118 lines
12 KiB
Markdown
118 lines
12 KiB
Markdown
# RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor)
|
|
|
|
> Status: **DRAFT — final proof pending**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z (see infrastructure item below). Remaining for closure: one fully-green post-fix push pipeline — **this pack's own merge to `next` is that proof event**, its pipeline number recorded in the #1275 closure comment. Last updated 2026-08-18 by fargo (day-takeover orchestrator).
|
|
> Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source:
|
|
> `docs/PRD.md` § Release Integrity Workstream (#1275).
|
|
|
|
## RI-N1 — Canonical terminal verification + exact-commit publish gate
|
|
|
|
| exhibit | evidence | where |
|
|
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------- |
|
|
| Gate live, fail-closed | Push pipeline **2486**: `verify` ran at exact commit, FAILED on a real latent defect (gateway cross-user-isolation cleanup on the no-DB path), and `build` / `publish-npm` / `build-gateway` were all **skipped**. First push in repo history that did not publish ungated (prior ungated publishes beside failing builds: 2439, 2462, 2482). | Woodpecker repo 47 pipeline 2486 |
|
|
| Gate-caught defect fixed | PR **#1304** (afterAll honors `dbAvailable`; both paths verified: dead-port 28 skipped + file passes; live-5433 28 passed). Review 180 (fred). | PR #1304 |
|
|
| First gated green npm publish | Push pipeline **2488** (post-#1304): `verify` GREEN → `build` GREEN → `publish-next-npm` GREEN, all publish effects behind the gate. | Woodpecker pipeline 2488 |
|
|
| Negative controls | PR **#1305**: structural DAG tests (S1 missing edge, S2 renamed effect incl. command-based npm/kaniko detection, S3 detach, S4 failure:ignore/success override, S5 when-filter, S6 HEAD-mover between verify and publish with legitimate-recheckout positive control, S7 removal) + subset-stage composition control in verify-release.test.mjs. Mutation-verified by the dispatching seat in both directions (true bypass → S1 assertion fires; non-bypass edit → correctly green). Scripts tests 20/20, CI 2490 green. | PR #1305 |
|
|
| ✅ Canonical command | `scripts/verify-release.mjs` (stage table pinned to ci.yml by checked-in test). Merged with #1277; now also invokes the RI-N4 evaluator via its `quality-rails` stage (#1308). | `scripts/verify-release.mjs` |
|
|
|
|
## RI-N2 — Forge + MACP fail-closed (typed explicit simulation)
|
|
|
|
- ✅ Forge: PR **#1278** merged (head 4917df1f; CI 2477; review 184 fred at pinned head — prior review 172 dismissed by rebase, correctly re-taken).
|
|
- ✅ MACP: PR **#1293** merged (head 2097379e; CI 2465; review 173).
|
|
- ✅ Post-merge behavior docs: PR **#1299** merged (head 8a405b14; CI 2497; review 186 fargo at pinned head — legitimate independent seat; merged 2026-08-18 with --expect-head pin, content-verified on next @ ff45f7b).
|
|
|
|
## RI-N3 — PRD authority
|
|
|
|
- ✅ PR **#1294** merged (head 8d258e1d; CI 2466; review 174).
|
|
|
|
## RI-N4 — Quality-rails evaluator
|
|
|
|
- ✅ Probe inventory: PR **#1302** merged (head e06a47fac59; CI 2484; review 187 fargo at pinned head; 54 rows / 21 canonical checks / dispositions 43-2-9-0 row-count-verified; merged 2026-08-18, content-verified on next @ 6435089).
|
|
- ✅ TS evaluator absorbs shell probes: PR **#1308** merged (head 68279d61; CI 2506; review 188 fred at pinned head — seven targeted mutations, seven detections, incl. the vacuous-pass hole M1 and stage-removal M7). Evaluator: typed fail-closed verdicts, digested versioned definitions, per-subject sets; QC-19 absorbed (verbatim-list parity oracle), QC-20 as thin adapter (verify.sh unmodified); verify-release `quality-rails` stage wired (RI-N1 consumes the evaluator). Worker-produced, independently verified by the dispatching seat (quality-rails 40/40 incl. sabotage control 6-failed/34-passed restored sha-verified; root build 25/25; typecheck 45/45).
|
|
|
|
## RI-N5 — Consequence-aware stale UI
|
|
|
|
- ✅ PR **#1300** merged (head a337d787; CI 2481; review 179). Web suite 199 → 281 tests (failure matrix + negative controls), independently re-run by the dispatching seat before merge.
|
|
|
|
## Known-open infrastructure item (not a card)
|
|
|
|
Gateway/ci-base **image** pushes fail on registry credentials: Woodpecker repo
|
|
secrets `REGISTRY_USERNAME`/`REGISTRY_PASSWORD` are rejected by the Gitea
|
|
container registry (explicit `UNAUTHORIZED` at `/v2/token`; pipeline 2494 after
|
|
PR #1306 corrected the secret references — previously masked as an ambiguous
|
|
push-permission error since at least 2439). Requires a package-scoped token
|
|
(Jason). The npm publish path is green and gated; this item tracks image pushes
|
|
only and predates the RI-050 floor.
|
|
|
|
**Update 2026-08-18 (fargo):** Jason set new secret values ~17:25Z; pipeline
|
|
**2507** (the #1308 merge push, first after the update, 18:0xZ) still fails
|
|
`build-gateway` with the identical `UNAUTHORIZED`. Read-only isolation (no
|
|
secrets read, no CI retries): the registry endpoint and auth mechanism are
|
|
HEALTHY — a valid Gitea token via basic-auth mints a JWT at `/v2/token` (200),
|
|
bad credentials 401 cleanly. Therefore the failure is isolated to the secret
|
|
VALUES, not the endpoint or pipeline. Most likely shape error (labeled guess):
|
|
the registry authenticates username + **API token with package scope**, not
|
|
username + login password; if REGISTRY_PASSWORD holds a login password rather
|
|
than a minted token value, `/v2/token` 401s exactly as observed. npm publishes
|
|
remained green in 2507; every publish step except the image push is gated and
|
|
green.
|
|
|
|
**Resolution 2026-08-18 23:47Z — FIXED on the Gitea server (jarvis, #1275
|
|
comment 23239).** Root cause was neither scope nor a missing token:
|
|
`REGISTRY_USERNAME` held `mosaic`, the **pre-rename org name**. Gitea's rename
|
|
redirect covers API/web paths but not Basic-auth username lookup, and
|
|
`mosaicstack` is an organization, which has no password — the pair could never
|
|
authenticate. Fix: `REGISTRY_USERNAME`=`woodpecker` (the existing service
|
|
account, Gitea user 41, already in `ci-publish`) and `REGISTRY_PASSWORD`= a
|
|
newly minted `write:package`-only token (`gitea admin user generate-access-token`
|
|
in the Gitea container; minting with a token is forbidden server-side). Events
|
|
`[push, tag]` preserved. Verified **without a pipeline run**:
|
|
`POST /v2/<pkg>/blobs/uploads/` opened then cancelled a session — **202** on
|
|
all four kaniko destinations (gateway, appservice, web, ci-base), anonymous
|
|
control **401**, wrong-owner control **401**. Not verified: stored-secret
|
|
byte-intactness (Woodpecker never returns secret values). First post-fix push
|
|
on `next` is the end-to-end proof; per the pack status line above, that is
|
|
this PR's own merge pipeline. If `build-gateway` is still red with this
|
|
credential proven good, the fault is in the step, not the secret — do not
|
|
re-mint on that evidence. The earlier "Requires a package-scoped token
|
|
(Jason)" expectation is superseded: the defect was a stale value from the org
|
|
rename, not a scope grant Jason owed.
|
|
|
|
## Process record (audit trail)
|
|
|
|
- Merges executed under the jarvis principal (topher seat; identity provisioning
|
|
pending) via the Gitea API replicating `pr-merge.sh` semantics (head-pin +
|
|
squash + keep branch): `pr-merge.sh` hard-codes `main`-only targets and cannot
|
|
express this repo's `next` trunk — wrapper gap captured to OpenBrain
|
|
(id 9db7a95a) and to the framework queue.
|
|
- Reviews tonight: 175/178 (zane's #1298, both heads, by topher); 176/177/179/
|
|
180/181/182 (fred) — cross-review rule (producer ≠ reviewer) held on every
|
|
merge: producers were pi workers / zane; reviewers were the other seat.
|
|
- CI contention note: concurrent PR pipelines on the single CI agent can time
|
|
out the web SPA suite (measured 2470/2472 vs serialized 2475/2476/2477);
|
|
serialize retries when the queue is busy.
|
|
|
|
## Process record — 2026-08-18 day takeover (fargo)
|
|
|
|
- Takeover directive: Jason (via jarvis router + both seats' handoff documents,
|
|
relayed verbatim over comms). First-move conflict between the two handoffs
|
|
(zane: doctor PR first; topher: review-queue first) resolved on dependency
|
|
grounds per jarvis's read — topher's order won; zane's finding-2 doctor PR
|
|
(upgraded by fred's measurement) remains queued, nothing depends on it.
|
|
- Reviews 186 (#1299) + 187 (#1302): fargo, at pinned heads, as the legitimate
|
|
independent seat (topher dispatched both producers; cross-review rule held).
|
|
Both merged with --expect-head pinning via the REPO-COPY pr-merge.sh
|
|
(allows next; the installed copy still lags — zane's route, not the raw-API
|
|
break-glass), each preceded by ci-queue-wait -B next -R mosaicstack/stack.
|
|
CI green at both heads (2497, 2484). Merges content-verified on the shipping
|
|
ref (TASKS anchors at ff45f7b / 6435089).
|
|
- RI-3-002: one pi worker (zai/glm-5.3:high), independently verified by the
|
|
dispatching seat before push; PR #1308 reviewed by fred (188, seven
|
|
mutations incl. vacuous-pass and stage-removal) and merged head-pinned at
|
|
68279d61 → next @ 245e0c4.
|
|
- Registry-credential isolation measurement (above) performed read-only; no
|
|
secret values read, no retry-pushes against CI.
|
|
- One reviewer-scope disclosure (fred, review 188): fred's approval explicitly
|
|
did NOT re-run root build/typecheck/mosaic-vitest — those remain the
|
|
dispatching seat's numbers. The changed-package suites, verify-release
|
|
suite, and seven mutations were fred's own.
|