Repair plugin API dependency coordinate

Author: DmytroMitin

.github/workflows/test.yml

@@ -29,5 +29,8 @@ jobs:
           java -version
           sbt -batch verifyJdkVersionEnforcement
 
+      - name: Verify build dependency coordinates
+        run: sbt -batch verifyBuildDependencyCoordinatePolicy
+
       - name: Run tests
         run: sbt test

README.md

@@ -29,6 +29,7 @@ Useful project docs:
 - [Generated-origin position feasibility history](docs/quasiquotes-generated-origin-position-contract-feasibility.md)
 - [Experimental API surface](docs/experimental-api-surface.md)
 - [Experimental plugin API surface baseline](docs/experimental-plugin-api-surface-baseline.md)
+- [`pluginApi` dependency-coordinate integrity](docs/plugin-api-dependency-coordinate-integrity.md)
 - [Precompiled handler execution and output contract](docs/precompiled-handler-execution-and-output-contract.md)
 - [Structured expansion output role contract](docs/structured-expansion-output-role-contract.md)
 - [Annotated-class shape and admission contract](docs/annotated-class-shape-and-admission-contract.md)
@@ -189,6 +190,18 @@ the pinned experimental build, not stable API, cross-version compatibility,
 artifact publication, or release policy. See the
 [experimental plugin API surface baseline](docs/experimental-plugin-api-surface-baseline.md).
 
+Prompt 78 repairs the `pluginApi` compiler dependency organization to exactly
+`org.scala-lang`. `verifyBuildDependencyCoordinatePolicy` checks the effective
+sbt declarations, exact compiler/version/scope, toolchain pins, root aggregate,
+and retained Prompt 77 verifier in 14 bounded cases.
+`verifyPluginApiCleanResolution` then copies the target-free repository to a
+disposable directory, resolves with fresh task-owned Coursier/Ivy state,
+compiles and packages `pluginApi`, audits the thin JAR, and deletes the copy and
+cache. The clean package remains 175956 bytes, 126 entries, and SHA-256
+`f5221f7bb27586f9994b4daca420676ade624c40a67f54f3fe8aa71de411be79`;
+the Prompt 77 surface SHA remains unchanged. See
+[`pluginApi` dependency-coordinate integrity](docs/plugin-api-dependency-coordinate-integrity.md).
+
 Before either direct splicing or a composition-state update, the plugin
 validates both successful forms. Structured output receives null-safe role,
 kind, uniqueness, and package-conflict validation, is canonicalized, and then

ROADMAP.md

@@ -493,9 +493,28 @@ and missing-API negative compiles fail without output. This checkpoint does not
 promise stable or cross-version compatibility, Maven publication, semantic
 versioning, or release readiness.
 
-The next bounded decision must be driven by a concrete packaged-consumer,
-classloader, or authoring problem. Do not add another generic adapter or promote
-the exact-build manifest into a public compatibility promise automatically.
+Controller review then found that Prompt 77 had committed an invalid
+prompt-contaminated organization for the `pluginApi` compiler dependency.
+Prompt 78 repairs that coordinate and establishes:
+
+```text
+PLUGIN_API_DEPENDENCY_COORDINATE_REPAIRED
+PLUGIN_API_CLEAN_RESOLUTION_AND_PACKAGE_PROVEN
+EXPERIMENTAL_PLUGIN_API_SURFACE_BASELINE_RESTORED
+```
+
+The effective-coordinate policy passes 14/14 cases. A target-free disposable
+copy resolves the exact `org.scala-lang:scala3-compiler_3` dependency through a
+fresh task-owned cache, clean-compiles and packages the API, reproduces the
+175956-byte/126-entry JAR and SHA-256
+`f5221f7bb27586f9994b4daca420676ade624c40a67f54f3fe8aa71de411be79`,
+and deletes both repository copy and cache. The canonical Prompt 77 manifest
+remains byte-identical with normalized SHA-256
+`039a25870ed7265a657bb5262f86e0af13a35672f942db7a81d4ba66184217e0`.
+
+Only after this repair may the next bounded broad-vs-small experimental API
+decision resume. Do not add another generic adapter or promote the exact-build
+manifest into a public compatibility promise automatically.
 
 ## Known Risks
 

bootstrap-prompt.md

@@ -110,7 +110,8 @@ The current project state is a minimal Scala 3 research compiler-plugin project
   manual dispatch or Sunday 04:17 UTC schedule, keeps failures visible, has
   read-only permissions, uploads 14-day bounded evidence, and never runs on
   push, pull request, or merge. The ordinary pinned `Test` workflow remains
-  byte-identical.
+  blocking; Prompt 78 adds only its required local dependency-coordinate gate
+  before the main tests and refreshes the policy-owned workflow hash.
 - `project/RecurringExactNightlyWorkflowPolicy.scala`,
   `project/RecurringExactNightlyWorkflowPolicySpec.scala`, and
   `verifyRecurringExactNightlyWorkflowPolicy` make the workflow and invariant
@@ -134,6 +135,12 @@ The current project state is a minimal Scala 3 research compiler-plugin project
   handler linkage probes. Classification is
   `EXPERIMENTAL_PLUGIN_API_SURFACE_BASELINE_READY`; it is not a stable API or
   cross-version compatibility promise.
+- Prompt 78 repairs the invalid prompt-contaminated `pluginApi` compiler
+  organization to `org.scala-lang`, adds a 14-case effective-coordinate policy,
+  and proves target-free/fresh-cache resolution and packaging. Classifications
+  are `PLUGIN_API_DEPENDENCY_COORDINATE_REPAIRED`,
+  `PLUGIN_API_CLEAN_RESOLUTION_AND_PACKAGE_PROVEN`, and
+  `EXPERIMENTAL_PLUGIN_API_SURFACE_BASELINE_RESTORED`.
 - The build adds `Resolver.scalaNightlyRepository` because research plugins are only enabled on nightly or snapshot Scala 3 builds.
 - The plugin defines custom built-in marker annotations in `paradise3.gen` and `paradise3.debug`.
 - The experimental handler API defines `paradise3.api.expander`, a tiny `paradise3.api.helpers.ExpansionHelpers` convenience layer, `paradise3.externalDebug`, `paradise3.externalCompanionDebug`, `paradise3.externalSiblingDebug`, `paradise3.externalLabel`, `paradise3.externalTypedLabel`, `paradise3.externalMarker`, and fixture-only `paradise3.externalQuasiquotesTerm` in `pluginApi` for the precompiled external-handler loading spikes.
@@ -733,6 +740,12 @@ Create these files:
 222. `docs/experimental-plugin-api-surface-baseline.md`
 223. `prompts/77.codex.experimental.plugin.api.surface.baseline.and.isolated.handler.linkage.contract.prompt.md`
 224. `reviews/77_chatgpt_experimental_plugin_api_surface_baseline_handoff/README.md`
+225. `project/BuildDependencyCoordinatePolicy.scala`
+226. `project/BuildDependencyCoordinatePolicySpec.scala`
+227. `project/PluginApiCleanResolution.scala`
+228. `docs/plugin-api-dependency-coordinate-integrity.md`
+229. `prompts/78.codex.plugin.api.dependency.coordinate.repair.and.clean.resolution.proof.prompt.md`
+230. `reviews/78_chatgpt_plugin_api_dependency_coordinate_repair_handoff/README.md`
 
 ## File Requirements
 
@@ -2344,8 +2357,10 @@ Create these files:
   `verifyJdkVersionEnforcement`, and exactly one
   `verifyNewerExactNightlyCompatibility` command. Never duplicate the ladder or
   put the exact Scala version/discovery logic in YAML.
-- Keep the normal `.github/workflows/test.yml` byte-identical and blocking for
-  push/PR. The recurring workflow is non-blocking because it has no
+- Keep the normal `.github/workflows/test.yml` pinned and blocking for push/PR,
+  including Prompt 78's dependency-coordinate policy before the main tests.
+  Refresh its policy-owned hash only when a separately reviewed task changes
+  that workflow. The recurring workflow is non-blocking because it has no
   push/PR/merge trigger, while its failures remain visible.
 - Keep the recurring workflow policy model/spec/task and its synthetic drift
   checks. Preserve the exact descriptor and hashes, root Scala, sbt, JDK,
@@ -2448,6 +2463,32 @@ Create these files:
   drift evidence, not stable/cross-version compatibility, semantic versioning,
   Maven publication, or release policy.
 
+### Prompt 78 and review handoff
+
+- Keep the `pluginApi` compiler dependency exactly
+  `"org.scala-lang" %% "scala3-compiler" % scalaVersion.value`. Historical
+  Prompt 78 evidence may quote the bad organization, but production settings,
+  current policy, manifests, and current documentation must not treat it as a
+  valid coordinate.
+- Keep `BuildDependencyCoordinatePolicy` and its 14-case spec bounded to the
+  effective `pluginApi` compiler coordinate, prompt-number contamination,
+  pinned Scala/sbt/JDK policy, separate project, five-member root aggregate,
+  and retained Prompt 77 manifest/tasks.
+- Keep `verifyBuildDependencyCoordinatePolicy` in the ordinary pinned `Test`
+  workflow before the main tests. It is local and deterministic.
+- Keep `verifyPluginApiCleanResolution` explicit. It must copy no `.git` or
+  target/IDE/workspace state, use task-owned fresh Coursier and isolated Ivy/sbt
+  state, run the clean update/compile/package sequence, audit the thin JAR, and
+  delete both disposable repository and cache.
+- Keep `docs/plugin-api-dependency-coordinate-integrity.md` and
+  `reviews/78_chatgpt_plugin_api_dependency_coordinate_repair_handoff/` as the
+  focused contract and exact 19-document evidence packet.
+- Preserve `PLUGIN_API_DEPENDENCY_COORDINATE_REPAIRED`,
+  `PLUGIN_API_CLEAN_RESOLUTION_AND_PACKAGE_PROVEN`, and
+  `EXPERIMENTAL_PLUGIN_API_SURFACE_BASELINE_RESTORED`. They repair and restore
+  exact-build evidence; they do not promote the API or choose the next
+  broad-vs-small design.
+
 ### `bootstrap-prompt.md`
 
 - Describe the repository as a minimal Scala 3 research compiler-plugin project
@@ -2510,6 +2551,9 @@ Create these files:
 - Include Prompt 77's canonical manifest, verifier/model spec, candidate-render
   and verification tasks, isolated positive/runtime/negative source probes,
   focused baseline document, prompt, and exact 20-document handoff.
+- Include Prompt 78's corrected compiler coordinate, dependency policy/spec,
+  clean-resolution task, ordinary Test workflow gate, focused integrity
+  document, prompt, and exact 19-document handoff.
 - Explain that the document must evolve with the repository as new files and behavior are introduced.
 
 ## Constraints

build.sbt

@@ -81,6 +81,12 @@ lazy val renderExperimentalPluginApiSurfaceBaseline =
 lazy val verifyExperimentalPluginApiSurfaceBaseline =
   taskKey[Unit]("Verify the exact-build pluginApi surface and isolated handler linkage contract")
 
+lazy val verifyBuildDependencyCoordinatePolicy =
+  taskKey[Unit]("Verify the exact pluginApi dependency coordinate and retained build shape")
+
+lazy val verifyPluginApiCleanResolution =
+  taskKey[Unit]("Verify pluginApi resolution and packaging from a target-free fresh dependency cache")
+
 lazy val root = (project in file("."))
   .aggregate(
     legacyMetadataMarkerFixture,
@@ -260,8 +266,122 @@ lazy val sameModuleHandlerCycleSpike =
 lazy val pluginApi = (project in file("plugin-api"))
   .settings(
     name := "macroparadise-scala3-plugin-api",
-    libraryDependencies += "orgP069.scala-lang" %% "scala3-compiler" % scalaVersion.value
+    libraryDependencies += "org.scala-lang" %% "scala3-compiler" % scalaVersion.value
+  )
+
+verifyBuildDependencyCoordinatePolicy := {
+  BuildDependencyCoordinatePolicySpec.run()
+  JdkVersionEnforcement.enforceCurrent()
+
+  def dependency(module: ModuleID): BuildDependencyCoordinatePolicy.Dependency =
+    BuildDependencyCoordinatePolicy.Dependency(
+      module.organization,
+      module.name,
+      module.revision,
+      module.configurations.getOrElse("compile"),
+      module.explicitArtifacts.flatMap(_.classifier).toList
+    )
+
+  val structure = buildStructure.value
+  val rootRef = thisProjectRef.value
+  val rootBuildRefs = structure.allProjectRefs.filter(_.build == rootRef.build)
+  val extracted = Project.extract(state.value)
+  val allDependencies = rootBuildRefs.flatMap { reference =>
+    extracted.getOpt(reference / libraryDependencies).getOrElse(Seq.empty)
+  }
+  val rootProject =
+    structure.allProjectPairs.find(_._2 == rootRef).map(_._1).getOrElse {
+      sys.error(s"root project ${rootRef.project} is missing from the loaded build")
+    }
+  val pluginApiRef = rootBuildRefs.find(_.project == "pluginApi").getOrElse {
+    sys.error("pluginApi project is missing from the loaded build")
+  }
+  val pluginApiProject =
+    structure.allProjectPairs.find(_._2 == pluginApiRef).map(_._1).getOrElse {
+      sys.error("pluginApi project definition is missing from the loaded build")
+    }
+  val expectedPluginApiBase = (baseDirectory.value / "plugin-api").getCanonicalFile
+  val shape = BuildDependencyCoordinatePolicy.BuildShape(
+    scalaVersion.value,
+    sbtVersion.value,
+    JdkVersionEnforcement.currentDetectedVersion().feature.getOrElse(-1),
+    pluginApiProject.id,
+    pluginApiRef != rootRef && pluginApiProject.base.getCanonicalFile == expectedPluginApiBase,
+    rootProject.aggregate.map(_.project).toSet,
+    (baseDirectory.value / "project" / "experimental-plugin-api-surface-baseline.txt").isFile,
+    Set(
+      renderExperimentalPluginApiSurfaceBaseline.key.label,
+      verifyExperimentalPluginApiSurfaceBaseline.key.label
+    )
   )
+  val result = BuildDependencyCoordinatePolicy.verify(
+    (pluginApi / libraryDependencies).value.map(dependency),
+    allDependencies.map(dependency),
+    shape
+  )
+  require(
+    result.errors.isEmpty,
+    s"build dependency-coordinate policy failed: ${result.errors.mkString("; ")}"
+  )
+  streams.value.log.info(
+    s"build dependency-coordinate policy verified: ${result.render} syntheticCases=${BuildDependencyCoordinatePolicySpec.CaseCount}/${BuildDependencyCoordinatePolicySpec.CaseCount}"
+  )
+}
+
+verifyPluginApiCleanResolution := {
+  def dependency(module: ModuleID): BuildDependencyCoordinatePolicy.Dependency =
+    BuildDependencyCoordinatePolicy.Dependency(
+      module.organization,
+      module.name,
+      module.revision,
+      module.configurations.getOrElse("compile"),
+      module.explicitArtifacts.flatMap(_.classifier).toList
+    )
+
+  val structure = buildStructure.value
+  val rootRef = thisProjectRef.value
+  val rootBuildRefs = structure.allProjectRefs.filter(_.build == rootRef.build)
+  val extracted = Project.extract(state.value)
+  val allDependencies = rootBuildRefs.flatMap { reference =>
+    extracted.getOpt(reference / libraryDependencies).getOrElse(Seq.empty)
+  }
+  val rootProject = structure.allProjectPairs.find(_._2 == rootRef).map(_._1).get
+  val pluginApiRef = rootBuildRefs.find(_.project == "pluginApi").get
+  val pluginApiProject = structure.allProjectPairs.find(_._2 == pluginApiRef).map(_._1).get
+  val shape = BuildDependencyCoordinatePolicy.BuildShape(
+    scalaVersion.value,
+    sbtVersion.value,
+    JdkVersionEnforcement.currentDetectedVersion().feature.getOrElse(-1),
+    pluginApiProject.id,
+    pluginApiProject.base.getCanonicalFile == (baseDirectory.value / "plugin-api").getCanonicalFile,
+    rootProject.aggregate.map(_.project).toSet,
+    (baseDirectory.value / "project" / "experimental-plugin-api-surface-baseline.txt").isFile,
+    Set(
+      renderExperimentalPluginApiSurfaceBaseline.key.label,
+      verifyExperimentalPluginApiSurfaceBaseline.key.label
+    )
+  )
+  val result = PluginApiCleanResolution.run(
+    baseDirectory.value,
+    target.value / "plugin-api-clean-resolution",
+    (pluginApi / libraryDependencies).value.map(dependency),
+    allDependencies.map(dependency),
+    shape
+  )
+  require(
+    result.classification != PluginApiCleanResolution.FailedClassification,
+    s"pluginApi clean resolution proof failed: ${result.render}"
+  )
+  require(
+    result.disposableRepositoryDeleted && result.taskOwnedCacheDeleted,
+    s"pluginApi clean resolution proof did not delete disposable state: ${result.render}"
+  )
+  val log = streams.value.log
+  if (result.isBlocked)
+    log.warn(s"pluginApi clean resolution proof environmentally blocked: ${result.render}")
+  else
+    log.info(s"pluginApi clean resolution verified: ${result.render}")
+}
 
 renderExperimentalPluginApiSurfaceBaseline := {
   val evidence = target.value / "experimental-plugin-api-surface-baseline-render"

docs/experimental-plugin-api-surface-baseline.md

@@ -11,6 +11,16 @@ and regression-detectable. It does not declare a stable public API, general
 binary compatibility, release readiness, or compatibility across Scala
 versions.
 
+Prompt 78 controller review found that the original Prompt 77 commit contained
+an invalid compiler dependency organization. The original local passes
+therefore did not establish clean resolution reproducibility. Prompt 78
+corrects the organization to `org.scala-lang`, adds an effective-coordinate
+policy, and proves the same package from a target-free disposable copy and a
+fresh task-owned dependency cache. The canonical surface records and normalized
+SHA below remain unchanged, so the baseline classification is restored rather
+than regenerated. See
+[`pluginApi` dependency-coordinate integrity](plugin-api-dependency-coordinate-integrity.md).
+
 The baseline is valid only for:
 
 ```text