FA-9991 / Packaging / Open access
Package publication plan: Immutable versions are overwritten · case 01
Immutable versions are overwritten.
ROOT CAUSE
The implementation substitutes return 'publish' for return 'immutable-conflict', so immutable versions are overwritten.
VERIFIED REPAIR
Reject changed content at an existing version.
Unsuccessful approach: The attempted repair substitutes return 'skip'. Fixture 3 still yields 'skip' instead of 'immutable-conflict'.
Case contract
Reject an immutable version with changed digest; skip equal published digests; reject missing attestations; reject private packages on public registries; otherwise publish. Existing equality takes precedence over publication checks.
Why this case matters
An offline model of package publication plan, suitable for testing build and release tooling without external services.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(version, digest, existing, attested, private, registry):
if version in existing:
if existing[version] == digest: return 'skip'
return 'publish'
if not attested: return 'missing-attestation'
if private and registry == 'public': return 'private-package'
return 'publish'
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('1', 'a', {}, True, False, 'public'), 'publish')
check('fixture 2', solve('1', 'a', {'1': 'a'}, False, True, 'public'), 'skip')
check('fixture 3', solve('1', 'a', {'1': 'b'}, True, False, 'public'), 'immutable-conflict')
check('fixture 4', solve('1', 'a', {}, False, False, 'public'), 'missing-attestation')
check('fixture 5', solve('1', 'a', {}, True, True, 'public'), 'private-package')
check('fixture 6', solve('1', 'a', {}, True, True, 'private'), 'publish')
check('fixture 7', solve('2', 'a', {'1': 'b'}, True, False, 'public'), 'publish')
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | publish | publish | Passed |
| fixture 2 | skip | skip | Passed |
| fixture 3 | publish | immutable-conflict | Failed |
| fixture 4 | missing-attestation | missing-attestation | Passed |
| fixture 5 | private-package | private-package | Passed |
| fixture 6 | publish | publish | Passed |
| fixture 7 | publish | publish | Passed |
SHA-256 / ed5f3cd13306312ab0d366d9feecade51c7a84cf0d75d17642c7b3095e75675b
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(version, digest, existing, attested, private, registry):
if version in existing:
if existing[version] == digest: return 'skip'
return 'skip'
if not attested: return 'missing-attestation'
if private and registry == 'public': return 'private-package'
return 'publish'
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('1', 'a', {}, True, False, 'public'), 'publish')
check('fixture 2', solve('1', 'a', {'1': 'a'}, False, True, 'public'), 'skip')
check('fixture 3', solve('1', 'a', {'1': 'b'}, True, False, 'public'), 'immutable-conflict')
check('fixture 4', solve('1', 'a', {}, False, False, 'public'), 'missing-attestation')
check('fixture 5', solve('1', 'a', {}, True, True, 'public'), 'private-package')
check('fixture 6', solve('1', 'a', {}, True, True, 'private'), 'publish')
check('fixture 7', solve('2', 'a', {'1': 'b'}, True, False, 'public'), 'publish')
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | publish | publish | Passed |
| fixture 2 | skip | skip | Passed |
| fixture 3 | skip | immutable-conflict | Failed |
| fixture 4 | missing-attestation | missing-attestation | Passed |
| fixture 5 | private-package | private-package | Passed |
| fixture 6 | publish | publish | Passed |
| fixture 7 | publish | publish | Passed |
SHA-256 / 9aadc778f02b232921b6dce7ed6da92e059a98dd4dbc6c5af13b3da3a1556008
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
N = 1
observations = []
def solve(version, digest, existing, attested, private, registry):
if version in existing:
if existing[version] == digest: return 'skip'
return 'immutable-conflict'
if not attested: return 'missing-attestation'
if private and registry == 'public': return 'private-package'
return 'publish'
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
check('fixture 1', solve('1', 'a', {}, True, False, 'public'), 'publish')
check('fixture 2', solve('1', 'a', {'1': 'a'}, False, True, 'public'), 'skip')
check('fixture 3', solve('1', 'a', {'1': 'b'}, True, False, 'public'), 'immutable-conflict')
check('fixture 4', solve('1', 'a', {}, False, False, 'public'), 'missing-attestation')
check('fixture 5', solve('1', 'a', {}, True, True, 'public'), 'private-package')
check('fixture 6', solve('1', 'a', {}, True, True, 'private'), 'publish')
check('fixture 7', solve('2', 'a', {'1': 'b'}, True, False, 'public'), 'publish')
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 1 | publish | publish | Passed |
| fixture 2 | skip | skip | Passed |
| fixture 3 | immutable-conflict | immutable-conflict | Passed |
| fixture 4 | missing-attestation | missing-attestation | Passed |
| fixture 5 | private-package | private-package | Passed |
| fixture 6 | publish | publish | Passed |
| fixture 7 | publish | publish | Passed |
SHA-256 / 547ca9fee9b6a8d368115b3a6c8eda59df0d444f3bf68ecea0f97f67e9e723db
Verification & scope
This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:38:34.802108+00:00.
Case digest / 3b39f7e622c8e8d894bbdbfc5cb39c089e0ca5cd377b46c8fc3e0072ae352823