acompose refuses a stale bundle and never silently falls back #334

New issue

Open

opened 2026-08-25 17:08:18 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-25 17:08:18 +00:00

Member

Parent

#329

What to build

Once composition leaves Go, a new failure mode appears: an author edits the YAML, forgets to run the compositor, and acompose mounts a stale bundle that looks completely healthy. Go cannot compose, but it can compare.

Two behaviors:

Staleness refusal. The bundle carries a digest of the source data it was composed from. acompose compares that digest against the source when the source is reachable, and refuses a bundle whose source has moved on. The error names the compositor command the author needs to run. Bundles already retain provenance and content digests per docs/bundle-protocol.md, so this extends existing machinery rather than inventing it.

No silent fallback. A missing, unreadable, or stale mount fails loudly instead of quietly reverting to a default roster. There is precedent to generalize: docs/person-packages.md already records that refresh-then-exec refuses last-known-good fallback because that projection may use the default. Make that the general rule rather than one special case.

A source that is not reachable from the launching host is not an error, since a launch-only host legitimately has the bundle and not the data. Absence of the source and a stale source are different states and must not collapse into one.

Acceptance criteria

Bundles carry a digest of their source data, recorded in the manifest or trace per the producer contract from #331.
acompose refuses a bundle whose reachable source has changed since composition, and the message names the command to fix it.
An unreachable source is not treated as staleness, and a launch-only host with no source works normally.
A missing or unreadable mount fails loudly with a message naming the resolved path it tried.
No code path silently substitutes a default roster for a requested one.
Tests cover fresh, stale, absent-source, and missing-mount as four distinct outcomes.

Blocked by

Blocked by #332

## Parent #329 ## What to build Once composition leaves Go, a new failure mode appears: an author edits the YAML, forgets to run the compositor, and `acompose` mounts a stale bundle that looks completely healthy. Go cannot compose, but it can compare. Two behaviors: **Staleness refusal.** The bundle carries a digest of the source data it was composed from. `acompose` compares that digest against the source when the source is reachable, and refuses a bundle whose source has moved on. The error names the compositor command the author needs to run. Bundles already retain provenance and content digests per `docs/bundle-protocol.md`, so this extends existing machinery rather than inventing it. **No silent fallback.** A missing, unreadable, or stale mount fails loudly instead of quietly reverting to a default roster. There is precedent to generalize: `docs/person-packages.md` already records that refresh-then-exec refuses last-known-good fallback because that projection may use the default. Make that the general rule rather than one special case. A source that is not reachable from the launching host is not an error, since a launch-only host legitimately has the bundle and not the data. Absence of the source and a stale source are different states and must not collapse into one. ## Acceptance criteria - [ ] Bundles carry a digest of their source data, recorded in the manifest or trace per the producer contract from #331. - [ ] `acompose` refuses a bundle whose reachable source has changed since composition, and the message names the command to fix it. - [ ] An unreachable source is not treated as staleness, and a launch-only host with no source works normally. - [ ] A missing or unreadable mount fails loudly with a message naming the resolved path it tried. - [ ] No code path silently substitutes a default roster for a requested one. - [ ] Tests cover fresh, stale, absent-source, and missing-mount as four distinct outcomes. ## Blocked by - Blocked by #332

coilyco-ops referenced this issue

2026-08-25 17:08:46 +00:00

acompose embeds no roster and mounts core through the ordinary path #336

coilyco-ops referenced this issue

2026-08-25 17:10:24 +00:00

Invert the stack: data, compositor, bundle, then Go. Drop KDL, move composition out of the engine, mount the roster #329

coilyco-ops added the

priority

autonomy

headless

labels

2026-08-25 17:13:37 +00:00