writeonce/docs/stories/language-runtime-database/15-deps-package-manager.md
shoney.arickathil 1fe808b7a4 docs(stories): add readiness, retire status: refine, sweep all 47 iterations
- `readiness: ready | refine` is a SECOND axis, orthogonal to status.
  `ready` = the brainstorm is complete and the decisions are LOCKED (a spec
  approved, or the forks explicitly confirmed). `refine` = open forks remain
  and it cannot be planned yet
- `status: refine` RETIRED because it carried both meanings at once, so a held
  iteration with an approved spec (language 18, 26) was indistinguishable from
  one nobody had thought about. status is now purely where the WORK is:
  done | in-progress | pending | hold — `pending` was already the board's own
  rendering word, so nothing new was invented
- all 47 iterations classified from EVIDENCE in their own text, not by guess:
  "the four forks are SETTLED" / "spec + plan approved" / "Approved spec:" for
  ready; "Forks the spec must settle" / "no spec exists yet" for refine. Every
  shipped iteration is ready by definition. 19 done, 5 in-progress, 15
  pending, 8 hold; 27 ready, 20 refine
- two iterations moved refine -> in-progress rather than -> pending: language
  31 and 34 are absorbed into 24 and work on them is literally happening, which
  the board already showed as 🔄 while their frontmatter said otherwise. That
  disagreement is now gone
- board legend, board-views' frontmatter contract, and two new Dataview
  queries updated — the useful one being `readiness: ready AND status:
  pending`, the startable set

WHAT THE NEW AXIS IMMEDIATELY SURFACED: of 15 pending iterations, exactly ONE
is startable — databasev2 4, io_uring group-commit, whose forks were confirmed
settled 2026-08-20. Everything else pending needs a brainstorm first. That was
invisible while one key carried both meanings, and it is now on the board.

Also caught by the sweep, unrelated to readiness but found by cross-checking
frontmatter against the board: SIX duplicate rows. Every iteration moved into
databasev2 was still listed in the LANGUAGE pending table under its retired id
(23, 32, 33, 20, 21, 27) as well as its new one. Stale copies removed. And two
databasev2 rows made claims the sweep contradicts — iteration 1 was billed
"startable today" while its forks are open, and 6 still called itself the
ceiling-raiser after 2 took that role.

Docs only. linkcheck 0 broken / 0 anchors.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-27 16:54:45 +02:00

64 lines
3 KiB
Markdown

---
iteration: "15"
status: done
readiness: ready
---
# Iteration 15 — dependencies: `wo.toml [deps]`, git fetch, `wo.lock`
> Format: `product/story-iteration-template`. Part of
> [Story — one language, one runtime, one database, one binary](00-story.md).
>
> **Inserted 2026-08-18. LANDED the same day** (branch `web-framework`): all
> acceptance criteria met — `just deps-accept` 8/0 (cold fetch + lock, use
> <dep> and <dep>/sub, offline-when-locked with the remote deleted,
> lock-beats-moved-tag, --update-deps, drift/transitive/collision
> diagnostics WO-E106/E107, dep `fn main` never the entry, manifest shape).
> The enabler for code shared between writeonce repositories — the web
> framework (iteration 16) is the driving consumer.
>
> **Spec exists:** [`2026-08-18-web-framework-design.md`](../../superpowers/specs/2026-08-18-web-framework-design.md)
> section A is normative for this iteration. **Plan:**
> [`2026-08-18-deps-package-manager.md`](../../superpowers/plans/2026-08-18-deps-package-manager.md)
> (5 tasks: manifest inline-table + [deps]; resolver fetch/cache/lock;
> multi-root discovery + module mapping + entry restriction; the
> `just deps-accept` gate over file:// remotes; docs closeout).
## Goals
- A project declares exact-rev git dependencies in `wo.toml [deps]`
(`name = { git = "...", rev = "..." }`); `woc` fetches them (via the `git`
binary — no network code in the compiler) into `.wo-deps/<name>/` and
resolves `use <name>` / `use <name>/sub` into the dep's module tree.
- `wo.lock` pins resolved SHAs: builds are reproducible, a moved tag is
reported rather than silently followed, and a lock-satisfied build never
touches the network.
- Honest edges: transitive `[deps]` refused with a diagnostic (flat-only v1),
dep/local module-name collisions diagnosed, a dep's `fn main` ignored,
`pub` applies across the boundary exactly as across modules.
## Acceptance Criteria
- **Given** an app whose `[deps]` names a framework in a local `file://` git
repo, **when** `woc <app>` runs twice, **then** the first run fetches +
writes `wo.lock`, the second builds offline from `.wo-deps`, and the built
binary runs.
- **Given** the dep's tag moved after `wo.lock` was written, **when** the app
builds, **then** the lock wins and the drift is reported;
`woc --update-deps` refreshes it.
- **Given** a dep whose own `wo.toml` has `[deps]`, or a dep name colliding
with a local module, **when** the app builds, **then** each is a named
diagnostic, never silent misresolution.
## Out Of Scope
Registries, version ranges/semver solving, transitive dependencies (the
successor's first fork), private-remote auth handling beyond what ambient
`git` config provides, vendoring commands.
## Proposed Solution
Manifest parsing extends `compiler/bin/main.ml`'s existing wo.toml reader;
fetch = `Sys.command` over the `git` binary; resolution plugs the dep root
into the existing directory-as-module discovery. Fixtures under `tests/` use
local `file://` remotes so the suite stays network-free.