mosaicstack/stack
1
0
Fork 1
Code Issues 296 Pull Requests 18 Actions Packages Projects Releases 15 Wiki Activity

docs(ri-050): registry credential fixed server-side; pack merge is the end-to-end proof (#1275)

Browse Source
This commit is contained in:
fargo
2026-08-18 18:51:02 -05:00
parent 91593f9bae
commit 0cf7d26de1
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/release-integrity/TASKS.md
+1 -1
View File
@@ -26,7 +26,7 @@
| RI-3-002 | done | RI-N4: TS evaluator absorbs effective shell probes; typed results (passed/failed/blocked/error/not-applicable) with versioned digested check definitions; shell commands become thin adapters; contract/parity/negative-control tests | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-qr-evaluator | RI-3-001 | 30K | | PR #1308 (head 68279d61): CI green (2506), independent review APPROVED (Gitea review 188, fred, seven mutations incl. vacuous-pass + stage-removal). Merged by fargo at pinned head → next @ 245e0c4. Follow-up #1309 (digest wording). |
| RI-4-001 | done | RI-N3: one PRD application service — `mission --plan` persists mission↔PRD linkage (ids/versions/selected requirements); `mosaic prdy` routes through the service or becomes a named import/export adapter; Markdown is a labeled generated view; explicit conflict-aware import | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-prd-authority | RI-0-001 | 35K | PR #1294 (head 8d258e1d): CI green (pipeline 2466), independent review APPROVED (Gitea review 174, jarvis seat, 2026-08-17) - prdy 20/20 + command specs 9/9 at head. Merge queued behind #1276/#1277/#1278. | PR #1294 (head 8d258e1d): CI green (2466), review 174. Merged 2026-08-18 overnight wave → next @ d92de53. |
| RI-5-001 | done | RI-N5: typed freshness states (current/stale/partial/unknown/unavailable); no failed-fetch-renders-empty; stale derived verdicts → unknown; mutations disabled when stale; failure-matrix tests | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-web-stale-safety | RI-0-001 | 25K | |
| RI-V-001 | in-progress | Final verification + release evidence: all cards verified merged, negative controls demonstrated, real `next` publish run green on exact commit, evidence pack recorded | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-release-evidence | RI-1-002, RI-2-001, RI-2-002, RI-3-002, RI-4-001, RI-5-001 | 10K | | Evidence pack live on branch docs/ri-050-release-evidence @ 340b95e — all five requirements evidenced; final exhibit (fully-green push) gated on registry item; then PR + topher review. |
| RI-V-001 | in-progress | Final verification + release evidence: all cards verified merged, negative controls demonstrated, real `next` publish run green on exact commit, evidence pack recorded | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-release-evidence | RI-1-002, RI-2-001, RI-2-002, RI-3-002, RI-4-001, RI-5-001 | 10K | | Evidence pack live on branch docs/ri-050-release-evidence @ 91593f9+ — all five requirements evidenced; registry credential fixed 2026-08-18 23:47Z (jarvis, #1275 c23239); pack PR is the first post-fix merge, its push pipeline the end-to-end proof; topher review then merge, close #1275 on green. |
## Dispatch waves (max 2 parallel workers)
docs/release-integrity/release-evidence.md
+22 -1
View File
@@ -1,6 +1,6 @@
# RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor)
> Status: **DRAFT — near complete**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Remaining for closure: one fully-green push pipeline (blocked only on the registry-credential item below) and final verification. Last updated 2026-08-18 by fargo (day-takeover orchestrator).
> Status: **DRAFT — final proof pending**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z (see infrastructure item below). Remaining for closure: one fully-green post-fix push pipeline — **this pack's own merge to `next` is that proof event**, its pipeline number recorded in the #1275 closure comment. Last updated 2026-08-18 by fargo (day-takeover orchestrator).
> Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source:
> `docs/PRD.md` § Release Integrity Workstream (#1275).
@@ -56,6 +56,27 @@ than a minted token value, `/v2/token` 401s exactly as observed. npm publishes
remained green in 2507; every publish step except the image push is gated and
green.
**Resolution 2026-08-18 23:47Z — FIXED on the Gitea server (jarvis, #1275
comment 23239).** Root cause was neither scope nor a missing token:
`REGISTRY_USERNAME` held `mosaic`, the **pre-rename org name**. Gitea's rename
redirect covers API/web paths but not Basic-auth username lookup, and
`mosaicstack` is an organization, which has no password — the pair could never
authenticate. Fix: `REGISTRY_USERNAME`=`woodpecker` (the existing service
account, Gitea user 41, already in `ci-publish`) and `REGISTRY_PASSWORD`= a
newly minted `write:package`-only token (`gitea admin user generate-access-token`
in the Gitea container; minting with a token is forbidden server-side). Events
`[push, tag]` preserved. Verified **without a pipeline run**:
`POST /v2/<pkg>/blobs/uploads/` opened then cancelled a session — **202** on
all four kaniko destinations (gateway, appservice, web, ci-base), anonymous
control **401**, wrong-owner control **401**. Not verified: stored-secret
byte-intactness (Woodpecker never returns secret values). First post-fix push
on `next` is the end-to-end proof; per the pack status line above, that is
this PR's own merge pipeline. If `build-gateway` is still red with this
credential proven good, the fault is in the step, not the secret — do not
re-mint on that evidence. The earlier "Requires a package-scoped token
(Jason)" expectation is superseded: the defect was a stale value from the org
rename, not a scope grant Jason owed.
## Process record (audit trail)
- Merges executed under the jarvis principal (topher seat; identity provisioning