Keep vendored re-runs idempotent across patch-service outages - #250

Merged

Mikola Lysenko (mikolalysenko) merged 19 commits into

mainfrom

fix/vendor-service-outage-idempotence

Sep 24, 2026

Commits on Sep 23, 2026

refactor(core/vendor): decode committed archives from one in-memory buffer

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
b2cbef8
feat(core/vendor): verify a committed artifact for reuse against the ledger

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
4c814f6
fix(core/vendor): reuse the committed npm tarball before acquiring a new one

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
cefd430
fix(core/vendor): re-wire the committed pypi wheel after a relock

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
2394e4d
fix(core/vendor): let an in-sync golang re-run pass service + offline

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
18144cc
fix(core/api): retry transient vendor-service failures and trip a breaker

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
5872257
test(cli): pin vendor re-run idempotence across a service outage end to end

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
2c46e54
test(core/vendor): cover the bun.lock forged-ledger and new-uuid reuse edges

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
d18032f
fix(core/vendor): reuse only a canonical committed archive

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
cf4f8f9
fix(core/vendor): bind a reused wheel's name to the package and preview it in dry runs

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
c6f98b8
fix(core/vendor): let an npm dry run see the committed-tarball reuse

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
02a7a17
fix(core/vendor): derive yarn berry's checksum from the verified tarball bytes

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
fffa818
fix(core/api): bound each vendor-service attempt and type the body-read error

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
6dc66bf
test(core/vendor): disable vendor-service retries in non-retry test clients

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
c876468
docs(changelog): note canonical-archive reuse, dry-run parity and attempt timeouts

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
8651115
test(cli): make the bun.lockb outage re-run tell reuse from a local re-pack

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
8141a23
test(scripts): require the reuse event when the pdm relock re-scan re-wires

Mikola Lysenko (mikolalysenko)
and
Claude (claude)
committed
d6b41c2

Navigation Menu

Keep vendored re-runs idempotent across patch-service outages - #250

Keep vendored re-runs idempotent across patch-service outages#250
Mikola Lysenko (mikolalysenko) merged 19 commits into
mainfrom
fix/vendor-service-outage-idempotence

Commits on Sep 23, 2026

refactor(core/vendor): decode committed archives from one in-memory buffer

feat(core/vendor): verify a committed artifact for reuse against the ledger

fix(core/vendor): reuse the committed npm tarball before acquiring a new one

fix(core/vendor): re-wire the committed pypi wheel after a relock

fix(core/vendor): let an in-sync golang re-run pass service + offline

fix(core/api): retry transient vendor-service failures and trip a breaker

test(cli): pin vendor re-run idempotence across a service outage end to end

test(core/vendor): cover the bun.lock forged-ledger and new-uuid reuse edges

fix(core/vendor): reuse only a canonical committed archive

fix(core/vendor): bind a reused wheel's name to the package and preview it in dry runs

fix(core/vendor): let an npm dry run see the committed-tarball reuse

fix(core/vendor): derive yarn berry's checksum from the verified tarball bytes

fix(core/api): bound each vendor-service attempt and type the body-read error

test(core/vendor): disable vendor-service retries in non-retry test clients

docs(changelog): note canonical-archive reuse, dry-run parity and attempt timeouts

test(cli): make the bun.lockb outage re-run tell reuse from a local re-pack

test(scripts): require the reuse event when the pdm relock re-scan re-wires

Commits on Sep 24, 2026

fix(vendor): golang dry-run of an in-sync module under --offline no longer refuses

Merge origin/main (#249 integrity hardening) into fix/vendor-service-outage-idempotence