ layer omits loom on that platform rather than substituting something. gale's CI is `ubuntu-22.04` (x86_64) and development is darwin/arm64, so neither is affected — but an aarch64 Linux runner would find `varve which loom` refusing, by design rather than by accident. + +## Why the pin carries a digest (2026-08-28) + +The pin above names a layer **and a manifest digest**. The digest is not +decoration — without it the pin does not resolve at all: + + $ varve which synth + error: layer 2026.08.4 is installed more than once under different + digests (2 entries) and the pin carries no digest to disambiguate + +The rolling channel republished `2026.08.4` under a second manifest digest. +Both copies are in the local store: + +| manifest digest | installed | +|---|---| +| `sha256:7e48ccc3…` | 2026-08-27 00:35 | +| `sha256:c1e6a418…` | 2026-08-27 23:45 | + +**The two carry identical payloads.** `varve inspect` under each pin returns +the same 47-line inventory, byte-identical apart from the layer's own digest +line, and every dispatched tool hashes the same under both: + +| tool | version | sha256 (first 16) | +|---|---|---| +| synth | 0.58.0 | `033d7c61118e7093` | +| loom | 1.4.0 | `9583f530baa0d6f0` | +| meld | 0.52.0 | `88fb38bd1e796632` | +| witness | 0.43.0 | `3c54bf7bde25f284` | +| rivet | 0.34.0 | `72b1b81dab0b8a78` | + +So this is a re-publication, not a content change, and not a compromise. The +digest recorded above is the later one — what the channel serves now. + +The lesson is the one varve's design already states: **on the rolling channel a +layer name is not a stable identifier.** Any reproducibility claim anchored to +`layer = "2026.08.4"` alone is falsifiable, and was — the name resolved to one +manifest on 27 Aug and to two by 28 Aug. Only the digest pins the artifact. + +varve's behaviour here is correct and is the reason this was caught rather than +silently mixed: it refused to guess, exited non-zero, and named the fix. A +shim that had fallen back to an ambient binary would have produced a build +attributable to no layer at all. + +Negative control for this section: delete the `digest` line from `varve.toml` +and re-run `varve which synth`. It must exit 1 with the message above. If it +succeeds, the duplicate has been pruned from the store and this section's +premise no longer holds locally — the digest pin stays regardless. diff --git a/varve.toml b/varve.toml index 49154e1..44774ab 100644 --- a/varve.toml +++ b/varve.toml @@ -6,3 +6,4 @@ manifest-version = 1 realm = "pulseengine" channel = "rolling" layer = "2026.08.4" +digest = "sha256:c1e6a418f87dedfb97caca3d983cb7a17b3365492f66de920487a8470f064fe1"