mosaicstack/stack
1
0
Fork 1
Code Issues 141 Pull Requests 5 Actions Packages Projects Releases 15 Wiki Activity

fix(quality): close registry silent-defeat paths
ci/woodpecker/pr/ci Pipeline was successful
Details

Browse Source
This commit is contained in:
f10-coder
2026-08-01 11:28:28 -05:00
parent 83d2ecb224
commit 32b490a712
11 changed files with 889 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ADMIN-GUIDE/quality-gate-registry.md
+4 -2
View File
@@ -14,7 +14,7 @@ Investigate any of these immediately:
## Updating a gate
1. Add or change the criterion, its exact criterion-side `caseRefs`, and matching case-side `criterionIds`.
1. Add or change the criterion, its exact criterion-side `caseRefs`, and matching case-side `criterionIds`. Preserve recursive closed-schema validation for every nested object; new fields require explicit key and type handling.
2. Observe the must-fail case fail for its own stated reason; moving the binding to any undeclared case must fail verification.
3. Declare an exact inerting mutation and observe the verifier detect it.
4. If required and actual behavior differ, add a tracked remediation owner and justification.
@@ -28,7 +28,9 @@ Do not add an ownerless exception or describe an open delta as pass/green/OK.
Woodpecker runs `gate-verify` on every pull request and protected-main push without path filtering. This is deliberate: changes outside gate files can make a gate inert. The step unshallows the checkout so activation ancestry and historical manifest provenance can be checked; a shallow boundary must never be interpreted as non-ancestry.
Provider evidence input is an optional JSON array of normalized pipeline records containing `commit`, unique integer pipeline `number`, pipeline `status`, and a `gate-verify` step status. The highest numbered rerun is authoritative; ambiguous duplicates fail. Its retention window is provider-controlled and is not overstated by this repository.
Provider evidence input is an optional JSON array of normalized pipeline records containing `commit`, globally unique integer pipeline `number`, pipeline `status`, and a `gate-verify` step status. Collection-wide identity/type validation occurs before commit filtering; a duplicate number across two commits fails subject binding. The highest numbered valid rerun for one commit is authoritative. Its retention window is provider-controlled and is not overstated by this repository.
Do not add or update an activation SHA in the manifest. The verifier derives the immutable history boundary from Git as the parent of the first first-parent registry-introduction commit. HEAD, HEAD's parent, and the introduction commit are registered rejected seam candidates.
PR CI executes current-tree verification only, unprivileged and fail-closed. It does not execute isolated own-tree replay: RM-60 must provide a protected launcher or runner-level rootless sandbox before any PR-controlled executable/configuration is evaluated. Repo-only code cannot safely grant itself the capability intended to contain itself.