What has happened
dev now carries a second system inside the product repository. Recent additions include roughly 1,300 lines of container runtime, 1,100 of analysis, 1,000 of orchestration and 700 of storage, plus isolation, a provider ledger and a shipping proxy.
CommitLore and CDEB have different change rates, different threat models and different audiences. Sharing one branch and one CI has consequences that are already visible:
- a CLI release and a research harness change move through the same gate
- one pull request can require judging container isolation, statistics, and product semantics at once
- the installed product's dependency risk and the experiment runner's are not separated
- review scope grows past what a single reviewer can hold
Options
packages/core
packages/cli
packages/mcp
packages/cdeb
or CDEB in its own repository, consuming the product as a pinned dependency — which has the useful property that the benchmark then measures a released artifact rather than a sibling directory.
The second is cleaner and costs more to set up. Either beats the current arrangement.
The related point, stated separately because it is not structural
#532 — a pull request covering security isolation and research methodology — carried no requested reviewer. For a solo project that is unremarkable, and for a change of that kind it is the wrong default. Whatever the structure ends up being, work touching isolation guarantees or published results should pass an adversarial review gate that is not the author's own.
What has happened
devnow carries a second system inside the product repository. Recent additions include roughly 1,300 lines of container runtime, 1,100 of analysis, 1,000 of orchestration and 700 of storage, plus isolation, a provider ledger and a shipping proxy.CommitLore and CDEB have different change rates, different threat models and different audiences. Sharing one branch and one CI has consequences that are already visible:
Options
or CDEB in its own repository, consuming the product as a pinned dependency — which has the useful property that the benchmark then measures a released artifact rather than a sibling directory.
The second is cleaner and costs more to set up. Either beats the current arrangement.
The related point, stated separately because it is not structural
#532 — a pull request covering security isolation and research methodology — carried no requested reviewer. For a solo project that is unremarkable, and for a change of that kind it is the wrong default. Whatever the structure ends up being, work touching isolation guarantees or published results should pass an adversarial review gate that is not the author's own.