Description
Phase 1 of #448. Correct the Bazel inventory, remove stale Bazel documentation,
and settle the exception question.
The guard is not a single allowlist. It has three mechanisms, and conflating them
is what makes an allowlist rot, because it cannot distinguish "not yet" from
"never":
- Vendored-path exclusions. Exact paths. A vendored third-party module is
outside the guard's remit and needs no justification.
- A migration and retirement ledger. Every nested module that still exists but
is scheduled to go away, with its target phase and whether it goes by
migration or by removal. rules/oci-destinations is a retirement entry: it is
migration scaffolding that disappears once its five consumers no longer need
it. The ledger must shrink monotonically.
- Permanent service exceptions. Only these carry the exception contract, and
only these survive the final phase.
nvsnap is the open question, and it is not settled in advance. An earlier draft
excluded it permanently on the grounds that its base image is not publicly
pullable. That rationale is stale: its current Bazel targets pin public
gcr.io/distroless/static, docker.io/library/ubuntu, and
docker.io/library/alpine by digest and build on @distroless_static. Private
NGC is the publish destination, not the base. The legacy
docker/agent/Dockerfile.app does default to a private base, which is the likely
origin of the claim, but that path is not what consolidation moves. This phase
decides nvsnap on current evidence rather than inheriting a workflow comment.
Every permanent exception records: owner and rationale, the retained module and
its CI entry point, how the component sources first-party dependencies, residual
correctness risk, and a dated revisit trigger. An entry missing any of these is
unfinished work, not an exception.
Definition of Done
- The three guard mechanisms exist and are distinguishable.
- Every ledger entry has a target phase; every permanent exception has a contract.
nvsnap is either migrated or holds a contract based on current evidence.- Stale Bazel documentation removed.
tools/ci/bazel-consolidation-inventory output matches the plan.
Resources
Description
Phase 1 of #448. Correct the Bazel inventory, remove stale Bazel documentation,
and settle the exception question.
The guard is not a single allowlist. It has three mechanisms, and conflating them
is what makes an allowlist rot, because it cannot distinguish "not yet" from
"never":
outside the guard's remit and needs no justification.
is scheduled to go away, with its target phase and whether it goes by
migration or by removal.
rules/oci-destinationsis a retirement entry: it ismigration scaffolding that disappears once its five consumers no longer need
it. The ledger must shrink monotonically.
only these survive the final phase.
nvsnapis the open question, and it is not settled in advance. An earlier draftexcluded it permanently on the grounds that its base image is not publicly
pullable. That rationale is stale: its current Bazel targets pin public
gcr.io/distroless/static,docker.io/library/ubuntu, anddocker.io/library/alpineby digest and build on@distroless_static. PrivateNGC is the publish destination, not the base. The legacy
docker/agent/Dockerfile.appdoes default to a private base, which is the likelyorigin of the claim, but that path is not what consolidation moves. This phase
decides
nvsnapon current evidence rather than inheriting a workflow comment.Every permanent exception records: owner and rationale, the retained module and
its CI entry point, how the component sources first-party dependencies, residual
correctness risk, and a dated revisit trigger. An entry missing any of these is
unfinished work, not an exception.
Definition of Done
nvsnapis either migrated or holds a contract based on current evidence.tools/ci/bazel-consolidation-inventoryoutput matches the plan.Resources