Skip to content

docs: close v0.2.6 release verification record #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HTExplicit merged 2 commits into from
Sep 18, 2026
Merged

docs: close v0.2.6 release verification record #185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f85f85
docs: close v0.2.6 release verification record
Sep 18, 2026
1af1a66
docs: align recovered source and completed validation metadata
Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions .downstream/upstream-review-v0.2.6.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,12 @@ Ticket runtime defaults remain safe: `enabled=false`, empty harvest proxy, `fail

- Passed: Wire regeneration, focused backend ticket/account/DTO tests, focused frontend settings/account/dialog/manifest tests, frontend production build and `git diff --check`.
- Passed: full backend compile (`go test -run '^$' ./...`), `go vet ./...`, `go mod verify`, focused runtime/continuation/Cindy tests and risk/automation contract tests.
- Passed: US `resource-preflight` baseline; evidence `artifacts/evidence/us-runtime-audit-2026-09-18_140357_769694.log` records the `.14` image, digest, healthy container, resource profile, guard hashes and unchanged companion services.
- Pending: required PR checks, Release and production deployment.
- Not run: real upstream model calls, harvest-proxy calls, management-page activation, canary, long observation and production deployment.
- Passed: US pre-deploy and post-deploy `resource-preflight` baselines; evidence `artifacts/evidence/us-runtime-audit-2026-09-18_140357_769694.log` and `artifacts/evidence/us-runtime-audit-2026-09-18_150841_483754.log` record the `.14` and `v0.2.6-codexrip.1` images, digest, healthy container, resource profile, guard hashes and unchanged companion services.
- Passed: applicable PR checks and main CI/security/Downstream Verify; PR and release trees match (`970fb93bb74577d46469d63b744a125dfa343b9c`). The ordinary-branch Upstream risk gate was skipped by its existing condition, not executed as a successful classification; the exact-SHA manifest is the review evidence.
- Passed: [Release](https://github.com/HTExplicit/sub2api/actions/runs/35358623663) and [deploy-preserve](https://github.com/HTExplicit/sub2api/actions/runs/35359519253). Runtime digest `sha256:fc8a1d7ec4dc66820ac2fbffde74f8c3109459e61c6f5c57b62c799e97afc6ca` and revision match the Release. Health passed after two startup 502 retries.
- Read-only admin verification: ticket disabled, harvest proxy absent, OpenAI OAuth and Setup Token account counts both zero. No real model quality result is claimed.
- Not run: real upstream model calls, harvest-proxy calls, management-page activation, canary, long observation and automatic rollback.

## Release boundary

The candidate release is `v0.2.6-codexrip.1`. Production deployment uses the existing immutable-digest `deploy-preserve` path and changes only the `sub2api` container. The release does not claim that ticket quality improvements have been model-validated while the feature remains disabled.
Released and deployed: `v0.2.6-codexrip.1`, source `4bb9eabca65d17c9c392945b332e3914b2ff16c3`. Production deployment uses the existing immutable-digest `deploy-preserve` path and changes only the `sub2api` container. The release does not claim that ticket quality improvements have been model-validated while the feature remains disabled.
7 changes: 5 additions & 2 deletions .downstream/upstream-risk.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2064,7 +2064,9 @@
"frontend/src/views/user/RedeemView.vue",
"frontend/src/views/user/UserOrdersView.vue"
],
"review_status": "resolutions_implemented_validation_pending",
"release_commit": "4bb9eabca65d17c9c392945b332e3914b2ff16c3",
"review_gate_execution": "ordinary_branch_skipped_exact_sha_review_recorded",
"review_status": "reviewed_validated_released",
"risk_class": "review_required",
"schema": 1,
"temporary_tag_created": false,
Expand Down Expand Up @@ -2213,5 +2215,6 @@
"upstream_tag": "v0.2.6",
"upstream_tag_checked_at": "2026-09-18",
"upstream_tag_status": "withdrawn_not_advertised",
"upstream_tree": "61de86700f217d58c337998f3c51a89969493267"
"upstream_tree": "61de86700f217d58c337998f3c51a89969493267",
"validation_reference": "https://github.com/HTExplicit/sub2api/pull/184"
}
19 changes: 6 additions & 13 deletions DOWNSTREAM.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,19 +4,12 @@ This fork maintains the `codexrip` patch set over official Sub2API releases.

## Source baseline

- Official baseline: `v0.2.5`, peeled commit `86f93c28ee34cc74b629dafb748bd5ac5ca8c5ea`.
- Version-only sync: `881f3202694c6bc932446931a30c27d9675178b9`; embedded version `0.2.5`.
- Integration starts at production `v0.2.4-codexrip.11`, commit `4c96fb375a68744ddf356ffb3f64afac5e21894b`.
- Conflict decisions and validation: [v0.2.5 review](.downstream/upstream-review-v0.2.5.md).
- The operator workspace `docs/sub2api.md` owns the current production pointer.
A source merge or Release alone does not establish deployment completion.

### Recovered upstream v0.2.6

- The withdrawn upstream release is recovered from exact merge commit `49a39b6dc1abed30fd227611e8af1108bc427610`; the remote `v0.2.6` tag is not used as a source.
- The merge includes the official changes after v0.2.5 and the six Codex ticket patches. The ticket feature remains runtime-disabled in the published deployment until an administrator supplies a harvest proxy and enables it from the settings page.
- Ticket collection and injection apply only to OpenAI OAuth and Setup Token accounts. Cindy/API-key accounts retain their existing identity, health, quota and sticky-session behavior.
- The integration review and one-off exact-SHA risk evidence are recorded in `.downstream/upstream-review-v0.2.6.md` and `.downstream/upstream-risk.json`.
- Integrated upstream: recovered `v0.2.6`, exact commit `49a39b6dc1abed30fd227611e8af1108bc427610`. The public tag was withdrawn when recovered; source is pinned to the commit, not a recreated official tag.
- Integration base: production `v0.2.5-codexrip.14`, commit `a2f13d34a41bb89225e5d6864d466b4a35d6448f`; embedded version is `0.2.6`.
- Conflict decisions and validation: [v0.2.6 review](.downstream/upstream-review-v0.2.6.md); exact-SHA evidence: [risk manifest](.downstream/upstream-risk.json).
- The operator workspace `docs/sub2api.md` owns the current production pointer. A source merge or Release alone does not establish deployment completion.
- The full recovered tree includes the official changes after v0.2.5 and all six Codex ticket patches. Ticket collection/injection is disabled in this deployment; the admin settings expose the proxy and live switch for later explicit activation.
- Tickets apply only to OpenAI OAuth/Setup Token accounts, excluding shadows. Cindy/API-key paths retain their existing identity, health, quota and sticky-session behavior.

## Official behavior and downstream contracts

Expand Down
Loading