From 0cf7d26de120b916d976192dd768ee2274e4c879 Mon Sep 17 00:00:00 2001 From: fargo Date: Tue, 18 Aug 2026 18:51:02 -0500 Subject: [PATCH] docs(ri-050): registry credential fixed server-side; pack merge is the end-to-end proof (#1275) --- docs/release-integrity/TASKS.md | 2 +- docs/release-integrity/release-evidence.md | 23 +++++++++++++++++++++- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/docs/release-integrity/TASKS.md b/docs/release-integrity/TASKS.md index 761cc918..82b4546e 100644 --- a/docs/release-integrity/TASKS.md +++ b/docs/release-integrity/TASKS.md @@ -26,7 +26,7 @@ | RI-3-002 | done | RI-N4: TS evaluator absorbs effective shell probes; typed results (passed/failed/blocked/error/not-applicable) with versioned digested check definitions; shell commands become thin adapters; contract/parity/negative-control tests | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-qr-evaluator | RI-3-001 | 30K | | PR #1308 (head 68279d61): CI green (2506), independent review APPROVED (Gitea review 188, fred, seven mutations incl. vacuous-pass + stage-removal). Merged by fargo at pinned head → next @ 245e0c4. Follow-up #1309 (digest wording). | | RI-4-001 | done | RI-N3: one PRD application service — `mission --plan` persists mission↔PRD linkage (ids/versions/selected requirements); `mosaic prdy` routes through the service or becomes a named import/export adapter; Markdown is a labeled generated view; explicit conflict-aware import | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-prd-authority | RI-0-001 | 35K | PR #1294 (head 8d258e1d): CI green (pipeline 2466), independent review APPROVED (Gitea review 174, jarvis seat, 2026-08-17) - prdy 20/20 + command specs 9/9 at head. Merge queued behind #1276/#1277/#1278. | PR #1294 (head 8d258e1d): CI green (2466), review 174. Merged 2026-08-18 overnight wave → next @ d92de53. | | RI-5-001 | done | RI-N5: typed freshness states (current/stale/partial/unknown/unavailable); no failed-fetch-renders-empty; stale derived verdicts → unknown; mutations disabled when stale; failure-matrix tests | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-web-stale-safety | RI-0-001 | 25K | | -| RI-V-001 | in-progress | Final verification + release evidence: all cards verified merged, negative controls demonstrated, real `next` publish run green on exact commit, evidence pack recorded | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-release-evidence | RI-1-002, RI-2-001, RI-2-002, RI-3-002, RI-4-001, RI-5-001 | 10K | | Evidence pack live on branch docs/ri-050-release-evidence @ 340b95e — all five requirements evidenced; final exhibit (fully-green push) gated on registry item; then PR + topher review. | +| RI-V-001 | in-progress | Final verification + release evidence: all cards verified merged, negative controls demonstrated, real `next` publish run green on exact commit, evidence pack recorded | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-release-evidence | RI-1-002, RI-2-001, RI-2-002, RI-3-002, RI-4-001, RI-5-001 | 10K | | Evidence pack live on branch docs/ri-050-release-evidence @ 91593f9+ — all five requirements evidenced; registry credential fixed 2026-08-18 23:47Z (jarvis, #1275 c23239); pack PR is the first post-fix merge, its push pipeline the end-to-end proof; topher review then merge, close #1275 on green. | ## Dispatch waves (max 2 parallel workers) diff --git a/docs/release-integrity/release-evidence.md b/docs/release-integrity/release-evidence.md index 296a7117..2e07eaef 100644 --- a/docs/release-integrity/release-evidence.md +++ b/docs/release-integrity/release-evidence.md @@ -1,6 +1,6 @@ # RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor) -> Status: **DRAFT — near complete**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Remaining for closure: one fully-green push pipeline (blocked only on the registry-credential item below) and final verification. Last updated 2026-08-18 by fargo (day-takeover orchestrator). +> Status: **DRAFT — final proof pending**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z (see infrastructure item below). Remaining for closure: one fully-green post-fix push pipeline — **this pack's own merge to `next` is that proof event**, its pipeline number recorded in the #1275 closure comment. Last updated 2026-08-18 by fargo (day-takeover orchestrator). > Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source: > `docs/PRD.md` § Release Integrity Workstream (#1275). @@ -56,6 +56,27 @@ than a minted token value, `/v2/token` 401s exactly as observed. npm publishes remained green in 2507; every publish step except the image push is gated and green. +**Resolution 2026-08-18 23:47Z — FIXED on the Gitea server (jarvis, #1275 +comment 23239).** Root cause was neither scope nor a missing token: +`REGISTRY_USERNAME` held `mosaic`, the **pre-rename org name**. Gitea's rename +redirect covers API/web paths but not Basic-auth username lookup, and +`mosaicstack` is an organization, which has no password — the pair could never +authenticate. Fix: `REGISTRY_USERNAME`=`woodpecker` (the existing service +account, Gitea user 41, already in `ci-publish`) and `REGISTRY_PASSWORD`= a +newly minted `write:package`-only token (`gitea admin user generate-access-token` +in the Gitea container; minting with a token is forbidden server-side). Events +`[push, tag]` preserved. Verified **without a pipeline run**: +`POST /v2//blobs/uploads/` opened then cancelled a session — **202** on +all four kaniko destinations (gateway, appservice, web, ci-base), anonymous +control **401**, wrong-owner control **401**. Not verified: stored-secret +byte-intactness (Woodpecker never returns secret values). First post-fix push +on `next` is the end-to-end proof; per the pack status line above, that is +this PR's own merge pipeline. If `build-gateway` is still red with this +credential proven good, the fault is in the step, not the secret — do not +re-mint on that evidence. The earlier "Requires a package-scoped token +(Jason)" expectation is superseded: the defect was a stale value from the org +rename, not a scope grant Jason owed. + ## Process record (audit trail) - Merges executed under the jarvis principal (topher seat; identity provisioning