meshcore-client

Commit Graph

Author	SHA1	Message	Date
Strycher	c25b7ccbdf	chore(#335 ): pin drift, commit pubspec.lock, guard the web asset version Owner asked whether the web assets must be re-downloaded on every drift bump. They do not - the version can be pinned - but doing that safely needed three changes, because the failure mode is silent. 1. drift and drift_flutter are pinned EXACTLY (2.34.2 / 0.3.1), no caret. The committed web assets are built for a specific drift release, so a caret would let pub resolve a newer drift than the shipped binaries and break the web build with no signal at compile time. 2. pubspec.lock is now committed (removed from .gitignore). It was ignored, which for an application means resolution can differ between machines and CI. That undermines the pin: the assets are matched against the RESOLVED version, so resolution has to be reproducible. Owner-authorized, and it is a repo-wide change rather than a storage-only one. 3. New test asserting the shipped assets match the resolved drift version, plus that both files exist and the wasm really starts with the WebAssembly magic bytes. Verified in both directions: it passes when matched and fails loudly with re-download instructions when skewed. Without (3) a stale asset compiles, deploys, and only fails in the user's browser - the exact silent-failure class SAFELANE 6 forbids and that produced #333 earlier. Upgrading drift is now a deliberate step: bump the pin, re-download both assets, update web/drift_assets.version. The test fails until you do. flutter analyze clean, tests pass.	2 months ago

Author

SHA1

Message

Date

Strycher

c25b7ccbdf

chore(#335 ): pin drift, commit pubspec.lock, guard the web asset version

Owner asked whether the web assets must be re-downloaded on every drift bump.
They do not - the version can be pinned - but doing that safely needed three
changes, because the failure mode is silent.

1. drift and drift_flutter are pinned EXACTLY (2.34.2 / 0.3.1), no caret. The
   committed web assets are built for a specific drift release, so a caret
   would let pub resolve a newer drift than the shipped binaries and break the
   web build with no signal at compile time.

2. pubspec.lock is now committed (removed from .gitignore). It was ignored,
   which for an application means resolution can differ between machines and
   CI. That undermines the pin: the assets are matched against the RESOLVED
   version, so resolution has to be reproducible. Owner-authorized, and it is
   a repo-wide change rather than a storage-only one.

3. New test asserting the shipped assets match the resolved drift version,
   plus that both files exist and the wasm really starts with the WebAssembly
   magic bytes. Verified in both directions: it passes when matched and fails
   loudly with re-download instructions when skewed.

Without (3) a stale asset compiles, deploys, and only fails in the user's
browser - the exact silent-failure class SAFELANE 6 forbids and that produced
#333 earlier.

Upgrading drift is now a deliberate step: bump the pin, re-download both
assets, update web/drift_assets.version. The test fails until you do.

flutter analyze clean, tests pass.

1 Commits (83f6360f7ec0bd94cf844e1e4ccbb032ef3c879d)