[Kinflou]

A draft proposal for how Comline works with no internet access, across every repository. It covers four situations:

• an offline developer machine;
• an isolated build or CI network;
• an air-gapped deployment;
• bringing the tooling itself into a sealed network.

Pages, under proposals/offline/:

• index: the situations, a survey of where each repository touches the network today, the rules that hold whatever the details, a rollout and the open questions.
• fetching:
  • choosing a dependency vs getting pinned bytes;
  • fetching on demand by default, with a hard offline switch and comline fetch;
  • package settings that only tighten (explicit fetching, required hashes);
  • the strictest setting wins, and a dependency's settings apply only to its own builds;
  • when a hash is mandatory: registry dependencies always; git when offline, when required, or when there is more than one source;
  • a hash mismatch is an error, never a fallback.
• supply:
  • identity is the hash, location is replaceable;
  • several ordered sources per dependency, from the package, from machine or organisation mirrors, and added by the root for hashed transitive pins (add only, never replace);
  • a shared hash-keyed cache, vendoring, mirrors and signed bundles;
  • generated code's dependencies, with publishing the runtimes as a 1.0 requirement;
  • the tooling: release artifacts, reproducible builds, an SBOM, and an offline docs bundle.

The decisions were settled in discussion. The open questions are listed on the pages.

mkdocs build --strict passes.