Drive version-drift checks from the Release Surface Manifest

[derek-palmer]

From the 2026-06-09 Architecture Review. Recommendation strength: Strong (top recommendation).

Files

• scripts/check_versions.py
• src/codeforerunner/release_surfaces.py
• src/codeforerunner/release_surfaces.json
• install.sh, install.ps1 (version-bearing surfaces)

Problem

The Release Surface Manifest declares every version source and ships read_surface_version() (release_surfaces.py:96) whose own docstring says it exists to drive drift checks — but scripts/check_versions.py bypasses it with five hardcoded readers (read_pyproject_version, read_package_json_version, read_marketplace_versions, read_install_sh_version, read_install_ps1_version). The same version-source knowledge lives twice, and a new surface added to the manifest is silently invisible to the drift check.

Solution

Rewrite check_versions.py as a thin adapter over the manifest: enumerate version_bearing_surfaces(), read each via read_surface_version(), assert all values agree. The five hardcoded readers are deleted.

Benefits

• Locality: version-source knowledge concentrates in one module (the manifest).
• Leverage: every future release surface declared in the manifest is drift-checked automatically.
• Deletion test: the five readers vanish and nothing reappears at call sites — they were restating manifest facts.
• Tests: one test surface (the manifest accessor) replaces the split between test_check_versions.py and test_release_surfaces.py.

Unblocks adjacent work: shim pin injection and the Package Contents Inspector consuming the same manifest.