Files

T

jarvisandjason.woltje 5acce72c6a docs(ri-050): RI-V-001 evidence pack draft — measured exhibits so far (#1275 )

Draft during the 2026-08-18 overnight run: RI-N1 gate evidence complete
(2486 fail-closed blocking all publish steps, 2488 first gated green npm
publish, negative controls mutation-verified in #1305), plus pending-card
placeholders and the registry-credentials infrastructure note. Updated
to final when all RI cards merge.

2026-08-18 01:20:39 -05:00

6.5 KiB

Raw Blame History

RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor)

Status: DRAFT — in progress (evidence accumulating during the 2026-08-18 overnight run). Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source: docs/PRD.md § Release Integrity Workstream (#1275).

RI-N1 — Canonical terminal verification + exact-commit publish gate

exhibit	evidence	where
Gate live, fail-closed	Push pipeline 2486: `verify` ran at exact commit, FAILED on a real latent defect (gateway cross-user-isolation cleanup on the no-DB path), and `build` / `publish-npm` / `build-gateway` were all skipped. First push in repo history that did not publish ungated (prior ungated publishes beside failing builds: 2439, 2462, 2482).	Woodpecker repo 47 pipeline 2486
Gate-caught defect fixed	PR #1304 (afterAll honors `dbAvailable`; both paths verified: dead-port 28 skipped + file passes; live-5433 28 passed). Review 180 (fred).	PR #1304
First gated green npm publish	Push pipeline 2488 (post-#1304): `verify` GREEN → `build` GREEN → `publish-next-npm` GREEN, all publish effects behind the gate.	Woodpecker pipeline 2488
Negative controls	PR #1305: structural DAG tests (S1 missing edge, S2 renamed effect incl. command-based npm/kaniko detection, S3 detach, S4 failure:ignore/success override, S5 when-filter, S6 HEAD-mover between verify and publish with legitimate-recheckout positive control, S7 removal) + subset-stage composition control in verify-release.test.mjs. Mutation-verified by the dispatching seat in both directions (true bypass → S1 assertion fires; non-bypass edit → correctly green). Scripts tests 20/20, CI 2490 green.	PR #1305
⏳ Canonical command	`scripts/verify-release.mjs` (stage table pinned to ci.yml by checked-in test). Merged with #1277.	`scripts/verify-release.mjs`

RI-N2 — Forge + MACP fail-closed (typed explicit simulation)

⏳ Forge: PR #1278 (head 4917df1f; CI 2477 green; forge 116/116 at head). Merge pending review at rebased head.
⏳ MACP: PR #1293 (head 2097379e; CI 2465 green; review 173). Merge queued.
Post-merge behavior docs: PR #1299 (README + mosaic-forge SKILL.md; merges after #1278).

RI-N3 — PRD authority

⏳ PR #1294 (head 8d258e1d; CI 2466 green; review 174). Merge queued.

RI-N4 — Quality-rails evaluator

⏳ Probe inventory: PR #1302 (CI 2484 green). Review pending.
⏳ TS evaluator absorbs shell probes: RI-3-002, dispatch after #1302 merges.

RI-N5 — Consequence-aware stale UI

⏳ PR #1300 (head a337d787; CI 2481 green; review 179). Web suite 199 → 281 tests (failure matrix + negative controls), independently re-run by the dispatching seat. Merge queued.

Known-open infrastructure item (not a card)

Gateway/ci-base image pushes fail on registry credentials: Woodpecker repo secrets REGISTRY_USERNAME/REGISTRY_PASSWORD are rejected by the Gitea container registry (explicit UNAUTHORIZED at /v2/token; pipeline 2494 after PR #1306 corrected the secret references — previously masked as an ambiguous push-permission error since at least 2439). Requires a package-scoped token (Jason). The npm publish path is green and gated; this item tracks image pushes only and predates the RI-050 floor.

Process record (audit trail)

Merges executed under the jarvis principal (topher seat; identity provisioning pending) via the Gitea API replicating pr-merge.sh semantics (head-pin + squash + keep branch): pr-merge.sh hard-codes main-only targets and cannot express this repo's next trunk — wrapper gap captured to OpenBrain (id 9db7a95a) and to the framework queue.
Reviews tonight: 175/178 (zane's #1298, both heads, by topher); 176/177/179/ 180/181/182 (fred) — cross-review rule (producer ≠ reviewer) held on every merge: producers were pi workers / zane; reviewers were the other seat.
CI contention note: concurrent PR pipelines on the single CI agent can time out the web SPA suite (measured 2470/2472 vs serialized 2475/2476/2477); serialize retries when the queue is busy.

6.5 KiB Raw Blame History