Repository navigation
feat(release): enforce immutable durable buyer releases #36
Description
Activity
Reopened because the issue was marked
completedwhile every immutable-release acceptance criterion remained unchecked and the live GitHub release collection is still empty. Current protected Noema ismain@36e5cf957ee20a8bb3e19ff50fea6c97771d2ba1; open source lanes are Draft #560 and Draft #559. Source-level release workflow capability is not equivalent to a published immutable release,isImmutable=true, release-asset verification, tag immutability, publication receipt, or rollback/transfer evidence. Keep this issue open until those exact buyer-facing artifacts exist; do not manufacture completion from PR/source integration.2026-09-11 release-authority refresh: protected source is
main@0b5b4ecbcaad56193bb6f7d9be2149876134df9c; Noema GitHub Release inventory is still exactly 0. #595–#600 are already integrated/documentation-converged rather than pending. Active Draft #601 is the Noema Policy / Approval CAS source slice.Current #601 exact
592245ce0274196f158c6ee1787f16182dbd50cbhas terminal-success application CI, reviewer-ci, required central Security Scan and patch-validator-image after repairing a real 100% branch-coverage failure on predecessor1dcf0912.... It is not release-ready or merge-ready yet because the production Policy / Approval behavior has noCHANGELOG.md## Unreleasedrecord on the branch. Keep Draft until that same-lane repair and a fresh unchanged-head four-gate generation.Even after #601 integration, source GREEN is not release authority. ADR-0017 remains Proposed; every procedural approval/revocation event is
activationAuthorized:false; live Keyverse/owner trust selection, releasedcontext-graph-contractspublication schema, production deployment/recovery/canary evidence, SemVer/tag/artifact/SBOM/provenance/reproducibility/rollback and immutable GitHub Release publication remain separate acceptance classes.Current release-authority update: protected source is now
main@70c997e45db975a2ac43197ec2c49c9916a3e238after normal #603 integration. The procedural chain is protected through State / Checkpoint history (#597), Policy / Approval CAS (#601), and the point-in-time publication preflight (#603). #603 keepspublicationAuthorized:falseandactivationAuthorized:false; it is not an immutable release, graph publication, deployment, canary, or production outcome receipt.Draft #604 is the post-#603 canonical documentation convergence lane. Its current exact head is
72abb528e3d30eff324f34a5bc4c076f6be677b2; final exact-head CI/security/reviewer/image evidence is still non-terminal, so no merge/release claim transfers from predecessor heads.Fresh release inventory remains Noema 0,
context-graph-contracts0, Keyverse 0. Therefore mutable sibling heads remain ineligible as release/trust authority, and the release lane must stay fail-closed. The next procedural publication step is not another reconciliation primitive: only after an immutable released graph contract plus live Keyverse/owner trust and current lifecycle/revocation evidence exist should an actual publisher consume the exact admitted #603 preflight. SemVer/tag/package/SBOM/provenance/reproducibility/rollback and immutable GitHub Release publication remain independently required for this issue.Fresh release-authority update after normal #604 integration: protected Noema is GitHub-verified
main@585b2f09c418e7d90e9e2729ee51f384e0602d9f; the current GitHub Release collection is still empty. #603 publication preflight and #604 documentation convergence are protected source only. They do not satisfy immutable release, deployment, production KPI, rollback/recovery, or product-outcome evidence.The procedural path is not a release candidate for active publication yet:
context-graph-contractsstill has no immutable GitHub Release, Keyverse still has no immutable GitHub Release, and live current signer-trust selection is now tracked at Keyverse#156. CGC procedural contract release remains tracked at context-graph-contracts#28. Do not publish/tag merely to manufacture a release while these runtime-authority prerequisites are absent.Noema source/release preparation remains executable independently, but an immutable buyer release must still bind one then-current exact protected head to version/tag/package or image, SBOM, provenance/attestation, reproducibility and rollback, then be independently re-read as an immutable GitHub Release. Current count remains 0.
Current release-authority update: protected source is still
main@585b2f09c418e7d90e9e2729ee51f384e0602d9f, with Draft #605 exactb4fd8abb77a69847655e04a03fa63a72ea6d56b4as the sole open source lane. Fresh Noema GitHub Release inventory is[]. #605's exact-objectdatabase_size_bytesproducer is source/operability preparation only and its ADR remains Proposed; it does not provide a tag/package/image/SBOM/provenance/reproducibility/rollback publication receipt. The current exact's application CI, reviewer-ci, required Security Scan and patch-validator-image remain non-terminal, so no release candidate or merge authority is inferred from earlier GREEN generations.2026-09-11 KST release-authority refresh: protected Noema advanced by normal #605 integration to GitHub-verified
main@98942c88c228c18d44808db1c29bd8f165aa4167. #605 exactb4fd8abb77a69847655e04a03fa63a72ea6d56b4had terminal-success application CI34542741791, reviewer-ci34542741784, required Security Scan34542741748, patch-validator-image34542741760and clean current-head review before merge. Itsread_operabilitysource is observation-only and keeps ADR-0013 Proposed; it is not deployed transaction/recovery/p95/PITR or release evidence.Fresh GitHub Release inventory remains 0. Version/tag/package/SBOM/provenance/reproducibility/rollback and an immutable GitHub Release therefore remain unproven. Draft #606 is now the only open Noema PR and repairs the moving product/technical baseline after #605; that documentation lane is not release authority either. The issue body’s older
main@97a528.../ Draft #595 snapshot is historical and must not be used as current release state.2026-09-11 release-authority refresh: protected Noema is GitHub-verified
main@8a03aabf9c0f2d02d1f17c9848ba9abe88f71753, and GitHub Release inventory is still empty. #606 is already merged; do not retain older Draft #595/#606 snapshots as current authority.The existing
release-evidence.ymlstill requires an exact semantic-version tag matchingpackage.json, sterile source/SBOM/checksum materialization, signed attestation and immutable release verification. No tag/release is being created from source CI alone. Release remains downstream of current source gaps and exact-head gates; Draft #607 is an active reviewer evidence-integrity repair and the procedural graph lane still lacks immutablecontext-graph-contractsand Keyverse owner releases.2026-09-11 release-authority refresh: protected Noema is GitHub-verified
main@b3e940e4c0fb317ce50d34458bf8f2958f428cd7after normal #607 integration. Fresh GitHub Release inventory is still empty, so #607 protected source and its exact-head four-gate GREEN do not create immutable release authority. Draft #608 is documentation-authority convergence only and is not a release candidate while its current exact checks are non-terminal.Current owner prerequisites also remain unreleased:
context-graph-contracts#28andkeyverse#156are open, and fresh release collections for both repositories are empty. Reviewer evidence owner gaps.github#2086(execution framing) and.github#2087(trusted retrieval handoff) are likewise open. Do not publish/consume mutable sibling source to manufacture release readiness. Source review/docs work remains executable independently; immutable Noema publication still requires one exact protected release candidate with tag/package-or-image/SBOM/provenance/reproducibility/rollback evidence and independent post-publication verification.Fresh 2026-09-11 release-authority update: protected Noema advanced by normal #612 integration to GitHub-verified
main@d10a41c91c643e2b3d46608795e710cdd58ba220(parentsc8aeacb...+ #612 exacta919be3...). Fresh GitHub Release inventory is still 0. Draft #613 is documentation-only convergence for the post-#612 moving gap baseline and does not create release authority. #612 adds protected exact-distribution recovery source/command semantics, but ADR-0018 remains Proposed and #611 still requires immutable reviewed release + controlled production recovery rehearsal with independently verified provider pre/post distribution, receipt/Sigstore, smoke/KPI, and immutable recovery evidence. Do not select or publish a release from PR-head checks or source integration alone.28 remaining items
Release-authority successor update: #724 is no longer a blocker; it merged normally into GitHub-verified protected
main@a69bfadb9a450a37a810a71d4070d652e23d3d60. #726/#727/#728 are now restacked/reconciled onto that source but remain mutable Draft candidates, not release authority. #726 current exact25181755cc07432b40f5bedfbb6ea5dec9a3310dcontains fresh independent-review RED→GREEN repairs for generated pointer-transparent pseudo paint, typographic-pseudo font selection, and unmodeled text-decoration paint; its current hosted lanes are queued/pending and fresh exact-head independent re-review is requested. #727 is9f8f6031a4477c2f5fcb31367c6d8a517ae64e13; #728 is5deb783fd0985f374630112a92b921bb2f420356. No candidate becomes immutable release evidence until its own current-head gates/review complete and protected source advances normally.Release-authority successor update: #726 moved to repaired exact
560a662b09c9742d46a8ba0a977a8872c5b199feafter a current-head independent review found unmodeledfont-palettecolor-font paint. REDc599ce81…→ GREENbfbe8d2b…now fails closed unless pseudo/base computed palettes are bothnormal; new doctoring records why custom-palette equality is not enough for the single-color contrast proof. #727 is52494add6a21865864fecc45558bf957634179f0; #728 is5deb783fd0985f374630112a92b921bb2f420356. All remain mutable Draft candidates, not immutable release evidence. Protected source remains GitHub-verifiedmain@a69bfadb9a450a37a810a71d4070d652e23d3d60, and release inventory is still empty pending normal candidate integration and release gates.Release-authority correction for #727: the prior
52494add…filename interpretation is superseded after exact-head review confirmed protected grammar limits the basename to 100 characters. Corrective RED1cdc3ef2…→ GREEN13daa317…preserves 100-character basenames for both.yml/.yamland rejects 101-character basenames; current doctoring/exact is8806d06ac2cdf3ca878c54fdc760eb7cd5c8be10. This mutable candidate still requires fresh exact-head hosted GREEN and re-review before it can contribute to any protected-source/release transition.Release-authority current-head update: #726
560a662b…, #7278806d06a…, and #7285deb783f…each have a fresh independent source review on the exact current head with no remaining actionable finding. None is release or merge authority because each candidate's application CI, reviewer-ci, required Security Scan, and patch-validator-image runs are still queued/nonterminal. Protected source remains GitHub-verifiedmain@a69bfadb9a450a37a810a71d4070d652e23d3d60; release inventory remains empty. Keep all three Draft until exact-head hosted gates are terminal applicable GREEN.2026-09-22 KST release-authority refresh
Fresh protected source is
main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251. The only open source lanes are Draft #730c74e3488566baf9616050988944a77bb94b3177dand Draft #7293c988adf8f15a94a81afe80dbe2df22fd29f77d3; both remain current-head review/hosted-evidence work and neither is immutable release authority.A fresh GitHub Release collection read is still empty: 0 releases. Therefore no current protected head can yet be claimed as a published SemVer/tag/package-or-image/SBOM/provenance/reproducibility/rollback evidence set merely from protected source or PR gates. #730/#729 must first converge normally; release candidate selection must then fresh-read the resulting protected head plus #27/#29/#73 and other owner prerequisites rather than inheriting mutable PR evidence.
This supersedes the older protected-main/open-PR inventory in the issue body only; it does not satisfy Release Policy Auditor provisioning, immutable publication, production Environment/deployment, recovery, KPI, or legal/outbound-rights evidence.
2026-09-22 KST current release-authority successor
Superseding the earlier same-day open-head note: protected source remains
main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251; current open lanes are Draft #730a631c89d2ca360ef838dc236655f3c78774eeeb7and Draft #729f76018093c742fe68a1fffa00c1ecb570c9c2093. Both are current-head review/hosted-evidence work, not immutable release authority.Fresh GitHub Release inventory remains 0 releases. No SemVer/tag/package-or-image/SBOM/provenance/reproducibility/rollback completion is inferred from protected source, source GREEN, or PR checks. Release candidate selection must fresh-read the eventual protected head plus #27/#29/#73 and other owner prerequisites before any publication.
Release-candidate authority supersession — 2026-09-24 KST
This comment updates exact-head prerequisites only; the immutable buyer-release contract and owner/admin prerequisites in the issue body remain unchanged.
#730 current exact is now
09e795db5801b4d2cd8453f0e0d2f06b30189d59, ordinary-forward fromcaeeee70…after fresh independent review found a stale publication-error test expectation. The final tree delta versuscaeeee70…is one test file, net +1/-1; production publication/review/merge authority is unchanged. Fresh runsci 35931729399,reviewer-ci 35931729461, requiredSecurity Scan 35931729476,patch-validator-image 35931729396are all currently queued, and fresh current-exact independent/formal Noema review remains outstanding.#729 stays at
ed64dc9bd85244f64c5f0c3a477028e536908246but is no longer a candidate GREEN: active baseline/P0 plus six current-authority fixtures still bind predecessor #730caeeee70…, so #729 is an explicit stale-authority RED until ordinary-forward convergence to09e795db…and fresh hosted/review evidence.Neither open lane is release authority. Source/test/review evidence must not be promoted to SemVer tag/package/immutable GitHub Release/SBOM/provenance/reproducibility/rollback evidence. Release selection must fresh-read the exact protected head after these lanes are normally merged and all independent release prerequisites are satisfied.
Release-candidate authority refresh — #729 stale RED repaired
#729 is no longer at stale exact
ed64dc9bd85244f64c5f0c3a477028e536908246. It ordinary-forward advanced by one non-force commit to08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2, converging the active baseline/P0 governance candidate and all six executable authority fixtures to #730 current exact09e795db5801b4d2cd8453f0e0d2f06b30189d59. Exact predecessor→current scope is seven files only: active baseline + six authority fixtures; historical archive and foreign-owner authority are unchanged.Fresh #729 current runs are
ci 35937027430,reviewer-ci 35937027412, requiredSecurity Scan 35937027485, andpatch-validator-image 35937027246; all remain queued/nonterminal. Current-head independent/formal review is also not complete. #730 stays09e795db…with its four hosted lanes queued.GitHub Release inventory is still 0. Neither open lane is release authority, and this source/docs-to-code repair does not create SemVer/tag/package/immutable Release/SBOM/provenance/reproducibility/rollback/deployment evidence. Release selection remains fail closed until normal integration and all independent buyer-release prerequisites are satisfied.
2026-09-24 KST release-candidate supersession: #730 current source candidate is
17b3191d16ffccb956275b66b071d727b207be2b; #729 remains08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2but is stale because its active authority still points at predecessor #73009e795db…. #730 current exact hosted runs are nonterminal. This is source/test convergence evidence only; it is not immutable Release, SBOM, provenance, reproducibility, deployment, recovery, or rollback evidence. Release acceptance remains open until protected exact source is normally merged and the immutable release path is actually exercised and verified.Release-candidate supersession (2026-09-24 KST): current source candidate is #730
1cfc08e0be9b922ba332825f1327a728afd28a8con protectedmain@ca32ae2eb8c5ce73af2769d6a58a7ac714503251; #72908e63220…has terminal hosted GREEN but is stale because its active authority still names a predecessor #730 exact. This is source/test authority only. Immutable GitHub Release, version/tag/package, SBOM/provenance, reproducibility, and rollback acceptance remain separate and must not be inferred from hosted checks.2026-09-24 KST release-candidate supersession — #730 current source exact is
2f5adbfe1690025d1bacb565923e0d5681531b13; #729 remains08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2but stale against that foundation. The latest #730 movement is test/doctoring-only repair of a reviewed semantic-oracle false PASS; no production runtime or release boundary changed. Current exact hosted runs are nonterminal and current-head independent/formal review is not yet present. Therefore neither #730 nor #729 is release-ready, and no version/tag/package/immutable GitHub Release/SBOM/provenance/reproducibility/rollback completion is asserted from this source movement.Release-candidate supersession, 2026-09-24 KST: open governance candidate #730 advanced to
660a8cc2f860c3dc7e3e2e9ea5e5034997b9e389via a test-only direct-JSDoc adjacency RED→GREEN plus Proposed doctoring. The change does not create release authority: current hosted exact-head runs areci 35985432304,reviewer-ci 35985432309, requiredSecurity Scan 35985432272,patch-validator-image 35985432318, presently nonterminal, and fresh current-head independent review is still required. #72908e63220…remains stale against this foundation exact. Immutable tag/package/Release/SBOM/provenance/reproducibility/rollback remain unsatisfied until an actually release-ready protected head is selected and the protected release path is executed.Release-candidate authority supersession: current #730 source candidate is
7f9d1264c513934cb55eeaa7a02ce506eac16a61. Fresh review finding on predecessor660a8cc2…was repaired test-first as REDddcc8ad0…→ GREENfc4f1b6c…; current adds code-current Proposed doctoring only. #729 remains stale against this exact and must converge only after #730 is hosted-stable/current-head-reviewed. No immutable GitHub Release, SBOM/provenance/reproducibility/rollback completion is inferred from this source movement.2026-09-24 KST additive release-authority supersession.
Protected Noema is still
main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251, and a fresh GitHub Release read remains empty. The present open lanes are not release authority.#730 is now Draft exact
8bb181f5c51c814507df2721bc69567e36f190ae; its newest ordinary-forward delta is test/doctoring only: RED223187b1…catches a raw-text function-declaration false PASS in the production-docstring oracle, GREEN42183f7d…uses the existing TypeScript devDependency to bind the oracle to an actualFunctionDeclaration, and current adds Proposed TRACEABILITY. Production release/merge authority and the 38-function scope are unchanged. Fresh exact hosted runsci 35996542730,reviewer-ci 35996542701,Security Scan 35996542754,patch-validator-image 35996542750remain nonterminal; formal current-head Noema merge authority is not asserted.#729 remains
08e63220aa06dd1d7c758cacbbe3bf7782c5c6e2and stale against the current #730 authority despite historical terminal GREEN. It must converge once after #730 stabilizes; predecessor GREEN cannot be reused.No version/tag/package/immutable Release/SBOM/provenance/reproducibility/rollback completion is asserted by these source/test changes.
Additive supersession — release candidate authority tracks #730 current exact
4ba169dd652c547786a314b7b0129fa11d563086. RED19ba7993…/ GREEN15d54e25…repairs only the owned production-docstring test oracle's comment-token identity; production merge/release behavior is unchanged. This exact still needs fresh hosted terminal GREEN and current-head independent/formal review. GitHub release authority must not advance from predecessor evidence.
Current release authority — 2026-09-24 KST
Fresh protected Noema is GitHub-verified
main@ca32ae2eb8c5ce73af2769d6a58a7ac714503251, the normal two-parent merge of #726 reviewed sourced32a054c361eb9e9ad6e563d4956d8586ed7d38fonto prior protectedmain@c3a3a42170ac06fbfc5c1a3b32e34827d967b5c9. #726/#727/#728 are protected history. Fresh GitHub Release inventory is still empty. The only open source/docs lanes are #729 and #730, both Draft and neither is release authority.caeeee70de9221b582cb2b9e0e2c1b77b9c10d27. Predecessor51d3d1bd77742f5eccf75ce6167faa11cb97f24freached assigned hosted runners and exposed two post-evaluated-base test-contract drifts: stale five-argument claim-evidence publisher fixtures and GitHub-I/O publication stubs that still modeled a head-only live snapshot. Ordinary-forward314a7db40267889f80caeaa9a9f88fc8c6ba1ae1and currentcaeeee70…repair only those test seams to the six-argument(repo, pr, verdict, head, token_source, base_sha)contract and exact live{state, head, base}snapshot. Production publication/review/merge authority is unchanged. Current hosted runs are application CI35907252412, reviewer-ci35907252577, required Security Scan35907252427, and patch-validator-image35907252418, all nonterminal/queued. Formal current-head Noema merge-authority review remains absent.ed64dc9bd85244f64c5f0c3a477028e536908246. Predecessorf67cb881c09850cfb92a734fb5c39fc48db04754reached assigned runners and release tests exposed an archive/current-authority split: the compact active baseline had lost direct PRD/TRD/UML/ERD/CONTEXT_MAP pointers while fix(agent-runtime): bound current workflow-state response #652/fix(state): keep procedural history hashing outside storage transactions #714/fix(policy-approval): keep cryptographic work outside durable transaction #719 historical assertions still read the active index after lineage moved todocs/history/product-technical-gap-baseline-20260921.md. The ordinary-forward successor redirects only historical assertions to the archive, restores canonical active pointers, and advances the baseline/P0 row plus six executable current-authority fixtures to fix: require canonical governance and normal-merge authority #730caeeee70…. Current hosted runs are application CI35908370542, reviewer-ci35908370590, required Security Scan35908370535, and patch-validator-image35908370487, all queued. Formal current-head Noema merge-authority review remains absent.Current job-level observations on both heads are positive-unassigned for the application/reviewer/required-scope/patch-validator jobs (
steps=[],runner_id=0, empty runner identity); conditional gitleaks siblings arecompleted/skippedwithout runner assignment. Issue #30 owns that classification. These point-in-time observations are not evidence of persistent runner starvation or a release blocker beyond the fact that current required evidence is nonterminal.The release-authority source established through #706/#708/#709/#710/#712 remains protected ancestry: least-privilege release-policy read authority, draft/tag identity control, canonical release documentation, and tag-triggered exact-current-protected-main admission. #722/#723/#724/#725 are protected private-reporting/dependency foundation; #727 Semgrep/readiness, #728 CI lockfile-evidence failure preservation, and #726 external private-reporting source integration are protected history. The two open lanes do not widen publication authority.
Protected source, review, CI, SBOM/vulnerability receipts inside CI, executable documentation, setting evidence and verified merges are not immutable release evidence. Production Environment, deployment, recovery, KPI, reproducibility/rollback and legal/IP/outbound-rights remain separate authority classes.
Buyer-verifiable release contract
A release must bind one exact protected source to a SemVer tag/package identity and immutable GitHub Release, with complete SBOM/dependency-license inventory, provenance/attestation, reproducibility and rollback evidence. Release publication, production Environment governance, deployment receipt, production KPI, controlled recovery rehearsal and legal/IP/outbound-rights remain separate authority classes.
The present protected tip is not automatically a release candidate. Candidate selection must fresh-read current protected source, open gaps, operational/recovery evidence and owner prerequisites immediately before release.
Remaining acceptance
ca32ae2e…after security: evidence external private-reporting surface #726, with fix(sec): clear the seven Semgrep findings without suppressing any of them #727/fix(ci): preserve primary failure when lockfile regeneration is skipped #728 already in protected ancestry.ed64dc9bd85244f64c5f0c3a477028e536908246to obtain formal current-head Noema review and terminal applicable hosted evidence before normal merge.caeeee70de9221b582cb2b9e0e2c1b77b9c10d27to obtain formal current-head Noema review and terminal applicable hosted evidence before normal merge, then retain a fresh protected-source governance receipt under chore(governance): protect main and enforce release checks #27.Boundary
Repository source/review preparation remains executable. The current #729/#730 waits are hosted/review evidence waits only. Live owner/admin provisioning, foreign-owner immutable releases, production Environment, deployment/recovery, elapsed production KPI and legal-transfer evidence block only their own evidence classes. No current PR converts source controls into immutable Release Policy configuration, an immutable Noema Release, production deployment/recovery/KPI, provider/model routing, destination/outbound authority, quarantine/security authority, or legal transfer rights.
Related: #3, #5, #27, #29, #30, #40, #66, #73, #96, #227, #541, #561, #584, #611, #706, #708, #709, #710, #712, #722, #723, #724, #725, #726, #727, #728, #729, #730.