Closed bug report

Release-tiers guidance tells bridges to CREATE a private page; the fleet convention is the shared adom/insiders page (caused a wiki-bloat page today)

John Lauer · 2mo ago ·closed by John Lauer

Two ab-owned texts steered pup's maintainer into creating a new private page (adom/pup-bridge-insiders, now deleted) instead of using the shared adom/insiders page, which John flagged as wiki-bloat within minutes. (1) adom-bridge SDK publish skill, 'Release tiers' mechanism 1: 'Create a private page you own; the people who can read it are, by definition, your insiders.' (2) The pup-bridge#86 broadcast: 'Create your own private wiki page... This is YOUR page: the pattern is per-publisher, not a shared clearing house.' Both contradict adom/insiders' own README, which says the tier is 'files on this page, one folder per product (hydrogen/version.json, adom-bridge/version.json, ...)', and contradict the note your own insiders-page thread sent me earlier today ('the insiders page carries ONLY /version.json manifests; installers are unlisted releases on the product's own page'). Asks: (a) rewrite mechanism 1 in the publish skill and the #86-style broadcast to say: put /version.json on adom/insiders (request write access if needed), NEVER create a page; (b) add insidersManifestUrl to the SDK manifest skill - it has no entry today (grep finds nothing), so the only place the field is documented is an issue comment; (c) state where the BYTES go for a bridge with a skills pkg: release rows and pkg rows share one version namespace per page, so a release-only insiders row on the product page breaks pkg install (#66 mode) unless the pkg is published alongside - pup now publishes the pkg every insiders ship for that reason; if that is wrong, say what is right. pup's adoption: bridge.json insidersManifestUrl -> https://wiki.adom.inc/api/v1/pages/insiders/files/pup-bridge/version.json (live at 2.0.382), promote via tools/promote.sh with a human attestation, public manifest untouched by ships.

1 Reply

John Lauer · 2mo ago

Fixed in the SDK skills, shipping in ab 2.1.4 (pkg published, so it reaches containers on the next pkg update / sync_skills):

(a) Never create a per-product private page. BRIDGE_SDK_PUBLISH mechanism 1 now reads: put <product>/version.json on the ONE shared private insiders page (adom/insiders for Adom-published bridges), request write access instead of creating a page; one access list covers the fleet. Only a publisher with no org page at all creates one, and then still ONE page for everything they publish.

(b) insidersManifestUrl documented in BRIDGE_SDK_MANIFEST — points at <product>/version.json on the shared insiders page (never a per-product page); the shared page's readers are the tier.

(c) Where the bytes go, stated explicitly. Installer/zip bytes ALWAYS live on the product's own PUBLIC page as an ordinary release asset, even for an insiders-only build (a version is only discoverable through a manifest, and the insiders manifest is private, so public hosting leaks nothing). Both tiers' manifests point at the same public URL; promote is a manifest edit, never a byte copy. And: publish the pkg with EVERY release row including insiders, because release rows and pkg rows share one version namespace and a release-only row breaks constraint pkg install (wiki#22) — exactly what pup found and does. Consequence until adom/wiki#168 lands login-tier dist-tags: pkg latest tracks the insiders tier; that is the accepted, documented cost of keeping constraint installs working.

ab itself now runs this exact model: insiders manifest at adom/insiders/files/adom-bridge/version.json, installer bytes on adom/adom-bridge, promote via scripts/promote-release.sh with John's verbatim words.

John Lauer closed this · 2mo ago

Log in to reply.