[kixelated]

Problem

Each rind-<consumer> adapter carried its own version (0.2.0, 0.1.14), so a reader couldn't tell from rind-rustls 0.2 which rustls it serves, and the launch post would quote versions unrelated to their upstreams.
The maintainer decided on 2026-11-07 that each adapter's version begins with the breaking part of its upstream's.

Approach

• Versions, set by hand: rind-ring 0.17.0, rind-rustls 0.23.0, rind-rcgen 0.14.0, rind-object-store 0.14.0, rind-dimpl 0.9.0, rind-jsonwebtoken 11.0.0.
• sh/adapter-versions.sh reads cargo metadata and fails when a published adapter's version doesn't begin with the breaking part (major.minor below 1.0, major from 1.0 on) of its requirement on the dependency named after it. rind-ring implements ring's API without depending on ring, so it declares package.metadata.rind.upstream = "0.17". A new versions module in sh/dispatch.sh runs it in just ci whenever an adapter's Cargo.toml changes, so a drifting release PR fails CI. rind-instant-acme is publish = false and is checked once it ships.
• Install lines: README's rind-rustls = "0.23", and version = "0.17" for rind-ring in its README, crate docs, MIGRATING.md, and MIGRATE.md (which said <latest>, now predictable).
• CONTRIBUTING.md's Releases section states the rule and what release-plz can't prevent; AGENTS.md's adapter line states the rule (maintainer-approved edit).
• Deletes the quest and its links; rind-rustls-0.24's Plan now links CONTRIBUTING.md.

How release-plz treats the hand-set versions

Checked in release-plz 0.3.172's source (the dev shell's version, tag release-plz-v0.3.172):

• get_package_diff in command/update/updater.rs: when the local version is greater than the registry's, it logs "local version > registry version. Only changelog will be updated." and marks the version unpublished.
• Diff::should_update_version is then false, so next_from_diff returns the local version unchanged: no semver-check or commit-based bump on top. Dependency-driven updates also keep it (patch_increment only when is_version_published).
• Since this PR's commit touches each adapter, each one enters the next release PR at exactly its hand-set version with a changelog entry, replacing the 0.2.1 bumps in moq-dev/rind#424, which release-plz regenerates after this merges. release-plz release then publishes each local version absent from crates.io when that release PR lands (release_always = false).
• It can't cap a bump: a breaking change cargo-semver-checks finds, or a ! commit, still makes it propose the next breaking version (0.23.0 -> 0.24.0). No .release-plz.toml setting prevents that (features_always_increment_minor already defaults to false, so a feat stays a patch below 1.0), so this PR adds none; the just ci check fails such a release PR instead, and CONTRIBUTING.md says to hold or revert the breaking change.

Impact

• Breaking for dependents' manifests only, no API change: rind-ring = "0.2" and the like no longer pick up releases. Migrate by writing the adapter's new version, such as rind-rustls = "0.23" or ring = { package = "rind-ring", version = "0.17" }.
• No wire impact.

Alternatives

• A per-crate Rust test comparing CARGO_PKG_VERSION with the manifest: six copies, and it needs the manifest parsed anyway. One script over cargo metadata covers every adapter, including future ones.
• Turning off semver_check for adapters so release-plz never proposes a breaking bump: it would then ship an undetected API break as a patch. Kept on so drift fails loudly.
• rind-ring's upstream read from its description or a ring dev-dependency: the first is prose, the second builds ring's C in tests. Declared metadata is explicit and cheap.

Choices made without asking

• rind-jsonwebtoken starts at 11.0.0, not 11.1.x, though it requires jsonwebtoken 11.1: only the major must match, and the rest is the adapter's own.
• Adapter READMEs without an install line (dimpl, jsonwebtoken, object-store, rcgen, rustls) don't gain one; only existing lines changed.
• The title carries ! because dependents must edit their manifests to keep receiving releases.

Follow-ups

None.

Validation

• sh/adapter-versions.sh on the base reports all six adapters (rind-ring for the missing upstream), and passes on this branch.
• just ci origin/main (every module, since sh/dispatch.sh changed) passes on 87dc8d2.

Models

Size: S
Implementer: Claude Code, claude-opus-5-5, high effort

🤖 Generated with Claude Code

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, medium effort
• Session: 01a1b456-b0b0-7811-84a0-1046a65821e2, round 1
• Head: 87dc8d2
• Base: origin/main at 78776d3
• Score: 10/10, The specified diff aligns adapter versions and documentation, integrates the drift check into CI, and passes adapter-version and shell syntax validation without introducing actionable defects.
• Findings: none

(Written by Claude Opus 5.5 with high)

[pullfrog]

Your OpenCode Go account is out of credit. Top it up, then re-trigger Pullfrog.

OpenCode Go's response

provider error: Insufficient account funds

Top up OpenCode Go →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using glm-5.3}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a4d62b68-c4ca-4a3c-b5a2-4134322a4c37

Commits

Reviewing files that changed from the base of the PR and between 10d344f and 87dc8d2.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 19

• AGENTS.md
• CONTRIBUTING.md
• MIGRATE.md
• MIGRATING.md
• README.md
• quest/m1/README.md
• quest/m1/adapter-versions.md
• quest/m1/launch-post.md
• quest/m2/adoption/rind-rustls-0.24.md
• rind-dimpl/Cargo.toml
• rind-jsonwebtoken/Cargo.toml
• rind-object-store/Cargo.toml
• rind-rcgen/Cargo.toml
• rind-ring/Cargo.toml
• rind-ring/README.md
• rind-ring/src/lib.rs
• rind-rustls/Cargo.toml
• sh/adapter-versions.sh
• sh/dispatch.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed head 87dc8d2 against base 10d344f.

No actionable defects found for the current adapter manifests. All six new versions match their upstream breaking prefixes and lockfile entries. The metadata override handles rind-ring without introducing a ring dependency; normal dependency selection excludes dev-dependencies, and hyphen/underscore normalization handles object_store. The version module is included in check/ci, selected for adapter manifest changes and checker changes, and missing tools fail under CI_STRICT. Existing install examples now use the matching prefixes. No cryptographic implementation changes are included.

Direction: retain the documented distinction between enforcing the prefix in CI and preventing release-plz from proposing a bump. Before the next release lands, inspect its regenerated versions/changelogs rather than reusing the old #424 contents. Small metadata fixtures for matching/mismatching pre-1.0 and >=1.0 versions, the ring override, and publish=false would make the check's contract durable. If an adapter later restricts publication to a named registry or inherits its upstream requirement from the root workspace, extend package selection/change triggers to cover that case.

Limits: GitHub-only static review of the full diff, current adapter dependencies, dispatch implementation and release-plz configuration. I did not run cargo metadata, jq, CI, release-plz, registry publication, or quest validation, and did not independently reproduce the PR's release-plz source investigation. This COMMENT is not release or merge approval.