Two things, and the second is why the first keeps being needed.
RESYNC. cloud/openapi.yaml lagged hanzoai/cloud's origin/main again — the second
time today. Load-bearing authored shapes fall 234 -> 199: 35 routes cloud typed
since the last sync now carry their own bodies, parameters and responses, so the
hand-written shapes propping them up are no longer needed. 2455 operations, 1887
described, 298 paths source-true from cloud.
THE GATE. Nothing noticed either time. `sync.py --check` has always existed and
nothing ran it, and no push-triggered CI ever could: this file is invalidated by a
commit in a DIFFERENT repository, so the event that breaks it produces no event
here. A push to hanzoai/cloud silently makes every SDK, doc page and MCP tool
generated from hanzo.yaml describe a router that has already moved.
So the trigger is a clock — hourly, because cloud deploys many times a day and a
daily check would let a stale document ship SDKs for most of a working day.
--check only, deliberately. The job does not resync and does not commit. A bot
pushing a 2 MB regenerated document into main would be a second writer on the file
merge.py owns, and an unreviewed spec change reaching every SDK is a worse failure
than the staleness it fixes. Red build, the exact fix command in the log, a person
runs it.
Verified rather than assumed, because a gate that fails on its own first run is
worse than none: `--check --cloud <path>` is a real flag combination (both are in
sync.py's argparse), it exits 0 in sync and 1 when stale, and the shallow
`fetch-depth: 1` checkout is safe because sync.py runs its own
`git fetch origin main` before reading the ref.
Co-authored-by: Hanzo Dev <[email protected]>
