Design: grounded technical contracts and decision set #1

Merged

mathieu merged 40 commits from design/technical-contracts into main

2026-08-31 00:58:50 +00:00

hephaistos commented

2026-08-30 20:27:27 +00:00

Owner

Scope

Proposes the consequential AURoscope design choices for Mathieu's review. All 13 decisions remain explicitly Proposed; this PR accepts none of them.

Included

exact Paru/Pacman/makepkg contract and compatibility blockers
Go architecture and dependency options
SQLite model and approval/TOCTOU protocol
scanner/LLM contracts
XDG layout and cleanup
threat model and risk-proportional test strategy
versioned dependency notes and disposable spike evidence

Important blockers / amendments

stable Paru 2.1.0 cannot cleanly separate interactive menu output from selected names; production search selection requires a stable release containing d1dfbc4
Paru's actual PreBuildCommand timing is not literally immediately before each build; D4 asks Mathieu to accept an explicit specification amendment or choose an upstream hook/makepkg-proxy alternative
local/PKGBUILD-repository builds can execute makepkg --printsrcinfo before the hook; D13 proposes rejecting them in v1 and normalizing allowed modes with trusted reset flags

Verification

exact upstream source/manual/test review at recorded commits
disposable Arch spikes for makepkg sourcing, Paru selection streams, order grammar, config layering/mode reset, and SQLite drivers
citations ledger strict verification
git diff --cached --check
independent focused design review: PASS after corrections

No implementation plan, production code, or accepted ADR is included.

## Scope Proposes the consequential AURoscope design choices for Mathieu's review. All 13 decisions remain explicitly **Proposed**; this PR accepts none of them. ## Included - exact Paru/Pacman/makepkg contract and compatibility blockers - Go architecture and dependency options - SQLite model and approval/TOCTOU protocol - scanner/LLM contracts - XDG layout and cleanup - threat model and risk-proportional test strategy - versioned dependency notes and disposable spike evidence ## Important blockers / amendments - stable Paru 2.1.0 cannot cleanly separate interactive menu output from selected names; production search selection requires a stable release containing `d1dfbc4` - Paru's actual `PreBuildCommand` timing is not literally immediately before each build; D4 asks Mathieu to accept an explicit specification amendment or choose an upstream hook/makepkg-proxy alternative - local/PKGBUILD-repository builds can execute `makepkg --printsrcinfo` before the hook; D13 proposes rejecting them in v1 and normalizing allowed modes with trusted reset flags ## Verification - exact upstream source/manual/test review at recorded commits - disposable Arch spikes for makepkg sourcing, Paru selection streams, order grammar, config layering/mode reset, and SQLite drivers - citations ledger strict verification - `git diff --cached --check` - independent focused design review: PASS after corrections No implementation plan, production code, or accepted ADR is included.

Rows
Columns