# Three repositories and pins

The hand-offs between sggs-data, sggs-platform and gurbani-soul-ios, each a reviewed lock file with a commit and a checksum, drawn as one poster you can step through.

- Page: <https://docs.gurbanisoul.com/architecture/three-repositories-and-pins/>
- Updated: 2026-09-26
- Verified against: `a661527` on 2026-09-26
- From the Sri Guru Granth Sahib Ji — Knowledge Base wiki. Sri Guru Granth Sahib Ji is quoted verbatim, cited by Ang, and never altered.

---

The project is three repositories joined by pins — small, reviewed files naming an exact commit
and the sha256 of the artifact taken from it — so nothing is copied by hand and nothing can drift.
The newcomer's version of this page is [How the repositories fit together](https://docs.gurbanisoul.com/onboarding/how-the-repos-fit/);
the decisions are [ADR-0007](https://docs.gurbanisoul.com/adr/0007-three-repositories/) and [ADR-0008](https://docs.gurbanisoul.com/adr/0008-dataset-by-pin/).

![Poster 02 — three repositories and the pins that join them](https://docs.gurbanisoul.com/posters/02-three-repositories-and-pins.svg)

## The four pins

| Pin | Where | Names | Proved by |
|---|---|---|---|
| `dataset.lock.json` | platform | sggs-data commit · `db/sggs.sqlite` sha256 · size | `make dataset-check` (`scripts/data/fetch_dataset.py --check-pin`), `scripture-integrity` |
| `dataset.lock.json` | app | the same object | the app's CI |
| `vendor.lock.json` | app | platform tag `vX.Y.Z` · sha256 per vendored `contract/` file | the app's parity tests and release gate |
| `docs-site/sources.lock.json` | platform (wiki) | sibling commit · sha256 per published doc | `tools/fetch_sibling_docs.py --check` in the `docs` job |

A bump of any of them is a small pull request that a reviewer can read in full. The wiki's own pin
is proposed automatically: every Monday `docs-pins` opens that pull request when a sibling changed
a file the wiki publishes, and moves nothing otherwise.