[abrichr]

The platform manifest generator can now pin Flow, Types, Agent and Desktop releases made from this monorepo. Before this, it knew only the frozen standalone repositories and their v<version> tags, so it refused every monorepo release:

FATAL: OpenAdaptAI/openadapt-flow has no published release tag for 2.2.0. Tried v2.2.0.

This blocks the launcher 1.18.0 release. It raises the Flow floor to 2.2.0, and the release gate (validate_platform_manifest --launcher-candidate) then needs a BOM that pins Flow 2.3.0 and openadapt-types 0.24.0.

What changes

Generator (scripts/generate_platform_manifest.py)

• _release_sources(role, version) lists the tags that may identify a version, in order:

  • for a folded component, the monorepo first: OpenAdaptAI/OpenAdapt@<package>-v<version> under packages/<dir>;
  • then the standalone repository and its existing v<version> (or Desktop desktop-v<version>) tags, for releases from before the fold.

  The first tag that exists is bound. Nothing is invented.

• A monorepo release records source_root (packages/flow) in its provenance, and its provenance URL points at that directory.

• Schema sources, qualification-evidence paths and the Desktop sidecar uv.lock are read under source_root. Evidence rows in QUALIFICATION_EVIDENCE are now package-relative, and their repository comes from the selected release.

• Standalone provenance is unchanged byte for byte: there is no source_root key, and the URLs and paths are the same.

Validator (scripts/validate_platform_manifest.py)

• A component's provenance must be one of its release sources: repository, tag and directory together. Rejected combinations include the monorepo tag with the standalone repository, another package's directory, a monorepo release without its directory, and a tag for another version.
• Each evidence pointer's expected repository and path come from the selected release. The Desktop sidecar's lock URL comes from the Desktop provenance.

Manifest: regenerated with the same published selection. Only the generator hash and generation time change (the report too).

Docs: docs/platform-manifest.md describes the two tag forms and source_root.

Checks

• New tests/test_platform_manifest_monorepo.py (14 tests):
  • monorepo-first lookup and the standalone fallback;
  • the tags-tried message;
  • package-relative paths, schema sources read under packages/flow, and the sidecar lock URL in both forms;
  • the validator accepting both forms and refusing four mismatched provenances and an evidence path outside the package.
• The manifest, platform-version, release-lock and release-component suites: 83 passed. ruff 0.17.0 check and format are clean.
• Live dry run: agent 2.2.1 and Desktop 0.22.0 bound to openadapt-agent-v2.2.1 and openadapt-desktop-v0.22.0. The sidecar lock came from packages/desktop/uv.lock, and online validation passed, including commit, tree and lock digests. Flow 2.0.0 and types 0.18.0 fell back to their standalone tags.
• The regenerated manifest passes online validation (--require-compatible --launcher-candidate).

Not pinnable, by design

• Flow 2.2.0: it declares no openadapt-types range, because its contracts were bundled in, and the customer-runner unit needs one.
• openadapt-types 0.23.0: it re-exports Flow's models and ships no openadapt_types/*.py schema sources.

The generator refuses both with a named reason. Flow 2.3.0 requires openadapt-types>=0.24.0,<0.25.0, and types 0.24.0 has the sources again, so the 1.18.0 BOM pins those two.

🤖 Generated with Claude Code