feat(release): Add Stable 1.0 GA promotion#1383
Conversation
Authenticate the exact frozen Stable RC through post-freeze production evidence and explicit GA authorization. Add deterministic promotion records, release artifacts, a maintenance baseline, protected publication workflow, receipt verification, and fail-closed tests.
Align project runbooks and agent skills with the unified evidence model, Stable RC freeze, and exact-byte GA promotion introduced since 32ca700. Clarify no-rebuild identity, post-freeze evidence, protected publication, receipt verification, release-note generation, and maintenance-baseline responsibilities.
Enforce canonical PR-283 artifact names, checksum layouts, publication targets, and exact predecessor identity before authorizing Stable GA promotion. Preserve the selected RC summary through protected publication, exclude rejected waivers from audit records, and render untrusted frozen metadata with collision-safe Markdown code spans and Unicode line-break rejection.
Stage only authenticated RC and manifest inputs in the protected publication artifact so unexpected producer files cannot cross the redaction boundary. Verify the annotated tag object's internal name in both publication and failure-audit paths, and freeze both contracts with focused regression tests.
Reuse the selected Stable RC release ID in the Stable GA example so the documented manifest flow satisfies exact candidate binding. Assert that the checked-in RC and GA examples keep identical release IDs.
Carry every canonical PR-283 checksum target through Stable GA validation and retained publication inputs so authentic RC artifacts can be revalidated without missing-file blockers. Keep the staging boundary closed to unexpected files and lock both workflow boundaries to the engine's canonical checksum contract.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4c986408c3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Authenticate the same-run Stable GA artifact lookup with the workflow token that has Actions read permission. Keep the protected leumor PAT as the default for identity checks and publication writes, and lock the token split with a workflow regression test.
Resolve temporary workspace roots before exercising fail-closed symlink checks so macOS system path aliases do not mask the intended assertions.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7f8abd6dfb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Authenticate the catalog and signature independently through each approved DNS address before recording successful Stable GA publication verification. Keep structural regression coverage around the per-address checks so a single healthy backend cannot mask inconsistent peers.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a58d731300
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Require every approved artifact-base address to return each planned asset with the authorized size and digest. Fail closed on an unreachable, non-successful, or inconsistent backend so publication receipts cannot be based on only one healthy endpoint.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: caa6e76dbd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reverify every artifact-base asset and the authorized rollback catalog at the pre-finalization checkpoint. Keep all public targets ahead of the protected undraft boundary so target drift cannot be discovered only after Stable GA becomes public.
|
1 participant
Summary
certify.py stable-gacommand, example manifest, policy, and closed v1 schemas for exact Stable RC selection, post-freeze validation, explicit GA authorization, promotion planning, publication receipts, and the Stable 1.0 maintenance baselinev284-style integer tags, and update related release, packaging, platform, writing, and operator guidanceRelease and security guarantees
stable-gaexecution cannot create tags, Releases, branches, catalog updates, update descriptors, or network insertsHow to test
./gradlew spotlessApplyactionlint .github/workflows/stable-1.0-rc-release.yml .github/workflows/stable-1.0-ga-promotion.ymlpython3 -m py_compile tools/release-certification/cryptad_certification/cli.py tools/release-certification/cryptad_certification/manifest.py tools/release-certification/cryptad_certification/legacy.py tools/release-certification/cryptad_certification/engines/stable_1_0_ga.py tools/release-certification/cryptad_certification/engines/stable_1_0_ga_core.py tools/release-certification/cryptad_certification/engines/stable_1_0_ga_artifacts.py tools/release-certification/cryptad_certification/tests/test_stable_ga.pypython3 tools/release-certification/certify.py stable-ga --self-test— 70 tests passpython3 tools/release-certification/certify.py self-test all— 254 tests passgit diff --check origin/develop...HEADProtected checks not executed locally
No production signing, protected evidence attestation, real 24-hour soak, live-network validation, tag creation, GitHub Release publication, catalog publication, update-descriptor insertion, or network insertion was performed. Those operations remain gated by the documented protected environments and explicit release-manager authorization.
Operational follow-up
Release managers must populate and protect the
stable-1-0-ga-evidenceandstable-1-0-gaenvironments, retain the exact selected RC artifact and lineage, provide production evidence/authorization and trusted catalog verification inputs, independently host the planned artifact-base bytes, and verify the final publication receipt before calling Stable 1.0 GA complete.