From 33a6218aa37c81e15b191ea1be556cb68eb306da Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Thu, 17 Sep 2026 23:45:25 +0100 Subject: [PATCH 01/15] docs: add current v0.3 release assessment --- .../2026-09-17-v0.3-release-assessment.md | 451 ++++++++++++++++++ 1 file changed, 451 insertions(+) create mode 100644 docs/analysis/2026-09-17-v0.3-release-assessment.md diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md new file mode 100644 index 0000000000..7aa541cd91 --- /dev/null +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -0,0 +1,451 @@ +# v0.3 release assessment - 2026-09-17 + +This is a dated decision-support snapshot for the final `v0.3.0` release. It does not replace +[`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), the release plan, or live GitHub state. +Live GitHub and newer maintainer rulings take precedence. + +No recommendation below changes an issue, milestone, repository setting, or release gate by itself. +A scope change becomes authoritative only when the maintainer records it on the relevant issue. + +## Executive verdict + +**State: release candidate available, final release not ready.** + +Taskdeck has crossed the packaging threshold. `v0.3.0-rc.1` exists with a Windows x64 archive, +checksum, and provenance asset. The remaining path is dominated by release governance and proof, +not by inventing a distribution mechanism. + +The milestone is advanced in issue-count terms, but the most important remaining items are strongly +coupled: + +1. freeze the final scope and explicitly close or re-rule every open milestone issue; +2. complete and prove the Smart CI gate, including the landed-commit verifier; +3. bring Actions storage below the private-repository allowance or record a paid-spend decision; +4. finish clean-from-tag release qualification and the public release/source mirror; +5. execute the human private-repository cutover and post-cutover rehearsal; +6. prove the exact final tag and its public artifacts. + +Until those steps are complete, publishing a final `v0.3.0` would turn the RC into a release without +meeting the repository's own declared trust boundary. + +## 1. Snapshot + +Measured on 2026-09-17 against `main` `49e7d143c9611d32e68563d48a80373b5df9d725`. + +| Signal | Current state | Interpretation | +| --- | --- | --- | +| Milestone progress | 102 closed, 30 open, 132 total | **77.3% closed** by issue count | +| Open issue split | 16 CI, 5 dogfooding, 9 other | The remaining set mixes gates, human acts, trackers, defects, and broad feature work | +| Distribution | `v0.3.0-rc.1` published | Windows packaging, checksum, and provenance already exist | +| Development repository | Public | The planned private cutover has not happened | +| Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not yet required and branch-current enforcement is not yet the release contract | +| Open PR queue | 15 open at measurement time | Several are release-relevant, but many are unrelated to milestone closure | +| Milestone due date | None | Sequencing must come from the gate, not a calendar field | + +The issue percentage is useful for throughput, but it is not a release-readiness percentage. A +single unresolved gate such as storage, public-source continuity, or the private cutover can block +the release even when most issues are closed. + +## 2. Formal gate scorecard + +The standing release gate has five clauses. + +| Clause | State | What remains | +| --- | --- | --- | +| Exact final-head RC checks green | Pending | Re-run on the exact commit selected for the final tag, after the queue and scope are frozen | +| Milestone closed or explicitly re-ruled | **Not met** | 30 open issues need delivery, evidence-based closure, or an explicit milestone ruling | +| Launch kit drafted | **Met** | Keep copy and links current through the mirror cutover | +| `main` green | Must be re-proved | The final claim must bind to the eventual release head, not an older green tip | +| Private cutover with Smart CI gate enforced | **Not met** | Complete #2337 prerequisites, settings changes, private-mode rehearsal, and evidence | + +**Current formal position: no-go for the final tag.** This does not invalidate the RC. It means the +RC has not yet satisfied the final-release proof chain. + +## 3. Critical path + +### CP-1: Scope closure and milestone truth + +The current rule is that `v0.3.0` tags only when every milestone issue is closed or explicitly +re-ruled. With 30 open issues, the first maintainer task is not implementation. It is to assign each +issue one disposition: + +- **SHIP** - required for the v0.3 release claim; +- **CLOSE ON EVIDENCE** - materially delivered, but the issue needs reconciliation and a closing + record; +- **DEFER** - valuable, but not necessary for this release claim; move it to the correct milestone + with a reason; +- **HUMAN GATE** - implementation is prepared, but a maintainer action or value is required. + +Do this once, record it, and then reject new v0.3 scope unless it is a release-critical regression. +Without that freeze, closing issues faster can still move the release further away. + +### CP-2: Smart CI gate and landed verification + +Issues: #2326, #2327, #2329, #2331, #2332, #2508, plus tracker #2324. + +The planner and gate infrastructure are substantial, but the release contract is incomplete: + +- the landed-commit verifier required by #2327 is still missing; +- `mergeBaseSha` or an equivalent machine-readable moved-base binding in #2508 must be resolved as + part of that verifier contract; +- the latest recorded recall window was not acceptable: 7 usable merged PRs against a floor of 20, + with 3 observed failed lanes and 3 misses; +- selection must not leave shadow/observation mode until the declared recall threshold is actually + met; +- the maintainer must register `Smart CI / Required Gate`, enable branch-current strictness, retain + the three security contexts, and decide administrator enforcement only after the evidence is + clean. + +**Recommended acceptance:** at least 20 usable merged PRs after the last relevant planner fix, zero +false reds, 100% recall for the lane families being enabled, a proven bounded normal-merge path, and +proven full escalation for bypass/direct-push and missing-receipt cases. + +### CP-3: Storage economics before privacy + +Issue: #2333. + +Retention controls have improved, but the latest bounded measurement still exceeded the 1 GB +private-repository artifact allowance before the complete inventory was exhausted. Cache use was +also near its separate cap. + +Choose one of two honest outcomes before the visibility flip: + +1. **Recommended:** re-run the identity-bound cleanup dry run, preserve release/provenance evidence, + authorize the exact current deletion set, and verify unexpired artifact storage below the + allowance; or +2. record a non-zero Actions storage budget and alert that can sustain the measured estate. + +A `$0` hard ceiling and storage above the allowance are not a workable steady state. The risk is not +only cost: Actions can stop at the point the release most needs qualification. + +### CP-4: Release qualification and duplicate-event removal + +Issues: #2334, #2378, #2561, #2588, with current release-contract PRs #3111 and #3131. + +The nightly coordinator exists, but the recorded state is still observation-only. Complete the +following before the final tag: + +- accept the observation window before any nightly selective execution is enabled; +- prove the weekly full sweep across the declared Linux, Windows, browser, security, container, and + performance surfaces; +- keep mutation manual unless ADR-0052 is deliberately amended; +- rebuild from the exact tag in a clean hosted context; +- verify digests, SBOM, provenance, migration/upgrade behavior, and no promotion of ordinary PR + artifacts; +- collapse duplicate tag/release qualification where the same commit is otherwise built twice; +- run a no-publish rehearsal with self-hosted runners offline; +- resolve or explicitly disposition the Windows/Linux launcher timing residuals that can make release + qualification nondeterministic. + +PR #3111 is directly aligned with this path. PR #3131 closes a tag-grammar edge that should land +before a final tag is trusted. + +### CP-5: Supply-chain least privilege + +Issue: #2335. Primary open implementation: PR #2838. + +Full-SHA pinning, the hosted-only control-path fixture, and the `pull_request_target` trust contract +are substantially present. PR #2838 carries the remaining checkout-credential persistence and Pages +permission-scoping work identified in the cutover checklist. + +**Recommended action:** update #2838 onto current `main`, repeat exact-head hosted qualification and +fresh review, then merge it before the public cutover rehearsal. Do not keep this blocked merely +because the branch is old; either re-qualify it or replace it with a clean equivalent PR. + +A separate explicit CodeQL disposition should close the last policy ambiguity in #2335. It can be +"re-enable under the hosted control lane" or a recorded reason to keep the current scanners, but it +should not remain implicit. + +### CP-6: Public source and release continuity + +Issue: #2439. Design authority: +[`PUBLIC_MIRROR_OPTIONS.md`](../ci/PUBLIC_MIRROR_OPTIONS.md). + +The chosen design is already sensible: a separate public repository receives a source snapshot per +release tag plus byte-identical release assets. The missing pieces are operational: + +- maintainer creates and names the public mirror; +- maintainer creates a fine-grained publishing credential scoped only to that mirror; +- the private repository gains the fail-closed publishing workflow; +- the export denies nested `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` files at any depth; +- the snapshot scan handles the known documentation placeholders without weakening secret checks; +- GitHub token-shape detection uses the strict forms recorded on #2439; +- a prerelease rehearsal proves source and asset hashes before any public publish; +- README, licensing, launch-kit, install, and public-home links point at the mirror. + +**Suggested mirror name:** `Taskdeck-Public`. It communicates that it is the public distribution and +corresponding-source surface, not a second development authority. Keep Actions disabled in the +mirror. + +### CP-7: Human private-repository cutover + +Issue and checklist: #2337 and +[`PRIVATE_REPO_CUTOVER_CHECKLIST.md`](../ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md). + +Recommended order: + +1. freeze merges briefly and capture the current branch-protection and Actions settings; +2. finish storage cleanup or record spend; +3. finish the hosted public-mode rehearsal, including release dry run and mirror dry run; +4. require `Smart CI / Required Gate`, set strict branch-current behavior, and retain the security + contexts; +5. enable administrator enforcement with a documented temporary-setting break-glass procedure; +6. change the development repository to private; +7. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork + policy; +8. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release + rehearsal; +9. register isolated self-hosted runners only now, then prove no secrets, read-only token posture, + offline behavior, and hosted override; +10. record evidence and resume normal merges. + +The repository must stay hosted-only until the visibility boundary is private and the isolated +runners are deliberately registered. + +### CP-8: Final tag and public verification + +After all earlier gates are closed: + +- select one exact `main` commit and stop feature merges; +- update release notes, upgrade notes, known limitations, and public links; +- run the complete final-head gate and release qualification; +- smoke the Windows archive from a clean extraction path; +- smoke the container by immutable digest; +- prove the MCP external-client to proposal to human review to applied-card path; +- prove install/update/backup behavior claimed by the release; +- publish the source snapshot and assets to the public mirror; +- verify checksums and provenance from the public consumer side; +- publish `v0.3.0` only after those identities match. + +## 4. Maintainer decision packet + +### D1: Keep the current all-issues rule or focus the release scope + +**Option A - strict milestone closure:** implement every open issue before `v0.3.0`. + +- Strongest interpretation of the existing ruling. +- Highest schedule uncertainty because the milestone still contains broad redesigns and long-tail + residuals. + +**Option B - claim-based release scope:** keep every trust, packaging, security, data-integrity, and +headline-product issue in v0.3; explicitly move broad redesigns and non-blocking polish to the next +milestone. + +- Preserves release quality while preventing unrelated ambition from indefinitely blocking a + downloadable beta. +- Requires a visible per-issue ruling rather than silent scope drift. + +**Recommendation: Option B.** Keep the bar high for what v0.3 claims, but stop using one milestone as +both a release gate and an unlimited improvement backlog. + +### D2: CLI trust model - #1131 + +**Option A:** route CLI mutations through claims-first actor and board authorization. + +**Option B:** define the CLI as an unrestricted local-administrator tool, gate its availability, and +document that it must not be exposed to a collaborator or remote shell. + +**Recommendation for v0.3: Option B**, provided the shared instance does not expose the CLI to the +second user. Schedule claims-first CLI authorization before the CLI becomes a collaborative or +remote operator surface. + +### D3: Automation Chat - #2004 + +**Option A:** complete the full chat workflow redesign in v0.3. + +**Option B:** ship a bounded honesty repair: an actionable turn without a board cannot look +successful; board binding is explicit; generated prose is never presented as an applied change; the +turn ends in a proposal link or a clear non-action reason. Move the richer default-to-act redesign to +v0.4. + +**Option C:** label or disable Automation Chat as experimental for v0.3 and move the complete issue. + +**Recommendation: Option B** if Chat remains visible in the headline experience. Use Option C if the +surface is not needed for the v0.3 story. + +### D4: Night theme - #2009 + +**Option A:** complete the multi-palette design spike and ADR now. + +**Option B:** land the measurable release-safety subset: control-boundary contrast, night contrast +specs, view-layer color-audit coverage, and removal of known theme-agnostic literals. Move aesthetic +palette exploration to the next milestone. + +**Option C:** mark the theme experimental and defer the whole issue. + +**Recommendation: Option B** if the night theme is offered as supported. Otherwise use Option C. + +### D5: MCP hash approval - #1309 + +**Option A:** enforce tool-definition hash approval in the invocation path now. + +**Option B:** retain the current explicit statement that runtime approval is not enforced, avoid an +implied security claim, and close v0.3 after the external-client to Review to applied-card demo is +proved. + +**Recommendation: Option B for v0.3.** The current invariant and guide are already honest. Runtime +approval is valuable, but it should arrive as a fully designed policy rather than a rushed final-tag +hook. + +### D6: Two-person private instance - #1772 + +**Option A:** keep it as a v0.3 gate and perform the real two-account deployment, backup, restore, +realtime, access-policy, and durability proof. + +**Option B:** move it to v0.4 and keep v0.3 strictly a downloadable/self-hosted beta release. + +**Recommendation: Option B** unless the release will actively recruit a second participant. If it is +retained, the maintainer must supply the collaborator identity, monthly ceiling and alert threshold, +and off-platform backup-retention window before deployment. + +### D7: Administrator enforcement + +**Option A:** `enforce_admins: true`, with break-glass documented as a temporary, recorded settings +change. + +**Option B:** leave administrators exempt and rely on process. + +**Recommendation: Option A** after the rehearsal. A release trust boundary is strongest when it also +binds the maintainer, while still allowing an explicit emergency procedure. + +### D8: Storage posture + +**Option A:** preserve only release/provenance and required audit evidence, delete obsolete CI +artifacts using the identity-bound tool, and keep the `$0` ceiling. + +**Option B:** retain the larger evidence estate and set a realistic paid storage budget. + +**Recommendation: Option A** for v0.3. The repository already contains purpose-built retention and +cleanup machinery; paying for obsolete build output has little release value. + +## 5. Disposition proposal for all 30 open milestone issues + +This table is a proposed release-owner pass. It is deliberately explicit so no open issue disappears +inside a percentage. + +| Issue | Proposed disposition | Required release outcome | +| --- | --- | --- | +| #2324 | CLOSE LAST | Close after its child evidence and the cutover ledger are complete | +| #2326 | SHIP | Clean shadow planner evidence and accepted recall report | +| #2327 | SHIP | Landed verifier, gate proof, settings handoff, post-registration proof | +| #2328 | SHIP + HUMAN GATE | Scripts/contracts complete; register isolated runners only after privacy | +| #2329 | SHIP | Ownership manifest complete and recall demonstrates safe selection | +| #2331 | SHIP | Bounded Windows contract and weekly full coverage before matrix reduction | +| #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | +| #2333 | SHIP + HUMAN GATE | Storage below allowance or paid-spend decision, with ledger evidence | +| #2334 | SHIP | Accepted nightly observation, weekly sweep, clean tag qualification | +| #2335 | SHIP | Re-qualify/merge #2838 and record CodeQL disposition | +| #2337 | HUMAN GATE | Execute the private cutover and private-mode rehearsal | +| #2378 | SHIP OR CLOSE ON CURRENT EVIDENCE | Remove the Windows timeout class or prove the new contract supersedes it | +| #2439 | SHIP + HUMAN GATE | Create mirror, publish workflow, rehearsal, and public-link cutover | +| #2508 | SHIP WITH #2327 | Make moved-base receipt binding machine-readable or supersede it explicitly | +| #2561 | SHIP OR CONSOLIDATE | Close stale PID/process-state behavior needed for reliable Windows qualification | +| #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism needed for reliable qualification | +| #1940 | CLOSE ON EVIDENCE + DECISION | Core acceptance is delivered; settle request-edit/defer follow-ups or refile them | +| #1949 | RECONCILE | Close delivered guards; move parser/coverage long-tail into a bounded follow-up if non-blocking | +| #1999 | CLOSE ON EVIDENCE | Reconcile delivered triage-edit work and refile only proven residuals | +| #2004 | DECIDE | Bounded honesty repair in v0.3 or move/disable the broader redesign | +| #2009 | DECIDE | Ship contrast/audit safety subset or move the palette spike | +| #1131 | DECIDE + DOCUMENT/IMPLEMENT | Claims-first CLI or explicitly gated local-admin CLI | +| #1307 | RECONCILE, THEN SHIP OR SPLIT | Audit shipped risk ordering/batch flow; keep only unresolved honesty work in scope | +| #1309 | CLOSE AFTER PROOF | Retain honest no-enforcement decision and complete the external MCP demo | +| #1772 | DECIDE | Keep as real participant proof or move to v0.4 | +| #2214 | SHIP | Deep-link reauthorization, poll recovery, and stale-state honesty | +| #2235 | CLOSEOUT LAST | Reconcile docs, issues, ADRs, links, status, and release-facing truth | +| #2315 | CLOSE ON EVIDENCE OR DEFER | It is not a blocker by prior ruling; do not leave it both non-blocking and milestone-open | +| #2391 | SHIP AFTER MIRROR | Make every launch block copy-ready with final public URLs and caveats | +| #2499 | TARGETED FIX OR DEFER | Document legacy fail-closed behavior; decide whether broader producer stamping is a v0.3 claim | + +## 6. Open PR queue: release ordering + +The queue is moving quickly. Treat the following as release-oriented priority rather than merge order +by age. + +### Priority 0: directly on the release trust path + +- #2838 - checkout credentials and Pages permission scoping; +- #3111 - container release contract; +- #3131 - release-tag grammar; +- #3130 - public Pages behavior and no-loopback demo posture; +- #3139 - hosted execution of documentation-governance regression suites; +- #3143 - hosted Docker MCP safety regressions, if it remains the chosen closure for #2332/#2312. + +### Priority 1: supports closure but does not independently unlock the tag + +- #2931 - mutation activation smoke; useful, but mutation remains manual; +- #3098 - friends-and-family runbook; important only if #1772 stays in v0.3; +- #3140 - PowerShell inventory wrapper correctness; +- #3113 - worktree guard hardening. + +### Priority 2: normal product correctness + +The remaining product PRs should continue only where they close retained v0.3 issues or fix a +release-critical regression. Otherwise, let them settle after the release branch is frozen rather +than repeatedly moving the final qualification head. + +## 7. Recommended execution sequence + +### Wave A: lock the release + +1. Record D1 to D8 on the relevant issues. +2. Apply a disposition to all 30 open issues. +3. Stop admitting non-critical work to v0.3. +4. Re-qualify and merge the Priority 0 PRs. +5. Implement the landed verifier and close the receipt-binding residual. +6. Complete the bounded product fixes retained by the scope ruling. + +### Wave B: prove the control plane + +1. Fix any remaining Smart CI false-red/missed-lane cause. +2. Accumulate the complete observation window. +3. Accept the nightly observation and weekly full sweep. +4. Clean storage and record the new measurement. +5. Create the public mirror and run the no-publish rehearsal. +6. Complete the public hosted-only cutover rehearsal. + +### Wave C: cut over and release + +1. Pause merges and capture settings. +2. Register the required gate and strict branch-current behavior. +3. Flip the development repository private. +4. Run the private-mode matrix and main verifier. +5. Register and prove isolated runners, or remain hosted-only if that is the recorded final ruling. +6. Close trackers and run #2235's final truth pass. +7. Freeze one exact release commit. +8. Qualify and publish the final tag, source snapshot, assets, checksums, and provenance. +9. Verify the public consumer path before announcing. + +## 8. Definition of done + +`v0.3.0` is ready when all of the following are true: + +- every milestone issue is closed or carries an explicit recorded move; +- no release-critical PR is parked or waiting on an unrecorded maintainer ruling; +- the exact final head is green under the final required-check configuration; +- the landed verifier and full-escalation paths are proven; +- the Smart CI observation and recall threshold is met; +- storage and spend posture is sustainable in private mode; +- clean-from-tag release qualification succeeds with runners offline; +- public source and release assets are available through the mirror with matching identities; +- private-mode R0/R2/R4, merge, nightly, and release rehearsals pass; +- the Windows archive, immutable container, MCP proposal flow, upgrade, and supported backup path are + smoke-tested from a consumer perspective; +- release notes and known limitations describe shipped reality rather than intended work; +- the final tag is the commit that received the evidence above. + +## 9. Advancement brief + +- **Issue throughput:** strong - 102 of 132 milestone issues are closed. +- **Packaging:** strong - a real RC and integrity assets exist. +- **Product readiness:** mixed - the core downloadable beta exists, but a small number of broad + product decisions still obscure the release boundary. +- **CI/release trust:** incomplete - the landed verifier, valid observation evidence, release + qualification, least-privilege residual, and storage target remain open. +- **Distribution continuity:** designed but not operational - the public mirror still needs creation, + workflow, and rehearsal. +- **Human cutover:** not executed - the development repository remains public and the final required + gate is not enforced. + +The milestone is therefore **late-stage but not in final-tag territory**. The fastest safe route is +not more parallel feature work. It is a short release programme centered on scope rulings, the Smart +CI proof chain, storage, mirror continuity, and the private cutover. From ca6cf02d85a66f4f1f42f1a922b4ce6e1076b677 Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Thu, 17 Sep 2026 23:52:27 +0100 Subject: [PATCH 02/15] docs: refresh v0.3 milestone and CI evidence --- .../2026-09-17-v0.3-release-assessment.md | 81 +++++++++++-------- 1 file changed, 47 insertions(+), 34 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index 7aa541cd91..7058cb6abe 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -30,16 +30,18 @@ meeting the repository's own declared trust boundary. ## 1. Snapshot -Measured on 2026-09-17 against `main` `49e7d143c9611d32e68563d48a80373b5df9d725`. +Code and settings were measured on 2026-09-17 against `main` +`49e7d143c9611d32e68563d48a80373b5df9d725`. The milestone count was refreshed after #2561 closed at +2026-09-17T22:41:10Z. | Signal | Current state | Interpretation | | --- | --- | --- | -| Milestone progress | 102 closed, 30 open, 132 total | **77.3% closed** by issue count | -| Open issue split | 16 CI, 5 dogfooding, 9 other | The remaining set mixes gates, human acts, trackers, defects, and broad feature work | +| Milestone progress | 103 closed, 29 open, 132 total | **78.0% closed** by issue count | +| Open issue split | 15 CI, 5 dogfooding, 9 other | The remaining set mixes gates, human acts, trackers, defects, and broad feature work | | Distribution | `v0.3.0-rc.1` published | Windows packaging, checksum, and provenance already exist | | Development repository | Public | The planned private cutover has not happened | | Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not yet required and branch-current enforcement is not yet the release contract | -| Open PR queue | 15 open at measurement time | Several are release-relevant, but many are unrelated to milestone closure | +| Open PR queue | 16 including this assessment PR at refresh | Several are release-relevant, but many are unrelated to milestone closure | | Milestone due date | None | Sequencing must come from the gate, not a calendar field | The issue percentage is useful for throughput, but it is not a release-readiness percentage. A @@ -53,7 +55,7 @@ The standing release gate has five clauses. | Clause | State | What remains | | --- | --- | --- | | Exact final-head RC checks green | Pending | Re-run on the exact commit selected for the final tag, after the queue and scope are frozen | -| Milestone closed or explicitly re-ruled | **Not met** | 30 open issues need delivery, evidence-based closure, or an explicit milestone ruling | +| Milestone closed or explicitly re-ruled | **Not met** | 29 open issues need delivery, evidence-based closure, or an explicit milestone ruling | | Launch kit drafted | **Met** | Keep copy and links current through the mirror cutover | | `main` green | Must be re-proved | The final claim must bind to the eventual release head, not an older green tip | | Private cutover with Smart CI gate enforced | **Not met** | Complete #2337 prerequisites, settings changes, private-mode rehearsal, and evidence | @@ -66,7 +68,7 @@ RC has not yet satisfied the final-release proof chain. ### CP-1: Scope closure and milestone truth The current rule is that `v0.3.0` tags only when every milestone issue is closed or explicitly -re-ruled. With 30 open issues, the first maintainer task is not implementation. It is to assign each +re-ruled. With 29 open issues, the first maintainer task is not implementation. It is to assign each issue one disposition: - **SHIP** - required for the v0.3 release claim; @@ -86,15 +88,18 @@ Issues: #2326, #2327, #2329, #2331, #2332, #2508, plus tracker #2324. The planner and gate infrastructure are substantial, but the release contract is incomplete: - the landed-commit verifier required by #2327 is still missing; -- `mergeBaseSha` or an equivalent machine-readable moved-base binding in #2508 must be resolved as - part of that verifier contract; -- the latest recorded recall window was not acceptable: 7 usable merged PRs against a floor of 20, - with 3 observed failed lanes and 3 misses; -- selection must not leave shadow/observation mode until the declared recall threshold is actually - met; -- the maintainer must register `Smart CI / Required Gate`, enable branch-current strictness, retain - the three security contexts, and decide administrator enforcement only after the evidence is - clean. +- #2508's core `mergeBaseSha` / `mergeBaseTipSha` machine-readable binding shipped in PR #2832, but + two bounded residuals remain: malformed diagnostic receipts must normalise invalid binding fields + to `null`, and no-event local `--pr` simulation needs explicit validation semantics; +- the latest recorded selection-recall report was not acceptable: 7 usable merged PRs against a + floor of 20, with 3 observed failed lanes and 3 misses; +- the gate's separate false-red observation window is also not clean: its earlier zero-false-red + claim was retracted after a reproducible base-move false red; +- selection must not leave shadow/observation mode until the declared recall threshold and false-red + threshold are both met; +- after the repository is private, the maintainer must register `Smart CI / Required Gate`, enable + the current `strict: true` branch-current ruling, retain the three security contexts, and decide + administrator enforcement. **Recommended acceptance:** at least 20 usable merged PRs after the last relevant planner fix, zero false reds, 100% recall for the lane families being enabled, a proven bounded normal-merge path, and @@ -120,7 +125,10 @@ only cost: Actions can stop at the point the release most needs qualification. ### CP-4: Release qualification and duplicate-event removal -Issues: #2334, #2378, #2561, #2588, with current release-contract PRs #3111 and #3131. +Issues: #2334, #2378 and #2588, with current release-contract PRs #3111 and #3131. + +#2561 closed during this assessment after its launcher cleanup path was completed and reconciled. It +is no longer part of the open release queue. The nightly coordinator exists, but the recorded state is still observation-only. Complete the following before the final tag: @@ -134,8 +142,8 @@ following before the final tag: artifacts; - collapse duplicate tag/release qualification where the same commit is otherwise built twice; - run a no-publish rehearsal with self-hosted runners offline; -- resolve or explicitly disposition the Windows/Linux launcher timing residuals that can make release - qualification nondeterministic. +- resolve or explicitly disposition the remaining Windows/Linux launcher timing residuals that can + make release qualification nondeterministic. PR #3111 is directly aligned with this path. PR #3131 closes a tag-grammar edge that should land before a final tag is trusted. @@ -182,15 +190,19 @@ mirror. Issue and checklist: #2337 and [`PRIVATE_REPO_CUTOVER_CHECKLIST.md`](../ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md). +The latest #2327 evidence adds an important ordering correction: do not register the stable gate +while the repository is public, because a fork can publish a same-named `pull_request` check. Use a +short, frozen cutover window instead. + Recommended order: 1. freeze merges briefly and capture the current branch-protection and Actions settings; 2. finish storage cleanup or record spend; 3. finish the hosted public-mode rehearsal, including release dry run and mirror dry run; -4. require `Smart CI / Required Gate`, set strict branch-current behavior, and retain the security - contexts; -5. enable administrator enforcement with a documented temporary-setting break-glass procedure; -6. change the development repository to private; +4. enable the full-SHA action setting after the pinning migration is qualified; +5. change the development repository to private while the merge freeze remains active; +6. immediately require `Smart CI / Required Gate`, set `strict: true`, retain the three security + contexts, and apply the recorded administrator-enforcement decision; 7. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork policy; 8. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release @@ -318,7 +330,7 @@ artifacts using the identity-bound tool, and keep the `$0` ceiling. **Recommendation: Option A** for v0.3. The repository already contains purpose-built retention and cleanup machinery; paying for obsolete build output has little release value. -## 5. Disposition proposal for all 30 open milestone issues +## 5. Disposition proposal for all 29 open milestone issues This table is a proposed release-owner pass. It is deliberately explicit so no open issue disappears inside a percentage. @@ -338,8 +350,7 @@ inside a percentage. | #2337 | HUMAN GATE | Execute the private cutover and private-mode rehearsal | | #2378 | SHIP OR CLOSE ON CURRENT EVIDENCE | Remove the Windows timeout class or prove the new contract supersedes it | | #2439 | SHIP + HUMAN GATE | Create mirror, publish workflow, rehearsal, and public-link cutover | -| #2508 | SHIP WITH #2327 | Make moved-base receipt binding machine-readable or supersede it explicitly | -| #2561 | SHIP OR CONSOLIDATE | Close stale PID/process-state behavior needed for reliable Windows qualification | +| #2508 | SHIP RESIDUALS | Core binding shipped in #2832; normalise malformed diagnostic receipts and define local `--pr` semantics | | #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism needed for reliable qualification | | #1940 | CLOSE ON EVIDENCE + DECISION | Core acceptance is delivered; settle request-edit/defer follow-ups or refile them | | #1949 | RECONCILE | Close delivered guards; move parser/coverage long-tail into a bounded follow-up if non-blocking | @@ -375,7 +386,8 @@ by age. - #2931 - mutation activation smoke; useful, but mutation remains manual; - #3098 - friends-and-family runbook; important only if #1772 stays in v0.3; - #3140 - PowerShell inventory wrapper correctness; -- #3113 - worktree guard hardening. +- #3113 - worktree guard hardening; +- #3151 - this release assessment and decision packet. ### Priority 2: normal product correctness @@ -388,16 +400,16 @@ than repeatedly moving the final qualification head. ### Wave A: lock the release 1. Record D1 to D8 on the relevant issues. -2. Apply a disposition to all 30 open issues. +2. Apply a disposition to all 29 open issues. 3. Stop admitting non-critical work to v0.3. 4. Re-qualify and merge the Priority 0 PRs. -5. Implement the landed verifier and close the receipt-binding residual. +5. Implement the landed verifier and close #2508's two remaining receipt/CLI residuals. 6. Complete the bounded product fixes retained by the scope ruling. ### Wave B: prove the control plane 1. Fix any remaining Smart CI false-red/missed-lane cause. -2. Accumulate the complete observation window. +2. Accumulate the complete observation and recall windows. 3. Accept the nightly observation and weekly full sweep. 4. Clean storage and record the new measurement. 5. Create the public mirror and run the no-publish rehearsal. @@ -406,8 +418,8 @@ than repeatedly moving the final qualification head. ### Wave C: cut over and release 1. Pause merges and capture settings. -2. Register the required gate and strict branch-current behavior. -3. Flip the development repository private. +2. Flip the development repository private in the frozen window. +3. Register the required gate, `strict: true`, retained security checks, and administrator policy. 4. Run the private-mode matrix and main verifier. 5. Register and prove isolated runners, or remain hosted-only if that is the recorded final ruling. 6. Close trackers and run #2235's final truth pass. @@ -423,7 +435,7 @@ than repeatedly moving the final qualification head. - no release-critical PR is parked or waiting on an unrecorded maintainer ruling; - the exact final head is green under the final required-check configuration; - the landed verifier and full-escalation paths are proven; -- the Smart CI observation and recall threshold is met; +- the Smart CI observation and recall thresholds are met; - storage and spend posture is sustainable in private mode; - clean-from-tag release qualification succeeds with runners offline; - public source and release assets are available through the mirror with matching identities; @@ -435,11 +447,12 @@ than repeatedly moving the final qualification head. ## 9. Advancement brief -- **Issue throughput:** strong - 102 of 132 milestone issues are closed. +- **Issue throughput:** strong - 103 of 132 milestone issues are closed, and #2561 closed during this + assessment. - **Packaging:** strong - a real RC and integrity assets exist. - **Product readiness:** mixed - the core downloadable beta exists, but a small number of broad product decisions still obscure the release boundary. -- **CI/release trust:** incomplete - the landed verifier, valid observation evidence, release +- **CI/release trust:** incomplete - the landed verifier, clean observation/recall evidence, release qualification, least-privilege residual, and storage target remain open. - **Distribution continuity:** designed but not operational - the public mirror still needs creation, workflow, and rehearsal. From e74f4ab19ce2aba335908a72afc46179ded31d4a Mon Sep 17 00:00:00 2001 From: Chris0Jeky Date: Fri, 18 Sep 2026 00:01:09 +0100 Subject: [PATCH 03/15] docs: align release assessment with settled gates --- .../2026-09-17-v0.3-release-assessment.md | 50 ++++++++++--------- 1 file changed, 27 insertions(+), 23 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index 7058cb6abe..57615bbe88 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -20,7 +20,7 @@ coupled: 1. freeze the final scope and explicitly close or re-rule every open milestone issue; 2. complete and prove the Smart CI gate, including the landed-commit verifier; -3. bring Actions storage below the private-repository allowance or record a paid-spend decision; +3. bring Actions storage below the private-repository allowance under the confirmed `$0` ceiling; 4. finish clean-from-tag release qualification and the public release/source mirror; 5. execute the human private-repository cutover and post-cutover rehearsal; 6. prove the exact final tag and its public artifacts. @@ -97,9 +97,9 @@ The planner and gate infrastructure are substantial, but the release contract is claim was retracted after a reproducible base-move false red; - selection must not leave shadow/observation mode until the declared recall threshold and false-red threshold are both met; -- after the repository is private, the maintainer must register `Smart CI / Required Gate`, enable - the current `strict: true` branch-current ruling, retain the three security contexts, and decide - administrator enforcement. +- after the repository is private, the maintainer must register `Smart CI / Required Gate`, retain + the three security contexts, and decide `strict` branch-current enforcement and administrator + enforcement from the observed recall and false-red evidence; neither setting is pre-ruled. **Recommended acceptance:** at least 20 usable merged PRs after the last relevant planner fix, zero false reds, 100% recall for the lane families being enabled, a proven bounded normal-merge path, and @@ -113,14 +113,13 @@ Retention controls have improved, but the latest bounded measurement still excee private-repository artifact allowance before the complete inventory was exhausted. Cache use was also near its separate cap. -Choose one of two honest outcomes before the visibility flip: +Before the visibility flip, re-run the identity-bound cleanup dry run, preserve release/provenance +evidence, authorize the exact current deletion set, and verify unexpired artifact storage below the +allowance. The settled SC-3 ruling keeps the Actions spending limit at `$0`; paid overage is not an +available release prerequisite. If cleanup is insufficient, the maintainer must resolve that gap +within the `$0` posture before cutover. -1. **Recommended:** re-run the identity-bound cleanup dry run, preserve release/provenance evidence, - authorize the exact current deletion set, and verify unexpired artifact storage below the - allowance; or -2. record a non-zero Actions storage budget and alert that can sustain the measured estate. - -A `$0` hard ceiling and storage above the allowance are not a workable steady state. The risk is not +A `$0` hard ceiling with storage above the allowance is not a workable steady state. The risk is not only cost: Actions can stop at the point the release most needs qualification. ### CP-4: Release qualification and duplicate-event removal @@ -157,8 +156,9 @@ are substantially present. PR #2838 carries the remaining checkout-credential pe permission-scoping work identified in the cutover checklist. **Recommended action:** update #2838 onto current `main`, repeat exact-head hosted qualification and -fresh review, then merge it before the public cutover rehearsal. Do not keep this blocked merely -because the branch is old; either re-qualify it or replace it with a clean equivalent PR. +fresh review, and take it through the still-open ADR-0066/J.3 maintainer decision and review before +the public cutover rehearsal. Merge it only after that explicit control-plane gate and all current +evidence pass; do not treat an old branch, a replacement PR, or agent approval as a waiver. A separate explicit CodeQL disposition should close the last policy ambiguity in #2335. It can be "re-enable under the hosted control lane" or a recorded reason to keep the current scanners, but it @@ -201,8 +201,8 @@ Recommended order: 3. finish the hosted public-mode rehearsal, including release dry run and mirror dry run; 4. enable the full-SHA action setting after the pinning migration is qualified; 5. change the development repository to private while the merge freeze remains active; -6. immediately require `Smart CI / Required Gate`, set `strict: true`, retain the three security - contexts, and apply the recorded administrator-enforcement decision; +6. immediately require `Smart CI / Required Gate`, retain the three security contexts, and apply the + evidence-based maintainer decisions for branch-current strictness and administrator enforcement; 7. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork policy; 8. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release @@ -313,22 +313,25 @@ and off-platform backup-retention window before deployment. ### D7: Administrator enforcement **Option A:** `enforce_admins: true`, with break-glass documented as a temporary, recorded settings -change. +change, if the post-rehearsal evidence supports it. **Option B:** leave administrators exempt and rely on process. -**Recommendation: Option A** after the rehearsal. A release trust boundary is strongest when it also -binds the maintainer, while still allowing an explicit emergency procedure. +**Recommendation:** defer this choice until the rehearsal and observation evidence are recorded. If +that evidence supports administrator enforcement, Option A gives the strongest release trust boundary +while still allowing an explicit emergency procedure; the maintainer owns the decision. ### D8: Storage posture **Option A:** preserve only release/provenance and required audit evidence, delete obsolete CI artifacts using the identity-bound tool, and keep the `$0` ceiling. -**Option B:** retain the larger evidence estate and set a realistic paid storage budget. +**Option B:** retain the larger evidence estate and seek a new maintainer ruling. It is not an +available v0.3 release posture under the settled `$0` hard ceiling. **Recommendation: Option A** for v0.3. The repository already contains purpose-built retention and -cleanup machinery; paying for obsolete build output has little release value. +cleanup machinery; retaining obsolete build output has little release value under the settled +spending ceiling. ## 5. Disposition proposal for all 29 open milestone issues @@ -344,9 +347,9 @@ inside a percentage. | #2329 | SHIP | Ownership manifest complete and recall demonstrates safe selection | | #2331 | SHIP | Bounded Windows contract and weekly full coverage before matrix reduction | | #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | -| #2333 | SHIP + HUMAN GATE | Storage below allowance or paid-spend decision, with ledger evidence | +| #2333 | SHIP + HUMAN GATE | Storage below allowance under the `$0` ceiling, with ledger evidence | | #2334 | SHIP | Accepted nightly observation, weekly sweep, clean tag qualification | -| #2335 | SHIP | Re-qualify/merge #2838 and record CodeQL disposition | +| #2335 | SHIP | Re-qualify #2838, obtain the ADR-0066/J.3 maintainer gate before any merge, and record CodeQL disposition | | #2337 | HUMAN GATE | Execute the private cutover and private-mode rehearsal | | #2378 | SHIP OR CLOSE ON CURRENT EVIDENCE | Remove the Windows timeout class or prove the new contract supersedes it | | #2439 | SHIP + HUMAN GATE | Create mirror, publish workflow, rehearsal, and public-link cutover | @@ -419,7 +422,8 @@ than repeatedly moving the final qualification head. 1. Pause merges and capture settings. 2. Flip the development repository private in the frozen window. -3. Register the required gate, `strict: true`, retained security checks, and administrator policy. +3. Register the required gate and retained security checks, then apply the evidence-based decisions + for branch-current strictness and administrator enforcement. 4. Run the private-mode matrix and main verifier. 5. Register and prove isolated runners, or remain hosted-only if that is the recorded final ruling. 6. Close trackers and run #2235's final truth pass. From 2e706d18d2d2f0dea359d8ed66af932e0290d85f Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:03:33 +0100 Subject: [PATCH 04/15] docs: correct v0.3 cutover and mirror sequencing --- .../2026-09-17-v0.3-release-assessment.md | 156 +++++++++++------- 1 file changed, 99 insertions(+), 57 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index 57615bbe88..00f0257ace 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -22,8 +22,10 @@ coupled: 2. complete and prove the Smart CI gate, including the landed-commit verifier; 3. bring Actions storage below the private-repository allowance under the confirmed `$0` ceiling; 4. finish clean-from-tag release qualification and the public release/source mirror; -5. execute the human private-repository cutover and post-cutover rehearsal; -6. prove the exact final tag and its public artifacts. +5. prove self-hosted runner isolation before registration; +6. execute the human private-repository cutover and post-cutover rehearsal; +7. prove the exact final tag, publish the private Release, republish it through the public mirror, + and verify the public artifacts before announcement. Until those steps are complete, publishing a final `v0.3.0` would turn the RC into a release without meeting the repository's own declared trust boundary. @@ -41,7 +43,7 @@ Code and settings were measured on 2026-09-17 against `main` | Distribution | `v0.3.0-rc.1` published | Windows packaging, checksum, and provenance already exist | | Development repository | Public | The planned private cutover has not happened | | Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not yet required and branch-current enforcement is not yet the release contract | -| Open PR queue | 16 including this assessment PR at refresh | Several are release-relevant, but many are unrelated to milestone closure | +| Open PR queue | Moving rapidly during this assessment | Use section 6 as a release-priority snapshot, not as a stable count | | Milestone due date | None | Sequencing must come from the gate, not a calendar field | The issue percentage is useful for throughput, but it is not a release-readiness percentage. A @@ -88,9 +90,9 @@ Issues: #2326, #2327, #2329, #2331, #2332, #2508, plus tracker #2324. The planner and gate infrastructure are substantial, but the release contract is incomplete: - the landed-commit verifier required by #2327 is still missing; -- #2508's core `mergeBaseSha` / `mergeBaseTipSha` machine-readable binding shipped in PR #2832, but - two bounded residuals remain: malformed diagnostic receipts must normalise invalid binding fields - to `null`, and no-event local `--pr` simulation needs explicit validation semantics; +- #2508's core `mergeBaseSha` / `mergeBaseTipSha` machine-readable binding shipped in PR #2832; +- draft PR #3156 addresses #2508's two remaining bounded residuals: schema-valid diagnostic + receipts for malformed bindings and explicit no-event local `--pr` semantics; - the latest recorded selection-recall report was not acceptable: 7 usable merged PRs against a floor of 20, with 3 observed failed lanes and 3 misses; - the gate's separate false-red observation window is also not clean: its earlier zero-false-red @@ -178,56 +180,80 @@ release tag plus byte-identical release assets. The missing pieces are operation - the export denies nested `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` files at any depth; - the snapshot scan handles the known documentation placeholders without weakening secret checks; - GitHub token-shape detection uses the strict forms recorded on #2439; -- a prerelease rehearsal proves source and asset hashes before any public publish; +- a dry-run rehearsal proves the snapshot and asset-verification path without publishing; - README, licensing, launch-kit, install, and public-home links point at the mirror. +The final handoff is deliberately private-first. The mirror workflow consumes the already-published +private Release, its body, and its assets. It then stages and verifies an invisible draft in the +mirror before publishing the public commit, tag, and Release. + **Suggested mirror name:** `Taskdeck-Public`. It communicates that it is the public distribution and corresponding-source surface, not a second development authority. Keep Actions disabled in the mirror. -### CP-7: Human private-repository cutover +### CP-7: Runner proof and human private-repository cutover -Issue and checklist: #2337 and +Issues and authority: #2328, #2337, +[`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), and [`PRIVATE_REPO_CUTOVER_CHECKLIST.md`](../ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md). -The latest #2327 evidence adds an important ordering correction: do not register the stable gate -while the repository is public, because a fork can publish a same-named `pull_request` check. Use a -short, frozen cutover window instead. +Two boundaries must remain distinct: + +1. **Before cutover, while no self-hosted runner is associated with the public repository**, prove + the isolated VM, no-host-mount, no-personal-credential, one-job-per-host, hosted-override, + offline-runner, workspace/Docker/cache cleanup, VM-reset, and revocation contracts. +2. **After the repository becomes private**, perform only the human registration/association step, + then verify labels, read-only token posture, and one selected private workload on the already + proven runner environment. + +The latest #2327 evidence adds another ordering constraint: do not register the stable gate while +the repository is public, because a fork can publish a same-named `pull_request` check. Use a short, +frozen cutover window instead. Recommended order: 1. freeze merges briefly and capture the current branch-protection and Actions settings; -2. finish storage cleanup or record spend; -3. finish the hosted public-mode rehearsal, including release dry run and mirror dry run; -4. enable the full-SHA action setting after the pinning migration is qualified; -5. change the development repository to private while the merge freeze remains active; -6. immediately require `Smart CI / Required Gate`, retain the three security contexts, and apply the +2. finish storage cleanup under the settled `$0` ceiling; +3. finish the hosted public-mode rehearsal, including release and mirror dry runs; +4. complete the entire pre-registration runner isolation, cleanup, offline, override, reset, and + revocation proof while the VMs remain unassociated with GitHub; +5. enable the full-SHA action setting after the pinning migration is qualified; +6. change the development repository to private while the merge freeze remains active; +7. immediately require `Smart CI / Required Gate`, retain the three security contexts, and apply the evidence-based maintainer decisions for branch-current strictness and administrator enforcement; -7. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork +8. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork policy; -8. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release - rehearsal; -9. register isolated self-hosted runners only now, then prove no secrets, read-only token posture, - offline behavior, and hosted override; -10. record evidence and resume normal merges. +9. register only the already-proven isolated runners, verify their association, labels, and + read-only token posture, or record a hosted-only ruling; +10. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release + rehearsal under the final runner mode; +11. record evidence and resume normal merges. -The repository must stay hosted-only until the visibility boundary is private and the isolated -runners are deliberately registered. +The repository must stay hosted-only while public. Runner registration is not itself the isolation +proof and must not precede it. -### CP-8: Final tag and public verification +### CP-8: Final tag, private Release, mirror publication, and public verification After all earlier gates are closed: -- select one exact `main` commit and stop feature merges; -- update release notes, upgrade notes, known limitations, and public links; -- run the complete final-head gate and release qualification; -- smoke the Windows archive from a clean extraction path; -- smoke the container by immutable digest; -- prove the MCP external-client to proposal to human review to applied-card path; -- prove install/update/backup behavior claimed by the release; -- publish the source snapshot and assets to the public mirror; -- verify checksums and provenance from the public consumer side; -- publish `v0.3.0` only after those identities match. +1. select one exact `main` commit and stop feature merges; +2. update release notes, upgrade notes, known limitations, and public links; +3. run the complete final-head gate and clean tag qualification; +4. smoke the Windows archive from a clean extraction path; +5. smoke the container by immutable digest; +6. prove the MCP external-client to proposal to human review to applied-card path; +7. prove install/update/backup behavior claimed by the release; +8. create the exact final tag and publish the **private** `v0.3.0` Release with the qualified assets, + checksums, provenance, and release body; +9. let the private repository's mirror workflow consume that Release, build the allowlisted source + snapshot, stage the mirror Release as a draft, and re-download/verify all assets; +10. publish the mirror commit, tag, and public Release only after the draft verification succeeds; +11. verify checksums, provenance, source identity, install links, and downloads from the anonymous + public-consumer side; +12. announce `v0.3.0` only after those identities match. + +The private Release is the trigger and input to the mirror workflow. Public verification therefore +happens after the private Release is published, but before the public announcement. ## 4. Maintainer decision packet @@ -343,7 +369,7 @@ inside a percentage. | #2324 | CLOSE LAST | Close after its child evidence and the cutover ledger are complete | | #2326 | SHIP | Clean shadow planner evidence and accepted recall report | | #2327 | SHIP | Landed verifier, gate proof, settings handoff, post-registration proof | -| #2328 | SHIP + HUMAN GATE | Scripts/contracts complete; register isolated runners only after privacy | +| #2328 | SHIP + HUMAN GATE | Prove isolation, cleanup, offline and hosted-override contracts before cutover; only register/associate after privacy | | #2329 | SHIP | Ownership manifest complete and recall demonstrates safe selection | | #2331 | SHIP | Bounded Windows contract and weekly full coverage before matrix reduction | | #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | @@ -352,8 +378,8 @@ inside a percentage. | #2335 | SHIP | Re-qualify #2838, obtain the ADR-0066/J.3 maintainer gate before any merge, and record CodeQL disposition | | #2337 | HUMAN GATE | Execute the private cutover and private-mode rehearsal | | #2378 | SHIP OR CLOSE ON CURRENT EVIDENCE | Remove the Windows timeout class or prove the new contract supersedes it | -| #2439 | SHIP + HUMAN GATE | Create mirror, publish workflow, rehearsal, and public-link cutover | -| #2508 | SHIP RESIDUALS | Core binding shipped in #2832; normalise malformed diagnostic receipts and define local `--pr` semantics | +| #2439 | SHIP + HUMAN GATE | Create mirror, publishing workflow, dry run, private-Release handoff, and public-link cutover | +| #2508 | SHIP RESIDUALS | Core binding shipped in #2832; review and qualify draft PR #3156 | | #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism needed for reliable qualification | | #1940 | CLOSE ON EVIDENCE + DECISION | Core acceptance is delivered; settle request-edit/defer follow-ups or refile them | | #1949 | RECONCILE | Close delivered guards; move parser/coverage long-tail into a bounded follow-up if non-blocking | @@ -382,7 +408,8 @@ by age. - #3131 - release-tag grammar; - #3130 - public Pages behavior and no-loopback demo posture; - #3139 - hosted execution of documentation-governance regression suites; -- #3143 - hosted Docker MCP safety regressions, if it remains the chosen closure for #2332/#2312. +- #3143 - hosted Docker MCP safety regressions, if it remains the chosen closure for #2332/#2312; +- #3156 - #2508 diagnostic-receipt and local-what-if residuals. ### Priority 1: supports closure but does not independently unlock the tag @@ -405,31 +432,37 @@ than repeatedly moving the final qualification head. 1. Record D1 to D8 on the relevant issues. 2. Apply a disposition to all 29 open issues. 3. Stop admitting non-critical work to v0.3. -4. Re-qualify and merge the Priority 0 PRs. -5. Implement the landed verifier and close #2508's two remaining receipt/CLI residuals. +4. Re-qualify and merge the Priority 0 PRs through every applicable control-plane gate. +5. Implement #2327's landed verifier and review/qualify #3156 for #2508's remaining residuals. 6. Complete the bounded product fixes retained by the scope ruling. -### Wave B: prove the control plane +### Wave B: prove the control plane before cutover 1. Fix any remaining Smart CI false-red/missed-lane cause. 2. Accumulate the complete observation and recall windows. 3. Accept the nightly observation and weekly full sweep. -4. Clean storage and record the new measurement. +4. Clean storage and record the new measurement under the `$0` ceiling. 5. Create the public mirror and run the no-publish rehearsal. 6. Complete the public hosted-only cutover rehearsal. +7. Prove the entire self-hosted VM isolation, cleanup, offline, override, reset, and revocation + contract without registering the runners with the public repository. -### Wave C: cut over and release +### Wave C: cut over, release privately, mirror, and announce 1. Pause merges and capture settings. 2. Flip the development repository private in the frozen window. 3. Register the required gate and retained security checks, then apply the evidence-based decisions for branch-current strictness and administrator enforcement. -4. Run the private-mode matrix and main verifier. -5. Register and prove isolated runners, or remain hosted-only if that is the recorded final ruling. -6. Close trackers and run #2235's final truth pass. -7. Freeze one exact release commit. -8. Qualify and publish the final tag, source snapshot, assets, checksums, and provenance. -9. Verify the public consumer path before announcing. +4. Re-check private repository settings and external surfaces. +5. Register the already-proven isolated runners and verify association/token posture, or record a + hosted-only ruling. +6. Run the private-mode matrix and main verifier under the final runner mode. +7. Close trackers and run #2235's final truth pass. +8. Freeze one exact release commit and complete tag qualification. +9. Publish the private `v0.3.0` Release with the qualified assets and metadata. +10. Let the mirror workflow stage, verify, and publish the public source snapshot and byte-identical + assets. +11. Verify the anonymous public consumer path, then announce. ## 8. Definition of done @@ -440,14 +473,20 @@ than repeatedly moving the final qualification head. - the exact final head is green under the final required-check configuration; - the landed verifier and full-escalation paths are proven; - the Smart CI observation and recall thresholds are met; -- storage and spend posture is sustainable in private mode; +- artifact storage is below the private allowance under the settled `$0` spending ceiling; - clean-from-tag release qualification succeeds with runners offline; -- public source and release assets are available through the mirror with matching identities; -- private-mode R0/R2/R4, merge, nightly, and release rehearsals pass; +- self-hosted isolation, cleanup, hosted override, offline behavior, reset, and revocation are proven + before any runner registration; +- the private repository, required gate, and final runner association are rehearsed in private mode; +- the private `v0.3.0` Release contains the exact qualified assets, checksums, provenance, and body; +- the mirror republishes the corresponding source and byte-identical assets through its staged + verification path; +- anonymous public verification confirms matching source, checksums, provenance, install links, and + downloads; - the Windows archive, immutable container, MCP proposal flow, upgrade, and supported backup path are smoke-tested from a consumer perspective; - release notes and known limitations describe shipped reality rather than intended work; -- the final tag is the commit that received the evidence above. +- the public announcement happens only after the private-Release-to-mirror handoff succeeds. ## 9. Advancement brief @@ -458,11 +497,14 @@ than repeatedly moving the final qualification head. product decisions still obscure the release boundary. - **CI/release trust:** incomplete - the landed verifier, clean observation/recall evidence, release qualification, least-privilege residual, and storage target remain open. +- **Runner readiness:** engineering proof is still required before registration; registration itself + waits until the repository is private. - **Distribution continuity:** designed but not operational - the public mirror still needs creation, - workflow, and rehearsal. + workflow, dry run, and the final private-Release handoff. - **Human cutover:** not executed - the development repository remains public and the final required gate is not enforced. The milestone is therefore **late-stage but not in final-tag territory**. The fastest safe route is not more parallel feature work. It is a short release programme centered on scope rulings, the Smart -CI proof chain, storage, mirror continuity, and the private cutover. +CI proof chain, storage, runner isolation, mirror continuity, the private cutover, and the final +private-Release-to-public-mirror handoff. From 4df31cb227fc1fa0e0a0445cc895a86e8cf9ef3f Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:04:34 +0100 Subject: [PATCH 05/15] docs: use settled mirror and deployment decisions --- .../2026-09-17-v0.3-release-assessment.md | 590 ++++++++---------- 1 file changed, 255 insertions(+), 335 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index 00f0257ace..a9d4eea982 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -15,20 +15,19 @@ Taskdeck has crossed the packaging threshold. `v0.3.0-rc.1` exists with a Window checksum, and provenance asset. The remaining path is dominated by release governance and proof, not by inventing a distribution mechanism. -The milestone is advanced in issue-count terms, but the most important remaining items are strongly -coupled: +The release-critical chain is: -1. freeze the final scope and explicitly close or re-rule every open milestone issue; -2. complete and prove the Smart CI gate, including the landed-commit verifier; -3. bring Actions storage below the private-repository allowance under the confirmed `$0` ceiling; -4. finish clean-from-tag release qualification and the public release/source mirror; +1. freeze scope and explicitly close or re-rule every open milestone issue; +2. complete the Smart CI proof chain, including the landed-commit verifier; +3. reduce Actions storage below the private-repository allowance under the settled `$0` ceiling; +4. finish clean-from-tag release qualification and public-mirror rehearsal; 5. prove self-hosted runner isolation before registration; -6. execute the human private-repository cutover and post-cutover rehearsal; -7. prove the exact final tag, publish the private Release, republish it through the public mirror, - and verify the public artifacts before announcement. +6. execute the private-repository cutover and private-mode rehearsal; +7. publish the private Release, let it drive the public mirror, verify the public artifacts, then + announce. -Until those steps are complete, publishing a final `v0.3.0` would turn the RC into a release without -meeting the repository's own declared trust boundary. +Publishing final `v0.3.0` before those steps would promote a valid RC without satisfying the +repository's own release trust boundary. ## 1. Snapshot @@ -39,159 +38,130 @@ Code and settings were measured on 2026-09-17 against `main` | Signal | Current state | Interpretation | | --- | --- | --- | | Milestone progress | 103 closed, 29 open, 132 total | **78.0% closed** by issue count | -| Open issue split | 15 CI, 5 dogfooding, 9 other | The remaining set mixes gates, human acts, trackers, defects, and broad feature work | -| Distribution | `v0.3.0-rc.1` published | Windows packaging, checksum, and provenance already exist | +| Open issue split | 15 CI, 5 dogfooding, 9 other | Gates, human acts, trackers, defects, and broad feature work are mixed together | +| Distribution | `v0.3.0-rc.1` published | Basic Windows packaging, checksum, and provenance already exist | | Development repository | Public | The planned private cutover has not happened | -| Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not yet required and branch-current enforcement is not yet the release contract | -| Open PR queue | Moving rapidly during this assessment | Use section 6 as a release-priority snapshot, not as a stable count | -| Milestone due date | None | Sequencing must come from the gate, not a calendar field | +| Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not yet required | +| Open PR queue | Moving rapidly during this assessment | Section 6 is a priority snapshot, not a stable count | +| Milestone due date | None | The release gate, not a calendar field, must define readiness | -The issue percentage is useful for throughput, but it is not a release-readiness percentage. A -single unresolved gate such as storage, public-source continuity, or the private cutover can block -the release even when most issues are closed. +Issue closure is a throughput measure, not a release-readiness percentage. One unresolved gate such +as storage, source continuity, or the private cutover can still block the tag. ## 2. Formal gate scorecard -The standing release gate has five clauses. - | Clause | State | What remains | | --- | --- | --- | -| Exact final-head RC checks green | Pending | Re-run on the exact commit selected for the final tag, after the queue and scope are frozen | -| Milestone closed or explicitly re-ruled | **Not met** | 29 open issues need delivery, evidence-based closure, or an explicit milestone ruling | +| Exact final-head RC checks green | Pending | Re-run against the exact final tag candidate after scope and merges freeze | +| Milestone closed or explicitly re-ruled | **Not met** | 29 issues need delivery, evidence-based closure, or an explicit move | | Launch kit drafted | **Met** | Keep copy and links current through the mirror cutover | -| `main` green | Must be re-proved | The final claim must bind to the eventual release head, not an older green tip | -| Private cutover with Smart CI gate enforced | **Not met** | Complete #2337 prerequisites, settings changes, private-mode rehearsal, and evidence | +| `main` green | Must be re-proved | The release claim must bind to the eventual final head | +| Private cutover with Smart CI enforced | **Not met** | Complete #2337 prerequisites, settings change, and private-mode rehearsal | -**Current formal position: no-go for the final tag.** This does not invalidate the RC. It means the -RC has not yet satisfied the final-release proof chain. +**Current formal position: no-go for the final tag.** The RC remains useful and valid. ## 3. Critical path -### CP-1: Scope closure and milestone truth +### CP-1: Freeze the release claim -The current rule is that `v0.3.0` tags only when every milestone issue is closed or explicitly -re-ruled. With 29 open issues, the first maintainer task is not implementation. It is to assign each -issue one disposition: +Every open issue needs one explicit disposition: -- **SHIP** - required for the v0.3 release claim; -- **CLOSE ON EVIDENCE** - materially delivered, but the issue needs reconciliation and a closing - record; -- **DEFER** - valuable, but not necessary for this release claim; move it to the correct milestone - with a reason; -- **HUMAN GATE** - implementation is prepared, but a maintainer action or value is required. +- **SHIP** - required for a v0.3 claim; +- **CLOSE ON EVIDENCE** - materially delivered but not reconciled; +- **DEFER** - useful but not required for this release claim; +- **HUMAN GATE** - implementation is prepared but a maintainer act or value remains. -Do this once, record it, and then reject new v0.3 scope unless it is a release-critical regression. -Without that freeze, closing issues faster can still move the release further away. +After the ruling, reject new v0.3 scope unless it is a release-critical regression. Without a scope +freeze, issue throughput can increase while the release moves further away. -### CP-2: Smart CI gate and landed verification +### CP-2: Complete Smart CI and landed verification Issues: #2326, #2327, #2329, #2331, #2332, #2508, plus tracker #2324. -The planner and gate infrastructure are substantial, but the release contract is incomplete: +Remaining release evidence: -- the landed-commit verifier required by #2327 is still missing; -- #2508's core `mergeBaseSha` / `mergeBaseTipSha` machine-readable binding shipped in PR #2832; -- draft PR #3156 addresses #2508's two remaining bounded residuals: schema-valid diagnostic - receipts for malformed bindings and explicit no-event local `--pr` semantics; -- the latest recorded selection-recall report was not acceptable: 7 usable merged PRs against a - floor of 20, with 3 observed failed lanes and 3 misses; -- the gate's separate false-red observation window is also not clean: its earlier zero-false-red - claim was retracted after a reproducible base-move false red; -- selection must not leave shadow/observation mode until the declared recall threshold and false-red - threshold are both met; -- after the repository is private, the maintainer must register `Smart CI / Required Gate`, retain - the three security contexts, and decide `strict` branch-current enforcement and administrator - enforcement from the observed recall and false-red evidence; neither setting is pre-ruled. +- #2327's landed-commit verifier is still missing; +- #2508's structured moved-base binding shipped in #2832; +- draft PR #3156 addresses #2508's two bounded residuals: schema-valid failed receipts for malformed + bindings and explicit local no-event `--pr` semantics; +- the latest recall report had 7 usable merged PRs against a floor of 20, with 3 observed failed + lanes and 3 misses; +- the zero-false-red claim was retracted after a reproducible base-move false red; +- selective execution must stay in observation until recall and false-red thresholds are met; +- after privacy, the maintainer registers `Smart CI / Required Gate`, retains the three security + contexts, and decides branch-current strictness and administrator enforcement from the recorded + evidence. Neither setting is pre-ruled. -**Recommended acceptance:** at least 20 usable merged PRs after the last relevant planner fix, zero -false reds, 100% recall for the lane families being enabled, a proven bounded normal-merge path, and -proven full escalation for bypass/direct-push and missing-receipt cases. +Recommended acceptance is at least 20 usable merged PRs after the last relevant planner fix, zero +false reds, 100% recall for enabled lane families, a bounded normal-merge path, and proven full +escalation for bypass/direct-push and missing-receipt cases. -### CP-3: Storage economics before privacy +### CP-3: Resolve storage under the settled `$0` ceiling Issue: #2333. -Retention controls have improved, but the latest bounded measurement still exceeded the 1 GB -private-repository artifact allowance before the complete inventory was exhausted. Cache use was -also near its separate cap. +The latest bounded measurement exceeded the 1 GB private-repository artifact allowance before the +inventory was exhausted, while caches were near their separate cap. -Before the visibility flip, re-run the identity-bound cleanup dry run, preserve release/provenance -evidence, authorize the exact current deletion set, and verify unexpired artifact storage below the -allowance. The settled SC-3 ruling keeps the Actions spending limit at `$0`; paid overage is not an -available release prerequisite. If cleanup is insufficient, the maintainer must resolve that gap -within the `$0` posture before cutover. +Before cutover: -A `$0` hard ceiling with storage above the allowance is not a workable steady state. The risk is not -only cost: Actions can stop at the point the release most needs qualification. +1. run the identity-bound cleanup dry run again; +2. preserve release, provenance, and required audit evidence; +3. authorize the exact current deletion set; +4. verify unexpired artifact storage below the allowance. -### CP-4: Release qualification and duplicate-event removal +Paid overage is not an available v0.3 prerequisite under the settled SC-3 ruling. If cleanup is not +enough, the gap must be resolved within the `$0` posture before privacy. -Issues: #2334, #2378 and #2588, with current release-contract PRs #3111 and #3131. +### CP-4: Finish nightly and clean release qualification -#2561 closed during this assessment after its launcher cleanup path was completed and reconciled. It -is no longer part of the open release queue. +Issues: #2334, #2378, and #2588. Relevant PRs include #3111 and #3131. -The nightly coordinator exists, but the recorded state is still observation-only. Complete the -following before the final tag: +Required outcomes: -- accept the observation window before any nightly selective execution is enabled; -- prove the weekly full sweep across the declared Linux, Windows, browser, security, container, and - performance surfaces; +- accept the nightly observation window before selective execution is enabled; +- prove the weekly full sweep across Linux, Windows, browsers, security, containers, and performance; - keep mutation manual unless ADR-0052 is deliberately amended; - rebuild from the exact tag in a clean hosted context; -- verify digests, SBOM, provenance, migration/upgrade behavior, and no promotion of ordinary PR - artifacts; -- collapse duplicate tag/release qualification where the same commit is otherwise built twice; +- verify digests, SBOM, provenance, migrations/upgrades, and non-promotion of PR artifacts; +- remove duplicate tag/release qualification for the same commit; - run a no-publish rehearsal with self-hosted runners offline; -- resolve or explicitly disposition the remaining Windows/Linux launcher timing residuals that can - make release qualification nondeterministic. - -PR #3111 is directly aligned with this path. PR #3131 closes a tag-grammar edge that should land -before a final tag is trusted. +- resolve or explicitly disposition remaining launcher timing nondeterminism. -### CP-5: Supply-chain least privilege +#2561 closed during this assessment and is no longer in the open release queue. -Issue: #2335. Primary open implementation: PR #2838. +### CP-5: Close supply-chain least privilege -Full-SHA pinning, the hosted-only control-path fixture, and the `pull_request_target` trust contract -are substantially present. PR #2838 carries the remaining checkout-credential persistence and Pages -permission-scoping work identified in the cutover checklist. +Issue: #2335. Primary implementation: PR #2838. -**Recommended action:** update #2838 onto current `main`, repeat exact-head hosted qualification and -fresh review, and take it through the still-open ADR-0066/J.3 maintainer decision and review before -the public cutover rehearsal. Merge it only after that explicit control-plane gate and all current -evidence pass; do not treat an old branch, a replacement PR, or agent approval as a waiver. +Update #2838 onto current `main`, repeat exact-head hosted qualification and fresh review, and take it +through the still-open ADR-0066/J.3 maintainer decision. Merge only after that explicit control-plane +gate and current evidence pass. An old branch, replacement PR, or agent approval is not a waiver. -A separate explicit CodeQL disposition should close the last policy ambiguity in #2335. It can be -"re-enable under the hosted control lane" or a recorded reason to keep the current scanners, but it -should not remain implicit. +Also record an explicit CodeQL decision: re-enable it under the hosted control lane or retain the +current scanners with the reason recorded. -### CP-6: Public source and release continuity +### CP-6: Operationalise the approved public mirror Issue: #2439. Design authority: [`PUBLIC_MIRROR_OPTIONS.md`](../ci/PUBLIC_MIRROR_OPTIONS.md). -The chosen design is already sensible: a separate public repository receives a source snapshot per -release tag plus byte-identical release assets. The missing pieces are operational: - -- maintainer creates and names the public mirror; -- maintainer creates a fine-grained publishing credential scoped only to that mirror; -- the private repository gains the fail-closed publishing workflow; -- the export denies nested `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` files at any depth; -- the snapshot scan handles the known documentation placeholders without weakening secret checks; -- GitHub token-shape detection uses the strict forms recorded on #2439; -- a dry-run rehearsal proves the snapshot and asset-verification path without publishing; -- README, licensing, launch-kit, install, and public-home links point at the mirror. +The approved mirror is **`Chris0Jeky/taskdeck-release`**. The remaining work is operational: -The final handoff is deliberately private-first. The mirror workflow consumes the already-published -private Release, its body, and its assets. It then stages and verifies an invisible draft in the -mirror before publishing the public commit, tag, and Release. +- create that repository with mirror Actions disabled; +- create a fine-grained credential scoped only to its Contents read/write boundary; +- add the private repository's fail-closed publishing workflow; +- deny nested `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` files at any depth; +- handle known documentation placeholders without weakening secret checks; +- use the strict GitHub token shapes recorded on #2439; +- prove the snapshot and asset-verification path in a dry run; +- update README, licensing, launch-kit, install, and public-home links. -**Suggested mirror name:** `Taskdeck-Public`. It communicates that it is the public distribution and -corresponding-source surface, not a second development authority. Keep Actions disabled in the -mirror. +The final handoff is private-first. The mirror workflow consumes the already-published private +Release, its body, and its assets. It stages and verifies an invisible draft in the mirror before +publishing the public commit, tag, and Release. -### CP-7: Runner proof and human private-repository cutover +### CP-7: Prove runners, then execute the private cutover Issues and authority: #2328, #2337, [`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), and @@ -199,312 +169,262 @@ Issues and authority: #2328, #2337, Two boundaries must remain distinct: -1. **Before cutover, while no self-hosted runner is associated with the public repository**, prove - the isolated VM, no-host-mount, no-personal-credential, one-job-per-host, hosted-override, - offline-runner, workspace/Docker/cache cleanup, VM-reset, and revocation contracts. -2. **After the repository becomes private**, perform only the human registration/association step, - then verify labels, read-only token posture, and one selected private workload on the already - proven runner environment. +1. **Before cutover, while no runner is associated with the public repository**, prove isolated VMs, + no host mounts, no personal credentials, one job per host, hosted override, offline behavior, + workspace/Docker/cache cleanup, VM reset, and revocation. +2. **After privacy**, perform the human registration/association step, then verify labels, read-only + token posture, and one selected private workload on that already-proven environment. -The latest #2327 evidence adds another ordering constraint: do not register the stable gate while -the repository is public, because a fork can publish a same-named `pull_request` check. Use a short, -frozen cutover window instead. +Do not register the stable gate while the repository is public. A fork can publish a same-named +`pull_request` check. Use a short frozen cutover window: -Recommended order: - -1. freeze merges briefly and capture the current branch-protection and Actions settings; -2. finish storage cleanup under the settled `$0` ceiling; -3. finish the hosted public-mode rehearsal, including release and mirror dry runs; -4. complete the entire pre-registration runner isolation, cleanup, offline, override, reset, and - revocation proof while the VMs remain unassociated with GitHub; +1. freeze merges and capture branch-protection and Actions settings; +2. finish storage cleanup under `$0`; +3. finish hosted public-mode release and mirror dry runs; +4. complete all pre-registration runner proof while VMs remain unassociated; 5. enable the full-SHA action setting after the pinning migration is qualified; -6. change the development repository to private while the merge freeze remains active; -7. immediately require `Smart CI / Required Gate`, retain the three security contexts, and apply the - evidence-based maintainer decisions for branch-current strictness and administrator enforcement; -8. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork - policy; -9. register only the already-proven isolated runners, verify their association, labels, and - read-only token posture, or record a hosted-only ruling; -10. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release - rehearsal under the final runner mode; -11. record evidence and resume normal merges. - -The repository must stay hosted-only while public. Runner registration is not itself the isolation -proof and must not precede it. +6. change the development repository to private; +7. immediately require `Smart CI / Required Gate`, retain the security contexts, and apply the + evidence-based strictness and administrator decisions; +8. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and forks; +9. register only the already-proven runners, or record a hosted-only ruling; +10. run private-mode R0/R2/R4 PRs, a normal merge, nightly dispatch, and no-publish release rehearsal; +11. record evidence and resume merges. -### CP-8: Final tag, private Release, mirror publication, and public verification +### CP-8: Tag, publish privately, mirror, verify, announce -After all earlier gates are closed: +After all earlier gates close: 1. select one exact `main` commit and stop feature merges; -2. update release notes, upgrade notes, known limitations, and public links; -3. run the complete final-head gate and clean tag qualification; -4. smoke the Windows archive from a clean extraction path; -5. smoke the container by immutable digest; -6. prove the MCP external-client to proposal to human review to applied-card path; -7. prove install/update/backup behavior claimed by the release; -8. create the exact final tag and publish the **private** `v0.3.0` Release with the qualified assets, - checksums, provenance, and release body; -9. let the private repository's mirror workflow consume that Release, build the allowlisted source - snapshot, stage the mirror Release as a draft, and re-download/verify all assets; -10. publish the mirror commit, tag, and public Release only after the draft verification succeeds; -11. verify checksums, provenance, source identity, install links, and downloads from the anonymous - public-consumer side; -12. announce `v0.3.0` only after those identities match. +2. update release notes, upgrade notes, limitations, and public links; +3. run final-head checks and clean tag qualification; +4. smoke the Windows archive and immutable container; +5. prove the MCP external-client to proposal to review to applied-card path; +6. prove claimed install, update, and backup behavior; +7. create the exact tag and publish the **private** `v0.3.0` Release with qualified assets, + checksums, provenance, and body; +8. let the mirror workflow build the allowlisted source snapshot, stage the mirror Release, and + re-download/verify every asset; +9. publish the mirror commit, tag, and public Release only after draft verification succeeds; +10. verify source identity, checksums, provenance, install links, and downloads anonymously; +11. announce only after the identities match. The private Release is the trigger and input to the mirror workflow. Public verification therefore -happens after the private Release is published, but before the public announcement. +happens after private publication but before public announcement. ## 4. Maintainer decision packet -### D1: Keep the current all-issues rule or focus the release scope +### D1: Release scope -**Option A - strict milestone closure:** implement every open issue before `v0.3.0`. +**A. Strict:** implement every open milestone issue. -- Strongest interpretation of the existing ruling. -- Highest schedule uncertainty because the milestone still contains broad redesigns and long-tail - residuals. +**B. Claim-based:** retain trust, packaging, security, data-integrity, and headline-product work; +explicitly move broad redesigns and non-blocking polish. -**Option B - claim-based release scope:** keep every trust, packaging, security, data-integrity, and -headline-product issue in v0.3; explicitly move broad redesigns and non-blocking polish to the next -milestone. - -- Preserves release quality while preventing unrelated ambition from indefinitely blocking a - downloadable beta. -- Requires a visible per-issue ruling rather than silent scope drift. - -**Recommendation: Option B.** Keep the bar high for what v0.3 claims, but stop using one milestone as -both a release gate and an unlimited improvement backlog. +**Recommendation: B.** Keep the bar high for the v0.3 claim without treating one milestone as an +unlimited improvement backlog. ### D2: CLI trust model - #1131 -**Option A:** route CLI mutations through claims-first actor and board authorization. +**A.** Route CLI mutations through claims-first actor and board authorization. -**Option B:** define the CLI as an unrestricted local-administrator tool, gate its availability, and -document that it must not be exposed to a collaborator or remote shell. +**B.** Define the CLI as an unrestricted local-administrator tool, gate access, and document that it +must not be exposed to a collaborator or remote shell. -**Recommendation for v0.3: Option B**, provided the shared instance does not expose the CLI to the -second user. Schedule claims-first CLI authorization before the CLI becomes a collaborative or -remote operator surface. +**Recommendation for v0.3: B**, provided the shared instance does not expose the CLI. Schedule +claims-first CLI authorization before collaborative or remote use. ### D3: Automation Chat - #2004 -**Option A:** complete the full chat workflow redesign in v0.3. +**A.** Complete the full redesign now. -**Option B:** ship a bounded honesty repair: an actionable turn without a board cannot look -successful; board binding is explicit; generated prose is never presented as an applied change; the -turn ends in a proposal link or a clear non-action reason. Move the richer default-to-act redesign to -v0.4. +**B.** Ship a bounded honesty repair: explicit board binding, no false applied-change claim, and each +actionable turn ending in a proposal link or clear non-action reason. -**Option C:** label or disable Automation Chat as experimental for v0.3 and move the complete issue. +**C.** Mark or hide it as experimental and defer the redesign. -**Recommendation: Option B** if Chat remains visible in the headline experience. Use Option C if the -surface is not needed for the v0.3 story. +**Recommendation: B** if Chat stays visible in the headline experience; otherwise C. ### D4: Night theme - #2009 -**Option A:** complete the multi-palette design spike and ADR now. +**A.** Complete the multi-palette spike and ADR now. -**Option B:** land the measurable release-safety subset: control-boundary contrast, night contrast -specs, view-layer color-audit coverage, and removal of known theme-agnostic literals. Move aesthetic -palette exploration to the next milestone. +**B.** Ship the measurable safety subset: control-boundary contrast, night contrast specifications, +view-layer color-audit coverage, and removal of known theme-agnostic literals. -**Option C:** mark the theme experimental and defer the whole issue. +**C.** Mark the theme experimental and defer. -**Recommendation: Option B** if the night theme is offered as supported. Otherwise use Option C. +**Recommendation: B** if night theme is supported; otherwise C. ### D5: MCP hash approval - #1309 -**Option A:** enforce tool-definition hash approval in the invocation path now. +**A.** Enforce tool-definition hash approval in the invocation path now. -**Option B:** retain the current explicit statement that runtime approval is not enforced, avoid an -implied security claim, and close v0.3 after the external-client to Review to applied-card demo is -proved. +**B.** Retain the explicit statement that runtime approval is not enforced, avoid implying otherwise, +and close v0.3 after the external-client-to-applied-card demonstration. -**Recommendation: Option B for v0.3.** The current invariant and guide are already honest. Runtime -approval is valuable, but it should arrive as a fully designed policy rather than a rushed final-tag -hook. +**Recommendation: B for v0.3.** Add enforcement later as a fully designed policy. ### D6: Two-person private instance - #1772 -**Option A:** keep it as a v0.3 gate and perform the real two-account deployment, backup, restore, -realtime, access-policy, and durability proof. +**A.** Keep the real two-account deployment, backup, restore, realtime, access-policy, and durability +proof in v0.3. -**Option B:** move it to v0.4 and keep v0.3 strictly a downloadable/self-hosted beta release. +**B.** Move it to v0.4 and keep v0.3 a downloadable/self-hosted beta release. -**Recommendation: Option B** unless the release will actively recruit a second participant. If it is -retained, the maintainer must supply the collaborator identity, monthly ceiling and alert threshold, -and off-platform backup-retention window before deployment. +**Recommendation: B** unless the v0.3 release will actively recruit a second participant. If A is +retained, do not re-open settled inputs: the collaborator identity is privately held, the £20 monthly +ceiling and £10 alert are recorded, and twelve weekly off-platform copies are already ruled. The +remaining maintainer choices are the tunnel mechanism and daily token ceiling. ### D7: Administrator enforcement -**Option A:** `enforce_admins: true`, with break-glass documented as a temporary, recorded settings -change, if the post-rehearsal evidence supports it. +**A.** Enable `enforce_admins` with a recorded temporary-setting break-glass procedure if rehearsal +evidence supports it. -**Option B:** leave administrators exempt and rely on process. +**B.** Leave administrators exempt and rely on process. -**Recommendation:** defer this choice until the rehearsal and observation evidence are recorded. If -that evidence supports administrator enforcement, Option A gives the strongest release trust boundary -while still allowing an explicit emergency procedure; the maintainer owns the decision. +**Recommendation:** decide from the observation and rehearsal evidence. The maintainer owns this +choice; it is not pre-ruled. ### D8: Storage posture -**Option A:** preserve only release/provenance and required audit evidence, delete obsolete CI -artifacts using the identity-bound tool, and keep the `$0` ceiling. +**A.** Preserve release/provenance and required audit evidence, delete obsolete CI artifacts with the +identity-bound tool, and keep the `$0` ceiling. -**Option B:** retain the larger evidence estate and seek a new maintainer ruling. It is not an -available v0.3 release posture under the settled `$0` hard ceiling. +**B.** Retain the larger evidence estate and seek a new ruling. This is not an available v0.3 posture +under the settled ceiling. -**Recommendation: Option A** for v0.3. The repository already contains purpose-built retention and -cleanup machinery; retaining obsolete build output has little release value under the settled -spending ceiling. +**Recommendation: A.** -## 5. Disposition proposal for all 29 open milestone issues - -This table is a proposed release-owner pass. It is deliberately explicit so no open issue disappears -inside a percentage. +## 5. Proposed disposition for all 29 open milestone issues | Issue | Proposed disposition | Required release outcome | | --- | --- | --- | -| #2324 | CLOSE LAST | Close after its child evidence and the cutover ledger are complete | -| #2326 | SHIP | Clean shadow planner evidence and accepted recall report | +| #2324 | CLOSE LAST | Close after child evidence and the cutover ledger | +| #2326 | SHIP | Clean planner evidence and accepted recall report | | #2327 | SHIP | Landed verifier, gate proof, settings handoff, post-registration proof | -| #2328 | SHIP + HUMAN GATE | Prove isolation, cleanup, offline and hosted-override contracts before cutover; only register/associate after privacy | -| #2329 | SHIP | Ownership manifest complete and recall demonstrates safe selection | -| #2331 | SHIP | Bounded Windows contract and weekly full coverage before matrix reduction | +| #2328 | SHIP + HUMAN GATE | Prove isolation before cutover; only register/associate after privacy | +| #2329 | SHIP | Ownership manifest complete and recall shows safe selection | +| #2331 | SHIP | Bounded Windows contract and weekly full coverage before reduction | | #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | -| #2333 | SHIP + HUMAN GATE | Storage below allowance under the `$0` ceiling, with ledger evidence | +| #2333 | SHIP + HUMAN GATE | Storage below allowance under `$0`, with ledger evidence | | #2334 | SHIP | Accepted nightly observation, weekly sweep, clean tag qualification | -| #2335 | SHIP | Re-qualify #2838, obtain the ADR-0066/J.3 maintainer gate before any merge, and record CodeQL disposition | -| #2337 | HUMAN GATE | Execute the private cutover and private-mode rehearsal | -| #2378 | SHIP OR CLOSE ON CURRENT EVIDENCE | Remove the Windows timeout class or prove the new contract supersedes it | -| #2439 | SHIP + HUMAN GATE | Create mirror, publishing workflow, dry run, private-Release handoff, and public-link cutover | -| #2508 | SHIP RESIDUALS | Core binding shipped in #2832; review and qualify draft PR #3156 | -| #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism needed for reliable qualification | -| #1940 | CLOSE ON EVIDENCE + DECISION | Core acceptance is delivered; settle request-edit/defer follow-ups or refile them | -| #1949 | RECONCILE | Close delivered guards; move parser/coverage long-tail into a bounded follow-up if non-blocking | -| #1999 | CLOSE ON EVIDENCE | Reconcile delivered triage-edit work and refile only proven residuals | -| #2004 | DECIDE | Bounded honesty repair in v0.3 or move/disable the broader redesign | -| #2009 | DECIDE | Ship contrast/audit safety subset or move the palette spike | -| #1131 | DECIDE + DOCUMENT/IMPLEMENT | Claims-first CLI or explicitly gated local-admin CLI | -| #1307 | RECONCILE, THEN SHIP OR SPLIT | Audit shipped risk ordering/batch flow; keep only unresolved honesty work in scope | -| #1309 | CLOSE AFTER PROOF | Retain honest no-enforcement decision and complete the external MCP demo | -| #1772 | DECIDE | Keep as real participant proof or move to v0.4 | -| #2214 | SHIP | Deep-link reauthorization, poll recovery, and stale-state honesty | -| #2235 | CLOSEOUT LAST | Reconcile docs, issues, ADRs, links, status, and release-facing truth | -| #2315 | CLOSE ON EVIDENCE OR DEFER | It is not a blocker by prior ruling; do not leave it both non-blocking and milestone-open | -| #2391 | SHIP AFTER MIRROR | Make every launch block copy-ready with final public URLs and caveats | -| #2499 | TARGETED FIX OR DEFER | Document legacy fail-closed behavior; decide whether broader producer stamping is a v0.3 claim | - -## 6. Open PR queue: release ordering - -The queue is moving quickly. Treat the following as release-oriented priority rather than merge order -by age. - -### Priority 0: directly on the release trust path +| #2335 | SHIP | Re-qualify #2838, obtain J.3 maintainer gate, record CodeQL ruling | +| #2337 | HUMAN GATE | Execute private cutover and private-mode rehearsal | +| #2378 | SHIP OR CLOSE ON EVIDENCE | Remove Windows timeout class or prove superseding contract | +| #2439 | SHIP + HUMAN GATE | Create `taskdeck-release`, workflow, dry run, private-Release handoff, link cutover | +| #2508 | SHIP RESIDUALS | Core binding shipped; review and qualify draft #3156 | +| #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism | +| #1940 | CLOSE ON EVIDENCE + DECISION | Settle request-edit/defer follow-ups or refile them | +| #1949 | RECONCILE | Close delivered guards; move non-blocking parser/coverage tail | +| #1999 | CLOSE ON EVIDENCE | Reconcile delivered triage-edit work and refile proven residuals | +| #2004 | DECIDE | Bounded honesty repair or move/disable redesign | +| #2009 | DECIDE | Safety subset or move palette spike | +| #1131 | DECIDE + DOCUMENT/IMPLEMENT | Claims-first CLI or gated local-admin CLI | +| #1307 | RECONCILE, THEN SHIP OR SPLIT | Keep only unresolved honesty work in scope | +| #1309 | CLOSE AFTER PROOF | Honest no-enforcement decision plus external MCP demo | +| #1772 | DECIDE | Keep real participant proof or move to v0.4 | +| #2214 | SHIP | Deep-link reauthorization, poll recovery, stale-state honesty | +| #2235 | CLOSEOUT LAST | Reconcile docs, issues, ADRs, links, status, and release truth | +| #2315 | CLOSE ON EVIDENCE OR DEFER | Do not leave a ruled non-blocker milestone-open | +| #2391 | SHIP AFTER MIRROR | Final copy with public URLs and caveats | +| #2499 | TARGETED FIX OR DEFER | Document legacy fail-closed behavior and rule producer stamping | + +## 6. Release-oriented PR priority + +### Priority 0: direct release trust path - #2838 - checkout credentials and Pages permission scoping; - #3111 - container release contract; - #3131 - release-tag grammar; -- #3130 - public Pages behavior and no-loopback demo posture; -- #3139 - hosted execution of documentation-governance regression suites; -- #3143 - hosted Docker MCP safety regressions, if it remains the chosen closure for #2332/#2312; +- #3130 - public Pages and no-loopback demo posture; +- #3139 - hosted documentation-governance regressions; +- #3143 - hosted Docker MCP safety regressions if retained for #2332/#2312; - #3156 - #2508 diagnostic-receipt and local-what-if residuals. -### Priority 1: supports closure but does not independently unlock the tag +### Priority 1: supports closure -- #2931 - mutation activation smoke; useful, but mutation remains manual; -- #3098 - friends-and-family runbook; important only if #1772 stays in v0.3; +- #2931 - mutation activation smoke; mutation remains manual; +- #3098 - friends-and-family runbook if #1772 stays; - #3140 - PowerShell inventory wrapper correctness; - #3113 - worktree guard hardening; -- #3151 - this release assessment and decision packet. - -### Priority 2: normal product correctness +- #3151 - this assessment and decision packet. -The remaining product PRs should continue only where they close retained v0.3 issues or fix a -release-critical regression. Otherwise, let them settle after the release branch is frozen rather -than repeatedly moving the final qualification head. +Other product PRs should continue only when they close retained v0.3 scope or a release-critical +regression. Otherwise they should not keep moving the final qualification head. -## 7. Recommended execution sequence +## 7. Recommended execution waves ### Wave A: lock the release -1. Record D1 to D8 on the relevant issues. +1. Record D1 to D8 on their issues. 2. Apply a disposition to all 29 open issues. -3. Stop admitting non-critical work to v0.3. -4. Re-qualify and merge the Priority 0 PRs through every applicable control-plane gate. -5. Implement #2327's landed verifier and review/qualify #3156 for #2508's remaining residuals. -6. Complete the bounded product fixes retained by the scope ruling. +3. Stop admitting non-critical v0.3 scope. +4. Re-qualify Priority 0 PRs through all applicable control-plane gates. +5. Implement #2327's landed verifier and qualify #3156. +6. Complete retained bounded product fixes. ### Wave B: prove the control plane before cutover -1. Fix any remaining Smart CI false-red/missed-lane cause. -2. Accumulate the complete observation and recall windows. -3. Accept the nightly observation and weekly full sweep. -4. Clean storage and record the new measurement under the `$0` ceiling. -5. Create the public mirror and run the no-publish rehearsal. -6. Complete the public hosted-only cutover rehearsal. -7. Prove the entire self-hosted VM isolation, cleanup, offline, override, reset, and revocation - contract without registering the runners with the public repository. +1. Fix remaining Smart CI false-red or missed-lane causes. +2. Accumulate complete observation and recall windows. +3. Accept nightly observation and the weekly full sweep. +4. clean storage and record the new measurement under `$0`; +5. create `Chris0Jeky/taskdeck-release` and run the no-publish rehearsal; +6. complete the public hosted-only cutover rehearsal; +7. prove all runner isolation, cleanup, offline, override, reset, and revocation contracts without + registering the runners. -### Wave C: cut over, release privately, mirror, and announce +### Wave C: cut over, release privately, mirror, announce 1. Pause merges and capture settings. -2. Flip the development repository private in the frozen window. -3. Register the required gate and retained security checks, then apply the evidence-based decisions - for branch-current strictness and administrator enforcement. +2. Flip the development repository private. +3. Register the required gate and retained security checks; apply evidence-based strictness/admin + decisions. 4. Re-check private repository settings and external surfaces. -5. Register the already-proven isolated runners and verify association/token posture, or record a - hosted-only ruling. -6. Run the private-mode matrix and main verifier under the final runner mode. -7. Close trackers and run #2235's final truth pass. -8. Freeze one exact release commit and complete tag qualification. -9. Publish the private `v0.3.0` Release with the qualified assets and metadata. -10. Let the mirror workflow stage, verify, and publish the public source snapshot and byte-identical - assets. -11. Verify the anonymous public consumer path, then announce. +5. Register already-proven runners or record hosted-only operation. +6. Run the private-mode matrix and main verifier. +7. Close trackers and perform #2235's final truth pass. +8. Freeze one exact release commit and qualify its tag. +9. Publish the private `v0.3.0` Release. +10. Let the mirror stage, verify, and publish the public source and byte-identical assets. +11. Verify anonymously, then announce. ## 8. Definition of done -`v0.3.0` is ready when all of the following are true: +`v0.3.0` is ready when: -- every milestone issue is closed or carries an explicit recorded move; -- no release-critical PR is parked or waiting on an unrecorded maintainer ruling; +- every milestone issue is closed or explicitly moved; +- no release-critical PR is parked behind an unrecorded maintainer ruling; - the exact final head is green under the final required-check configuration; -- the landed verifier and full-escalation paths are proven; -- the Smart CI observation and recall thresholds are met; -- artifact storage is below the private allowance under the settled `$0` spending ceiling; -- clean-from-tag release qualification succeeds with runners offline; -- self-hosted isolation, cleanup, hosted override, offline behavior, reset, and revocation are proven - before any runner registration; -- the private repository, required gate, and final runner association are rehearsed in private mode; -- the private `v0.3.0` Release contains the exact qualified assets, checksums, provenance, and body; -- the mirror republishes the corresponding source and byte-identical assets through its staged - verification path; -- anonymous public verification confirms matching source, checksums, provenance, install links, and - downloads; -- the Windows archive, immutable container, MCP proposal flow, upgrade, and supported backup path are - smoke-tested from a consumer perspective; -- release notes and known limitations describe shipped reality rather than intended work; -- the public announcement happens only after the private-Release-to-mirror handoff succeeds. +- landed verification and full-escalation paths are proven; +- Smart CI observation and recall thresholds are met; +- artifact storage is below the private allowance under `$0`; +- clean-from-tag qualification succeeds with runners offline; +- runner isolation, cleanup, override, offline, reset, and revocation are proven before registration; +- the private repository, required gate, and final runner mode pass rehearsal; +- the private Release contains the exact qualified assets, checksums, provenance, and body; +- `Chris0Jeky/taskdeck-release` republishes corresponding source and byte-identical assets through its + staged verification path; +- anonymous verification confirms source, checksums, provenance, links, and downloads; +- Windows archive, immutable container, MCP proposal flow, upgrade, and supported backup claims are + consumer-smoked; +- notes and limitations describe shipped reality; +- announcement happens only after the private-Release-to-mirror handoff succeeds. ## 9. Advancement brief -- **Issue throughput:** strong - 103 of 132 milestone issues are closed, and #2561 closed during this - assessment. +- **Issue throughput:** strong - 103 of 132 issues closed; #2561 closed during this assessment. - **Packaging:** strong - a real RC and integrity assets exist. -- **Product readiness:** mixed - the core downloadable beta exists, but a small number of broad - product decisions still obscure the release boundary. -- **CI/release trust:** incomplete - the landed verifier, clean observation/recall evidence, release - qualification, least-privilege residual, and storage target remain open. -- **Runner readiness:** engineering proof is still required before registration; registration itself - waits until the repository is private. -- **Distribution continuity:** designed but not operational - the public mirror still needs creation, - workflow, dry run, and the final private-Release handoff. -- **Human cutover:** not executed - the development repository remains public and the final required - gate is not enforced. - -The milestone is therefore **late-stage but not in final-tag territory**. The fastest safe route is -not more parallel feature work. It is a short release programme centered on scope rulings, the Smart -CI proof chain, storage, runner isolation, mirror continuity, the private cutover, and the final -private-Release-to-public-mirror handoff. +- **Product readiness:** mixed - the downloadable beta exists, but a few scope choices remain. +- **CI/release trust:** incomplete - landed verifier, clean observation/recall, release qualification, + least privilege, and storage remain open. +- **Runner readiness:** pre-registration engineering proof remains; registration waits for privacy. +- **Distribution continuity:** designed but not operational - `taskdeck-release`, workflow, dry run, + and final handoff remain. +- **Human cutover:** not executed - development remains public and the final gate is not enforced. + +The milestone is **late-stage but not in final-tag territory**. The fastest safe route is a focused +release programme around scope rulings, Smart CI evidence, storage, runner isolation, mirror +continuity, the private cutover, and the private-Release-to-public-mirror handoff. From 71a408f7235e7a1e503ccdfb1aef3a7fa22ef52e Mon Sep 17 00:00:00 2001 From: Chris0Jeky Date: Fri, 18 Sep 2026 00:04:55 +0100 Subject: [PATCH 06/15] docs: align cutover sequence with settled rulings --- .../2026-09-17-v0.3-release-assessment.md | 35 +++++++++++-------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index 57615bbe88..88488cbdbb 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -181,7 +181,7 @@ release tag plus byte-identical release assets. The missing pieces are operation - a prerelease rehearsal proves source and asset hashes before any public publish; - README, licensing, launch-kit, install, and public-home links point at the mirror. -**Suggested mirror name:** `Taskdeck-Public`. It communicates that it is the public distribution and +**Approved mirror name:** `Chris0Jeky/taskdeck-release`. It is the public distribution and corresponding-source surface, not a second development authority. Keep Actions disabled in the mirror. @@ -197,19 +197,23 @@ short, frozen cutover window instead. Recommended order: 1. freeze merges briefly and capture the current branch-protection and Actions settings; -2. finish storage cleanup or record spend; +2. finish storage cleanup and verify the allowance under the confirmed `$0` ceiling; paid overage + is not an available release posture; 3. finish the hosted public-mode rehearsal, including release dry run and mirror dry run; 4. enable the full-SHA action setting after the pinning migration is qualified; -5. change the development repository to private while the merge freeze remains active; -6. immediately require `Smart CI / Required Gate`, retain the three security contexts, and apply the +5. complete the Section F runner isolation, cleanup, offline-runner, hosted-override, reset, and + revocation proofs while still hosted-only; do not attach a runner yet; +6. change the development repository to private while the merge freeze remains active; +7. immediately require `Smart CI / Required Gate`, retain the three security contexts, and apply the evidence-based maintainer decisions for branch-current strictness and administrator enforcement; -7. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork +8. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and fork policy; -8. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release +9. run R0, R2, and R4 private-mode PRs, a normal merge, nightly dispatch, and no-publish release rehearsal; -9. register isolated self-hosted runners only now, then prove no secrets, read-only token posture, - offline behavior, and hosted override; -10. record evidence and resume normal merges. +10. register isolated self-hosted runners only now, set `CI_EXECUTION_MODE=hybrid`, and verify the + association, read-only token posture, offline behavior, hosted override, and that self-hosted + jobs consume no hosted minutes; +11. record evidence and resume normal merges. The repository must stay hosted-only until the visibility boundary is private and the isolated runners are deliberately registered. @@ -225,9 +229,11 @@ After all earlier gates are closed: - smoke the container by immutable digest; - prove the MCP external-client to proposal to human review to applied-card path; - prove install/update/backup behavior claimed by the release; -- publish the source snapshot and assets to the public mirror; +- publish the private `v0.3.0` Release only after exact-tag qualification and asset identities pass; +- let the private repository's mirror workflow create, verify, and publish the public source snapshot + and matching assets; - verify checksums and provenance from the public consumer side; -- publish `v0.3.0` only after those identities match. +- announce the public release only after those identities match. ## 4. Maintainer decision packet @@ -307,8 +313,9 @@ realtime, access-policy, and durability proof. **Option B:** move it to v0.4 and keep v0.3 strictly a downloadable/self-hosted beta release. **Recommendation: Option B** unless the release will actively recruit a second participant. If it is -retained, the maintainer must supply the collaborator identity, monthly ceiling and alert threshold, -and off-platform backup-retention window before deployment. +retained, the maintainer should execute the Stage 1 runbook with its already-recorded collaborator, +budget, and twelve-copy backup values; the remaining choices are the tunnel mechanism and daily token +ceiling, followed by the runbook's human secret, provider, and deployment actions. ### D7: Administrator enforcement @@ -343,7 +350,7 @@ inside a percentage. | #2324 | CLOSE LAST | Close after its child evidence and the cutover ledger are complete | | #2326 | SHIP | Clean shadow planner evidence and accepted recall report | | #2327 | SHIP | Landed verifier, gate proof, settings handoff, post-registration proof | -| #2328 | SHIP + HUMAN GATE | Scripts/contracts complete; register isolated runners only after privacy | +| #2328 | SHIP + HUMAN GATE | Prove isolation and cleanup while hosted-only; register isolated runners only after privacy | | #2329 | SHIP | Ownership manifest complete and recall demonstrates safe selection | | #2331 | SHIP | Bounded Windows contract and weekly full coverage before matrix reduction | | #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | From 95601f578d492a961f460d86d0a25eb3193d30f7 Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:14:10 +0100 Subject: [PATCH 07/15] docs: reconcile settled v0.3 rulings and exact release order --- .../2026-09-17-v0.3-release-assessment.md | 485 ++++++++++-------- 1 file changed, 268 insertions(+), 217 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index a9d4eea982..e5e5f2e48b 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -1,33 +1,33 @@ # v0.3 release assessment - 2026-09-17 This is a dated decision-support snapshot for the final `v0.3.0` release. It does not replace -[`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), the release plan, or live GitHub state. -Live GitHub and newer maintainer rulings take precedence. +[`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), the executable cutover checklist, issue +records, or live GitHub state. Newer maintainer rulings and live evidence take precedence. -No recommendation below changes an issue, milestone, repository setting, or release gate by itself. -A scope change becomes authoritative only when the maintainer records it on the relevant issue. +Recommendations in this document do not mutate an issue, milestone, repository setting, or release +gate. Human decisions and destructive actions remain human-owned. ## Executive verdict -**State: release candidate available, final release not ready.** +**State: a real release candidate exists, but final `v0.3.0` is not ready.** Taskdeck has crossed the packaging threshold. `v0.3.0-rc.1` exists with a Windows x64 archive, -checksum, and provenance asset. The remaining path is dominated by release governance and proof, -not by inventing a distribution mechanism. - -The release-critical chain is: - -1. freeze scope and explicitly close or re-rule every open milestone issue; -2. complete the Smart CI proof chain, including the landed-commit verifier; -3. reduce Actions storage below the private-repository allowance under the settled `$0` ceiling; -4. finish clean-from-tag release qualification and public-mirror rehearsal; -5. prove self-hosted runner isolation before registration; -6. execute the private-repository cutover and private-mode rehearsal; -7. publish the private Release, let it drive the public mirror, verify the public artifacts, then - announce. - -Publishing final `v0.3.0` before those steps would promote a valid RC without satisfying the -repository's own release trust boundary. +checksum, and provenance asset. The shortest safe path is now a release-control programme, not a new +packaging project: + +1. freeze the retained release scope and reconcile the open milestone issues; +2. complete the Smart CI proof chain, including landed-commit verification; +3. bring Actions storage below the private allowance under the settled `$0` ceiling; +4. finish nightly, clean-tag, and release qualification; +5. operationalise the approved public mirror; +6. prove runner isolation before any GitHub association; +7. execute the private cutover and hosted-only private-mode rehearsal; +8. associate runners only after that rehearsal, if hybrid mode is retained; +9. rehearse the final head, create the real tag, qualify that exact tag, publish the private Release, + mirror it publicly, verify anonymously, then announce. + +Publishing final `v0.3.0` earlier would promote a valid RC without satisfying the repository's own +release trust boundary. ## 1. Snapshot @@ -38,94 +38,114 @@ Code and settings were measured on 2026-09-17 against `main` | Signal | Current state | Interpretation | | --- | --- | --- | | Milestone progress | 103 closed, 29 open, 132 total | **78.0% closed** by issue count | -| Open issue split | 15 CI, 5 dogfooding, 9 other | Gates, human acts, trackers, defects, and broad feature work are mixed together | -| Distribution | `v0.3.0-rc.1` published | Basic Windows packaging, checksum, and provenance already exist | -| Development repository | Public | The planned private cutover has not happened | -| Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not yet required | -| Open PR queue | Moving rapidly during this assessment | Section 6 is a priority snapshot, not a stable count | -| Milestone due date | None | The release gate, not a calendar field, must define readiness | +| Open issue split | 15 CI, 5 dogfooding, 9 other | Gates, human acts, trackers, defects, and product work remain mixed together | +| Ruled residual | #2315 remains open but is discharged from release-gate clause 2 | Its closure is not a `v0.3.0` prerequisite | +| Distribution | `v0.3.0-rc.1` published | Basic Windows packaging, checksum, and provenance exist | +| Development repository | Public | The required private cutover has not happened | +| Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not registered yet | +| SHA pinning setting | Completed | `sha_pinning_required: true` is already enabled and verified | +| Public mirror | Approved name: `Chris0Jeky/taskdeck-release` | Repository, credential, workflow, and rehearsal still need execution | +| Milestone due date | None | Readiness is evidence-based, not date-based | -Issue closure is a throughput measure, not a release-readiness percentage. One unresolved gate such -as storage, source continuity, or the private cutover can still block the tag. +Issue closure is a throughput measure, not a release-readiness percentage. One unresolved trust gate +can still block the tag. Conversely, #2315 demonstrates why an open issue is not automatically a +blocker when a recorded release ruling explicitly discharges it. -## 2. Formal gate scorecard +## 2. Formal release-gate scorecard | Clause | State | What remains | | --- | --- | --- | -| Exact final-head RC checks green | Pending | Re-run against the exact final tag candidate after scope and merges freeze | -| Milestone closed or explicitly re-ruled | **Not met** | 29 issues need delivery, evidence-based closure, or an explicit move | -| Launch kit drafted | **Met** | Keep copy and links current through the mirror cutover | -| `main` green | Must be re-proved | The release claim must bind to the eventual final head | -| Private cutover with Smart CI enforced | **Not met** | Complete #2337 prerequisites, settings change, and private-mode rehearsal | +| Final candidate checks green | Pending | Prove the frozen head, then create and qualify the exact real tag | +| Milestone closed or explicitly re-ruled | **Not met** | Reconcile the remaining open set while preserving #2315's existing residual ruling | +| Launch kit drafted | **Met** | Keep copy and public links current through mirror publication | +| `main` green | Must be re-proved | The final claim must bind to the frozen release head, not an older green tip | +| Private cutover with Smart CI enforced | **Not met** | Complete prerequisites, flip private, register the gate, and pass private-mode rehearsal | -**Current formal position: no-go for the final tag.** The RC remains useful and valid. +**Formal position: no-go for the final tag.** This does not invalidate the RC. ## 3. Critical path -### CP-1: Freeze the release claim +### CP-1: Freeze and reconcile the release claim -Every open issue needs one explicit disposition: +The milestone currently has 29 open issues. #2315 is already a ruled tracked residual and must not be +turned back into a blocker. Every other open item needs its existing ruling honoured and one of these +outcomes recorded: -- **SHIP** - required for a v0.3 claim; -- **CLOSE ON EVIDENCE** - materially delivered but not reconciled; -- **DEFER** - useful but not required for this release claim; -- **HUMAN GATE** - implementation is prepared but a maintainer act or value remains. +- **SHIP** - complete the retained v0.3 acceptance criteria; +- **CLOSE ON EVIDENCE** - reconcile work that is materially delivered; +- **EXPLICIT RESIDUAL** - retain it open only where a maintainer ruling discharges it from the gate; +- **DEFER** - move non-required work with a reason and destination milestone; +- **HUMAN GATE** - finish agent-actionable preparation, then record the maintainer action. -After the ruling, reject new v0.3 scope unless it is a release-critical regression. Without a scope -freeze, issue throughput can increase while the release moves further away. +Do not re-open decisions that are already settled. In particular: + +- #2004 remains an ADR-first, full v0.3 implementation; +- #2009 remains in v0.3, with palette anchors as the remaining decision/work boundary; +- #1772 remains in v0.3 and Stage 1 has started; +- #2315 remains a non-blocking tracked residual; +- the Actions ceiling is `$0`; +- the public mirror is `Chris0Jeky/taskdeck-release`; +- SHA pinning is already enabled. + +After reconciliation, reject new v0.3 scope unless it is a release-critical regression. ### CP-2: Complete Smart CI and landed verification Issues: #2326, #2327, #2329, #2331, #2332, #2508, plus tracker #2324. -Remaining release evidence: +Current progress and remaining proof: -- #2327's landed-commit verifier is still missing; - #2508's structured moved-base binding shipped in #2832; -- draft PR #3156 addresses #2508's two bounded residuals: schema-valid failed receipts for malformed - bindings and explicit local no-event `--pr` semantics; -- the latest recall report had 7 usable merged PRs against a floor of 20, with 3 observed failed - lanes and 3 misses; -- the zero-false-red claim was retracted after a reproducible base-move false red; -- selective execution must stay in observation until recall and false-red thresholds are met; +- draft PR #3156 addresses its two remaining bounded residuals: schema-safe failed receipts for + malformed bindings and explicit local no-event `--pr` semantics; +- draft PR #3167 implements a fail-closed landed-verifier decision core for exact-tree and exact-policy + receipt qualification; +- #3167 intentionally does not yet collect/download authoritative evidence or change workflow + topology, so collector and workflow integration remain open; +- the latest recall report had 7 usable merged PRs against a floor of 20, with 3 observed failed lanes + and 3 misses; +- the earlier zero-false-red claim was retracted after a reproducible base-move false red; +- selective execution must remain observation-only until recall and false-red thresholds are met; - after privacy, the maintainer registers `Smart CI / Required Gate`, retains the three security - contexts, and decides branch-current strictness and administrator enforcement from the recorded - evidence. Neither setting is pre-ruled. + contexts, and decides branch-current strictness and administrator enforcement from the evidence. + Neither setting is pre-ruled. Recommended acceptance is at least 20 usable merged PRs after the last relevant planner fix, zero false reds, 100% recall for enabled lane families, a bounded normal-merge path, and proven full -escalation for bypass/direct-push and missing-receipt cases. +escalation for direct pushes, missing receipts, moved bases, and ambiguous evidence. ### CP-3: Resolve storage under the settled `$0` ceiling Issue: #2333. -The latest bounded measurement exceeded the 1 GB private-repository artifact allowance before the -inventory was exhausted, while caches were near their separate cap. +The latest bounded measurement still exceeded the 1 GB private-repository artifact allowance before +the complete inventory was exhausted, while caches were near their separate cap. Before cutover: 1. run the identity-bound cleanup dry run again; 2. preserve release, provenance, and required audit evidence; -3. authorize the exact current deletion set; -4. verify unexpired artifact storage below the allowance. +3. have the maintainer authorize the exact current deletion set; +4. execute only that identity-bound set; +5. remeasure unexpired artifacts and caches; +6. verify the private posture remains sustainable without paid overage. -Paid overage is not an available v0.3 prerequisite under the settled SC-3 ruling. If cleanup is not -enough, the gap must be resolved within the `$0` posture before privacy. +Paid storage is not an available v0.3 prerequisite under the settled SC-3 ruling. -### CP-4: Finish nightly and clean release qualification +### CP-4: Finish nightly and release qualification -Issues: #2334, #2378, and #2588. Relevant PRs include #3111 and #3131. +Issues: #2334, #2378, and #2588. Relevant open release-contract work has included #3111 and #3131. Required outcomes: - accept the nightly observation window before selective execution is enabled; - prove the weekly full sweep across Linux, Windows, browsers, security, containers, and performance; - keep mutation manual unless ADR-0052 is deliberately amended; -- rebuild from the exact tag in a clean hosted context; -- verify digests, SBOM, provenance, migrations/upgrades, and non-promotion of PR artifacts; +- rehearse from the frozen final head without publishing; +- create the real release tag, then rebuild and qualify **that exact tag** in a clean hosted context; +- verify digests, SBOM, provenance, migrations/upgrades, and non-promotion of ordinary PR artifacts; - remove duplicate tag/release qualification for the same commit; -- run a no-publish rehearsal with self-hosted runners offline; +- run no-publish release rehearsal with self-hosted runners offline; - resolve or explicitly disposition remaining launcher timing nondeterminism. #2561 closed during this assessment and is no longer in the open release queue. @@ -136,234 +156,254 @@ Issue: #2335. Primary implementation: PR #2838. Update #2838 onto current `main`, repeat exact-head hosted qualification and fresh review, and take it through the still-open ADR-0066/J.3 maintainer decision. Merge only after that explicit control-plane -gate and current evidence pass. An old branch, replacement PR, or agent approval is not a waiver. +gate and current evidence pass. An old green head, a replacement PR, or agent approval is not a +waiver. + +SHA pinning is already enabled and must not be presented as a future cutover task. -Also record an explicit CodeQL decision: re-enable it under the hosted control lane or retain the -current scanners with the reason recorded. +A separate explicit CodeQL decision remains useful: re-enable it under the hosted control lane or +retain the current scanners with the reason recorded. ### CP-6: Operationalise the approved public mirror Issue: #2439. Design authority: [`PUBLIC_MIRROR_OPTIONS.md`](../ci/PUBLIC_MIRROR_OPTIONS.md). -The approved mirror is **`Chris0Jeky/taskdeck-release`**. The remaining work is operational: +The approved mirror is **`Chris0Jeky/taskdeck-release`**. Remaining work: -- create that repository with mirror Actions disabled; -- create a fine-grained credential scoped only to its Contents read/write boundary; +- create the repository with mirror Actions disabled; +- create a fine-grained credential scoped only to the mirror's Contents read/write boundary; - add the private repository's fail-closed publishing workflow; - deny nested `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` files at any depth; - handle known documentation placeholders without weakening secret checks; - use the strict GitHub token shapes recorded on #2439; -- prove the snapshot and asset-verification path in a dry run; -- update README, licensing, launch-kit, install, and public-home links. +- prove source snapshot and asset verification in a no-publish rehearsal; +- update README, licensing, launch-kit, install, support, security, telemetry, and public-home links. The final handoff is private-first. The mirror workflow consumes the already-published private -Release, its body, and its assets. It stages and verifies an invisible draft in the mirror before -publishing the public commit, tag, and Release. +Release, its body, and its assets. It stages and verifies an invisible mirror draft before publishing +the public commit, tag, and Release. -### CP-7: Prove runners, then execute the private cutover +### CP-7: Prove runners, cut over privately, rehearse hosted-only, then associate runners Issues and authority: #2328, #2337, [`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), and [`PRIVATE_REPO_CUTOVER_CHECKLIST.md`](../ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md). -Two boundaries must remain distinct: +Three boundaries must remain distinct: -1. **Before cutover, while no runner is associated with the public repository**, prove isolated VMs, - no host mounts, no personal credentials, one job per host, hosted override, offline behavior, +1. **Before cutover, with no runner associated to the public repository**, prove isolated VMs, no host + mounts, no personal credentials, one job per host, hosted override, offline behavior, workspace/Docker/cache cleanup, VM reset, and revocation. -2. **After privacy**, perform the human registration/association step, then verify labels, read-only - token posture, and one selected private workload on that already-proven environment. +2. **Immediately after privacy**, register the stable Smart CI gate and run the complete private-mode + release rehearsal while execution remains hosted-only. +3. **Only after that hosted-only rehearsal succeeds**, associate already-proven runners, verify labels + and read-only token posture, enable hybrid mode if retained, and run a separate selected + self-hosted-workload proof. Do not register the stable gate while the repository is public. A fork can publish a same-named `pull_request` check. Use a short frozen cutover window: 1. freeze merges and capture branch-protection and Actions settings; 2. finish storage cleanup under `$0`; -3. finish hosted public-mode release and mirror dry runs; +3. finish public-mode release and mirror dry runs; 4. complete all pre-registration runner proof while VMs remain unassociated; -5. enable the full-SHA action setting after the pinning migration is qualified; -6. change the development repository to private; -7. immediately require `Smart CI / Required Gate`, retain the security contexts, and apply the +5. change the development repository to private; +6. immediately require `Smart CI / Required Gate`, retain the security contexts, and apply the evidence-based strictness and administrator decisions; -8. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and forks; -9. register only the already-proven runners, or record a hosted-only ruling; -10. run private-mode R0/R2/R4 PRs, a normal merge, nightly dispatch, and no-publish release rehearsal; +7. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and forks; +8. while still hosted-only, run private-mode R0/R2/R4 PRs, a normal merge, nightly dispatch, and the + no-publish release rehearsal; +9. if hybrid mode remains the ruling, register only the already-proven runners, verify association, + labels, and read-only token posture, then run the selected self-hosted workload proof; +10. otherwise record hosted-only operation; 11. record evidence and resume merges. -### CP-8: Tag, publish privately, mirror, verify, announce +### CP-8: Rehearse the head, create and qualify the real tag, publish, mirror, verify, announce After all earlier gates close: 1. select one exact `main` commit and stop feature merges; 2. update release notes, upgrade notes, limitations, and public links; -3. run final-head checks and clean tag qualification; -4. smoke the Windows archive and immutable container; -5. prove the MCP external-client to proposal to review to applied-card path; -6. prove claimed install, update, and backup behavior; -7. create the exact tag and publish the **private** `v0.3.0` Release with qualified assets, - checksums, provenance, and body; -8. let the mirror workflow build the allowlisted source snapshot, stage the mirror Release, and - re-download/verify every asset; -9. publish the mirror commit, tag, and public Release only after draft verification succeeds; -10. verify source identity, checksums, provenance, install links, and downloads anonymously; -11. announce only after the identities match. +3. run final-head checks and a no-publish rehearsal against that frozen head; +4. create the real `v0.3.0` tag on the proven commit; +5. rebuild from and qualify that **exact tag** in the clean hosted release workflow; +6. smoke the tag-produced Windows archive and immutable container; +7. prove the MCP external-client to proposal to review to applied-card path; +8. prove claimed install, update, and backup behaviour; +9. publish the private `v0.3.0` Release with the exact qualified assets, checksums, provenance, and + body; +10. let the mirror workflow build the allowlisted source snapshot, stage the mirror Release, and + re-download/verify every asset; +11. publish the mirror commit, tag, and public Release only after draft verification succeeds; +12. verify source identity, checksums, provenance, install links, and downloads anonymously; +13. announce only after the identities match. -The private Release is the trigger and input to the mirror workflow. Public verification therefore -happens after private publication but before public announcement. +A branch dispatch with a preview tag is a rehearsal, not exact-tag qualification. The real tag must +exist before the exact-tag rebuild. -## 4. Maintainer decision packet +## 4. Human action and decision packet -### D1: Release scope +### Already settled - do not ask again -**A. Strict:** implement every open milestone issue. +- #2004 stays in v0.3 as the ADR-first full implementation. +- #2009 stays in v0.3; palette anchors are the remaining bounded design input. +- #1772 stays in v0.3 and Stage 1 has started. +- The #1772 collaborator identity is privately held, the monthly ceiling is £20 with a £10 alert, + and twelve weekly encrypted off-platform copies are retained. +- #2315 is a tracked residual discharged from release-gate clause 2. +- The Actions spending ceiling is `$0`. +- The public mirror is `Chris0Jeky/taskdeck-release`. +- `sha_pinning_required: true` is already enabled. +- The development repository becomes private before the stable Smart CI context is registered. +- The private Release is published before the public mirror republishes it. -**B. Claim-based:** retain trust, packaging, security, data-integrity, and headline-product work; -explicitly move broad redesigns and non-blocking polish. +### Still requires a maintainer decision or action -**Recommendation: B.** Keep the bar high for the v0.3 claim without treating one milestone as an -unlimited improvement backlog. +#### H1: Final per-issue scope disposition -### D2: CLI trust model - #1131 +Apply the current rulings to the remaining open issue set. Prefer claim-based release scope: keep +trust, security, data integrity, packaging, and explicitly retained product work; move only work that +the release does not claim. Do not move #2004, #2009, #1772, or #2315 contrary to their recorded +rulings. -**A.** Route CLI mutations through claims-first actor and board authorization. +#### H2: CLI trust model - #1131 -**B.** Define the CLI as an unrestricted local-administrator tool, gate access, and document that it -must not be exposed to a collaborator or remote shell. +- **A:** route CLI mutations through claims-first actor and board authorization; +- **B:** define the CLI as a gated local-administrator tool that is never exposed to a collaborator + or remote shell. -**Recommendation for v0.3: B**, provided the shared instance does not expose the CLI. Schedule -claims-first CLI authorization before collaborative or remote use. +**Recommendation for v0.3: B**, with claims-first CLI authorization before collaborative or remote +use. -### D3: Automation Chat - #2004 +#### H3: MCP runtime hash approval - #1309 -**A.** Complete the full redesign now. +- **A:** enforce tool-definition hash approval in the invocation path now; +- **B:** retain the explicit statement that runtime approval is not enforced, make no stronger claim, + and close v0.3 after the external-client-to-applied-card demonstration. -**B.** Ship a bounded honesty repair: explicit board binding, no false applied-change claim, and each -actionable turn ending in a proposal link or clear non-action reason. +**Recommendation for v0.3: B.** Add enforcement later as a complete policy, not a rushed hook. -**C.** Mark or hide it as experimental and defer the redesign. +#### H4: Smart CI branch-current and administrator policy -**Recommendation: B** if Chat stays visible in the headline experience; otherwise C. +After the observation evidence is complete, choose: -### D4: Night theme - #2009 +- branch-current strictness on or off; +- administrator enforcement on or off; +- the exact temporary-setting break-glass procedure, if enforcement is enabled. -**A.** Complete the multi-palette spike and ADR now. +Do not pre-rule these before the evidence. -**B.** Ship the measurable safety subset: control-boundary contrast, night contrast specifications, -view-layer color-audit coverage, and removal of known theme-agnostic literals. +#### H5: CodeQL posture - #2335 -**C.** Mark the theme experimental and defer. +Choose either re-enable CodeQL under the hosted control lane or record why the current scanner set is +the v0.3 posture. -**Recommendation: B** if night theme is supported; otherwise C. +#### H6: Stage 1 private instance - #1772 -### D5: MCP hash approval - #1309 +The instance remains in v0.3. The two remaining choices are: -**A.** Enforce tool-definition hash approval in the invocation path now. +- tunnel mechanism; +- daily token ceiling. -**B.** Retain the explicit statement that runtime approval is not enforced, avoid implying otherwise, -and close v0.3 after the external-client-to-applied-card demonstration. +Then execute the existing runbook, including restore-before-invite and the evidence record. Account +creation, billing, invitation, and subjective acceptance remain human actions. -**Recommendation: B for v0.3.** Add enforcement later as a fully designed policy. +#### H7: Storage deletion - #2333 -### D6: Two-person private instance - #1772 +Review the fresh identity-bound dry-run report and authorize the exact destructive deletion set. Do +not authorize a count or ID list from an older inventory. -**A.** Keep the real two-account deployment, backup, restore, realtime, access-policy, and durability -proof in v0.3. +#### H8: Public mirror - #2439 -**B.** Move it to v0.4 and keep v0.3 a downloadable/self-hosted beta release. +Create `Chris0Jeky/taskdeck-release`, disable its Actions, and create the narrowly scoped publishing +credential. Keep the credential out of issues, logs, and documentation. -**Recommendation: B** unless the v0.3 release will actively recruit a second participant. If A is -retained, do not re-open settled inputs: the collaborator identity is privately held, the £20 monthly -ceiling and £10 alert are recorded, and twelve weekly off-platform copies are already ruled. The -remaining maintainer choices are the tunnel mechanism and daily token ceiling. +#### H9: Private cutover - #2337 -### D7: Administrator enforcement +Freeze merges, flip visibility, register the gate only after privacy, apply evidence-based branch +protection decisions, run the hosted-only private rehearsal, and only then associate runners if +hybrid mode remains desired. -**A.** Enable `enforce_admins` with a recorded temporary-setting break-glass procedure if rehearsal -evidence supports it. +#### H10: Final release publication -**B.** Leave administrators exempt and rely on process. +Approve the frozen commit, create the real tag, inspect exact-tag qualification, publish the private +Release, inspect anonymous mirror verification, then authorize the public announcement. -**Recommendation:** decide from the observation and rehearsal evidence. The maintainer owns this -choice; it is not pre-ruled. +## 5. Disposition proposal for all 29 open milestone issues -### D8: Storage posture - -**A.** Preserve release/provenance and required audit evidence, delete obsolete CI artifacts with the -identity-bound tool, and keep the `$0` ceiling. - -**B.** Retain the larger evidence estate and seek a new ruling. This is not an available v0.3 posture -under the settled ceiling. - -**Recommendation: A.** - -## 5. Proposed disposition for all 29 open milestone issues +This table is a release-owner routing proposal. Existing maintainer rulings override a generic +category. | Issue | Proposed disposition | Required release outcome | | --- | --- | --- | | #2324 | CLOSE LAST | Close after child evidence and the cutover ledger | | #2326 | SHIP | Clean planner evidence and accepted recall report | -| #2327 | SHIP | Landed verifier, gate proof, settings handoff, post-registration proof | -| #2328 | SHIP + HUMAN GATE | Prove isolation before cutover; only register/associate after privacy | +| #2327 | SHIP | Qualify #3167, add authoritative collection/workflow integration, prove gate and landed paths | +| #2328 | SHIP + HUMAN GATE | Prove isolation before cutover; associate only after hosted-only private rehearsal | | #2329 | SHIP | Ownership manifest complete and recall shows safe selection | | #2331 | SHIP | Bounded Windows contract and weekly full coverage before reduction | | #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | | #2333 | SHIP + HUMAN GATE | Storage below allowance under `$0`, with ledger evidence | -| #2334 | SHIP | Accepted nightly observation, weekly sweep, clean tag qualification | +| #2334 | SHIP | Accepted nightly observation, weekly sweep, real-tag qualification | | #2335 | SHIP | Re-qualify #2838, obtain J.3 maintainer gate, record CodeQL ruling | -| #2337 | HUMAN GATE | Execute private cutover and private-mode rehearsal | -| #2378 | SHIP OR CLOSE ON EVIDENCE | Remove Windows timeout class or prove superseding contract | -| #2439 | SHIP + HUMAN GATE | Create `taskdeck-release`, workflow, dry run, private-Release handoff, link cutover | +| #2337 | HUMAN GATE | Execute private cutover and hosted-only private-mode rehearsal | +| #2378 | SHIP OR CLOSE ON EVIDENCE | Remove Windows timeout class or prove a superseding contract | +| #2439 | SHIP + HUMAN GATE | Create `taskdeck-release`, workflow, rehearsal, private-Release handoff, link cutover | | #2508 | SHIP RESIDUALS | Core binding shipped; review and qualify draft #3156 | -| #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism | -| #1940 | CLOSE ON EVIDENCE + DECISION | Settle request-edit/defer follow-ups or refile them | -| #1949 | RECONCILE | Close delivered guards; move non-blocking parser/coverage tail | +| #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism needed for qualification | +| #1940 | CLOSE ON EVIDENCE | Reconcile delivered acceptance and refile only proven residuals | +| #1949 | RECONCILE AND SHIP RETAINED TAIL | Close delivered guards and finish or split only the retained parser/coverage work | | #1999 | CLOSE ON EVIDENCE | Reconcile delivered triage-edit work and refile proven residuals | -| #2004 | DECIDE | Bounded honesty repair or move/disable redesign | -| #2009 | DECIDE | Safety subset or move palette spike | -| #1131 | DECIDE + DOCUMENT/IMPLEMENT | Claims-first CLI or gated local-admin CLI | -| #1307 | RECONCILE, THEN SHIP OR SPLIT | Keep only unresolved honesty work in scope | -| #1309 | CLOSE AFTER PROOF | Honest no-enforcement decision plus external MCP demo | -| #1772 | DECIDE | Keep real participant proof or move to v0.4 | -| #2214 | SHIP | Deep-link reauthorization, poll recovery, stale-state honesty | +| #2004 | SHIP - DECISION SETTLED | ADR-first full implementation remains in v0.3 | +| #2009 | SHIP - DECISION SETTLED | Remains in v0.3; finish the bounded palette-anchor and contrast work | +| #1131 | DECIDE + IMPLEMENT/DOCUMENT | Claims-first CLI or explicitly gated local-admin CLI | +| #1307 | RECONCILE, THEN SHIP | Honour recorded sub-rulings, finish retained batch/dogfooding evidence, split only true residuals | +| #1309 | DECIDE + PROVE | Runtime enforcement now or honest non-enforcement plus external MCP demonstration | +| #1772 | SHIP + HUMAN GATE - DECISION SETTLED | Stage 1 remains in v0.3; choose tunnel/daily ceiling and execute runbook | +| #2214 | SHIP | Deep-link reauthorization, poll recovery, and stale-state honesty | | #2235 | CLOSEOUT LAST | Reconcile docs, issues, ADRs, links, status, and release truth | -| #2315 | CLOSE ON EVIDENCE OR DEFER | Do not leave a ruled non-blocker milestone-open | -| #2391 | SHIP AFTER MIRROR | Final copy with public URLs and caveats | -| #2499 | TARGETED FIX OR DEFER | Document legacy fail-closed behavior and rule producer stamping | +| #2315 | EXPLICIT TRACKED RESIDUAL | Preserve D-8 ruling; closure is not a release prerequisite | +| #2391 | SHIP AFTER MIRROR | Final launch copy with public URLs and caveats | +| #2499 | CLOSE ON RULED TRUTH WORK | Preserve fail-closed provenance ruling; finish the retained documentation/producer-truth slice | + +## 6. Release-oriented PR priority snapshot -## 6. Release-oriented PR priority +The queue changes rapidly. Recheck live state before acting. ### Priority 0: direct release trust path -- #2838 - checkout credentials and Pages permission scoping; +- #2838 - checkout credentials and Pages permission scoping, behind J.3 maintainer review; - #3111 - container release contract; - #3131 - release-tag grammar; - #3130 - public Pages and no-loopback demo posture; - #3139 - hosted documentation-governance regressions; - #3143 - hosted Docker MCP safety regressions if retained for #2332/#2312; -- #3156 - #2508 diagnostic-receipt and local-what-if residuals. +- #3156 - #2508 diagnostic-receipt and local-what-if residuals; +- #3167 - fail-closed landed-verifier decision core, with collector/integration still separate. ### Priority 1: supports closure - #2931 - mutation activation smoke; mutation remains manual; -- #3098 - friends-and-family runbook if #1772 stays; +- #3098 - friends-and-family runbook supporting the retained #1772 Stage 1 lane; - #3140 - PowerShell inventory wrapper correctness; - #3113 - worktree guard hardening; -- #3151 - this assessment and decision packet. +- #3151 - this assessment and release-owner packet. -Other product PRs should continue only when they close retained v0.3 scope or a release-critical -regression. Otherwise they should not keep moving the final qualification head. +Other product PRs should move the final qualification head only when they close retained v0.3 scope +or a release-critical regression. ## 7. Recommended execution waves -### Wave A: lock the release +### Wave A: lock and reduce the release queue -1. Record D1 to D8 on their issues. -2. Apply a disposition to all 29 open issues. -3. Stop admitting non-critical v0.3 scope. -4. Re-qualify Priority 0 PRs through all applicable control-plane gates. -5. Implement #2327's landed verifier and qualify #3156. -6. Complete retained bounded product fixes. +1. Preserve the settled rulings listed in section 4. +2. Decide only the genuinely open items H1 to H6. +3. Apply a release disposition to all open issues without recreating #2315 as a blocker. +4. Stop admitting non-critical v0.3 scope. +5. Re-qualify Priority 0 PRs through every applicable control-plane gate. +6. Qualify #3156 and #3167; follow #3167 with the separate authoritative collector/workflow slice. +7. Complete retained bounded product work, including #2004, #2009, and #1772. ### Wave B: prove the control plane before cutover @@ -374,37 +414,42 @@ regression. Otherwise they should not keep moving the final qualification head. 5. create `Chris0Jeky/taskdeck-release` and run the no-publish rehearsal; 6. complete the public hosted-only cutover rehearsal; 7. prove all runner isolation, cleanup, offline, override, reset, and revocation contracts without - registering the runners. + associating the runners to GitHub. -### Wave C: cut over, release privately, mirror, announce +### Wave C: cut over, rehearse hosted-only, tag, release privately, mirror, announce 1. Pause merges and capture settings. 2. Flip the development repository private. -3. Register the required gate and retained security checks; apply evidence-based strictness/admin - decisions. +3. Register the required gate and retained security checks; apply evidence-based strictness and + administrator decisions. 4. Re-check private repository settings and external surfaces. -5. Register already-proven runners or record hosted-only operation. -6. Run the private-mode matrix and main verifier. +5. Run the complete private-mode matrix and no-publish release rehearsal while hosted-only. +6. Associate already-proven runners only afterward, if hybrid mode remains desired, and run the + separate selected self-hosted workload proof. 7. Close trackers and perform #2235's final truth pass. -8. Freeze one exact release commit and qualify its tag. -9. Publish the private `v0.3.0` Release. -10. Let the mirror stage, verify, and publish the public source and byte-identical assets. -11. Verify anonymously, then announce. +8. Freeze one exact release commit and complete final-head rehearsal. +9. Create the real tag and qualify that exact tag. +10. Publish the private `v0.3.0` Release. +11. Let the mirror stage, verify, and publish the public source and byte-identical assets. +12. Verify anonymously, then announce. ## 8. Definition of done `v0.3.0` is ready when: -- every milestone issue is closed or explicitly moved; +- every milestone issue is closed, explicitly moved, or covered by a recorded clause-2 residual such + as #2315; - no release-critical PR is parked behind an unrecorded maintainer ruling; -- the exact final head is green under the final required-check configuration; +- the exact frozen head is green under the final required-check configuration; - landed verification and full-escalation paths are proven; - Smart CI observation and recall thresholds are met; - artifact storage is below the private allowance under `$0`; -- clean-from-tag qualification succeeds with runners offline; -- runner isolation, cleanup, override, offline, reset, and revocation are proven before registration; -- the private repository, required gate, and final runner mode pass rehearsal; -- the private Release contains the exact qualified assets, checksums, provenance, and body; +- self-hosted isolation, cleanup, override, offline, reset, and revocation are proven before + association; +- the private repository and required gate pass the full hosted-only private rehearsal; +- any later hybrid association passes a separate selected self-hosted workload proof; +- the real `v0.3.0` tag is rebuilt and qualified after it exists; +- the private Release contains the exact tag-qualified assets, checksums, provenance, and body; - `Chris0Jeky/taskdeck-release` republishes corresponding source and byte-identical assets through its staged verification path; - anonymous verification confirms source, checksums, provenance, links, and downloads; @@ -415,16 +460,22 @@ regression. Otherwise they should not keep moving the final qualification head. ## 9. Advancement brief -- **Issue throughput:** strong - 103 of 132 issues closed; #2561 closed during this assessment. +- **Issue throughput:** strong - 103 of 132 issues closed, 78.0%; #2561 closed during this assessment. - **Packaging:** strong - a real RC and integrity assets exist. -- **Product readiness:** mixed - the downloadable beta exists, but a few scope choices remain. -- **CI/release trust:** incomplete - landed verifier, clean observation/recall, release qualification, - least privilege, and storage remain open. -- **Runner readiness:** pre-registration engineering proof remains; registration waits for privacy. -- **Distribution continuity:** designed but not operational - `taskdeck-release`, workflow, dry run, - and final handoff remain. +- **Release-scope truth:** improved - settled decisions and #2315's residual status are now separated + from genuinely open choices. +- **Product readiness:** mixed - the downloadable beta exists, but retained #2004, #2009, #1772, and + several review residuals remain. +- **CI/release trust:** progressing - #3156 addresses #2508's bounded residuals and #3167 adds the + landed-verifier decision core, but collector integration, clean observation/recall, release + qualification, least privilege, and storage remain open. +- **Runner readiness:** pre-association engineering proof remains; hosted-only private rehearsal must + precede runner association. +- **Distribution continuity:** designed but not operational - `taskdeck-release`, its credential, + workflow, dry run, and final private-Release handoff remain. - **Human cutover:** not executed - development remains public and the final gate is not enforced. -The milestone is **late-stage but not in final-tag territory**. The fastest safe route is a focused -release programme around scope rulings, Smart CI evidence, storage, runner isolation, mirror -continuity, the private cutover, and the private-Release-to-public-mirror handoff. +The milestone is **late-stage but not in final-tag territory**. The fastest safe route is focused +release control: reconcile the retained issue set, complete Smart CI evidence, clean storage, prove +runner isolation, operationalise the mirror, rehearse private mode hosted-only, qualify the real tag, +and only then publish and announce. From 44522782d5f4139f4be313836a1fe660103a4a36 Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:24:27 +0100 Subject: [PATCH 08/15] docs: fix GHCR and exact-tag Windows cutover order --- .../2026-09-17-v0.3-release-assessment.md | 187 +++++++++++------- 1 file changed, 115 insertions(+), 72 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index e5e5f2e48b..74119137a3 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -21,10 +21,12 @@ packaging project: 4. finish nightly, clean-tag, and release qualification; 5. operationalise the approved public mirror; 6. prove runner isolation before any GitHub association; -7. execute the private cutover and hosted-only private-mode rehearsal; -8. associate runners only after that rehearsal, if hybrid mode is retained; -9. rehearse the final head, create the real tag, qualify that exact tag, publish the private Release, - mirror it publicly, verify anonymously, then announce. +7. make the GHCR packages public and verify anonymous access before repository privacy; +8. execute the private cutover and hosted-only private-mode rehearsal; +9. associate runners only after that rehearsal, if hybrid mode is retained; +10. rehearse the final head, create the real tag, qualify hosted Linux/control work and the Windows + archive on their approved runner classes, publish the private Release, mirror it publicly, verify + anonymously, then announce. Publishing final `v0.3.0` earlier would promote a valid RC without satisfying the repository's own release trust boundary. @@ -44,6 +46,8 @@ Code and settings were measured on 2026-09-17 against `main` | Development repository | Public | The required private cutover has not happened | | Required checks on `main` | Three security contexts only | `Smart CI / Required Gate` is not registered yet | | SHA pinning setting | Completed | `sha_pinning_required: true` is already enabled and verified | +| GHCR continuity | Pre-cutover mutation still required | Packages must be set public and anonymously verified before repository privacy | +| Exact-tag Windows path | Not yet adapted/proved | Under `$0`, final Windows qualification must use the proven isolated Windows runner rather than private hosted Windows | | Public mirror | Approved name: `Chris0Jeky/taskdeck-release` | Repository, credential, workflow, and rehearsal still need execution | | Milestone due date | None | Readiness is evidence-based, not date-based | @@ -55,11 +59,11 @@ blocker when a recorded release ruling explicitly discharges it. | Clause | State | What remains | | --- | --- | --- | -| Final candidate checks green | Pending | Prove the frozen head, then create and qualify the exact real tag | +| Final candidate checks green | Pending | Prove the frozen head, then create and qualify the exact real tag on the approved runner classes | | Milestone closed or explicitly re-ruled | **Not met** | Reconcile the remaining open set while preserving #2315's existing residual ruling | | Launch kit drafted | **Met** | Keep copy and public links current through mirror publication | | `main` green | Must be re-proved | The final claim must bind to the frozen release head, not an older green tip | -| Private cutover with Smart CI enforced | **Not met** | Complete prerequisites, flip private, register the gate, and pass private-mode rehearsal | +| Private cutover with Smart CI enforced | **Not met** | Complete prerequisites, preserve public package access, flip private, register the gate, and pass private-mode rehearsal | **Formal position: no-go for the final tag.** This does not invalidate the RC. @@ -85,7 +89,10 @@ Do not re-open decisions that are already settled. In particular: - #2315 remains a non-blocking tracked residual; - the Actions ceiling is `$0`; - the public mirror is `Chris0Jeky/taskdeck-release`; -- SHA pinning is already enabled. +- SHA pinning is already enabled; +- GHCR packages must remain public across the repository-visibility cutover; +- final exact-tag Windows qualification cannot consume private hosted Windows minutes under the + current budget ruling. After reconciliation, reject new v0.3 scope unless it is a release-critical regression. @@ -141,11 +148,16 @@ Required outcomes: - accept the nightly observation window before selective execution is enabled; - prove the weekly full sweep across Linux, Windows, browsers, security, containers, and performance; - keep mutation manual unless ADR-0052 is deliberately amended; -- rehearse from the frozen final head without publishing; -- create the real release tag, then rebuild and qualify **that exact tag** in a clean hosted context; +- rehearse from the frozen final head without publishing, with self-hosted runners offline; +- create the real release tag, then rebuild and qualify **that exact tag**; +- keep hosted Linux/control work within the settled private Actions allowance; +- route the exact-tag Windows archive build through the already-proven isolated Windows runner after + the hosted-only private rehearsal and runner association, because `windows-latest` would consume + disallowed private hosted Windows minutes under the current `$0` ruling; +- explicitly re-rule the budget before the tag rather than silently using hosted Windows if that + runner route cannot be delivered; - verify digests, SBOM, provenance, migrations/upgrades, and non-promotion of ordinary PR artifacts; - remove duplicate tag/release qualification for the same commit; -- run no-publish release rehearsal with self-hosted runners offline; - resolve or explicitly disposition remaining launcher timing nondeterminism. #2561 closed during this assessment and is no longer in the open release queue. @@ -164,7 +176,7 @@ SHA pinning is already enabled and must not be presented as a future cutover tas A separate explicit CodeQL decision remains useful: re-enable it under the hosted control lane or retain the current scanners with the reason recorded. -### CP-6: Operationalise the approved public mirror +### CP-6: Operationalise the approved public mirror and preserve public package access Issue: #2439. Design authority: [`PUBLIC_MIRROR_OPTIONS.md`](../ci/PUBLIC_MIRROR_OPTIONS.md). @@ -178,13 +190,16 @@ The approved mirror is **`Chris0Jeky/taskdeck-release`**. Remaining work: - handle known documentation placeholders without weakening secret checks; - use the strict GitHub token shapes recorded on #2439; - prove source snapshot and asset verification in a no-publish rehearsal; +- set the release GHCR packages explicitly public before the development repository becomes private; +- prove anonymous package pull/read access before the flip and re-read package visibility afterward; - update README, licensing, launch-kit, install, support, security, telemetry, and public-home links. -The final handoff is private-first. The mirror workflow consumes the already-published private +The final release handoff is private-first. The mirror workflow consumes the already-published private Release, its body, and its assets. It stages and verifies an invisible mirror draft before publishing -the public commit, tag, and Release. +the public commit, tag, and Release. GHCR is different: its public visibility must be established +before the repository flip so inherited access cannot silently make existing images private. -### CP-7: Prove runners, cut over privately, rehearse hosted-only, then associate runners +### CP-7: Prove runners, preserve GHCR, cut over privately, rehearse hosted-only, then associate runners Issues and authority: #2328, #2337, [`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), and @@ -199,25 +214,30 @@ Three boundaries must remain distinct: release rehearsal while execution remains hosted-only. 3. **Only after that hosted-only rehearsal succeeds**, associate already-proven runners, verify labels and read-only token posture, enable hybrid mode if retained, and run a separate selected - self-hosted-workload proof. + self-hosted-workload proof. The proven Windows runner then becomes the final exact-tag Windows + build route under the current `$0` ruling. Do not register the stable gate while the repository is public. A fork can publish a same-named -`pull_request` check. Use a short frozen cutover window: +`pull_request` check. Do not rely on inherited package access during the visibility flip. Use a short, +frozen cutover window: -1. freeze merges and capture branch-protection and Actions settings; +1. freeze merges and capture branch-protection, Actions, package, and external-surface settings; 2. finish storage cleanup under `$0`; 3. finish public-mode release and mirror dry runs; 4. complete all pre-registration runner proof while VMs remain unassociated; -5. change the development repository to private; -6. immediately require `Smart CI / Required Gate`, retain the security contexts, and apply the +5. set every release GHCR package explicitly public and verify anonymous pull/read access; +6. change the development repository to private; +7. immediately require `Smart CI / Required Gate`, retain the security contexts, and apply the evidence-based strictness and administrator decisions; -7. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and forks; -8. while still hosted-only, run private-mode R0/R2/R4 PRs, a normal merge, nightly dispatch, and the +8. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and forks, + including a second anonymous GHCR access check; +9. while still hosted-only, run private-mode R0/R2/R4 PRs, a normal merge, nightly dispatch, and the no-publish release rehearsal; -9. if hybrid mode remains the ruling, register only the already-proven runners, verify association, - labels, and read-only token posture, then run the selected self-hosted workload proof; -10. otherwise record hosted-only operation; -11. record evidence and resume merges. +10. if hybrid mode remains the ruling, register only the already-proven runners, verify association, + labels, and read-only token posture, then run the selected self-hosted workload proof; +11. otherwise record hosted-only operation and explicitly re-rule the final Windows build budget/path + before creating the release tag; +12. record evidence and resume merges. ### CP-8: Rehearse the head, create and qualify the real tag, publish, mirror, verify, announce @@ -225,22 +245,29 @@ After all earlier gates close: 1. select one exact `main` commit and stop feature merges; 2. update release notes, upgrade notes, limitations, and public links; -3. run final-head checks and a no-publish rehearsal against that frozen head; +3. run final-head checks and a no-publish rehearsal against that frozen head while self-hosted runners + remain offline; 4. create the real `v0.3.0` tag on the proven commit; -5. rebuild from and qualify that **exact tag** in the clean hosted release workflow; -6. smoke the tag-produced Windows archive and immutable container; -7. prove the MCP external-client to proposal to review to applied-card path; -8. prove claimed install, update, and backup behaviour; -9. publish the private `v0.3.0` Release with the exact qualified assets, checksums, provenance, and - body; -10. let the mirror workflow build the allowlisted source snapshot, stage the mirror Release, and +5. run the exact-tag hosted Linux/control qualification within the settled budget; +6. run the exact-tag Windows archive build and Windows-specific qualification on the proven isolated + Windows runner associated only after the hosted-only private rehearsal; +7. reconcile both runner-class evidence sets against the same tag, commit, policy, checksums, + provenance, and release contract; +8. smoke the tag-produced Windows archive and immutable container; +9. prove the MCP external-client to proposal to review to applied-card path; +10. prove claimed install, update, and backup behaviour; +11. publish the private `v0.3.0` Release with the exact qualified assets, checksums, provenance, and + body; +12. let the mirror workflow build the allowlisted source snapshot, stage the mirror Release, and re-download/verify every asset; -11. publish the mirror commit, tag, and public Release only after draft verification succeeds; -12. verify source identity, checksums, provenance, install links, and downloads anonymously; -13. announce only after the identities match. +13. publish the mirror commit, tag, and public Release only after draft verification succeeds; +14. verify source identity, checksums, provenance, install links, GHCR access, and downloads + anonymously; +15. announce only after the identities and public access checks match. A branch dispatch with a preview tag is a rehearsal, not exact-tag qualification. The real tag must -exist before the exact-tag rebuild. +exist before the exact-tag rebuild. Under the settled budget, a private `windows-latest` run is not an +acceptable substitute for the proven isolated Windows runner. ## 4. Human action and decision packet @@ -255,7 +282,12 @@ exist before the exact-tag rebuild. - The Actions spending ceiling is `$0`. - The public mirror is `Chris0Jeky/taskdeck-release`. - `sha_pinning_required: true` is already enabled. +- GHCR package visibility must be explicitly public before the development repository becomes + private. - The development repository becomes private before the stable Smart CI context is registered. +- The complete private-mode rehearsal runs hosted-only before any runner association. +- The final exact-tag Windows archive is built on the proven isolated Windows runner under the + current budget ruling, unless the maintainer explicitly re-rules the budget first. - The private Release is published before the public mirror republishes it. ### Still requires a maintainer decision or action @@ -314,21 +346,24 @@ creation, billing, invitation, and subjective acceptance remain human actions. Review the fresh identity-bound dry-run report and authorize the exact destructive deletion set. Do not authorize a count or ID list from an older inventory. -#### H8: Public mirror - #2439 +#### H8: Public mirror and GHCR continuity - #2439 Create `Chris0Jeky/taskdeck-release`, disable its Actions, and create the narrowly scoped publishing -credential. Keep the credential out of issues, logs, and documentation. +credential. Keep the credential out of issues, logs, and documentation. Before the development +repository becomes private, set the release GHCR packages public and verify anonymous pull/read +access. Verify again after the flip. #### H9: Private cutover - #2337 -Freeze merges, flip visibility, register the gate only after privacy, apply evidence-based branch -protection decisions, run the hosted-only private rehearsal, and only then associate runners if -hybrid mode remains desired. +Freeze merges, capture settings, make GHCR public, flip visibility, register the gate only after +privacy, apply evidence-based branch-protection decisions, run the hosted-only private rehearsal, and +only then associate already-proven runners if hybrid mode remains desired. #### H10: Final release publication -Approve the frozen commit, create the real tag, inspect exact-tag qualification, publish the private -Release, inspect anonymous mirror verification, then authorize the public announcement. +Approve the frozen commit, create the real tag, inspect exact-tag hosted Linux/control qualification +and isolated-Windows qualification, publish the private Release, inspect anonymous mirror and GHCR +verification, then authorize the public announcement. ## 5. Disposition proposal for all 29 open milestone issues @@ -340,16 +375,16 @@ category. | #2324 | CLOSE LAST | Close after child evidence and the cutover ledger | | #2326 | SHIP | Clean planner evidence and accepted recall report | | #2327 | SHIP | Qualify #3167, add authoritative collection/workflow integration, prove gate and landed paths | -| #2328 | SHIP + HUMAN GATE | Prove isolation before cutover; associate only after hosted-only private rehearsal | +| #2328 | SHIP + HUMAN GATE | Prove isolation before cutover; associate after hosted-only rehearsal; use proven Windows runner for exact-tag Windows qualification | | #2329 | SHIP | Ownership manifest complete and recall shows safe selection | | #2331 | SHIP | Bounded Windows contract and weekly full coverage before reduction | | #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | | #2333 | SHIP + HUMAN GATE | Storage below allowance under `$0`, with ledger evidence | -| #2334 | SHIP | Accepted nightly observation, weekly sweep, real-tag qualification | +| #2334 | SHIP | Accepted nightly observation, weekly sweep, real-tag qualification split across approved hosted Linux/control and isolated Windows runner paths | | #2335 | SHIP | Re-qualify #2838, obtain J.3 maintainer gate, record CodeQL ruling | -| #2337 | HUMAN GATE | Execute private cutover and hosted-only private-mode rehearsal | +| #2337 | HUMAN GATE | Preserve public GHCR, execute private cutover, and complete hosted-only private-mode rehearsal | | #2378 | SHIP OR CLOSE ON EVIDENCE | Remove Windows timeout class or prove a superseding contract | -| #2439 | SHIP + HUMAN GATE | Create `taskdeck-release`, workflow, rehearsal, private-Release handoff, link cutover | +| #2439 | SHIP + HUMAN GATE | Create `taskdeck-release`, preserve public GHCR, rehearse workflow, complete private-Release handoff and link cutover | | #2508 | SHIP RESIDUALS | Core binding shipped; review and qualify draft #3156 | | #2588 | SHIP OR CONSOLIDATE | Close Linux bind-timing nondeterminism needed for qualification | | #1940 | CLOSE ON EVIDENCE | Reconcile delivered acceptance and refile only proven residuals | @@ -410,28 +445,31 @@ or a release-critical regression. 1. Fix remaining Smart CI false-red or missed-lane causes. 2. Accumulate complete observation and recall windows. 3. Accept nightly observation and the weekly full sweep. -4. clean storage and record the new measurement under `$0`; -5. create `Chris0Jeky/taskdeck-release` and run the no-publish rehearsal; -6. complete the public hosted-only cutover rehearsal; -7. prove all runner isolation, cleanup, offline, override, reset, and revocation contracts without +4. Clean storage and record the new measurement under `$0`. +5. Create `Chris0Jeky/taskdeck-release` and run the no-publish rehearsal. +6. Complete the public hosted-only cutover rehearsal. +7. Prove all runner isolation, cleanup, offline, override, reset, and revocation contracts without associating the runners to GitHub. +8. Prepare the GHCR visibility mutation and anonymous verification commands for the frozen cutover. -### Wave C: cut over, rehearse hosted-only, tag, release privately, mirror, announce +### Wave C: preserve public distribution, cut over, rehearse hosted-only, tag, release privately, mirror, announce -1. Pause merges and capture settings. -2. Flip the development repository private. -3. Register the required gate and retained security checks; apply evidence-based strictness and +1. Pause merges and capture branch-protection, Actions, package, and external-surface settings. +2. Set release GHCR packages public and prove anonymous access. +3. Flip the development repository private. +4. Register the required gate and retained security checks; apply evidence-based strictness and administrator decisions. -4. Re-check private repository settings and external surfaces. -5. Run the complete private-mode matrix and no-publish release rehearsal while hosted-only. -6. Associate already-proven runners only afterward, if hybrid mode remains desired, and run the +5. Re-check private repository settings, public GHCR access, and other external surfaces. +6. Run the complete private-mode matrix and no-publish release rehearsal while hosted-only. +7. Associate already-proven runners only afterward, if hybrid mode remains desired, and run the separate selected self-hosted workload proof. -7. Close trackers and perform #2235's final truth pass. -8. Freeze one exact release commit and complete final-head rehearsal. -9. Create the real tag and qualify that exact tag. -10. Publish the private `v0.3.0` Release. -11. Let the mirror stage, verify, and publish the public source and byte-identical assets. -12. Verify anonymously, then announce. +8. Close trackers and perform #2235's final truth pass. +9. Freeze one exact release commit and complete final-head rehearsal. +10. Create the real tag. +11. Qualify the exact tag on hosted Linux/control lanes and the proven isolated Windows runner. +12. Publish the private `v0.3.0` Release. +13. Let the mirror stage, verify, and publish the public source and byte-identical assets. +14. Verify mirror downloads and GHCR anonymously, then announce. ## 8. Definition of done @@ -446,13 +484,17 @@ or a release-critical regression. - artifact storage is below the private allowance under `$0`; - self-hosted isolation, cleanup, override, offline, reset, and revocation are proven before association; +- GHCR packages are explicitly public and anonymously accessible before and after repository privacy; - the private repository and required gate pass the full hosted-only private rehearsal; - any later hybrid association passes a separate selected self-hosted workload proof; - the real `v0.3.0` tag is rebuilt and qualified after it exists; +- exact-tag hosted Linux/control evidence and isolated-Windows archive evidence bind the same tag, + commit, policy, checksums, provenance, and release contract; +- no private hosted Windows minutes are consumed unless the `$0` budget ruling is explicitly changed; - the private Release contains the exact tag-qualified assets, checksums, provenance, and body; - `Chris0Jeky/taskdeck-release` republishes corresponding source and byte-identical assets through its staged verification path; -- anonymous verification confirms source, checksums, provenance, links, and downloads; +- anonymous verification confirms source, checksums, provenance, links, GHCR access, and downloads; - Windows archive, immutable container, MCP proposal flow, upgrade, and supported backup claims are consumer-smoked; - notes and limitations describe shipped reality; @@ -469,13 +511,14 @@ or a release-critical regression. - **CI/release trust:** progressing - #3156 addresses #2508's bounded residuals and #3167 adds the landed-verifier decision core, but collector integration, clean observation/recall, release qualification, least privilege, and storage remain open. -- **Runner readiness:** pre-association engineering proof remains; hosted-only private rehearsal must - precede runner association. -- **Distribution continuity:** designed but not operational - `taskdeck-release`, its credential, - workflow, dry run, and final private-Release handoff remain. +- **Runner and Windows release readiness:** pre-association engineering proof remains; hosted-only + private rehearsal must precede association, and the exact-tag Windows workflow must be adapted and + proved on the isolated Windows runner under `$0`. +- **Distribution continuity:** designed but not operational - public GHCR must be pinned before the + visibility flip, and `taskdeck-release`, its credential, workflow, dry run, and final handoff remain. - **Human cutover:** not executed - development remains public and the final gate is not enforced. The milestone is **late-stage but not in final-tag territory**. The fastest safe route is focused release control: reconcile the retained issue set, complete Smart CI evidence, clean storage, prove -runner isolation, operationalise the mirror, rehearse private mode hosted-only, qualify the real tag, -and only then publish and announce. +runner isolation, preserve public GHCR, operationalise the mirror, rehearse private mode hosted-only, +qualify the real tag on the approved runner classes, and only then publish and announce. From bcb785ad1e57aa590643020ebcd0b8ae8483f4c9 Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:46:06 +0100 Subject: [PATCH 09/15] docs: make private rehearsal Linux-only across CI --- .../2026-09-17-v0.3-release-assessment.md | 96 +++++++++++-------- 1 file changed, 58 insertions(+), 38 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index 0d2631d744..630c8eeec4 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -22,7 +22,7 @@ packaging project: 5. operationalise the approved public mirror; 6. prove runner isolation before any GitHub association; 7. make the GHCR packages public and verify anonymous access before repository privacy; -8. execute the private cutover and hosted-only private-mode rehearsal; +8. execute the private cutover and a proven Linux-only private-mode rehearsal across every workflow; 9. associate runners only after that rehearsal, if hybrid mode is retained; 10. rehearse the final head, create the real tag, qualify hosted Linux/control work and the Windows archive on their approved runner classes, publish the private Release, mirror it publicly, verify @@ -63,7 +63,7 @@ blocker when a recorded release ruling explicitly discharges it. | Milestone closed or explicitly re-ruled | **Not met** | Reconcile the remaining open set while preserving #2315's existing residual ruling | | Launch kit drafted | **Met** | Keep copy and public links current through mirror publication | | `main` green | Must be re-proved | The final claim must bind to the frozen release head, not an older green tip | -| Private cutover with Smart CI enforced | **Not met** | Complete prerequisites, preserve public package access, flip private, register the gate, and pass private-mode rehearsal | +| Private cutover with Smart CI enforced | **Not met** | Complete prerequisites, preserve public package access, flip private, register the gate, and pass a proven Linux-only private-mode rehearsal | **Formal position: no-go for the final tag.** This does not invalidate the RC. @@ -152,7 +152,7 @@ Required outcomes: - create the real release tag, then rebuild and qualify **that exact tag**; - keep hosted Linux/control work within the settled private Actions allowance; - route the exact-tag Windows archive build through the already-proven isolated Windows runner after - the hosted-only private rehearsal and runner association, because `windows-latest` would consume + the Linux-only private rehearsal and runner association, because `windows-latest` would consume disallowed private hosted Windows minutes under the current `$0` ruling; - explicitly re-rule the budget before the tag rather than silently using hosted Windows if that runner route cannot be delivered; @@ -199,7 +199,7 @@ Release, its body, and its assets. It stages and verifies an invisible mirror dr the public commit, tag, and Release. GHCR is different: its public visibility must be established before the repository flip so inherited access cannot silently make existing images private. -### CP-7: Prove runners, preserve GHCR, cut over privately, rehearse hosted-only, then associate runners +### CP-7: Prove runners, preserve GHCR, cut over privately, rehearse Linux-only, then associate runners Issues and authority: #2328, #2337, [`V0_3_0_READINESS.md`](../releases/V0_3_0_READINESS.md), and @@ -210,12 +210,17 @@ Three boundaries must remain distinct: 1. **Before cutover, with no runner associated to the public repository**, prove isolated VMs, no host mounts, no personal credentials, one job per host, hosted override, offline behavior, workspace/Docker/cache cleanup, VM reset, and revocation. -2. **Immediately after privacy**, register the stable Smart CI gate and run the complete private-mode - release rehearsal while execution remains hosted-only. -3. **Only after that hosted-only rehearsal succeeds**, associate already-proven runners, verify labels +2. **Immediately after privacy**, register the stable Smart CI gate and run the private-mode rehearsal + through a proven Linux-only control while execution remains hosted-only. The control must suppress + every private hosted Windows job in required CI and all called or reusable workflows, including + Windows worktree-helper, backend-unit, frontend-unit, API-integration, and release jobs. It must + preserve the intended Linux, control-plane, and security evidence and fail closed if absent, + malformed, or bypassed. +3. **Only after that Linux-only rehearsal succeeds**, associate already-proven runners, verify labels and read-only token posture, enable hybrid mode if retained, and run a separate selected self-hosted-workload proof. The proven Windows runner then becomes the final exact-tag Windows - build route under the current `$0` ruling. + build route under the current `$0` ruling. Full Windows evidence may resume only on that approved + route or after an explicit budget re-ruling. Do not register the stable gate while the repository is public. A fork can publish a same-named `pull_request` check. Do not rely on inherited package access during the visibility flip. Use a short, @@ -225,20 +230,24 @@ frozen cutover window: 2. finish storage cleanup under `$0`; 3. finish public-mode release and mirror dry runs; 4. complete all pre-registration runner proof while VMs remain unassociated; -5. set every release GHCR package explicitly public and verify anonymous pull/read access; -6. change the development repository to private; -7. immediately require `Smart CI / Required Gate`, retain the security contexts, and apply the +5. prove a fail-closed Linux-only private rehearsal mode across required CI and every called or + reusable workflow; it must suppress all Windows jobs rather than only the release archive job; +6. set every release GHCR package explicitly public and verify anonymous pull/read access; +7. change the development repository to private; +8. immediately require `Smart CI / Required Gate`, retain the security contexts, and apply the evidence-based strictness and administrator decisions; -8. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and forks, +9. re-check Actions, Dependabot, Pages, packages, Releases, mirror links, collaborators, and forks, including a second anonymous GHCR access check; -9. while still hosted-only, run private-mode R0/R2/R4 PRs, a normal merge, nightly dispatch, and the - no-publish release rehearsal; that rehearsal must not dispatch the Windows release job on - `windows-latest`, because private hosted Windows is outside the settled `$0` allowance; -10. if hybrid mode remains the ruling, register only the already-proven runners, verify association, - labels, and read-only token posture, then run the selected self-hosted workload proof; -11. otherwise record hosted-only operation and explicitly re-rule the final Windows build budget/path +10. while runners remain unassociated, run private-mode R0/R2/R4 PRs, a normal merge, nightly + dispatch, and the no-publish release rehearsal through the proven Linux-only mode. Stop the + cutover if any private hosted Windows job is scheduled, if the mode can be bypassed, or if the + expected Linux/control/security evidence is missing; +11. if hybrid mode remains the ruling, register only the already-proven runners, verify association, + labels, and read-only token posture, then run the selected self-hosted workload and full Windows + evidence proofs on the approved isolated runner classes; +12. otherwise record hosted-only operation and explicitly re-rule the final Windows build budget/path before creating the release tag; -12. record evidence and resume merges. +13. record evidence and resume merges. ### CP-8: Rehearse the head, create and qualify the real tag, publish, mirror, verify, announce @@ -254,7 +263,7 @@ After all earlier gates close: 4. create the real `v0.3.0` tag on the proven commit; 5. run the exact-tag hosted Linux/control qualification within the settled budget; 6. run the exact-tag Windows archive build and Windows-specific qualification on the proven isolated, - secret-safe Windows runner associated only after the hosted-only private rehearsal; the release + secret-safe Windows runner associated only after the Linux-only private rehearsal; the release credential must never be passed to an ordinary hosted or persistent CI-04 runner, and the tag must remain held if the workflow cannot prove that boundary; 7. reconcile both runner-class evidence sets against the same tag, commit, policy, checksums, @@ -291,7 +300,8 @@ acceptable substitute for the proven isolated Windows runner. - GHCR package visibility must be explicitly public before the development repository becomes private. - The development repository becomes private before the stable Smart CI context is registered. -- The complete private-mode rehearsal runs hosted-only before any runner association. +- The pre-association private-mode rehearsal is Linux-only across every workflow and fails closed if + any private hosted Windows job can run or the expected evidence is absent. - The final exact-tag Windows archive is built on the proven isolated Windows runner under the current budget ruling, unless the maintainer explicitly re-rules the budget first. - The private Release is published before the public mirror republishes it. @@ -361,9 +371,11 @@ access. Verify again after the flip. #### H9: Private cutover - #2337 -Freeze merges, capture settings, make GHCR public, flip visibility, register the gate only after -privacy, apply evidence-based branch-protection decisions, run the hosted-only private rehearsal, and -only then associate already-proven runners if hybrid mode remains desired. +Freeze merges, capture settings, prove the fail-closed Linux-only rehearsal mode across every required +and called workflow, make GHCR public, flip visibility, register the gate only after privacy, apply +evidence-based branch-protection decisions, run the Linux-only private rehearsal while all runners +remain unassociated, and stop if any hosted Windows job can run. Only then associate already-proven +runners if hybrid mode remains desired. #### H10: Final release publication @@ -381,14 +393,14 @@ category. | #2324 | CLOSE LAST | Close after child evidence and the cutover ledger | | #2326 | SHIP | Clean planner evidence and accepted recall report | | #2327 | SHIP | Qualify #3167, add authoritative collection/workflow integration, prove gate and landed paths | -| #2328 | SHIP + HUMAN GATE | Prove isolation before cutover; associate after hosted-only rehearsal; use proven Windows runner for exact-tag Windows qualification | +| #2328 | SHIP + HUMAN GATE | Prove isolation before cutover; pass Linux-only all-workflow rehearsal; associate afterward; use proven Windows runner for exact-tag Windows qualification | | #2329 | SHIP | Ownership manifest complete and recall shows safe selection | | #2331 | SHIP | Bounded Windows contract and weekly full coverage before reduction | | #2332 | SHIP | One semantic frontend lane, journey selection, risk-gated containers | | #2333 | SHIP + HUMAN GATE | Storage below allowance under `$0`, with ledger evidence | | #2334 | SHIP | Accepted nightly observation, weekly sweep, real-tag qualification split across approved hosted Linux/control and isolated Windows runner paths | | #2335 | SHIP | Re-qualify #2838, obtain J.3 maintainer gate, record CodeQL ruling | -| #2337 | HUMAN GATE | Preserve public GHCR, execute private cutover, and complete hosted-only private-mode rehearsal | +| #2337 | HUMAN GATE | Preserve public GHCR, execute private cutover, and complete fail-closed Linux-only private-mode rehearsal across every workflow | | #2378 | SHIP OR CLOSE ON EVIDENCE | Remove Windows timeout class or prove a superseding contract | | #2439 | SHIP + HUMAN GATE | Create `taskdeck-release`, preserve public GHCR, rehearse workflow, complete private-Release handoff and link cutover | | #2508 | SHIP RESIDUALS | Core binding shipped; review and qualify draft #3156 | @@ -456,9 +468,11 @@ or a release-critical regression. 6. Complete the public hosted-only cutover rehearsal. 7. Prove all runner isolation, cleanup, offline, override, reset, and revocation contracts without associating the runners to GitHub. -8. Prepare the GHCR visibility mutation and anonymous verification commands for the frozen cutover. +8. Implement and prove the fail-closed Linux-only private rehearsal control across required CI and + all called or reusable workflows; demonstrate that no Windows lane can be scheduled through it. +9. Prepare the GHCR visibility mutation and anonymous verification commands for the frozen cutover. -### Wave C: preserve public distribution, cut over, rehearse hosted-only, tag, release privately, mirror, announce +### Wave C: preserve public distribution, cut over, rehearse Linux-only, tag, release privately, mirror, announce 1. Pause merges and capture branch-protection, Actions, package, and external-surface settings. 2. Set release GHCR packages public and prove anonymous access. @@ -466,10 +480,12 @@ or a release-critical regression. 4. Register the required gate and retained security checks; apply evidence-based strictness and administrator decisions. 5. Re-check private repository settings, public GHCR access, and other external surfaces. -6. Run the permitted private-mode matrix and no-publish release rehearsal while hosted-only; omit any - Windows release job on `windows-latest` and defer that archive path to the proven isolated runner. +6. With all self-hosted runners still unassociated, run private-mode R0/R2/R4 PRs, a normal merge, + nightly dispatch, and the no-publish release rehearsal through the proven Linux-only mode. The + control must suppress every Windows job in required CI and every called or reusable workflow, + preserve Linux/control/security evidence, and stop the cutover if absent or bypassable. 7. Associate already-proven runners only afterward, if hybrid mode remains desired, and run the - separate selected self-hosted workload proof. + separate selected self-hosted workload and full Windows evidence proofs. 8. Close trackers and perform #2235's final truth pass. 9. Freeze one exact release commit and complete final-head rehearsal. 10. Prove the tag-triggered release workflow is in draft-only publication-hold mode, then create the @@ -493,8 +509,11 @@ or a release-critical regression. - self-hosted isolation, cleanup, override, offline, reset, and revocation are proven before association; - GHCR packages are explicitly public and anonymously accessible before and after repository privacy; -- the private repository and required gate pass the full hosted-only private rehearsal; -- any later hybrid association passes a separate selected self-hosted workload proof; +- the private repository and required gate pass the fail-closed Linux-only rehearsal across required + CI and every called or reusable workflow, with all private hosted Windows jobs suppressed and the + intended Linux/control/security evidence preserved; +- any later hybrid association passes a separate selected self-hosted workload and full Windows + evidence proof; - the real `v0.3.0` tag is rebuilt and qualified after it exists; - exact-tag hosted Linux/control evidence and isolated-Windows archive evidence bind the same tag, commit, policy, checksums, provenance, and release contract; @@ -522,14 +541,15 @@ or a release-critical regression. - **CI/release trust:** progressing - #3156 addresses #2508's bounded residuals and #3167 adds the landed-verifier decision core, but collector integration, clean observation/recall, release qualification, least privilege, and storage remain open. -- **Runner and Windows release readiness:** pre-association engineering proof remains; hosted-only - private rehearsal must precede association, and the exact-tag Windows workflow must be adapted and - proved on the isolated Windows runner under `$0`. +- **Runner and Windows release readiness:** pre-association engineering proof and an all-workflow + Linux-only private rehearsal control remain; only after that rehearsal may isolated runners be + associated for the exact-tag Windows path under `$0`. - **Distribution continuity:** designed but not operational - public GHCR must be pinned before the visibility flip, and `taskdeck-release`, its credential, workflow, dry run, and final handoff remain. - **Human cutover:** not executed - development remains public and the final gate is not enforced. The milestone is **late-stage but not in final-tag territory**. The fastest safe route is focused release control: reconcile the retained issue set, complete Smart CI evidence, clean storage, prove -runner isolation, preserve public GHCR, operationalise the mirror, rehearse private mode hosted-only, -qualify the real tag on the approved runner classes, and only then publish and announce. +runner isolation and the all-workflow Linux-only rehearsal, preserve public GHCR, operationalise the +mirror, cut over privately, qualify the real tag on the approved runner classes, and only then publish +and announce. From da59e810f999a4f75fe9fb504fb9557347dd35ea Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:51:40 +0100 Subject: [PATCH 10/15] docs: reconcile private cutover execution order --- docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md | 306 ++++++++++++++++------ 1 file changed, 221 insertions(+), 85 deletions(-) diff --git a/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md b/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md index df4861aa30..91d25d50e3 100644 --- a/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md +++ b/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md @@ -1,90 +1,226 @@ # Private-repository cutover checklist (personal GitHub Pro account) -Last Updated: 2026-09-03 · Decision: ADR-0066 · Executable copy: CI-13 `#2337` (record evidence there) · Human actions: `OUTSTANDING_TASKS.md` §J - -The repository goes **private for the v0.3.0 release**. Everything below is proven while the -repository is still public and hosted-only; **no self-hosted runner is attached before the -visibility change**. Agents prepare, rehearse and verify; the maintainer performs the settings, -billing, visibility and runner-registration actions. - -## A. Decisions (maintainer) - -- [x] Confirm the GitHub plan is Pro and record the allowance in force (3,000 minutes/month, 1 GB storage as of 2026-08-30). *Confirmed by the maintainer 2026-09-03 (SC-3 re-ruling): the account is GitHub Pro and the included 3,000 minutes/month are the CI budget.* -- [ ] Verify at step J.7 that the Actions spending limit (Billing → Spending limits) reads **$0** and record it on `#2337`. *This box replaced "set a spend ceiling and alert" on 2026-09-03 when SC-3 was re-ruled (superseding the $10/month packet value): **deferred — no paid overage, no alert threshold.** Hosted Actions spend only the included 3,000 minutes/month and only on **Linux** jobs; Windows (x2) and any macOS (x10) legs run locally (the laptop runner via CI-04, or agent-run proving checks) or carry a local fallback, never hosted overage. GitHub's default $0 spending limit is the effective hard ceiling, which is what the J.7 read-back confirms.* -- [ ] Verify how the Codex GitHub App and Copilot code review are billed on a private repository (Copilot review consumes Actions minutes; do not assume the public-repo model); set the review cadence to after-CI-stabilises. -- [ ] Ownership: stay personal (ADR-0066 ruling 1) — the organization boundary is CI-14 with its triggers. *Confirmed 2026-09-03 with the private-Pro approval-boundary amendment (ADR-0066).* -- [ ] Initial execution mode: `hosted` (ruling 4); `hybrid` only after CI-04 is registered and proven. -- [x] Laptop as a real Windows runner, or hosted Windows as the initial fallback. *Ruled 2026-09-03 (SC-3 re-ruling): the laptop is the Windows runner and the fallback is local execution, not hosted Windows. Hosted Windows legs run only while the repository is still public and free; from the visibility change onward Windows evidence is local only — the laptop runner once CI-04 `#2328` registers it (SC-7), agent-run proving checks on this box until then. CI-07 `#2331` sizes the Windows contract for local execution, not for a hosted allowance.* -- [ ] Release/signing boundary stays `#2149`'s protected context, separate from ordinary CI. -- [ ] Public documentation/demo/site: GitHub Pages (`pages-frontend.yml`) keeps publishing from a private repo on Pro and the site stays public — keep, move, or retire; the launch-kit links (`#2242`) and any `awesome-selfhosted` reference get the same decision. *Ruled 2026-09-03 (SC-8): **private development repository + public release/source mirror** — Pages keeps publishing; Releases, checksums/provenance and the GPL source publish through the mirror (CI-16 `#2439`); launch-kit and `awesome-selfhosted` wording point at the mirror.* - -## B. Measure before changing (CI-01 `#2325`, CI-09 `#2333`) - -- [ ] `docs/ci/CI_BASELINE.md` committed with the 30-day window (runs, critical path, allowance minutes per run, storage). -- [ ] Unexpired artifact bytes and cache bytes recorded; retention classes applied; the one-time cleanup dry-run prepared (deletion itself is a maintainer-authorized action). - -## C. Planner and gate (CI-02 `#2326`, CI-03 `#2327`) - -- [ ] Versioned policy + schemas merged; planner fixtures green; fail-closed behaviour proven (unmapped path, planner error, control-path change). -- [ ] Shadow planner running on every PR; recall report over ≥20 PRs shows the plan would have selected every lane that actually failed. -- [ ] `Smart CI / Required Gate` in observation mode with zero false reds over ≥20 PRs; receipts bound to the exact SHA, merge tree and policy digest. -- [ ] Landed verifier proven: normal merge → bounded path; direct-push simulation → full escalation; base moved → re-qualification. -- [ ] **Maintainer:** register the gate as required; keep the three security contexts; decide on the observation evidence — not in advance (SC-4 ruling 2026-09-03) — whether to set `strict: true` and `enforce_admins` or to document break-glass. (CI-03 supplies the exact `gh api` commands.) - -## D. Event topology (CI-03) - -- [ ] PR workflow tests the merge ref and carries the substantive qualification; superseded runs cancel. -- [ ] Drafts run only the light plan unless R3/R4. -- [ ] Full `push: main` re-qualification replaced by the landed verifier. -- [ ] `merge_group` is not required for anything (inert trigger is fine). -- [ ] Auto-merge enabled only after the gate and branch-current are proven (maintainer setting). +Last Updated: 2026-09-18 · Decision: ADR-0066 · Executable issue: CI-13 `#2337` (record evidence there) · Human actions: `OUTSTANDING_TASKS.md` §J + +Taskdeck's development repository goes **private for the v0.3.0 release**. The cutover preserves a +public downloadable distribution while moving development, issues, CI, and the control plane behind +the private boundary. + +Agents prepare implementation, dry runs, and evidence. The maintainer alone performs billing, +visibility, branch-protection, package-visibility, credential, publication, and runner-association +actions. Never infer a human action from repository state or an issue comment. + +## Non-negotiable ordering and budget rules + +- GitHub Actions has a **$0 hard ceiling** with stop-on-limit enabled. +- After repository privacy, hosted execution is Linux/control/security only. No private hosted Windows + or macOS job may be scheduled without an explicit budget re-ruling recorded on `#2337`. +- Release GHCR packages become explicitly public and are anonymously verified **before** repository + privacy, then verified again afterward. +- `sha_pinning_required: true` is already enabled and verified. It is not a cutover mutation. +- `Smart CI / Required Gate` becomes required **only after** the repository is private. Registering it + while public leaves a spoofable same-name check interval for forks. +- Branch-current strictness, administrator enforcement, and break-glass are chosen from completed + observation evidence, not pre-ruled here. +- Runner isolation, cleanup, offline, override, reset, and revocation are proved before any GitHub + association. +- Immediately after privacy and before runner association, private-mode qualification runs through + CI-17 `#3170`'s trusted, fail-closed **Linux-only mode across every required, called, and reusable + workflow**. +- Only after that Linux-only rehearsal succeeds may already-proven isolated runners be associated. +- The final exact-tag Windows archive and Windows-specific qualification use a secret-safe isolated + release runner. A repository or release credential must never reach an ordinary hosted or + persistent CI-04 runner. +- The qualified private Release is published before `Chris0Jeky/taskdeck-release` consumes and + republishes it. + +## A. Settled decisions and remaining maintainer choices + +- [x] Personal GitHub Pro account confirmed in the existing ruling record. +- [x] Actions posture ruled to a $0 hard ceiling with stop-on-limit enabled. +- [x] Development repository ruled private for v0.3.0. +- [x] Public source/release mirror ruled as `Chris0Jeky/taskdeck-release`. +- [x] GitHub Pages remains public; public install, licensing, launch-kit, support, security, and + `awesome-selfhosted` references point to the approved public surfaces. +- [x] Release GHCR packages remain public across the repository-visibility change. +- [x] Laptop/isolated Windows execution is the Windows path after privacy; private hosted Windows is + not the fallback under the current budget. +- [ ] Verify how Codex GitHub App and Copilot review are billed on a private repository; set review + cadence to after CI stabilises rather than after every micro-push. +- [ ] Choose branch-current strictness, administrator enforcement, and the exact break-glass procedure + after the Smart CI observation window is accepted. +- [ ] Confirm whether post-rehearsal operation is `hybrid` or hosted-only. Hosted-only requires an + explicit final-Windows-path or budget re-ruling before the release tag. +- [ ] Keep the release/signing boundary protected and separate from ordinary CI. + +## B. Measure and clean before changing visibility (CI-01 `#2325`, CI-09 `#2333`) + +- [ ] `docs/ci/CI_BASELINE.md` is current for the accepted measurement window. +- [ ] Unexpired artifact bytes and cache bytes are recorded with retention classes. +- [ ] A fresh identity-bound cleanup dry run names the exact deletion set. +- [ ] Release, provenance, and required audit evidence are explicitly preserved. +- [ ] The maintainer authorizes only the current identity-bound set. +- [ ] The deletion ledger records requested, deleted, skipped, failed, and not-found objects. +- [ ] Post-cleanup artifacts and caches are remeasured below the private allowance under $0. + +## C. Planner, required gate, and landed verification (CI-02 `#2326`, CI-03 `#2327`) + +- [ ] Versioned policy and schemas are merged; planner fixtures and fail-closed cases are green. +- [ ] Shadow planner runs on every PR. +- [ ] The accepted window contains at least 20 usable merged PRs after the last relevant planner fix. +- [ ] Observation evidence shows zero false reds and complete recall for every enabled lane family. +- [ ] Receipts bind the exact head, merge tree, base, policy/config digest, and selected work. +- [ ] Authoritative landed evidence collection and workflow integration are complete. +- [ ] Normal merge takes the bounded path; direct push, missing/ambiguous evidence, moved base, or + invalid receipt forces full escalation. +- [ ] Exact commands for post-privacy required-check registration and rollback are prepared. +- [ ] The maintainer's strict/admin/break-glass choice is recorded, but the gate remains unregistered + until section K changes repository visibility to private. + +## D. Event topology + +- [ ] PR qualification tests the intended merge identity and superseded runs cancel safely. +- [ ] Drafts run only the light plan unless risk classification requires R3/R4. +- [ ] Main uses landed verification rather than an unconditional duplicate full suite. +- [ ] `merge_group` is either deliberately supported or inert and non-required. +- [ ] Auto-merge remains disabled until the final gate and branch-current policy are proven. ## E. Test right-sizing (CI-05 `#2329`, CI-07 `#2331`, CI-08 `#2332`) -- [ ] Linux semantic baseline defined in the ownership map. -- [ ] Windows compatibility contract defined and green; the full Windows suite retained weekly/release during the evidence period. -- [ ] Frontend lint/type/build/coverage once per PR on Linux; the Windows leg narrowed to launcher/platform. -- [ ] E2E selection by journey; container build by container/runtime/deploy risk; a manual full hosted qualification remains available. -- [ ] `ci-extended`'s `dependency-review` job removed or gated — `actions/dependency-review-action` and CodeQL need GitHub Advanced Security on a private repository; the in-repo dependency signals and Semgrep are the gates (CI-11). - -## F. Runners (CI-04 `#2328`) — prepared before, registered after - -- [ ] Linux runner is an isolated VM; Windows runner is an isolated VM or a dedicated low-privilege account. -- [ ] No host mounts, clipboard, SSH agent, browser profile, personal credentials; no repository/environment/release secrets on ordinary runners; one job per host; labels match the policy. -- [ ] Hosted override (`ci:hosted`, `CI_EXECUTION_MODE=hosted`) documented and tested; offline-runner behaviour tested (gate pending, never green). -- [ ] Workspace/temp/Docker/cache cleanup tested; VM reset/rebuild and incident revocation documented. - -## G. Supply chain (CI-11 `#2335`) - -- [ ] Every external `uses:` pinned to a full commit SHA with a version comment; the inventory guard is green. -- [ ] Default workflow token read-only (already); every elevated-permission job reviewed; `persist-credentials: false` where no push is needed. -- [ ] No `pull_request_target` path checks out or executes head code (contract test). -- [ ] CI-control changes run hosted-only (fixture). -- [ ] **Maintainer:** flip `sha_pinning_required` on after the migration. - -## H. Nightly and release (CI-10 `#2334` — v0.3 since 2026-09-03: Q1 on `#2337` ruled **A**, the whole section is a cutover prerequisite and `#2334` moved from v0.4) - -- [ ] One coordinator owns nightly/quality; a no-change night exits through the honest green receipt; the weekly full sweep exists. -- [ ] Mutation remains manual (ADR-0052). -- [ ] Release rebuilds from the exact tag in a clean hosted context; SBOM/provenance and digest verification release-owned; a release dry-run succeeds with ordinary self-hosted runners offline. - -## I. Rehearsal while still public (hosted-only, no runner attached) - -- [ ] R0 docs-only PR · R2 ordinary backend/frontend PR · R3 migration/auth/executor/MCP PR · R4 workflow/policy PR (hosted-only) · cancelled/superseded PR · normal merge → tiny main verifier · direct-push simulation → full escalation · nightly no-change skip · weekly/deep full run · release dry-run (no publish). - -## J. Manual private cutover (maintainer, in order) - -1. Pause merges briefly. -2. Capture current required-check and Actions settings (`gh api repos/Chris0Jeky/Taskdeck/branches/main/protection`, `…/actions/permissions`, `…/actions/permissions/workflow`). -3. Register the gate and apply the SC-4 evidence-based `strict` / `enforce_admins` decision (C); flip `sha_pinning_required` (G). -4. Verify public assets that must remain public have a separate home (A). -5. **Change repository visibility to private.** -6. Re-check Actions permissions, fork-PR approval policy, Dependabot, Pages/package/release visibility, runner association, collaborator list. -7. Run R0, R2, R4, a merge (main verifier), a nightly dispatch, and a no-publish release rehearsal in private mode; verify hosted-minute accounting against the 3,000-minute Linux-only allowance; read Billing → Spending limits back, confirm it shows **$0**, and record it on `#2337` (SC-3, checklist A). -8. Register the isolated runners (F); set `CI_EXECUTION_MODE=hybrid`; verify self-hosted jobs consume no hosted minutes and expose no secrets. -9. Resume merges; record post-cutover evidence on CI-00 `#2324`. - -## K. Rollback - -- Previous workflow files remain reachable by tag/commit; the manual hosted full-qualification workflow stays available; runners can be detached in one step; the pre-cutover branch-protection contexts are in the step-2 capture. -- Do not flip visibility back merely to regain free minutes before understanding a failure — use the hosted override or the rollback workflow first. +- [ ] Linux semantic baseline and ownership mapping are complete. +- [ ] Windows compatibility contract covers platform-sensitive behaviour and historical Windows-only + regressions. +- [ ] Weekly and release full-Windows coverage exists before ordinary PR Windows work is narrowed. +- [ ] Frontend semantic work runs once per ordinary PR on Linux; Windows retains only the approved + platform contract outside full qualification. +- [ ] E2E is journey-aware; containers are risk-gated; manual full qualification remains available. +- [ ] Private-repository-incompatible jobs such as dependency-review/CodeQL are either moved to an + approved hosted control lane or have an explicit recorded v0.3 posture. + +## F. Runners (CI-04 `#2328`) - prove before, associate after + +- [ ] Linux runner is an isolated VM; Windows runner is an isolated VM or dedicated low-privilege + account. The release-secret runner boundary is separately identified. +- [ ] No host mounts, clipboard, SSH agent, browser profile, or personal credentials are present. +- [ ] Ordinary runners receive no repository, environment, or release secrets; one job runs per host; + labels match policy. +- [ ] Hosted override and offline-runner behaviour are tested. Offline means pending/fail-closed, + never false green. +- [ ] Workspace, temp, Docker, and cache cleanup are tested. +- [ ] VM reset/rebuild, detachment, token revocation, and incident response are documented and proven. +- [ ] All proof above is complete while runners remain unassociated with the repository. + +## G. Supply chain and least privilege (CI-11 `#2335`) + +- [x] Every external `uses:` is pinned to a full commit SHA and the pin inventory guard is green. +- [x] `sha_pinning_required: true` is enabled and read back from GitHub. +- [ ] Default workflow tokens are read-only; every elevated job is justified and scoped. +- [ ] `persist-credentials: false` is present wherever a checkout does not need push credentials. +- [ ] No `pull_request_target` path checks out or executes untrusted head code. +- [ ] CI-control changes have a hosted-only trust fixture. +- [ ] PR `#2838` is current-head qualified and passes the ADR-0066/J.3 maintainer gate. +- [ ] CodeQL is re-enabled in an approved lane or the current scanner posture and residual are recorded. + +## H. Nightly and release qualification (CI-10 `#2334`) + +- [ ] One coordinator owns nightly/quality and emits an honest no-change receipt. +- [ ] The weekly full sweep covers Linux, Windows, browsers, security, containers, and performance. +- [ ] Mutation remains manual unless ADR-0052 is explicitly amended. +- [ ] Final-head no-publish rehearsal uses CI-17's trusted Linux-only mode while self-hosted runners are + offline. It schedules no private hosted Windows job. +- [ ] A draft-only publication hold prevents a real-tag workflow from publishing before post-tag + evidence is accepted. +- [ ] The real release tag is created only after final-head evidence and the hold are proven. +- [ ] Exact-tag Linux/control qualification runs on the approved hosted lanes. +- [ ] Exact-tag Windows archive and Windows-specific qualification run on the approved isolated, + secret-safe release runner after association. +- [ ] Linux/control and Windows evidence bind the same tag, commit, policy/config, checksums, + provenance, and release contract. +- [ ] SBOM, provenance, digest verification, migration/upgrade, install, backup/restore, MCP proposal + flow, and consumer smoke evidence are release-owned. + +## I. Public-mode rehearsal before cutover (hosted-only, no runner associated) + +- [ ] R0 docs-only PR. +- [ ] R2 ordinary backend/frontend PR. +- [ ] R3 migration/auth/executor/MCP PR. +- [ ] R4 workflow/policy PR through hosted control lanes. +- [ ] Cancelled and superseded PR behaviour. +- [ ] Normal merge to bounded landed verifier. +- [ ] Direct-push simulation to full escalation. +- [ ] Nightly no-change and weekly/deep run. +- [ ] Release dry run with no publication. +- [ ] Mirror dry run with no public mutation and byte-identity verification. +- [ ] CI-17 public-mode proof shows its trusted Linux-only selection cannot be set or bypassed by + untrusted PR-head code. + +## J. Public distribution preparation (CI-16 `#2439`) + +- [ ] Create `Chris0Jeky/taskdeck-release` and disable Actions in the mirror. +- [ ] Create a fine-grained publishing credential scoped only to the mirror contents boundary. Keep it + out of issues, logs, and repository files. +- [ ] The private-side mirror workflow uses an allowlisted snapshot, denies nested agent instruction + files, fails closed on secret/token shapes, and verifies every copied asset. +- [ ] Public README, licensing, install, support, security, telemetry, launch-kit, and site links target + their post-cutover homes. +- [ ] Set every release GHCR package explicitly public. +- [ ] Verify anonymous GHCR pull/read access before the repository visibility change. + +## K. Manual private cutover (maintainer, exact order) + +1. Pause merges and select a short frozen cutover window. +2. Capture current branch protection/rulesets, required checks, Actions permissions, package + visibility, Pages, Releases, collaborators, forks, external links, and rollback values. +3. Review and authorize only the fresh identity-bound storage deletion set from section B; execute it + and verify the post-cleanup measurement. +4. Verify the mirror repository, disabled mirror Actions, and narrowly scoped private-side credential. +5. Re-check that release GHCR packages are public and anonymously readable. +6. Confirm GitHub Pro and the settled $0 stop-on-limit posture. +7. **Change repository visibility to private.** Agents never perform this action. +8. Only now register `Smart CI / Required Gate`, retain the security contexts, and apply the recorded + strict/admin/break-glass policy. +9. Re-check Actions permissions, fork approval, Dependabot, Pages, packages, Releases, mirror links, + collaborators, forks, and anonymous GHCR access. +10. Keep every self-hosted runner unassociated. Run private-mode R0/R2/R4 PRs, a normal merge, a + nightly dispatch, and a no-publish release rehearsal through CI-17's trusted Linux-only mode. + Abort if any private hosted Windows job is scheduled, the mode is absent/bypassable, or expected + Linux/control/security evidence is missing. +11. Only after step 10 succeeds, associate already-proven runners if hybrid mode remains desired. + Verify labels, read-only token posture, no secret exposure, selected self-hosted workload evidence, + and full Windows evidence on the approved runner classes. +12. If hybrid mode is not retained, record hosted-only operation and explicitly re-rule the final + Windows build path or budget before creating the release tag. +13. Record the complete evidence ledger on CI-00 `#2324`; resume merges only after every assertion is + reconciled. + +## L. Final tag, private Release, mirror, and announcement + +1. Freeze one exact `main` commit and stop feature merges. +2. Update release notes, upgrade notes, limitations, checksums/provenance expectations, and public + links. +3. Run final-head checks and the CI-17 Linux-only no-publish rehearsal with self-hosted runners + offline. Do not create the tag if any private hosted Windows job is scheduled. +4. Activate and verify the draft-only publication hold. +5. Create the real `v0.3.0` tag on the proven commit. +6. Qualify that exact tag on hosted Linux/control lanes and the secret-safe isolated Windows release + runner. +7. Reconcile both runner-class evidence sets against the same immutable identity. +8. Consumer-smoke the produced archive/container and claimed install, update, MCP, and backup paths. +9. Publish the private `v0.3.0` Release with the exact qualified assets, checksums, provenance, and + body. +10. Let the private-side workflow stage and verify the mirror source and byte-identical assets. +11. Publish the mirror commit, tag, and public Release only after staged verification succeeds. +12. Verify source identity, downloads, checksums, provenance, links, and GHCR access anonymously. +13. Announce only after all public identities and access checks match. + +## M. Rollback and abort + +- Previous workflow/config files remain reachable by immutable commit; all setting values are + captured before mutation. +- The hosted control override remains available; associated runners can be detached and revoked in + one step. +- Do not flip public merely to regain free minutes. Diagnose against captured state and use the + documented override or rollback path. +- A failed, ambiguous, missing, or bypassable assertion stops the cutover. +- Do not create the release tag while the publication hold, Linux-only rehearsal, runner boundary, + public GHCR continuity, mirror handoff, storage posture, or exact-head evidence is unproved. From 3fb2cf488ab09d1fba2f98d2089ef6454d9f7cbc Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:52:55 +0100 Subject: [PATCH 11/15] docs: keep final-head rehearsal Linux-only --- docs/analysis/2026-09-17-v0.3-release-assessment.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index 630c8eeec4..fcf4f24cd5 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -148,7 +148,8 @@ Required outcomes: - accept the nightly observation window before selective execution is enabled; - prove the weekly full sweep across Linux, Windows, browsers, security, containers, and performance; - keep mutation manual unless ADR-0052 is deliberately amended; -- rehearse from the frozen final head without publishing, with self-hosted runners offline; +- rehearse from the frozen final head without publishing through the proven Linux-only mode, with + self-hosted runners offline and no private hosted Windows job scheduled; - create the real release tag, then rebuild and qualify **that exact tag**; - keep hosted Linux/control work within the settled private Actions allowance; - route the exact-tag Windows archive build through the already-proven isolated Windows runner after @@ -255,8 +256,9 @@ After all earlier gates close: 1. select one exact `main` commit and stop feature merges; 2. update release notes, upgrade notes, limitations, and public links; -3. run final-head checks and a no-publish rehearsal against that frozen head while self-hosted runners - remain offline; +3. run final-head checks and a no-publish rehearsal against that frozen head through the proven + Linux-only control while self-hosted runners remain offline; abort if any private hosted Windows + job is scheduled; before creating the real tag, activate and verify an explicit draft-only publication hold for the tag-triggered release workflow; if the current workflow would publish a Release automatically, do not create the tag until that hold is proven; @@ -487,7 +489,8 @@ or a release-critical regression. 7. Associate already-proven runners only afterward, if hybrid mode remains desired, and run the separate selected self-hosted workload and full Windows evidence proofs. 8. Close trackers and perform #2235's final truth pass. -9. Freeze one exact release commit and complete final-head rehearsal. +9. Freeze one exact release commit and complete the final-head rehearsal through the proven + Linux-only mode with all self-hosted runners offline. 10. Prove the tag-triggered release workflow is in draft-only publication-hold mode, then create the real tag. 11. Qualify the exact tag on hosted Linux/control lanes and the proven isolated Windows runner. @@ -512,6 +515,8 @@ or a release-critical regression. - the private repository and required gate pass the fail-closed Linux-only rehearsal across required CI and every called or reusable workflow, with all private hosted Windows jobs suppressed and the intended Linux/control/security evidence preserved; +- the frozen final-head no-publish rehearsal also uses the proven Linux-only mode, with self-hosted + runners offline and no private hosted Windows job scheduled; - any later hybrid association passes a separate selected self-hosted workload and full Windows evidence proof; - the real `v0.3.0` tag is rebuilt and qualified after it exists; From 79e09b210e1b66234a87d7a022bc45c48bd2ffeb Mon Sep 17 00:00:00 2001 From: Cristian Tcaci <59696583+Chris0Jeky@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:58:02 +0100 Subject: [PATCH 12/15] docs: remove release cutover prerequisite cycle --- docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md | 30 +++++++++++++---------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md b/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md index 91d25d50e3..c5f6e26f85 100644 --- a/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md +++ b/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md @@ -121,23 +121,27 @@ actions. Never infer a human action from repository state or an issue comment. - [ ] PR `#2838` is current-head qualified and passes the ADR-0066/J.3 maintainer gate. - [ ] CodeQL is re-enabled in an approved lane or the current scanner posture and residual are recorded. -## H. Nightly and release qualification (CI-10 `#2334`) +## H. Pre-cutover nightly and release contract (CI-10 `#2334`) + +Sections A-I are prerequisites for the visibility change. This section proves that the release +mechanisms and evidence contract are ready; it does **not** require the real tag, post-cutover runner +association, exact-tag qualification, or release publication. Those actions occur only in section L. - [ ] One coordinator owns nightly/quality and emits an honest no-change receipt. -- [ ] The weekly full sweep covers Linux, Windows, browsers, security, containers, and performance. +- [ ] The weekly full-sweep contract covers Linux, Windows, browsers, security, containers, and + performance, and has public-mode rehearsal evidence. - [ ] Mutation remains manual unless ADR-0052 is explicitly amended. -- [ ] Final-head no-publish rehearsal uses CI-17's trusted Linux-only mode while self-hosted runners are - offline. It schedules no private hosted Windows job. -- [ ] A draft-only publication hold prevents a real-tag workflow from publishing before post-tag - evidence is accepted. -- [ ] The real release tag is created only after final-head evidence and the hold are proven. -- [ ] Exact-tag Linux/control qualification runs on the approved hosted lanes. -- [ ] Exact-tag Windows archive and Windows-specific qualification run on the approved isolated, - secret-safe release runner after association. -- [ ] Linux/control and Windows evidence bind the same tag, commit, policy/config, checksums, - provenance, and release contract. +- [ ] CI-17's trusted Linux-only selection and no-publish rehearsal path are implemented and proven in + a public-mode dry run without allowing untrusted PR-head code to select or bypass the mode. +- [ ] A draft-only publication-hold mechanism is implemented and dry-run so a later real-tag workflow + cannot publish before post-tag evidence is accepted. The hold is activated and re-verified in L.4. +- [ ] The workflow contract can route later exact-tag Linux/control qualification to approved hosted + lanes and Windows archive qualification to the isolated secret-safe release runner, and fails + closed on the wrong runner class or identity. +- [ ] The release evidence contract binds one tag, commit, policy/config identity, checksums, + provenance, and produced assets across runner classes. - [ ] SBOM, provenance, digest verification, migration/upgrade, install, backup/restore, MCP proposal - flow, and consumer smoke evidence are release-owned. + flow, and consumer-smoke evidence have named producers and release-owned acceptance criteria. ## I. Public-mode rehearsal before cutover (hosted-only, no runner associated) From c7180844e25eb9dd352a6167d9d0a8a3dae131de Mon Sep 17 00:00:00 2001 From: Chris0Jeky Date: Fri, 18 Sep 2026 01:08:24 +0100 Subject: [PATCH 13/15] docs: include mirror preparation in cutover gate --- OUTSTANDING_TASKS.md | 2 +- docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md | 4 +++- docs/releases/V0_3_0_READINESS.md | 5 +++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/OUTSTANDING_TASKS.md b/OUTSTANDING_TASKS.md index d424a6f9ca..6ea70fbcee 100644 --- a/OUTSTANDING_TASKS.md +++ b/OUTSTANDING_TASKS.md @@ -164,7 +164,7 @@ The maintainer directed (2026-08-30) that the repository goes **private for the - [x] **SC-3 — plan confirmation and spend ceiling (`#2337` A/B1).** Confirm the account is GitHub Pro, set a monthly Actions spend ceiling + alert, and verify how the Codex GitHub App and Copilot code review are billed on a private repository. *(**Re-ruled 2026-09-03 by the maintainer in-session, superseding the packet's $10/month value: SC-3 is deferred — no paid overage ceiling is set.** The GitHub Pro plan is **confirmed** and its included 3,000 minutes/month are the whole hosted budget, spent on **Linux** jobs only; Windows (x2) and any macOS (x10) legs run locally — the laptop runner once CI-04 `#2328` registers it, agent-run proving checks until then — or carry a local fallback, never hosted overage. GitHub's default $0 spending limit is the effective hard ceiling. **Still the maintainer's:** read the Billing → Spending limits page at cutover step J.7 to confirm the limit is $0 and record it on `#2337`; verify Codex/Copilot billing on a private repository. Recorded on `#2337`, `#2324`, `#2328`, `#2331`, checklist A and ADR-0066.)* *(**Ticked 2026-09-06, 2026-09-06 guided-walkthrough reply q-5 = A, values supplied in-session (`map:v1:e5beef60c3235e76726721636988f12e53ad55368f875b9a64c8ce71ae621b93`):** Billing → Budgets shows a **$0** Actions budget; a GitHub budget caps spend only when its "stop usage when limit is reached" toggle is on, and that toggle was not read in the first pass; **confirmed on in the second pass (2026-09-06, q-22 = A, `map:v1:cfe8e597c6d5bbb5fac7db58f3e09fa8b62dab8f624eb25f77af37ab971c0451`), so the $0 budget is a hard ceiling** and the J.7 residual is closed; the Codex connector bills through the maintainer's OpenAI subscription, its review allowance refreshes on that subscription's daily cycle and it reaches private owned repositories, so no GitHub-side billing applies; Copilot is the Student offer (134/200 included AI credits at read time, additional usage not enabled, $0 budget) and is not relied on. Recorded on `#2337`.)* - [ ] **SC-4 — register the stable gate (`#2327`, `#2337` B3).** After >=20 PRs of observation without a false red, add `Smart CI / Required Gate` to the required checks, keep the three security contexts, and decide — on the recall evidence, not in advance — whether to set `strict: true` and `enforce_admins` or to document a break-glass (SC-4 ruling 2026-09-03: no pre-ruling). CI-03 supplies the exact `gh api` commands; agents do not change branch protection. *(**~~Precondition measured green 2026-09-06 — the observation window is complete and this is now actionable.~~ SUPERSEDED the same evening — read the correction two annotations below before acting on anything in this one.** Since `#2506` merged (2026-09-06T02:50:09Z) the shadow lane ran **72 times across 43 distinct branches**: 66 `success`, 5 `cancelled` (concurrency supersedes, each replaced by a later successful run on the same branch — the case PR `#2415` made green in shadow mode), and **1 `failure`, which was a true red, not a false one**: run `34031907997` on `issue-1363/baseline-census` (PR `#2753`) mirrored a genuine `Visual Regression` failure in run `34031907948`. **Zero false reds in 43 branches against a floor of 20** — but this tally was measured **before 19:34Z**, and a false red followed the same evening; it is a snapshot, not a closed count. Live branch protection on `main` reads `strict: false`, `enforce_admins: false`, `required_approving_review_count: 0` and exactly three contexts — `Dependency Security / Dependency Security Signals`, `SAST Scan / SAST Scan (Semgrep)`, `Secret Scan / Gitleaks Scan`. The maintainer command that keeps those three and adds the gate is recorded on `#2327`. Agents do not run it. **Ordering correction — SC-4 must not run before SC-6.** `smart-ci-shadow.yml`'s own header records a precondition the SC-4 row never carried: the repository must be **private (no forks)** first, because while it is public any fork's `pull_request` run can create a job named `Smart CI / Required Gate`, and branch protection would accept that spoofed context — a skipped job counts as successful. The repository is still public (read 2026-09-06). So the observation floor is now met, but the gate is registered **after** the private cutover, not before it.)* *(**Correction, same evening — the “zero false reds” figure above is wrong; a false red exists.** At 19:03Z the gate passed on `#2753` at head `d01fc0ec1`. At 19:31Z PR `#2761` merged and moved `main`’s tip. At 19:34Z the **same head SHA with an unchanged tree** failed: `planner-error — pull-request planning requires merge SHA and tree SHA from the same fetched merge ref`, with `CONTROL_BASE` at the new tip. Three re-runs failed, including a full re-run in which `Smart CI / Plan` re-derived from scratch and itself succeeded — though `.claude/rules/ci-control.md` already records that `gh run rerun` reuses the OLD merge ref, so those re-runs are the documented consequence of that behaviour rather than independent evidence that the condition persists. What actually cleared it was pushing a merge of `origin/main` (head `ab3d76cdc`: Plan, Required Gate and Planner Self-Test all green), which regenerates the merge ref. `smart-ci-shadow.yml`’s own header names `planner-error` as a planner defect and “never a product verdict”, so this is a false red by the definition this row depends on. **SC-4’s observation precondition is therefore NOT met.** This is the `#2562` failure mode, live on `main` and not limited to stacked PRs — `#2753` is not stacked; the trigger is a merge ref that predates the current base tip. **Observed once, and n=1 was forced:** `#2753` was the only other open PR at 19:31Z, so there was no second PR to check. The mechanism implies every open PR enters that state on every merge to `main`, but that generalisation is inferred from the code path, not measured — confirming it needs a merge while two or more PRs are open. Had the gate been required today, `#2753` would have become unmergeable because of an unrelated merge. Merging `origin/main` into the branch regenerates the merge ref and clears it, which the base-change re-prove rule requires anyway — but that is a per-PR touch after every merge, and it belongs in the SC-4 decision. Recorded on `#2327` and `#2562`; `#2562` re-ranked `Priority II`.)* *(**2026-09-03, maintainer decision packet SC4: do not pre-rule** — `strict`, `enforce_admins` and any break-glass are decided only after the observation window, on the recall evidence. Recorded on `#2327`.)* - [x] **SC-5 — flip `sha_pinning_required` after CI-11 (`#2335`).** Every external action is pinned first; the setting is the maintainer's. *(**Unblocked 2026-09-06:** `#2502` merged (`e0a824187`), all 152 external actions pinned. The command in that PR's body targets `actions/permissions/workflow`, which has no such field and silently ignores it; the setting lives on the Actions permissions root (read 2026-09-06: `sha_pinning_required: false`). Maintainer command: `gh api -X PUT repos/Chris0Jeky/Taskdeck/actions/permissions -F enabled=true -f allowed_actions=all -F sha_pinning_required=true`, verify with `gh api repos/Chris0Jeky/Taskdeck/actions/permissions --jq .sha_pinning_required`; recorded on `#2335`.)* *(**Done 2026-09-06 — the maintainer ran the command and the setting is verified.** `gh api repos/Chris0Jeky/Taskdeck/actions/permissions` now reads `{"enabled":true,"allowed_actions":"all","sha_pinning_required":true}`. The command returns no output on success, which is why it looked inert; the read-back is the proof. Every external `uses:` in `.github/workflows/` was already pinned by `#2502`, so the setting is enforcing an inventory that already complies and no workflow is broken by it. `#2335` stays open for its remaining acceptance criteria — the `pull_request_target` no-head-checkout contract test, the R4 hosted-only fixture, and the `#1819` CodeQL decision — none of which are maintainer actions.)* -- [ ] **SC-6 — change repository visibility to private (`#2337` B5).** The release-defining action, performed manually by the maintainer after checklist sections A–I; capture the settings evidence first (B2). Agents never change visibility or billing. +- [ ] **SC-6 — change repository visibility to private (`#2337` B5).** The release-defining action, performed manually by the maintainer after checklist sections A–J; capture the settings evidence first (B2). Agents never change visibility or billing. - [ ] **SC-7 — register the isolated runners after cutover (`#2328`, `#2337` B8).** Registration tokens never enter the repository; no runner is attached while the repository is public; `CI_EXECUTION_MODE` moves to `hybrid` only after the runners are proven. - [x] **SC-8 — public-asset and launch-kit decision (`#2337` A; `#2242`).** GitHub Pages keeps publishing from a private repository on Pro (the site stays public); the launch kit and the REVIVAL public-source messaging assumed a public repository — decide keep / move / reword and record it on `#2337`. *(**Ruled 2026-09-03, maintainer decision packet SC8: private development repository + public release/source mirror.** Releases, checksums/provenance and the GPL source stay public through a mirror; development, CI and issues go private; GitHub Pages keeps publishing. Mechanics — which repository, what syncs on a tag, how the launch kit and `awesome-selfhosted` wording point at the mirror — are seeded as CI-16 `#2439` and recorded on `#2337`.)* - [x] **SC-9 — Codex review credits are exhausted (maintainer billing).** On 2026-09-03 at 22:34Z the Codex connector answered PR `#2462`'s second and third pushes with "You have reached your Codex usage limits for code reviews" (it still reviewed the first and the fourth head). Until credits are added at the Codex usage dashboard, the documentation-only review gate falls back to one fresh-context agent review per PR (global law 2), which is what `#2462` used. Decide: top up, or accept the fallback and record that on `#2337` A (review-integration billing). *(**Ticked 2026-09-06, 2026-09-06 guided-walkthrough reply q-4 = A:** the fresh-context agent review is the documentation-only gate whenever the connector is out of credits; the maintainer reported the allowance returns with the OpenAI subscription cycle on 2026-09-07, so Codex resumes as the primary connector when present and no top-up is bought. Recorded on `#2337` A.)* diff --git a/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md b/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md index c5f6e26f85..f1a1538e17 100644 --- a/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md +++ b/docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md @@ -123,7 +123,9 @@ actions. Never infer a human action from repository state or an issue comment. ## H. Pre-cutover nightly and release contract (CI-10 `#2334`) -Sections A-I are prerequisites for the visibility change. This section proves that the release +Sections A-J are prerequisites for the visibility change. Complete the provisioning in section J +before executing this section's mirror dry run; section J is listed below for thematic grouping but +is part of the pre-cutover gate. This section proves that the release mechanisms and evidence contract are ready; it does **not** require the real tag, post-cutover runner association, exact-tag qualification, or release publication. Those actions occur only in section L. diff --git a/docs/releases/V0_3_0_READINESS.md b/docs/releases/V0_3_0_READINESS.md index 780601847a..4b335111f6 100644 --- a/docs/releases/V0_3_0_READINESS.md +++ b/docs/releases/V0_3_0_READINESS.md @@ -104,7 +104,7 @@ a false red. What stands between here and that condition: must not be described as shipped or authorized before its evidence conditions are met. **The cutover checklist is also a clause-5 prerequisite, and it is wider than the chain above.** -`OUTSTANDING_TASKS.md` SC-6 permits the visibility change only after sections A to I of +`OUTSTANDING_TASKS.md` SC-6 permits the visibility change only after sections A to J of `docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md` are complete. Those sections name their owners, so every one of them is gate work: @@ -119,6 +119,7 @@ one of them is gate work: | G. Supply chain | CI-11 `#2335` | Open, hands off to SC-5 | | H. Nightly and release | CI-10 `#2334` | Open, v0.3 since 2026-09-03 (Q1 ruled A), Priority I | | I. Rehearsal while still public | CI-13 `#2337` (checklist header) | Open, evidence recorded on `#2337` | +| J. Public distribution preparation | CI-16 `#2439` | Open; provision and verify before the mirror rehearsal | **Section F is not a human gate, despite SC-7.** Its four boxes are isolated VMs, no host mounts or personal credentials with one job per host, a tested hosted override and offline-runner behaviour, @@ -258,7 +259,7 @@ Refresh at each coordination cycle, from live state and not from this file: 1. Re-read the v0.3 row of `docs/REVIVAL_PLAN.md` for the gate clauses. 2. Re-read branch protection for the required contexts. Do not infer that the Smart CI gate is enforced from a green check. -3. Re-read `docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md` sections A to I and their named owners. SC-6 +3. Re-read `docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md` sections A to J and their named owners. SC-6 makes that whole list clause-5 work, so an issue moving in or out of it changes this file. 4. Re-count the milestone and re-check the section 2 chain. 5. Move anything that becomes shipped reality into `docs/STATUS.md`, not into this file. From cf2d5874335d3166ed25e062fd87a0e54df91d82 Mon Sep 17 00:00:00 2001 From: Chris0Jeky Date: Fri, 18 Sep 2026 01:23:16 +0100 Subject: [PATCH 14/15] docs: keep release qualification after cutover --- docs/analysis/2026-09-17-v0.3-release-assessment.md | 2 +- docs/releases/V0_3_0_READINESS.md | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/analysis/2026-09-17-v0.3-release-assessment.md b/docs/analysis/2026-09-17-v0.3-release-assessment.md index fcf4f24cd5..baf9e169da 100644 --- a/docs/analysis/2026-09-17-v0.3-release-assessment.md +++ b/docs/analysis/2026-09-17-v0.3-release-assessment.md @@ -18,7 +18,7 @@ packaging project: 1. freeze the retained release scope and reconcile the open milestone issues; 2. complete the Smart CI proof chain, including landed-commit verification; 3. bring Actions storage below the private allowance under the settled `$0` ceiling; -4. finish nightly, clean-tag, and release qualification; +4. finish nightly and the pre-cutover release contract plus public/no-publish rehearsals; 5. operationalise the approved public mirror; 6. prove runner isolation before any GitHub association; 7. make the GHCR packages public and verify anonymous access before repository privacy; diff --git a/docs/releases/V0_3_0_READINESS.md b/docs/releases/V0_3_0_READINESS.md index 4b335111f6..329157f62d 100644 --- a/docs/releases/V0_3_0_READINESS.md +++ b/docs/releases/V0_3_0_READINESS.md @@ -131,9 +131,10 @@ section F is unbuilt. **Section H is a prerequisite in full (Q1 on `#2337`, ruled A by the maintainer 2026-09-03).** CI-10 `#2334` moved from v0.4 to v0.3 and is a release blocker: the nightly coordinator with its honest -no-change receipt and weekly sweep, mutation kept manual, and the clean-from-tag hosted-only release -qualification all land before cutover. The agent's recommendation to split the section (keep nightly -consolidation on v0.4, carve out release qualification) was declined. `#2334` depends on CI-01 (closed), +no-change receipt and weekly sweep, mutation kept manual, and the pre-cutover release contract plus +public/no-publish rehearsals all land before cutover. Exact-tag qualification and publication remain +in section L after privacy and runner association. The agent's recommendation to split the section +(keep nightly consolidation on v0.4, carve out release qualification) was declined. `#2334` depends on CI-01 (closed), CI-03 `#2327` and CI-05 `#2329`, both already v0.3, so nothing else moves milestone; its scope also triages `#1210` and `#2180`, which carry no milestone. From c2dc5dc936c303ebe97430f024315d0950ae5977 Mon Sep 17 00:00:00 2001 From: Chris0Jeky Date: Fri, 18 Sep 2026 01:35:27 +0100 Subject: [PATCH 15/15] docs: make cutover sequencing explicit --- OUTSTANDING_TASKS.md | 2 +- docs/releases/V0_3_0_READINESS.md | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/OUTSTANDING_TASKS.md b/OUTSTANDING_TASKS.md index 6ea70fbcee..bc19b884ed 100644 --- a/OUTSTANDING_TASKS.md +++ b/OUTSTANDING_TASKS.md @@ -165,7 +165,7 @@ The maintainer directed (2026-08-30) that the repository goes **private for the - [ ] **SC-4 — register the stable gate (`#2327`, `#2337` B3).** After >=20 PRs of observation without a false red, add `Smart CI / Required Gate` to the required checks, keep the three security contexts, and decide — on the recall evidence, not in advance — whether to set `strict: true` and `enforce_admins` or to document a break-glass (SC-4 ruling 2026-09-03: no pre-ruling). CI-03 supplies the exact `gh api` commands; agents do not change branch protection. *(**~~Precondition measured green 2026-09-06 — the observation window is complete and this is now actionable.~~ SUPERSEDED the same evening — read the correction two annotations below before acting on anything in this one.** Since `#2506` merged (2026-09-06T02:50:09Z) the shadow lane ran **72 times across 43 distinct branches**: 66 `success`, 5 `cancelled` (concurrency supersedes, each replaced by a later successful run on the same branch — the case PR `#2415` made green in shadow mode), and **1 `failure`, which was a true red, not a false one**: run `34031907997` on `issue-1363/baseline-census` (PR `#2753`) mirrored a genuine `Visual Regression` failure in run `34031907948`. **Zero false reds in 43 branches against a floor of 20** — but this tally was measured **before 19:34Z**, and a false red followed the same evening; it is a snapshot, not a closed count. Live branch protection on `main` reads `strict: false`, `enforce_admins: false`, `required_approving_review_count: 0` and exactly three contexts — `Dependency Security / Dependency Security Signals`, `SAST Scan / SAST Scan (Semgrep)`, `Secret Scan / Gitleaks Scan`. The maintainer command that keeps those three and adds the gate is recorded on `#2327`. Agents do not run it. **Ordering correction — SC-4 must not run before SC-6.** `smart-ci-shadow.yml`'s own header records a precondition the SC-4 row never carried: the repository must be **private (no forks)** first, because while it is public any fork's `pull_request` run can create a job named `Smart CI / Required Gate`, and branch protection would accept that spoofed context — a skipped job counts as successful. The repository is still public (read 2026-09-06). So the observation floor is now met, but the gate is registered **after** the private cutover, not before it.)* *(**Correction, same evening — the “zero false reds” figure above is wrong; a false red exists.** At 19:03Z the gate passed on `#2753` at head `d01fc0ec1`. At 19:31Z PR `#2761` merged and moved `main`’s tip. At 19:34Z the **same head SHA with an unchanged tree** failed: `planner-error — pull-request planning requires merge SHA and tree SHA from the same fetched merge ref`, with `CONTROL_BASE` at the new tip. Three re-runs failed, including a full re-run in which `Smart CI / Plan` re-derived from scratch and itself succeeded — though `.claude/rules/ci-control.md` already records that `gh run rerun` reuses the OLD merge ref, so those re-runs are the documented consequence of that behaviour rather than independent evidence that the condition persists. What actually cleared it was pushing a merge of `origin/main` (head `ab3d76cdc`: Plan, Required Gate and Planner Self-Test all green), which regenerates the merge ref. `smart-ci-shadow.yml`’s own header names `planner-error` as a planner defect and “never a product verdict”, so this is a false red by the definition this row depends on. **SC-4’s observation precondition is therefore NOT met.** This is the `#2562` failure mode, live on `main` and not limited to stacked PRs — `#2753` is not stacked; the trigger is a merge ref that predates the current base tip. **Observed once, and n=1 was forced:** `#2753` was the only other open PR at 19:31Z, so there was no second PR to check. The mechanism implies every open PR enters that state on every merge to `main`, but that generalisation is inferred from the code path, not measured — confirming it needs a merge while two or more PRs are open. Had the gate been required today, `#2753` would have become unmergeable because of an unrelated merge. Merging `origin/main` into the branch regenerates the merge ref and clears it, which the base-change re-prove rule requires anyway — but that is a per-PR touch after every merge, and it belongs in the SC-4 decision. Recorded on `#2327` and `#2562`; `#2562` re-ranked `Priority II`.)* *(**2026-09-03, maintainer decision packet SC4: do not pre-rule** — `strict`, `enforce_admins` and any break-glass are decided only after the observation window, on the recall evidence. Recorded on `#2327`.)* - [x] **SC-5 — flip `sha_pinning_required` after CI-11 (`#2335`).** Every external action is pinned first; the setting is the maintainer's. *(**Unblocked 2026-09-06:** `#2502` merged (`e0a824187`), all 152 external actions pinned. The command in that PR's body targets `actions/permissions/workflow`, which has no such field and silently ignores it; the setting lives on the Actions permissions root (read 2026-09-06: `sha_pinning_required: false`). Maintainer command: `gh api -X PUT repos/Chris0Jeky/Taskdeck/actions/permissions -F enabled=true -f allowed_actions=all -F sha_pinning_required=true`, verify with `gh api repos/Chris0Jeky/Taskdeck/actions/permissions --jq .sha_pinning_required`; recorded on `#2335`.)* *(**Done 2026-09-06 — the maintainer ran the command and the setting is verified.** `gh api repos/Chris0Jeky/Taskdeck/actions/permissions` now reads `{"enabled":true,"allowed_actions":"all","sha_pinning_required":true}`. The command returns no output on success, which is why it looked inert; the read-back is the proof. Every external `uses:` in `.github/workflows/` was already pinned by `#2502`, so the setting is enforcing an inventory that already complies and no workflow is broken by it. `#2335` stays open for its remaining acceptance criteria — the `pull_request_target` no-head-checkout contract test, the R4 hosted-only fixture, and the `#1819` CodeQL decision — none of which are maintainer actions.)* - [ ] **SC-6 — change repository visibility to private (`#2337` B5).** The release-defining action, performed manually by the maintainer after checklist sections A–J; capture the settings evidence first (B2). Agents never change visibility or billing. -- [ ] **SC-7 — register the isolated runners after cutover (`#2328`, `#2337` B8).** Registration tokens never enter the repository; no runner is attached while the repository is public; `CI_EXECUTION_MODE` moves to `hybrid` only after the runners are proven. +- [ ] **SC-7 — register the isolated runners after cutover (`#2328`, `#2337` B8).** Registration tokens never enter the repository; no runner is attached while the repository is public; first complete the CI-17 private-mode Linux-only rehearsal with all runners still unassociated, then associate only already-proven runners; `CI_EXECUTION_MODE` moves to `hybrid` only after that proof. - [x] **SC-8 — public-asset and launch-kit decision (`#2337` A; `#2242`).** GitHub Pages keeps publishing from a private repository on Pro (the site stays public); the launch kit and the REVIVAL public-source messaging assumed a public repository — decide keep / move / reword and record it on `#2337`. *(**Ruled 2026-09-03, maintainer decision packet SC8: private development repository + public release/source mirror.** Releases, checksums/provenance and the GPL source stay public through a mirror; development, CI and issues go private; GitHub Pages keeps publishing. Mechanics — which repository, what syncs on a tag, how the launch kit and `awesome-selfhosted` wording point at the mirror — are seeded as CI-16 `#2439` and recorded on `#2337`.)* - [x] **SC-9 — Codex review credits are exhausted (maintainer billing).** On 2026-09-03 at 22:34Z the Codex connector answered PR `#2462`'s second and third pushes with "You have reached your Codex usage limits for code reviews" (it still reviewed the first and the fourth head). Until credits are added at the Codex usage dashboard, the documentation-only review gate falls back to one fresh-context agent review per PR (global law 2), which is what `#2462` used. Decide: top up, or accept the fallback and record that on `#2337` A (review-integration billing). *(**Ticked 2026-09-06, 2026-09-06 guided-walkthrough reply q-4 = A:** the fresh-context agent review is the documentation-only gate whenever the connector is out of credits; the maintainer reported the allowance returns with the OpenAI subscription cycle on 2026-09-07, so Codex resumes as the primary connector when present and no top-up is bought. Recorded on `#2337` A.)* - [x] **SC-10 — control-plane PRs awaiting the maintainer's review (ADR-0066 amendment 2026-09-03).** The amendment says control-plane (T0/T2) and runner changes merge only after the maintainer's review plus the fresh-context review. Queued by the 2026-09-04 overnight orchestrator, each already reviewed clean by a fresh-context agent and proven hosted at its head **against the base as of that PR's last hosted run, not against today's `main`** (measured 2026-09-04 21:40Z: `#2502` is 138 commits behind `main`, `#2506` 102, `#2532` 72, `#2550` 46; branch protection is not strict, so GitHub reports them `CLEAN` regardless, and a base change counts as a head change under the global laws). Each therefore needs `gh pr update-branch` plus a fresh hosted run and a re-check of its review against the moved base immediately before merge, `#2502` above all because it rewrites `uses:` refs across 34 workflow files; the update-branch runs were deliberately not spent in advance because `main` will move again before the maintainer arrives: `#2502` (CI-11 slice 1: 152 external actions pinned to full SHAs, guard enforced in `smart-ci-self-test.yml`; SC-5 command in the body), `#2506` (Smart CI planner: accept a merge ref regenerated against the live base tip — closes the shadow false-red shape seen on `#2485`, `#2496`, `#2500`; its last review round, 03:55:47Z, predates the current head `e1e80d579`, which is a 04:07:34Z merge of `main` touching none of the PR's own six files, so the review still covers the content and only the record is ambiguous), `#2532` (release-cache scanner comment handling, CI-09), and `#2550` (register the Paper colour-audit scanner test in `reusable-paper-color-audit.yml`; `#2504`, fresh-context review posted on the PR). **`#2522` (dev-up port release, `#1898`) is queued and was conflicting for most of 2026-09-04** after two dev-up commits landed on `main` (`8c0779fca`, `6c10850e6`); its head `18d214ba2` merged `main` and resolved that, and the hosted run at that head (`33922229492`) showed two Windows reds diagnosed on the PR as `#2378` (Frontend Unit launcher timeout) and `#2572` (a fixed-delay `WorkerResilienceTests` assertion, seeded from that run), neither in the PR's own files. It still needs `gh pr update-branch` and a fresh hosted run before a maintainer review of it means anything; the reconciliation session that carried it has closed, so the beta lane holds it behind its own queue. Two further open PRs touch control paths and were not in the queue above when it was written; both now carry a first fresh-context review (posted 2026-09-04 by the open-PR reconciliation session) but are not merge-ready: `#2531` (localized `netstat` state, `#2526` — stacked on `#2522` by design; review verdict FIX-FIRST because the fallback stopped discriminating on socket state; its advisory `Smart CI / Required Gate` is red on the stacked-base planner defect `#2562`, not on its code; retarget with `gh pr edit 2531 --base main` only after the parent lands, and note that its `Closes #2526` currently registers **no closing reference at all**, because GitHub links closing issues only from PRs targeting the default branch — merging it against the stacked base would land the delta on the parent branch and leave `#2526` open with no record why, so confirm `baseRefName == main` and a non-empty `closingIssuesReferences` before merging) and `#2535` (frontend telemetry build version, `#2182` — touches `release-container.yml`, `release-desktop.yml` and `scripts/ci/`; review verdict SHIP on the code, parked here as T2; its earlier `Frontend Unit (windows-latest)` red was the `#2378` / `#2161` timeout class, and at 21:48Z on 2026-09-04 its head `42c07fdb7` showed no failing check). Also decide the CI-07 `#2331` proposal (move the Windows launcher regression suite off the required hosted `windows-latest` leg per SC-3). **Post-hoc disclosure:** `#2479` (Paper colour-audit scanner, touches `reusable-paper-color-audit.yml`) was merged on 2026-09-04 at 03:58:46Z (merge `e99832f3c`) with the fresh-context review but without the maintainer's review — please review post hoc; revert is a one-liner if wanted. **Post-hoc disclosure (2):** `#2529` (merge `b461be49f`, docs-only, `docs/STATUS.md` alone) merged on 2026-09-04 at 06:33:08Z while its `ci-required.yml` run (`33842570671`, head `62f21d847`) had concluded `cancelled`, not success: the `Frontend Unit (windows-latest)` leg hit its 20-minute budget and was never re-run, and the merge landed 2 min 38 s after the run's final update at 06:30:30Z. Branch protection did not stop it and could not have: only the three security contexts are required, so the `ci-required` red is agent-enforced only. No revert appears warranted (a STATUS-only change cannot affect frontend tests, and `main` is green on that leg again at `#2559`, run `33886539482`), but a red required gate was treated as non-blocking, which global law 1 forbids; the call on any further action stays yours. The reconciliation sweep of the 40 PRs merged up to `#2559` found no other non-success `ci-required` run on a merged PR head (a separate red `main` push run of the same `#2378` shape at `17e48815e` is recorded in the eighth `docs/STATUS.md` block and back-referenced by the ninth). Belongs to the Windows-timeout cohort `#2378` / `#2161` / `#2159`. **Post-hoc disclosure (3):** `#2548` (merge `f094d090a`) and `#2556` (merge `b8878c922`), both `scripts/ci/dev-up.test.mjs`, and `#2549` (merge `e0516ca9d`, the Stryker v10 bump in `frontend/taskdeck-web/package.json` plus its lockfile) touch declared `ci/policy.v1.json` control paths and merged on 2026-09-04 on a fresh-context review alone, without the maintainer's review; `#2548` merged after its own review-gate comment had declared it parked for the maintainer, with no reversal on the thread, which is the exact behaviour the amendment exists to prevent. They are recorded in the tenth `docs/STATUS.md` block and are listed here so they sit in the same queue as `#2479`. All three are low blast radius (two test-only edits and a devDependency bump), so post-hoc review rather than revert is suggested; as with `#2479`, revert is yours to choose. Nothing was lost: measured 2026-09-04, all 80 head and merge SHAs of the 40 most recently merged PRs are ancestors of `origin/main`. Disclosures (2) and (3) were measured by the open-PR reconciliation session on 2026-09-04 and re-verified against the Actions API and the PR file lists before being recorded here. **Added 2026-09-05:** `#2587` (CI-10 slice 1, the Smart CI nightly coordinator `scripts/ci/smart-ci/nightly-coordinator.mjs` plus its tests, head `929331247`; two new files, no workflow, policy or doc edits; fresh-context review round 1 FIX-FIRST on a needs-closure HIGH, fixed, round 2 SHIP; seven non-blocking findings recorded on the PR and on `#2334`) is queued for your review and left unmerged by the beta lane. Two more joined on 2026-09-05: `#2608` (CI-07 slice under `#2331`, head `f74f590a0`: `if: runner.os == 'Linux'` on the launcher regression suite step in `reusable-frontend-unit.yml`, a placement contract test under `scripts/ci/smart-ci/`, a `TESTING_GUIDE.md` paragraph; fresh-context review SHIP, no fix round; **it is also `#2378`'s disposition**: the beta lane measured two hosted Windows launcher-suite logs on 2026-09-05 (p50 about 3 s, p90 13 to 15 s, slowest 26 to 31 s; the cases that hit `spawnSync ETIMEDOUT` take 1 to 8 s on a green run, so a 20 s clip means the runner is 3 to 5 times slower and the whole suite would land at 16 to 30 minutes against the job's 20 minute ceiling), so a larger per-spawn budget would only move the failure to a job cancellation, and every recorded `#2378` occurrence is on the Windows leg that `#2608` removes from hosted runs; three consistency points recorded on the PR for your ruling, because `ci/policy.v1.json`'s `launchers-windows` group, cutover checklist section E, `SMART_CI.md` section 5 and the `ci-required.yml` header map still state the pre-SC-3 two-leg target) and `#2610` (`#2582`, head `0fc8fb257`: `cancel-in-progress` becomes `github.ref != 'refs/heads/main'` in `ci-required.yml` with the group key unchanged, plus a four-assertion contract test in the Planner Self-Test glob; fresh-context review SHIP, no fix round; one precision point for your ruling, recorded on the PR and on `#2582`: GitHub keeps one in-progress plus one pending run per group, so this guarantees the in-flight `main` run completes and the tip runs after a wave, not a completed run per landed commit; a per-SHA group is the one-line alternative if CI-03's landed-commit verifier needs one run per merge). Both are parked unmerged by the beta lane. A fourth from the same lane joined at 11:19Z on 2026-09-05: `#2684` (`#2250` items 4 and 5, head `6150eb1a5`: fence-aware `UPGRADING.md` extraction that fails closed on an unterminated fence instead of publishing older versions' notes, bare anchors and relative links in the lifted section rewritten to `blob/` URLs, the 53-test composer suite wired into `ci-required.yml`'s release-workflow-contract job, the release trust doc's layout section updated; two fresh-context rounds, both SHIP; residuals on the PR and on `#2250`; parked unmerged). A fifth followed at 12:00Z: `#2687` (`#2250` items 1 to 3, head `64cd68f58`: a `preview_tag` workflow-dispatch input that renders the real stable page on a no-publish rehearsal and is refused before any build on a publishing dispatch; the page renderer runs from the workflow revision's own checkout so a pre-0.3 tag can be re-dispatched; the changelog base becomes the newest stable release strictly before the target by semver, via `scripts/ci/select-changelog-base.mjs` with 17 tests wired into `ci-required.yml`; two fresh-context rounds, both SHIP; hosted Workflow Lint and Release Workflow Contract green at `6b591ebed`; parked unmerged). Proving `#2687` end to end is yours: one rehearsal dispatch with `preview_tag` set and one re-dispatch of `v0.2.0`. With `#2684` and `#2687` parked, every `#2250` item sits in a parked PR. *(**Ruled 2026-09-06, 2026-09-06 guided-walkthrough reply q-1 = A, delegate all twelve:** the coordinator runs `gh pr update-branch`, a fresh hosted run at the new head, a fresh-context re-review wherever `main` touched the PR's own files **or anything they read or execute** (shared `scripts/ci/smart-ci/**` libraries, `ci/policy.v1.json`, reusable workflows the PR's workflow calls) since its last review, measured per PR before merge; a base change counts as a head change, so the hosted run is always re-proven, and merges in dependency order: `#2506` first, then `#2502`, `#2522` then `#2531` retargeted to `main` with a non-empty closing reference confirmed, then the rest; the maintainer reviews post hoc. **q-2 = A:** the five post-hoc merges `#2479`, `#2529`, `#2548`, `#2549`, `#2556` are acknowledged, no revert. `#2687`'s no-publish rehearsal dispatch (`preview_tag` set) is run by the coordinator after merge; a `v0.2.0` re-dispatch publishes and stays the maintainer's. Progress lands in the next `docs/STATUS.md` block; this row closes when the twelve are merged.)* *(**Progress 2026-09-06:** `#2506` merged `79d7efdb7`; `#2502` merged `e0a824187` after a re-review against the moved base caught a HIGH (the pin broke the Stryker workflow-contract text; fixed in-PR); `#2608` updated, re-reviewed SHIP with its three consistency points fixed in-PR, proving. Ten remain: `#2608`, `#2610`, `#2587`, `#2532`, `#2550`, `#2535`, `#2684`, `#2687`, `#2522` then `#2531`. Second-pass ruling q-24 = B: after `#2687` merges only the no-publish preview rehearsal runs; the `v0.2.0` re-dispatch is not run.)* *(**Ticked 2026-09-06, all twelve merged** — the last two the same afternoon: `#2687` `d69beedd7` and `#2531` `c4cca76b0`; per-PR heads, re-review outcomes and the re-proof interpretation are recorded on `#2337` and in the twenty-first `docs/STATUS.md` block; the `v0.3.0` preview rehearsal failed closed as designed and the `v0.3.0-rc.1` preview rendered the real RC page, both recorded on `#2250`. The maintainer's post-hoc review of the twelve remains theirs; the list with heads and merge SHAs is on `#2337`.)* diff --git a/docs/releases/V0_3_0_READINESS.md b/docs/releases/V0_3_0_READINESS.md index 329157f62d..cf4e6c6ca2 100644 --- a/docs/releases/V0_3_0_READINESS.md +++ b/docs/releases/V0_3_0_READINESS.md @@ -167,8 +167,9 @@ The earlier pair named here is closed: **`#2425`** (Windows worktree helper scen **Row states re-checked against `OUTSTANDING_TASKS.md` §J on 2026-09-10.** Six of the eleven SC rows read as open here while their §J row was already `[x]`: SC-1, SC-3, SC-5, SC-9, SC-10 and SC-11. All six are corrected below, and a D-9 row is added for `#1940`. The still-open gates are **SC-4** (register the stable gate), **SC-6** (visibility) and -**SC-7** (register the runners), and their order is SC-6 before SC-4 before SC-7. §J is the authority for -these states; this table is a view of it. +**SC-7** (register the runners), and their order is SC-6 before SC-4 before the CI-17 private-mode, +Linux-only rehearsal with runners still unassociated, then SC-7. §J is the authority for these +states; this table is a view of it. Clause 5 is entirely human. The named items live in `OUTSTANDING_TASKS.md` and map to issues: @@ -191,7 +192,7 @@ Clause 5 is entirely human. The named items live in `OUTSTANDING_TASKS.md` and m public release and source mirror**. Development, CI, issues and the control plane go private for v0.3.0; Releases, checksums and provenance, and the GPL-3.0-only source stay public through a mirror, with GitHub Pages still publishing from the private repository. CI-16 `#2439` implements it and -serves checklist section A, which puts it inside the SC-6 A-to-I prerequisite set. The launch kit and +serves checklist section J, which puts it inside the SC-6 A-to-J prerequisite set. The launch kit and any `awesome-selfhosted` wording point at the mirror, not the private repository. `#1772` (private shared instance) carries human decision CL-1 and is the one non-CI human-gated issue