From 0d0d57b6aaa43f4784e11efc03940f5b831a462a Mon Sep 17 00:00:00 2001 From: fargo Date: Tue, 18 Aug 2026 19:34:53 -0500 Subject: [PATCH] =?UTF-8?q?docs(ri-050):=20registry=20credential=20proven?= =?UTF-8?q?=20=E2=80=94=20pipeline=202517=20green=20at=20build-gateway=20(?= =?UTF-8?q?#1275)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/release-integrity/TASKS.md | 2 +- docs/release-integrity/release-evidence.md | 22 +++++++++++++--------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/docs/release-integrity/TASKS.md b/docs/release-integrity/TASKS.md index 82b4546e..f8d0643f 100644 --- a/docs/release-integrity/TASKS.md +++ b/docs/release-integrity/TASKS.md @@ -26,7 +26,7 @@ | RI-3-002 | done | RI-N4: TS evaluator absorbs effective shell probes; typed results (passed/failed/blocked/error/not-applicable) with versioned digested check definitions; shell commands become thin adapters; contract/parity/negative-control tests | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-qr-evaluator | RI-3-001 | 30K | | PR #1308 (head 68279d61): CI green (2506), independent review APPROVED (Gitea review 188, fred, seven mutations incl. vacuous-pass + stage-removal). Merged by fargo at pinned head → next @ 245e0c4. Follow-up #1309 (digest wording). | | RI-4-001 | done | RI-N3: one PRD application service — `mission --plan` persists mission↔PRD linkage (ids/versions/selected requirements); `mosaic prdy` routes through the service or becomes a named import/export adapter; Markdown is a labeled generated view; explicit conflict-aware import | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-prd-authority | RI-0-001 | 35K | PR #1294 (head 8d258e1d): CI green (pipeline 2466), independent review APPROVED (Gitea review 174, jarvis seat, 2026-08-17) - prdy 20/20 + command specs 9/9 at head. Merge queued behind #1276/#1277/#1278. | PR #1294 (head 8d258e1d): CI green (2466), review 174. Merged 2026-08-18 overnight wave → next @ d92de53. | | RI-5-001 | done | RI-N5: typed freshness states (current/stale/partial/unknown/unavailable); no failed-fetch-renders-empty; stale derived verdicts → unknown; mutations disabled when stale; failure-matrix tests | #1275 | pi-glm-5.3 | mosaicstack/stack | feat/ri-050-web-stale-safety | RI-0-001 | 25K | | -| RI-V-001 | in-progress | Final verification + release evidence: all cards verified merged, negative controls demonstrated, real `next` publish run green on exact commit, evidence pack recorded | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-release-evidence | RI-1-002, RI-2-001, RI-2-002, RI-3-002, RI-4-001, RI-5-001 | 10K | | Evidence pack live on branch docs/ri-050-release-evidence @ 91593f9+ — all five requirements evidenced; registry credential fixed 2026-08-18 23:47Z (jarvis, #1275 c23239); pack PR is the first post-fix merge, its push pipeline the end-to-end proof; topher review then merge, close #1275 on green. | +| RI-V-001 | in-progress | Final verification + release evidence: all cards verified merged, negative controls demonstrated, real `next` publish run green on exact commit, evidence pack recorded | #1275 | pi-glm-5.3 | mosaicstack/stack | docs/ri-050-release-evidence | RI-1-002, RI-2-001, RI-2-002, RI-3-002, RI-4-001, RI-5-001 | 10K | | Evidence pack live on branch docs/ri-050-release-evidence — all five requirements evidenced; registry credential fixed (jarvis, #1275 c23239) and PROVEN green: pipeline 2517 (retry of 2512, identical commit) all steps green incl. build-gateway; pack PR next, then topher review + merge, close #1275. | ## Dispatch waves (max 2 parallel workers) diff --git a/docs/release-integrity/release-evidence.md b/docs/release-integrity/release-evidence.md index 2e07eaef..1abf3779 100644 --- a/docs/release-integrity/release-evidence.md +++ b/docs/release-integrity/release-evidence.md @@ -1,6 +1,6 @@ # RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor) -> Status: **DRAFT — final proof pending**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z (see infrastructure item below). Remaining for closure: one fully-green post-fix push pipeline — **this pack's own merge to `next` is that proof event**, its pipeline number recorded in the #1275 closure comment. Last updated 2026-08-18 by fargo (day-takeover orchestrator). +> Status: **DRAFT — proof complete, awaiting review + merge**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z and **proven end-to-end**: push pipeline **2517** (retry of failed 2512 at the identical commit d4d32a8, only the secret changed between runs) — all steps green including `build-gateway`. Remaining for closure: this pack PR reviewed (topher), merged to `next`, its own push pipeline green, #1275 closed. Last updated 2026-08-19 by fargo (day-takeover orchestrator). > Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source: > `docs/PRD.md` § Release Integrity Workstream (#1275). @@ -68,14 +68,18 @@ in the Gitea container; minting with a token is forbidden server-side). Events `[push, tag]` preserved. Verified **without a pipeline run**: `POST /v2//blobs/uploads/` opened then cancelled a session — **202** on all four kaniko destinations (gateway, appservice, web, ci-base), anonymous -control **401**, wrong-owner control **401**. Not verified: stored-secret -byte-intactness (Woodpecker never returns secret values). First post-fix push -on `next` is the end-to-end proof; per the pack status line above, that is -this PR's own merge pipeline. If `build-gateway` is still red with this -credential proven good, the fault is in the step, not the secret — do not -re-mint on that evidence. The earlier "Requires a package-scoped token -(Jason)" expectation is superseded: the defect was a stale value from the org -rename, not a scope grant Jason owed. +control **401**, wrong-owner control **401**. The earlier "Requires a +package-scoped token (Jason)" expectation is superseded: the defect was a +stale value from the org rename, not a scope grant Jason owed. + +**Proof 2026-08-19 ~00:2xZ (fargo): pipeline 2517 green at build-gateway.** +Woodpecker retry of 2512 — identical commit d4d32a8, identical pipeline +config, only the server-side secret changed between runs — went green on +every step (clone, install, verify, build, publish-next-npm, +**build-gateway**). A/B at the same commit isolates the credential as the +variable; the stored value is byte-intact. Retry was serialized (sole run in +flight; merge-purpose CI queue guard had blocked on 2512's terminal failure +at the `next` head, which this retry also clears). The item is closed. ## Process record (audit trail)