registry: validate generated Python dependency metadata before Nix evaluation #207

New issue

Closed

opened 2026-09-08 02:03:13 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:13 +00:00

Owner

Problem

python_dependencies is consumed directly by flake.nix to select Python packages for plugin test/install/runtime environments, but the registry validator does not currently validate its shape. A malformed list, blank value, whitespace-padded name, or duplicate can pass registry validation and fail later during Nix evaluation with a poor catalog-level error.

Scope

when present, require a list of unique non-empty canonical strings
reject surrounding whitespace and non-string values
deterministic RED-first tests
no dependency allowlist: package existence remains Nix's authoritative check
no Zara Core/runtime changes

Gate

Compatibility contract tests, full nix flake check, generated package builds.

## Problem `python_dependencies` is consumed directly by `flake.nix` to select Python packages for plugin test/install/runtime environments, but the registry validator does not currently validate its shape. A malformed list, blank value, whitespace-padded name, or duplicate can pass registry validation and fail later during Nix evaluation with a poor catalog-level error. ## Scope - when present, require a list of unique non-empty canonical strings - reject surrounding whitespace and non-string values - deterministic RED-first tests - no dependency allowlist: package existence remains Nix's authoritative check - no Zara Core/runtime changes ## Gate Compatibility contract tests, full `nix flake check`, generated package builds.

nsaspy closed this issue

2026-09-08 02:03:13 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:37 +00:00

coding: validate worktree HEAD object IDs #377