From c0a3fcd340940324d4ff3f066460f4558550c16f Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 11:03:56 +0500 Subject: [PATCH 01/13] docs(workspace): declare the out-of-estate external root convention Third-party collaboration checkouts have no owner, installation, or selector in this estate, so they cannot be classified or materialized. Record the accepted placement (${HOME}/Developer/external, unanchored, never a materialization target) as ADR 0025 and route the affected skills to it. - gds-orient: report an out-of-estate boundary as expected steady state - gds-audit-estate: treat its GDS_WORKSPACE_ANCHOR_REQUIRED as accepted - gds-materialize-workspace: exclude externally owned repositories --- ...5-out-of-estate-external-workspace-root.md | 71 +++++++++++++++++++ skills/canonical/gds-audit-estate/SKILL.md | 8 ++- .../gds-materialize-workspace/SKILL.md | 3 + skills/canonical/gds-orient/SKILL.md | 9 ++- 4 files changed, 89 insertions(+), 2 deletions(-) create mode 100644 docs/adr/0025-out-of-estate-external-workspace-root.md diff --git a/docs/adr/0025-out-of-estate-external-workspace-root.md b/docs/adr/0025-out-of-estate-external-workspace-root.md new file mode 100644 index 0000000..71d87be --- /dev/null +++ b/docs/adr/0025-out-of-estate-external-workspace-root.md @@ -0,0 +1,71 @@ +# ADR 0025: Keep third-party collaboration checkouts in an out-of-estate external root + +Status: Accepted + +Date: 2026-07-26 + +## Context + +ADR 0018 established that device checkout placement is declared by typed +assignments in `estate/devices/*.yaml`, where a portfolio selector resolves to +one named `workspace_root`. Every selector in `estate/selectors/` matches +`owner:rldyourmnd` or `owner:nddev`, and both installations in +`estate/installations/` are scoped to those two accounts. + +A repository owned by a third-party GitHub account therefore cannot be +classified, discovered, or observed by this estate, even though work on it is +legitimate and routine — a collaborator checkout where the owner has write +access is a normal case, not an anomaly. + +Two placements were considered and rejected: + +- Placing it under an estate-managed root such as the `rldyourmnd` + (`portfolio:personal-projects`) root asserts a portfolio the repository can + never match, producing permanent classification drift. +- Forking it into the `rldyourmnd-forks` root changes the collaboration model. + The fork portfolio exists for upstreams without write access; forking a + private repository the owner can already push to adds cross-fork pull-request + friction and leaves the counterparty unable to push. + +Adding an `external` entry to `workspace_roots` was also rejected. Workspace +roots are read only through `materialization.include[].workspace_root`, so a +root no selector can reference is unreachable configuration that falsely +implies GDS materializes there. + +## Decision + +1. Checkouts of repositories owned by accounts outside the estate live under the + device-local root `${HOME}/Developer/external`. +2. That root is a convention for humans and agents only. It is deliberately not + declared in any device descriptor's `workspace_roots`, holds no portfolio + assignment, and is never a materialization target. +3. Such checkouts carry no `.gds/repository.yaml` anchor. Anchoring a repository + owned by another party would commit estate governance artifacts into a tree + this estate does not own. +4. `gds workspace audit` raises exactly one expected finding per external + checkout, `GDS_WORKSPACE_ANCHOR_REQUIRED` with `anchor_state: missing`. This + is the accepted steady state, not drift to remediate. Because the root is + outside every declared `workspace_root`, no placement finding + (`GDS_WORKSPACE_PLACEMENT_DRIFT`, `GDS_WORKSPACE_ROOT_NOT_READY`) is produced + and no bogus `expected_path` is computed. +5. Promotion out of `external` is an explicit estate change: it requires a new + owner, an installation that can observe the account, and a selector — that + is, transfer or adoption of the repository, never a local move alone. + +## Consequences + +- Third-party collaboration has one predictable device location, distinct from + the four estate-managed root families (`control-plane`, `nddev`, `rldyourmnd`, + and the owner-specific `forks` and `servers` roots). +- Estate audits stay truthful: an external checkout is reported as unanchored + rather than silently absent or wrongly classified. +- The anchor finding is permanent noise in `gds workspace audit --root + ${HOME}/Developer`. It is already the state of every unanchored boundary on + the device and is not introduced by this decision. +- No typed estate object changes, so no policy compilation, bundle, or + projection input is affected by placing a repository in `external`. + +## Rollback + +Delete or relocate the external checkout. Nothing in the estate references it, +so no plan, approval, or regeneration is required to reverse this placement. diff --git a/skills/canonical/gds-audit-estate/SKILL.md b/skills/canonical/gds-audit-estate/SKILL.md index f8fe9f2..f2ede4f 100644 --- a/skills/canonical/gds-audit-estate/SKILL.md +++ b/skills/canonical/gds-audit-estate/SKILL.md @@ -52,4 +52,10 @@ rate-limit evidence, and non-mutating next actions. ## References -No additional runtime reference is required; use current structured `gds` evidence. +Per ADR 0025, a checkout under the out-of-estate `${HOME}/Developer/external` +root yields exactly one expected `GDS_WORKSPACE_ANCHOR_REQUIRED` finding with +`anchor_state: missing` in `gds workspace audit`. Report it as accepted steady +state rather than remediable drift, and do not treat it as coverage loss. +Placement findings for the same path are not expected and remain real drift. +Otherwise no additional runtime reference is required; use current structured +`gds` evidence. diff --git a/skills/canonical/gds-materialize-workspace/SKILL.md b/skills/canonical/gds-materialize-workspace/SKILL.md index a8d680d..24d93ae 100644 --- a/skills/canonical/gds-materialize-workspace/SKILL.md +++ b/skills/canonical/gds-materialize-workspace/SKILL.md @@ -17,6 +17,9 @@ bounded resources. - Existing checkouts only need synchronization. - No explicit repository selector or device root is available. +- The repository is owned outside the estate. Per ADR 0025 it is cloned by hand + into `${HOME}/Developer/external` and has no selector, portfolio, or + materialization assignment. ## Inputs diff --git a/skills/canonical/gds-orient/SKILL.md b/skills/canonical/gds-orient/SKILL.md index 12126bd..97420b7 100644 --- a/skills/canonical/gds-orient/SKILL.md +++ b/skills/canonical/gds-orient/SKILL.md @@ -54,4 +54,11 @@ next workflow. Do not claim that any mutation was performed. ## References -No additional runtime reference is required; use current structured `gds` output. +A resolved boundary may legitimately sit outside the estate. Per ADR 0025, +checkouts of repositories owned by accounts outside this estate live under the +device-local `${HOME}/Developer/external` root, carry no `.gds/repository.yaml` +anchor, and are never materialization targets. For such a boundary, report +`standalone` mode with a missing anchor as the expected steady state and route +the user to ordinary Git work, not to a GDS repository workflow. Do not propose +anchoring, materializing, or reclassifying it. Otherwise no additional runtime +reference is required; use current structured `gds` output. From b305175e15ad560845deaa768067304500508bf0 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 11:32:01 +0500 Subject: [PATCH 02/13] docs(memory): record the out-of-estate external root in core-estate-layout Add ADR 0025 to the declared sources and state the invariant that an externally owned repository has no portfolio, is never materialized, and yields GDS_WORKSPACE_ANCHOR_REQUIRED as accepted steady state. --- .serena/memories/core-estate-layout.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index a06bd01..f1d8a63 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -20,6 +20,7 @@ sources: - docs/adr/0004-portfolio-and-superproject-terminology.md - docs/adr/0005-typed-relationships.md - docs/adr/0018-device-workspaces-and-metadata-repository-retirement.md + - docs/adr/0025-out-of-estate-external-workspace-root.md - docs/contracts/lifecycles-v1.md - core/estate/compiler.go - core/estate/index.go @@ -88,13 +89,20 @@ filesystem hierarchy as machine identity. - Device placement drift and gitlink OID drift are independent findings. `gds workspace audit` owns the former; `gds validate gitlinks` owns the latter. +- A repository owned outside the estate has no owner, installation, or + selector and therefore no portfolio. Its checkout is placed by convention in + the out-of-estate `external` device root, is never declared in + `workspace_roots`, and is never a materialization target. Its single expected + audit finding is `GDS_WORKSPACE_ANCHOR_REQUIRED`; that is accepted steady + state, not remediable drift. Leaving the estate root families is a + classification statement, not merely a local move. ## Sources - `.gds/repository.yaml` - `schemas/v1/repository.schema.json` - `docs/architecture/README.md` -- ADRs 0003, 0004, 0005, and 0018 +- ADRs 0003, 0004, 0005, 0018, and 0025 - `estate/devices/rldyourmnd-mac1.yaml` - `estate/devices/rldyourmnd-mac2.yaml` - `estate/selectors/organization-servers.yaml` From a8bbe62887e03befbb3ada973572632fbd4385d5 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 11:32:32 +0500 Subject: [PATCH 03/13] chore(memory): resync core-estate-layout provenance for ADR 0025 --- .serena/memories/core-estate-layout.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index f1d8a63..a1f9ebc 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -3,12 +3,12 @@ gds_memory_schema: 1 scope_id: repo_01KX7BV07RHD6KRA4Z4J0KCHGR status: verified visibility: private -source_commit: 1af6b65676c7fc9302764b0a0f3d4cb03e38987d +source_commit: c0a3fcd340940324d4ff3f066460f4558550c16f source_state: committed -source_digest: sha256:671a4a9e2b8be92fd0bac193983830be9073a341ef12d4852311c7b27793e379 +source_digest: sha256:244c21d918b72adf31a85aa9eb0691afcdba011f0ebc3673898c03bf18f74e81 generated_by: gds-memory-compiler bundle_version: 0.1.0-dev -verified_at: "2026-07-24T18:10:00Z" +verified_at: "2026-07-26T06:32:10Z" refresh_triggers: - architecture-source-change - repository-schema-change From 7f698b47651214f3721debf3dff3012a81b68fbc Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 11:50:56 +0500 Subject: [PATCH 04/13] feat(estate): place every server checkout in one flat servers root The per-owner servers/nddev and servers/rldyourmnd subroots were never materialized; every server checkout already lived directly in ${HOME}/Developer/servers. A device may not assign one root to two selectors (GDS_DEVICE_WORKSPACE_ROOT_REUSED), so a flat root requires one portfolio. Replace portfolio:organization-servers and portfolio:personal-servers with a shared portfolio:servers. Both selectors keep their own owner-scoped match, so a fork named server-* still lands in its owner's fork portfolio. Record the decision as ADR 0026 and update the core-estate-layout invariant. --- .serena/memories/core-estate-layout.md | 7 ++- core/estate/compiler_test.go | 4 +- docs/adr/0026-flat-servers-workspace-root.md | 63 ++++++++++++++++++++ estate/devices/rldyourmnd-mac1.yaml | 10 +--- estate/devices/rldyourmnd-mac2.yaml | 10 +--- estate/selectors/organization-servers.yaml | 2 +- estate/selectors/personal-servers.yaml | 2 +- 7 files changed, 78 insertions(+), 20 deletions(-) create mode 100644 docs/adr/0026-flat-servers-workspace-root.md diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index a1f9ebc..99f66db 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -69,8 +69,11 @@ filesystem hierarchy as machine identity. device selector and provider repository name, never from an implicit four-level filesystem hierarchy. - Server selectors are higher-priority specialized non-fork selectors. A - fork whose name starts with `server-` remains in the owner's fork portfolio; - organization and personal server portfolios use distinct workspace roots. + fork whose name starts with `server-` remains in the owner's fork portfolio. + Both server selectors assign one shared `portfolio:servers`, which resolves to + a single flat `servers` workspace root regardless of owning account. Owner + splitting stays correct for forks, where cross-owner name reuse is expected, + and is deliberately absent for servers. - A device may assign each portfolio selector once, may reference only declared workspace roots, and may not reuse one root for different selectors. Go and Python validators prove these semantic rules with the same negative fixtures. diff --git a/core/estate/compiler_test.go b/core/estate/compiler_test.go index cdbea96..f98bb0a 100644 --- a/core/estate/compiler_test.go +++ b/core/estate/compiler_test.go @@ -124,7 +124,7 @@ func TestCompileRoutesServerRepositoriesByNamePrefix(t *testing.T) { byID[assignment.ProviderID] = assignment } if got := byID[10]; got.MatchedSelector != "organization-servers" || - len(got.Portfolios) != 1 || got.Portfolios[0] != "portfolio:organization-servers" { + len(got.Portfolios) != 1 || got.Portfolios[0] != "portfolio:servers" { t.Fatalf("organization server repository = %#v", got) } if got := byID[11]; got.MatchedSelector != "organization-sources" || @@ -132,7 +132,7 @@ func TestCompileRoutesServerRepositoriesByNamePrefix(t *testing.T) { t.Fatalf("organization non-server repository = %#v", got) } if got := byID[12]; got.MatchedSelector != "personal-servers" || - len(got.Portfolios) != 1 || got.Portfolios[0] != "portfolio:personal-servers" { + len(got.Portfolios) != 1 || got.Portfolios[0] != "portfolio:servers" { t.Fatalf("personal server repository = %#v", got) } if got := byID[13]; got.MatchedSelector != "organization-forks" || diff --git a/docs/adr/0026-flat-servers-workspace-root.md b/docs/adr/0026-flat-servers-workspace-root.md new file mode 100644 index 0000000..6441123 --- /dev/null +++ b/docs/adr/0026-flat-servers-workspace-root.md @@ -0,0 +1,63 @@ +# ADR 0026: Place every server checkout in one flat servers workspace root + +Status: Accepted + +Date: 2026-07-26 + +## Context + +ADR 0018 made fork workspaces owner-specific so equal repository names cannot +collide across owners, and the server selectors were modelled the same way: +`portfolio:organization-servers` resolved to `${HOME}/Developer/servers/nddev` +and `portfolio:personal-servers` to `${HOME}/Developer/servers/rldyourmnd`. + +That owner split was never the intended shape for servers, and it was never +materialized. On `rldyourmnd-mac1` neither subroot exists; every server +checkout lives directly in `${HOME}/Developer/servers`. The declared layout and +the actual one have disagreed since the roots were declared, which is why +`gds workspace audit` reports `GDS_WORKSPACE_PLACEMENT_DRIFT` for +`servers/ci-workflows`. + +A device may not assign one workspace root to two selectors: both +`core/validation/schema.go` and `scripts/validate_gds_schemas.py` raise +`GDS_DEVICE_WORKSPACE_ROOT_REUSED`, proven by a negative fixture in +`tests/fixtures/schemas/v1/cases.json`. Pointing the two existing server +selectors at one flat root is therefore rejected by validation, and one flat +root requires one server portfolio. + +Servers are addressed by host, not by owning account. Splitting them by owner +adds a directory level that carries no operational meaning. + +## Decision + +1. `portfolio:organization-servers` and `portfolio:personal-servers` are + replaced by a single `portfolio:servers`. +2. Both server selectors keep their own `match` blocks and IDs. Selection stays + owner-scoped and `server-`-prefixed, so a fork named `server-*` still lands + in its owner's fork portfolio; only the assigned portfolio is now shared. +3. Every device declares one `servers` workspace root at + `${HOME}/Developer/servers` and exactly one materialization assignment for + `portfolio:servers`. The per-owner `servers/nddev` and `servers/rldyourmnd` + subroots are removed. +4. Server checkout placement is `${HOME}/Developer/servers/`, + flat, regardless of owning account. + +## Consequences + +- The declared layout now matches the materialized one, removing a standing + source of placement drift. +- Two server repositories with the same name under different owners would + resolve to one path. Layout analysis already rejects duplicate local paths, so + such a collision surfaces as a finding rather than silently overwriting a + checkout. Server repositories are host-named and unique in practice. +- Owner-specific roots remain correct for forks, where cross-owner name reuse is + expected. This decision does not change fork placement. +- The estate compiler's server assignments now carry `portfolio:servers`; + `core/estate/compiler_test.go` asserts the shared portfolio while still + asserting the distinct matched selectors. + +## Rollback + +Restore the two portfolio names in the server selectors and the two per-owner +roots and assignments in each device descriptor. No provider state is involved, +so rollback is a source-only change followed by regeneration. diff --git a/estate/devices/rldyourmnd-mac1.yaml b/estate/devices/rldyourmnd-mac1.yaml index c6a177a..d2dfdd4 100644 --- a/estate/devices/rldyourmnd-mac1.yaml +++ b/estate/devices/rldyourmnd-mac1.yaml @@ -12,8 +12,7 @@ workspace_roots: nddev-forks: "${HOME}/Developer/forks/nddev" rldyourmnd: "${HOME}/Developer/rldyourmnd" rldyourmnd-forks: "${HOME}/Developer/forks/rldyourmnd" - organization-servers: "${HOME}/Developer/servers/nddev" - personal-servers: "${HOME}/Developer/servers/rldyourmnd" + servers: "${HOME}/Developer/servers" materialization: default_mode: "absent" @@ -33,11 +32,8 @@ materialization: - selector: "portfolio:personal-projects" workspace_root: "rldyourmnd" mode: "active" - - selector: "portfolio:organization-servers" - workspace_root: "organization-servers" - mode: "active" - - selector: "portfolio:personal-servers" - workspace_root: "personal-servers" + - selector: "portfolio:servers" + workspace_root: "servers" mode: "active" harnesses: diff --git a/estate/devices/rldyourmnd-mac2.yaml b/estate/devices/rldyourmnd-mac2.yaml index 7e1e7e8..ff95262 100644 --- a/estate/devices/rldyourmnd-mac2.yaml +++ b/estate/devices/rldyourmnd-mac2.yaml @@ -12,8 +12,7 @@ workspace_roots: nddev-forks: "${HOME}/Developer/forks/nddev" rldyourmnd: "${HOME}/Developer/rldyourmnd" rldyourmnd-forks: "${HOME}/Developer/forks/rldyourmnd" - organization-servers: "${HOME}/Developer/servers/nddev" - personal-servers: "${HOME}/Developer/servers/rldyourmnd" + servers: "${HOME}/Developer/servers" materialization: default_mode: "absent" @@ -33,11 +32,8 @@ materialization: - selector: "portfolio:personal-projects" workspace_root: "rldyourmnd" mode: "active" - - selector: "portfolio:organization-servers" - workspace_root: "organization-servers" - mode: "active" - - selector: "portfolio:personal-servers" - workspace_root: "personal-servers" + - selector: "portfolio:servers" + workspace_root: "servers" mode: "active" harnesses: diff --git a/estate/selectors/organization-servers.yaml b/estate/selectors/organization-servers.yaml index f1166dc..471d8af 100644 --- a/estate/selectors/organization-servers.yaml +++ b/estate/selectors/organization-servers.yaml @@ -13,7 +13,7 @@ match: assign: management_mode: "observe-only" portfolios: - - "portfolio:organization-servers" + - "portfolio:servers" policy_profiles: - "repository-default" - "organization-default" diff --git a/estate/selectors/personal-servers.yaml b/estate/selectors/personal-servers.yaml index 71e8bd8..731c0c2 100644 --- a/estate/selectors/personal-servers.yaml +++ b/estate/selectors/personal-servers.yaml @@ -13,7 +13,7 @@ match: assign: management_mode: "observe-only" portfolios: - - "portfolio:personal-servers" + - "portfolio:servers" policy_profiles: - "repository-default" - "personal-default" From 677ba74dfa07f88518562b5620d419080c4373a4 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 11:51:09 +0500 Subject: [PATCH 05/13] docs(memory): add ADR 0026 to core-estate-layout sources --- .serena/memories/core-estate-layout.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index 99f66db..9491baa 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -21,6 +21,7 @@ sources: - docs/adr/0005-typed-relationships.md - docs/adr/0018-device-workspaces-and-metadata-repository-retirement.md - docs/adr/0025-out-of-estate-external-workspace-root.md + - docs/adr/0026-flat-servers-workspace-root.md - docs/contracts/lifecycles-v1.md - core/estate/compiler.go - core/estate/index.go @@ -105,7 +106,7 @@ filesystem hierarchy as machine identity. - `.gds/repository.yaml` - `schemas/v1/repository.schema.json` - `docs/architecture/README.md` -- ADRs 0003, 0004, 0005, 0018, and 0025 +- ADRs 0003, 0004, 0005, 0018, 0025, and 0026 - `estate/devices/rldyourmnd-mac1.yaml` - `estate/devices/rldyourmnd-mac2.yaml` - `estate/selectors/organization-servers.yaml` From 66a39d8ddf3b2af54889fdb28ccbb601554dd917 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 11:51:31 +0500 Subject: [PATCH 06/13] chore(memory): resync core-estate-layout provenance for the flat servers root --- .serena/memories/core-estate-layout.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index 9491baa..95bcf53 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -3,12 +3,12 @@ gds_memory_schema: 1 scope_id: repo_01KX7BV07RHD6KRA4Z4J0KCHGR status: verified visibility: private -source_commit: c0a3fcd340940324d4ff3f066460f4558550c16f +source_commit: 7f698b47651214f3721debf3dff3012a81b68fbc source_state: committed -source_digest: sha256:244c21d918b72adf31a85aa9eb0691afcdba011f0ebc3673898c03bf18f74e81 +source_digest: sha256:194a40f3ca141cb43187b457fefc22f48bcd82a000128c96ede2dbb164055840 generated_by: gds-memory-compiler bundle_version: 0.1.0-dev -verified_at: "2026-07-26T06:32:10Z" +verified_at: "2026-07-26T06:51:21Z" refresh_triggers: - architecture-source-change - repository-schema-change From 0e64dc713c9045c69f71034f00ed176eca3e34d5 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 12:04:54 +0500 Subject: [PATCH 07/13] fix(repository): declare the superproject role on the control plane Embedded placement requires the superproject to carry the superproject role and the module to carry the module role (core/workspace/layout.go). The control plane owns three gitlinks but declared only control-plane, so every embedded module was reported GDS_WORKSPACE_EMBEDDED_ROLE_INVALID. --- .gds/repository.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.gds/repository.yaml b/.gds/repository.yaml index e9f16d3..867f78a 100644 --- a/.gds/repository.yaml +++ b/.gds/repository.yaml @@ -5,6 +5,7 @@ repository: display_name: "github-device-sync" roles: - "control-plane" + - "superproject" lifecycle: "active" provider: From e5f2535a98b8cbd2aac042093ba35c5fa9407682 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 12:05:16 +0500 Subject: [PATCH 08/13] chore(projections): regenerate for the superproject role --- .claude/CLAUDE.md | 8 ++++---- .gds/bundle.lock.yaml | 14 +++++++------- .github/workflows/gds-ci.yml | 4 ++-- AGENTS.md | 8 ++++---- 4 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index abdaffb..ef453e4 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -2,9 +2,9 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.1.0-dev -source-commit: 4096db90d3a56fe60d43a98deea0eda422a35f72 -input-digest: sha256:aa682dc69f657adfe8199181f04e41d7f975179e7a097bebae65768cf7c42c72 -output-digest: sha256:398c5b72bcfc9533dadc641e25fd9a51481385304e68f8ed6317e9d40ce335b5 +source-commit: 0e64dc713c9045c69f71034f00ed176eca3e34d5 +input-digest: sha256:9035c1e5c46301ca11c9335b9fdc582d4ac1faac09b84b9f67c80240a4f3a553 +output-digest: sha256:99063599c92612eaa9d1829a06d41cfa1c5b027989ed866da243c984fb35c72c edit-source: - .gds/repository.yaml - policies/base/repository-default.yaml @@ -19,7 +19,7 @@ edit-source: ## Scope - GDS repository ID: `repo_01KX7BV07RHD6KRA4Z4J0KCHGR`. -- Roles: `control-plane`. +- Roles: `control-plane, superproject`. - Canonical repository facts: `.gds/repository.yaml`. - Applied policy bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`). - This is a first-class Claude Code projection compiled from the same typed diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index 2b16f50..7e2d5f5 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -5,18 +5,18 @@ bundle: version: "0.1.0-dev" release_sequence: 0 channel: "development" - source_commit: "4096db90d3a56fe60d43a98deea0eda422a35f72" - digest: "sha256:c5431d146bb8a8c251488ee3a96eea801ad054a0c8fecd9fbc61185791b3a991" + source_commit: "0e64dc713c9045c69f71034f00ed176eca3e34d5" + digest: "sha256:d09bd81b3f8b9cafe119d62fd9fcc549a66ce3f9b0d45d18f22b9065e5d6628d" projection: - input_digest: "sha256:aa682dc69f657adfe8199181f04e41d7f975179e7a097bebae65768cf7c42c72" - output_digest: "sha256:d51d393220248c490e77f20a57c1930a831ee667a4008559002c67fbc499a0e1" + input_digest: "sha256:9035c1e5c46301ca11c9335b9fdc582d4ac1faac09b84b9f67c80240a4f3a553" + output_digest: "sha256:50580247e105ae1e629c6eba93df9da2a65504ed8b9d1d6c7e0299717e626dc1" files: - path: ".claude/CLAUDE.md" - digest: "sha256:e063d50d8bceff8282381bdcf15bf3287726b28a7bd663b3924e47757719d1cd" + digest: "sha256:5fcaf99f4e593ebd17bf7c3100e8f94afb5e035fa914df7ba1c0ad1ce676b994" - path: ".gds/compiled-policy.json" digest: "sha256:5ce6a147f6bd0573a769cd28bc5609b16c99bbe93cbe8c233110c204bb47d5f2" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:570f2b4b2f8497339017d14075b86fcc8a558ed6202e947d5d40c37f730a92ce" + digest: "sha256:8b8ee2a9d5fa42b033055d1884e38f3cf3b156c8cb40a3610b776a60460cf562" - path: "AGENTS.md" - digest: "sha256:b861c844edc2b2f3ad7a6a66fcd3a8dca187d9bfb511e6623e2c993c19a442e0" + digest: "sha256:04f0737e9d7bee60e88c6fb7d325b767701adab663b8616bd0cc2496c3445a18" diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 55fbe25..afcf5ff 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -1,8 +1,8 @@ # GENERATED FILE - DO NOT EDIT DIRECTLY # generator: gds # bundle: 0.1.0-dev -# source-commit: 4096db90d3a56fe60d43a98deea0eda422a35f72 -# input-digest: sha256:aa682dc69f657adfe8199181f04e41d7f975179e7a097bebae65768cf7c42c72 +# source-commit: 0e64dc713c9045c69f71034f00ed176eca3e34d5 +# input-digest: sha256:9035c1e5c46301ca11c9335b9fdc582d4ac1faac09b84b9f67c80240a4f3a553 # output-digest: sha256:7e8d64d5f0249163fa46ed044b7fb9c98cb0fb3b96445c730c49e50e89755dcb # edit-source: # - .gds/repository.yaml diff --git a/AGENTS.md b/AGENTS.md index 9081716..56fc15a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,9 +2,9 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.1.0-dev -source-commit: 4096db90d3a56fe60d43a98deea0eda422a35f72 -input-digest: sha256:aa682dc69f657adfe8199181f04e41d7f975179e7a097bebae65768cf7c42c72 -output-digest: sha256:6e9805f81c23943faca08511de1521935adb2252a1eacbdce8628ed278c0ea08 +source-commit: 0e64dc713c9045c69f71034f00ed176eca3e34d5 +input-digest: sha256:9035c1e5c46301ca11c9335b9fdc582d4ac1faac09b84b9f67c80240a4f3a553 +output-digest: sha256:8ef035e28c8ee736c295069b828e70f2873be24f8f96b0cf02cf4ae223f4b9fe edit-source: - .gds/repository.yaml - policies/base/repository-default.yaml @@ -19,7 +19,7 @@ edit-source: ## Scope - Repository ID: `repo_01KX7BV07RHD6KRA4Z4J0KCHGR`. -- Roles: `control-plane`. +- Roles: `control-plane, superproject`. - Canonical repository facts: `.gds/repository.yaml`. - Applied bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`). - Compiled policy: `.gds/compiled-policy.json`. From b72ac4f55c23a4e908de608e356e6c0dc99e1915 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 12:06:06 +0500 Subject: [PATCH 09/13] chore(memory): resync provenance after the superproject role change --- .serena/memories/core-context-resolution.md | 6 +++--- .serena/memories/core-estate-layout.md | 6 +++--- .serena/memories/core-policy-projection.md | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.serena/memories/core-context-resolution.md b/.serena/memories/core-context-resolution.md index e9fd953..338aef5 100644 --- a/.serena/memories/core-context-resolution.md +++ b/.serena/memories/core-context-resolution.md @@ -3,12 +3,12 @@ gds_memory_schema: 1 scope_id: repo_01KX7BV07RHD6KRA4Z4J0KCHGR status: verified visibility: private -source_commit: 91ce9ee653b7a77001a6cdcf8e60ada89f6ea53a +source_commit: 0e64dc713c9045c69f71034f00ed176eca3e34d5 source_state: committed -source_digest: sha256:bdb7c732ee1fb9806b31b3087c6128d05507a41ae4734de5d8c37b717f955f71 +source_digest: sha256:021989abfd6ca2642d0acaae77e4c433a892e7cd2a85273be788e5fc779d3cef generated_by: gds-memory-compiler bundle_version: 0.1.0-dev -verified_at: "2026-07-24T14:00:00Z" +verified_at: "2026-07-26T07:05:58Z" refresh_triggers: - context-resolver-change - estate-registration-change diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index 95bcf53..e8a5c42 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -3,12 +3,12 @@ gds_memory_schema: 1 scope_id: repo_01KX7BV07RHD6KRA4Z4J0KCHGR status: verified visibility: private -source_commit: 7f698b47651214f3721debf3dff3012a81b68fbc +source_commit: 0e64dc713c9045c69f71034f00ed176eca3e34d5 source_state: committed -source_digest: sha256:194a40f3ca141cb43187b457fefc22f48bcd82a000128c96ede2dbb164055840 +source_digest: sha256:50a781c87671dc46fc3491f0bf7a49867ec5a702c01c6113dc2d4b82658303fd generated_by: gds-memory-compiler bundle_version: 0.1.0-dev -verified_at: "2026-07-26T06:51:21Z" +verified_at: "2026-07-26T07:05:30Z" refresh_triggers: - architecture-source-change - repository-schema-change diff --git a/.serena/memories/core-policy-projection.md b/.serena/memories/core-policy-projection.md index 18f4b4a..87594e3 100644 --- a/.serena/memories/core-policy-projection.md +++ b/.serena/memories/core-policy-projection.md @@ -3,12 +3,12 @@ gds_memory_schema: 1 scope_id: repo_01KX7BV07RHD6KRA4Z4J0KCHGR status: verified visibility: private -source_commit: 91ce9ee653b7a77001a6cdcf8e60ada89f6ea53a +source_commit: 0e64dc713c9045c69f71034f00ed176eca3e34d5 source_state: committed -source_digest: sha256:e01b4ba403cc9cff8127156084ef8d1d239fd4344c2451d9f2c5836ad18dd981 +source_digest: sha256:f7902f83d161db985501efa726aca6ad9c7713815b496ed9eeaa22936ed742f1 generated_by: gds-memory-compiler bundle_version: 0.1.0-dev -verified_at: "2026-07-24T14:00:00Z" +verified_at: "2026-07-26T07:05:58Z" refresh_triggers: - policy-compiler-change - projection-template-change From a90b2cb7b3b5230174d85b1eb6aff36cd2d2b305 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 12:08:19 +0500 Subject: [PATCH 10/13] test(golden): refresh control-plane projection golden for the superproject role --- .../golden/projections/control-plane/.claude/CLAUDE.md | 6 +++--- .../projections/control-plane/.gds/bundle.lock.yaml | 10 +++++----- .../control-plane/.github/workflows/gds-ci.yml | 2 +- tests/golden/projections/control-plane/AGENTS.md | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md index 480edb9..89ced22 100644 --- a/tests/golden/projections/control-plane/.claude/CLAUDE.md +++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md @@ -3,8 +3,8 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.1.0-dev source-commit: 433c46b6923f7dc1efb96713b9ffc9330ca8ba58 -input-digest: sha256:256450e100e53592836ef9f9bf7305196e002e4b52dcc676d0daed1c6aab3b53 -output-digest: sha256:398c5b72bcfc9533dadc641e25fd9a51481385304e68f8ed6317e9d40ce335b5 +input-digest: sha256:5b35960c5a72120c1e38b2e702b7442eb2eb3de2d1b6b7fc13ad85d86afa716a +output-digest: sha256:99063599c92612eaa9d1829a06d41cfa1c5b027989ed866da243c984fb35c72c edit-source: - .gds/repository.yaml - policies/base/repository-default.yaml @@ -19,7 +19,7 @@ edit-source: ## Scope - GDS repository ID: `repo_01KX7BV07RHD6KRA4Z4J0KCHGR`. -- Roles: `control-plane`. +- Roles: `control-plane, superproject`. - Canonical repository facts: `.gds/repository.yaml`. - Applied policy bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`). - This is a first-class Claude Code projection compiled from the same typed diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml index ea45f39..075bf0a 100644 --- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml +++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml @@ -9,14 +9,14 @@ bundle: digest: "sha256:c286b32de44516ba18c113d407d3777886129040aab2b0350a6dd0edaca398b1" projection: - input_digest: "sha256:256450e100e53592836ef9f9bf7305196e002e4b52dcc676d0daed1c6aab3b53" - output_digest: "sha256:ea6169ef587438b83907785ac62af6d5c0d058ce6766d370cfc1bb7936acecc1" + input_digest: "sha256:5b35960c5a72120c1e38b2e702b7442eb2eb3de2d1b6b7fc13ad85d86afa716a" + output_digest: "sha256:a0d39cea80752f40c2571a63482a9b506766cd46f3c3067f6d7c2afd37556fa9" files: - path: ".claude/CLAUDE.md" - digest: "sha256:a12cff41f2b077d82bfc3d948cbb286897ec6bac108deba78e49e1df627f95f4" + digest: "sha256:7c8ad2973788b441cc874a34439d4f62f05c8d73121a590f4654b4a4eda979ad" - path: ".gds/compiled-policy.json" digest: "sha256:5ce6a147f6bd0573a769cd28bc5609b16c99bbe93cbe8c233110c204bb47d5f2" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:00d86ff4ddb3979b34054e8de488730785af95e817452ff8179fb9d95b95bea1" + digest: "sha256:45bb03249d53f50dc1549260e6fa7666c3783172af3bafff902f1e5b5b495d67" - path: "AGENTS.md" - digest: "sha256:d92096d09c58775f4d925babd8f28cf1c10fef22825edf8283b3dfcae6cb05f6" + digest: "sha256:f87572d1ccf6cfdc4e754df1ed3bf0cf48dc6aa6e6a0c4fb97c66d38e8751461" diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml index 9a1c1d2..aa95c22 100644 --- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml +++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml @@ -2,7 +2,7 @@ # generator: gds # bundle: 0.1.0-dev # source-commit: 433c46b6923f7dc1efb96713b9ffc9330ca8ba58 -# input-digest: sha256:256450e100e53592836ef9f9bf7305196e002e4b52dcc676d0daed1c6aab3b53 +# input-digest: sha256:5b35960c5a72120c1e38b2e702b7442eb2eb3de2d1b6b7fc13ad85d86afa716a # output-digest: sha256:7e8d64d5f0249163fa46ed044b7fb9c98cb0fb3b96445c730c49e50e89755dcb # edit-source: # - .gds/repository.yaml diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md index 9dd5183..fc5451a 100644 --- a/tests/golden/projections/control-plane/AGENTS.md +++ b/tests/golden/projections/control-plane/AGENTS.md @@ -3,8 +3,8 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.1.0-dev source-commit: 433c46b6923f7dc1efb96713b9ffc9330ca8ba58 -input-digest: sha256:256450e100e53592836ef9f9bf7305196e002e4b52dcc676d0daed1c6aab3b53 -output-digest: sha256:6e9805f81c23943faca08511de1521935adb2252a1eacbdce8628ed278c0ea08 +input-digest: sha256:5b35960c5a72120c1e38b2e702b7442eb2eb3de2d1b6b7fc13ad85d86afa716a +output-digest: sha256:8ef035e28c8ee736c295069b828e70f2873be24f8f96b0cf02cf4ae223f4b9fe edit-source: - .gds/repository.yaml - policies/base/repository-default.yaml @@ -19,7 +19,7 @@ edit-source: ## Scope - Repository ID: `repo_01KX7BV07RHD6KRA4Z4J0KCHGR`. -- Roles: `control-plane`. +- Roles: `control-plane, superproject`. - Canonical repository facts: `.gds/repository.yaml`. - Applied bundle: `.gds/bundle.lock.yaml` (`0.1.0-dev`). - Compiled policy: `.gds/compiled-policy.json`. From cfabe5ec42a2c7b27a6f194ed1ee23a8ca63e70b Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 12:19:52 +0500 Subject: [PATCH 11/13] docs(placement): declare that submodule repositories get no standalone checkout Six repositories existed as both a gitlink and a standalone checkout, making one stable ID resolve to two Git stores and holding workspace audit in blocked with twelve identity findings. Record the rule as ADR 0027 and route the skills to it. - gds-manage-module: roles required on both sides; module role obliges a module block - gds-materialize-workspace: never materialize a submodule-consumed repository - gds-audit-estate: identity conflicts mean the standalone copy is the defect --- .serena/memories/core-estate-layout.md | 8 ++- ...epositories-have-no-standalone-checkout.md | 60 +++++++++++++++++++ skills/canonical/gds-audit-estate/SKILL.md | 6 ++ skills/canonical/gds-manage-module/SKILL.md | 10 +++- .../gds-materialize-workspace/SKILL.md | 2 + 5 files changed, 84 insertions(+), 2 deletions(-) create mode 100644 docs/adr/0027-submodule-repositories-have-no-standalone-checkout.md diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index e8a5c42..d7dbe67 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -22,6 +22,7 @@ sources: - docs/adr/0018-device-workspaces-and-metadata-repository-retirement.md - docs/adr/0025-out-of-estate-external-workspace-root.md - docs/adr/0026-flat-servers-workspace-root.md + - docs/adr/0027-submodule-repositories-have-no-standalone-checkout.md - docs/contracts/lifecycles-v1.md - core/estate/compiler.go - core/estate/index.go @@ -86,6 +87,11 @@ filesystem hierarchy as machine identity. - An embedded submodule remains an independent repository boundary even when checked out detached. Onboarding is safe only at the exact clean stage-zero superproject gitlink; filesystem nesting never supplies identity. +- A submodule-consumed repository is materialized only as its superproject's + gitlink and never as a standalone checkout. Both together make one stable ID + resolve to two Git stores, which layout analysis rejects. Embedded placement + requires role `superproject` on the superproject and role `module` on the + module, and role `module` obliges a `module` block in the repository anchor. - Workspace audit classifies each observed boundary by actual Git mode. Standalone checkouts resolve through device selectors; embedded modules resolve through the Git-reported superproject and exactly one typed @@ -106,7 +112,7 @@ filesystem hierarchy as machine identity. - `.gds/repository.yaml` - `schemas/v1/repository.schema.json` - `docs/architecture/README.md` -- ADRs 0003, 0004, 0005, 0018, 0025, and 0026 +- ADRs 0003, 0004, 0005, 0018, 0025, 0026, and 0027 - `estate/devices/rldyourmnd-mac1.yaml` - `estate/devices/rldyourmnd-mac2.yaml` - `estate/selectors/organization-servers.yaml` diff --git a/docs/adr/0027-submodule-repositories-have-no-standalone-checkout.md b/docs/adr/0027-submodule-repositories-have-no-standalone-checkout.md new file mode 100644 index 0000000..2640997 --- /dev/null +++ b/docs/adr/0027-submodule-repositories-have-no-standalone-checkout.md @@ -0,0 +1,60 @@ +# ADR 0027: Give a submodule-consumed repository no standalone checkout + +Status: Accepted + +Date: 2026-07-26 + +## Context + +ADR 0018 separated logical portfolio classification from device placement and +made both standalone checkouts and embedded submodules first-class, audited +independently. Nothing forbade a repository from being materialized both ways at +once, and in practice six were: `ci-workflows`, `macos-ubuntu-bootstrap`, and +`nddev-browser` existed as gitlinks under the control plane *and* as standalone +checkouts in the `nddev` root, and the three harness apps existed as gitlinks +under `nddev-harnesses` *and* standalone. + +Every such pair made one stable repository ID resolve to two distinct Git +stores, which layout analysis rejects: twelve findings, six +`GDS_CONTEXT_IDENTITY_CONFLICT` and six `GDS_IDENTITY_INDEX_ID_CONFLICT`, held +`gds workspace audit` in `blocked`. The two stores also diverged in practice — +three of the standalone checkouts carried commits that existed nowhere else. + +These repositories have their own remotes and their own release lifecycle, but +they are developed inside their consuming superproject. A second checkout adds +no capability and guarantees drift. + +## Decision + +1. A repository consumed through a `git-submodule-consumer` relationship is + materialized only as the superproject's gitlink. It gets no standalone + checkout on any device. +2. Its checkout path is inherited from the Git-reported superproject, per ADR + 0018 point 7. Device selectors do not place it. +3. Embedded placement requires roles on both sides: the superproject declares + role `superproject` and the module declares role `module`. Declaring role + `module` obliges a `module` block in `.gds/repository.yaml`, enforced by + `schemas/v1/repository.schema.json`. +4. Before removing a redundant standalone checkout, its commits must be + preserved into the submodule's own Git store. Deleting a checkout that holds + unreachable commits is data loss, not cleanup. + +## Consequences + +- All twelve identity findings are cleared and audit leaves `blocked`. +- There is exactly one working tree per repository ID on a device, so "which + copy is current" stops being a question. +- Work on a module happens inside the superproject checkout, on the module's own + branch, and is published through the module's own remote before the gitlink + advances. +- The control plane now declares role `superproject`, which changes its + generated projections; `nddev-browser` gained role `module` and a `module` + block declaring commit-contract compatibility and no published releases. +- A device root can no longer be read as an inventory of every repository the + estate knows: submodule-consumed repositories are absent from it by design. + +## Rollback + +Re-clone the standalone checkouts and restore the removed roles. Nothing in the +provider is involved. Rollback re-introduces the identity findings, which is why +it should only follow a deliberate change to the placement model. diff --git a/skills/canonical/gds-audit-estate/SKILL.md b/skills/canonical/gds-audit-estate/SKILL.md index f2ede4f..434ffc7 100644 --- a/skills/canonical/gds-audit-estate/SKILL.md +++ b/skills/canonical/gds-audit-estate/SKILL.md @@ -57,5 +57,11 @@ root yields exactly one expected `GDS_WORKSPACE_ANCHOR_REQUIRED` finding with `anchor_state: missing` in `gds workspace audit`. Report it as accepted steady state rather than remediable drift, and do not treat it as coverage loss. Placement findings for the same path are not expected and remain real drift. + +`GDS_CONTEXT_IDENTITY_CONFLICT` and `GDS_IDENTITY_INDEX_ID_CONFLICT` on one +repository ID mean the same repository has both a gitlink and a standalone +checkout. Per ADR 0027 the standalone copy is the defect; report it as removable +only after confirming its commits already exist in the submodule's Git store. + Otherwise no additional runtime reference is required; use current structured `gds` evidence. diff --git a/skills/canonical/gds-manage-module/SKILL.md b/skills/canonical/gds-manage-module/SKILL.md index 5f1d158..f485f44 100644 --- a/skills/canonical/gds-manage-module/SKILL.md +++ b/skills/canonical/gds-manage-module/SKILL.md @@ -52,4 +52,12 @@ policy, changed files, checks, and remaining consumer actions. ## References -No additional runtime reference is required; use current typed relationship policy. +Per ADR 0027, a submodule-consumed repository is materialized only as the +superproject's gitlink and never as a standalone checkout. Embedded placement +requires role `superproject` on the superproject and role `module` on the +module; declaring role `module` obliges a `module` block in +`.gds/repository.yaml`, enforced by `schemas/v1/repository.schema.json`, so add +both in one change or validation fails with `GDS_INSTANCE_INVALID`. Never delete +a redundant standalone checkout before its commits are preserved into the +submodule's own Git store. Otherwise no additional runtime reference is +required; use current typed relationship policy. diff --git a/skills/canonical/gds-materialize-workspace/SKILL.md b/skills/canonical/gds-materialize-workspace/SKILL.md index 24d93ae..8f15cf0 100644 --- a/skills/canonical/gds-materialize-workspace/SKILL.md +++ b/skills/canonical/gds-materialize-workspace/SKILL.md @@ -20,6 +20,8 @@ bounded resources. - The repository is owned outside the estate. Per ADR 0025 it is cloned by hand into `${HOME}/Developer/external` and has no selector, portfolio, or materialization assignment. +- The repository is consumed as a git submodule. Per ADR 0027 it exists only as + its superproject's gitlink and is never given a standalone checkout. ## Inputs From 3d51003ab96458b90b00b277fe711bb2fa13ba63 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 12:20:20 +0500 Subject: [PATCH 12/13] chore(memory): resync core-estate-layout provenance for ADR 0027 --- .serena/memories/core-estate-layout.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.serena/memories/core-estate-layout.md b/.serena/memories/core-estate-layout.md index d7dbe67..d27304f 100644 --- a/.serena/memories/core-estate-layout.md +++ b/.serena/memories/core-estate-layout.md @@ -3,12 +3,12 @@ gds_memory_schema: 1 scope_id: repo_01KX7BV07RHD6KRA4Z4J0KCHGR status: verified visibility: private -source_commit: 0e64dc713c9045c69f71034f00ed176eca3e34d5 +source_commit: cfabe5ec42a2c7b27a6f194ed1ee23a8ca63e70b source_state: committed -source_digest: sha256:50a781c87671dc46fc3491f0bf7a49867ec5a702c01c6113dc2d4b82658303fd +source_digest: sha256:471caa60f6e3cbe8933517bff2a622cf78ba95053ab9586d01b6b28f398eec0e generated_by: gds-memory-compiler bundle_version: 0.1.0-dev -verified_at: "2026-07-26T07:05:30Z" +verified_at: "2026-07-26T07:20:11Z" refresh_triggers: - architecture-source-change - repository-schema-change From cfde574968fffd9db69c43243b2ca5e7ca7f7710 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sun, 26 Jul 2026 12:42:12 +0500 Subject: [PATCH 13/13] chore(modules): advance nddev-browser to the declared module role Picks up NDDev-it-com/nddev-browser#17, which adds role module and the required module block so embedded placement validates. --- modules/nddev-browser | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/nddev-browser b/modules/nddev-browser index 0e86aa6..f104852 160000 --- a/modules/nddev-browser +++ b/modules/nddev-browser @@ -1 +1 @@ -Subproject commit 0e86aa64f18375b5d2837c9ab017f73f690691b3 +Subproject commit f1048523c4054eddb2192dc65b4aa3dd08585cbd