Skip to main content

OSS Inventory

OSS Inventory / Version Truth / Upgrade Readiness

This document defines the canonical repo-owned truth for OSS components used by jhf-spindle.

Canonical Sources​

  • Inventory: maintenance/oss-inventory.json
  • Version truth: maintenance/oss-version-truth.json
  • Upgrade policy: maintenance/oss-upgrade-policy.json
  • ERPNext v16 target truth: maintenance/erpnext-v16-upgrade-target.json
  • Verifier: maintenance/verify_oss_inventory_version_truth.py

The machine-readable truth is fail-closed and includes explicit upgrade-governance fields per relevant runtime family:

  • current_version
  • target_version
  • allowed_version_range
  • pinning_posture
  • compatibility_window_ref
  • preflight_assertion_refs
  • postdeploy_assertion_refs
  • rollback_contract_ref
  • evidence_contract_ref

Every inventory component also declares license, license_class, and license_evidence_url. The current baseline is deliberately unreviewed: NOASSERTION / unknown_blocked / https://anyfer.com/legal. A reviewed classification requires an approved SPDX identifier, a whitespace-free component-specific evidence URL, and a Fabric decision reference to JaddaHelpifyr/helpifyr-fabric#1540 or #1541. This is a fail-closed metadata posture only; it does not approve a component license, redistribution, managed hosting, public publication, or deployment.

The pinned ERPNext/Frappe major-upgrade target remains explicit and machine-readable even after the repo-owned mainline runtime truth moved to the admitted v16/11.8 lane. The historical live baseline and conservative patch-train posture (v15.0.0 -> latest stable v15 patch -> pinned v16 target) stay recorded so Host73/Host172 rollout evidence can still prove how the uplift was admitted.

Scope Boundary​

jhf-spindle owns the ERP-/Identity-near OSS truth for this repository.

Allowed:

  • repo-owned, machine-readable inventory and version truth
  • fail-closed drift checks in local verify and CI
  • explicit classification of external-owner surfaces

Forbidden:

  • local workaround for foreign-owner runtime drift
  • shadow truth outside the canonical JSON files listed above
  • storing secrets/tokens in docs, evidence, or contracts

Verify Path​

Local:

python maintenance/verify_oss_inventory_version_truth.py --output test-results/oss-version-truth.verify.json

The same verifier also validates that maintenance/erpnext-v16-upgrade-target.json:

  • stays aligned with the admitted ERPNext/Frappe v16 runtime truth in maintenance/oss-version-truth.json
  • keeps the conservative two-hop patch-train for the historical v15.0.0 baseline
  • pins explicit v16 ERPNext/Frappe targets instead of floating latest
  • declares the required Python/Node/MariaDB floors while leaving live Host172 drift fail-closed until deployment closes the DB gate

Optional bounded live check:

python maintenance/verify_oss_inventory_version_truth.py --check-live --ssh-target <internal-runtime-redacted><internal-runtime-redacted> --output artifacts/evidence/oss-version-truth.live.json

CI:

  • python maintenance/verify_oss_inventory_version_truth.py --output test-results/oss-version-truth.verify.ci.json
  • smoke test lane also executes:
    • apps/jhf_spindle_core/tests/test_verify_oss_inventory_version_truth_script.py

Guardrail On Floating Versions​

  • latest and floating refs must fail verification unless owner policy declares an explicit external-owner exception.
  • missing upgrade-governance fields must fail verification.
  • missing, duplicate, malformed, or unsupported legal-review metadata must fail verification.
  • Runtime image refs should be digest-pinned (@sha256:...) or explicit stable tags per policy.
  • CI action refs must be pinned to approved stable refs per version truth.
  • The ERPNext v16 target manifest and admitted repo runtime truth are still not authorization to mutate Host73 or Host172 on their own. Deployment-owned cutover and DB-gate evidence remain mandatory.

License notice: AGPLv3 (GNU Affero General Public License v3.0) Website: https://helpifyr.com