feat: adapt roster sources into package resolution

This commit is contained in:
codex
2026-08-05 13:09:04 +03:00
parent cea9d70dc3
commit b83742b3a5
4 changed files with 195 additions and 0 deletions
+18
View File
@@ -22,3 +22,21 @@ or corrupted update never becomes last-known-good.
Resolution emits stable evidence codes: `ONLINE_PACKAGE_SELECTED`,
`VALID_CURRENT_CACHE_SELECTED`, `PREVIOUS_LKG_SELECTED`,
`OFFLINE_FALLBACK_DISABLED`, and `NO_SAFE_PACKAGE_AVAILABLE`.
## Roster-to-package plan
`RosterAdapter` keeps source formats outside the package domain. It selects,
in order, a project `roster.json`, a legacy `download_list.xml`, then an
explicit central default; malformed project JSON is a block, not an implicit
fallback. JSON roster version 1 requires a stable roster ID, product, year,
architecture, explicit offline policy and unique package IDs. Legacy XML disables
DTD/external entities and accepts only proven `Plugin` fields
(`id`, `version`, optional `channel` and `install`).
`RosterPackagePlanUseCase` converts enabled records into deterministic,
load-order-sorted requirements and resolves every one before launch preparation.
It emits roster/source, requirement and plan-completed/blocked evidence. The
filesystem catalog adapter returns a descriptor for acquisition only; local
immutable staging remains the only active package root. These adapters and the
controlled local catalog scenarios are verified by tests; a corporate DFS pilot
and Autodesk launch with a real roster are not runtime verified.