statecraft.
Catalog/spec-spine

192-a-dependency-bump-in-a-hashed-manifest-is-not-governed

A dependency bump in a hashed manifest is not a governed change

Lifecycle approvedImplementation completeVerification unknownQualification unknown

A Cargo.toml or package.json that an adopter lists in `[index] extra_hashed_inputs`, typically because a spec claims it and L-008 then requires it to be hashed, enters the inputs record as raw bytes. A Dependabot version bump therefore stales `inputs.json`, and the bot cannot re-index its own PR, while the coupling gate would have waived the same change. Spec 060 closed this gap for workflows only. This spec closes it for the two package manifests: a hashed Cargo.toml or package.json folds as a projection that blanks exactly the version strings the dependency-only waiver forgives and keeps everything else, so the ledger and the waiver state one rule.

Read the full pinned specification ↗

Relationships

Claimed units

  • extends
    {
  "nature": "additive",
  "spec": "004-codebase-index",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/manifest.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "022-index-sharding",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/shard.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "005-coupling-gate",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/src/dep_only.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "004-codebase-index",
  "unit": {
    "kind": "file",
    "path": "crates/spec-spine-core/tests/index.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "057-the-docs-name-what-adopters-derived",
  "unit": {
    "kind": "file",
    "path": "docs/adoption-guide.md"
  }
}

Source headings

  1. 192: A dependency bump in a hashed manifest is not a governed change
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 3.1 A hashed manifest folds as its input projection (amends 004 3.5)
  6. 3.2 The projections and the waivers state one rule
  7. 3.3 The upgrade rewrites one file, once
  8. 3.4 Tests (minimum)
  9. 4. Out of scope
  10. 5. Resolved decisions
  11. Verification

Frozen anchors

No frozen anchors declared.