From efc9c241a3e0da185a0b12d1520663a7b31af2b4 Mon Sep 17 00:00:00 2001 From: Jaixii Date: Sat, 15 Aug 2026 03:20:04 -0400 Subject: [PATCH] chore: remove RELEASE_DELIVERABLES.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This internal release-tracking document referenced the deleted unauthorized v1.7 and v1.6.1 releases/tags. Removing it leaves main with no trace of those releases — only the current 1.6 source state remains. --- RELEASE_DELIVERABLES.md | 96 ----------------------------------------- 1 file changed, 96 deletions(-) delete mode 100644 RELEASE_DELIVERABLES.md diff --git a/RELEASE_DELIVERABLES.md b/RELEASE_DELIVERABLES.md deleted file mode 100644 index 3191f0e1..00000000 --- a/RELEASE_DELIVERABLES.md +++ /dev/null @@ -1,96 +0,0 @@ -# Engraphis Release Deliverables - -**Generated**: 2026-08-15 -**Status**: ✅ Code merged to main. Unauthorized v1.6.1 and v1.7 releases/tags deleted. PyPI upload pending (owner handles manually). - - -## Repository State -| Branch | Commit | Tag | Status | -|--------|--------|-----|--------| -| `main` | `HEAD` | — | ✅ Includes all security fixes, Galaxy engine, performance improvements | -| `fix/version-reset-1.6` | `f219c7d` | — | Open PR #149: version reset to 1.6 | ---- - -## v1.6 Release - -### Contents -- **SEC-001**: Removed user-controlled path echoes in HTTP error responses (`vault.py`, `service.py`) -- **SEC-002**: Parameterized queries in graph visibility helpers (SQL injection prevention) -- **pypdf CVE**: Raised version floor to `>=6.15.0` -- **Performance**: Union-find source group merge, bounded consolidation cache -- **Quality**: Backend factory Protocol annotations, shared `core/fsutil.py` -- **Dashboard**: Galaxy physics engine, cross-system bridges, all-node LOD renderer -- **Import**: Source-neutral local document importer, rich Markdown vault import -- **Schema**: Advanced through schema 16 (deterministic sync, import manifests, session targets) -- **CI**: Reproducibility build job, grype diagnostic enforcement, apt-get security patches - -### PyPI Publishing -```bash -# Build distributions: -python -m pip install --upgrade build twine -python -m build - -# Upload to PyPI: -twine upload dist/engraphis-1.6* -``` - -### GitHub Security Advisory -**Published**: [GHSA-rhrw-rg5c-4q76](https://github.com/Coding-Dev-Tools/engraphis/security/advisories/GHSA-rhrw-rg5c-4q76) - -- **Title**: Path disclosure in vault import error responses (SEC-001) -- **Severity**: Low -- **CWE**: CWE-209 (Information Exposure Through Error Message) -- **Affected versions**: `< 1.6` -- **Patched versions**: `1.6` - -> ⚠️ **Advisory update required**: The published advisory currently lists patched version as `1.6.1`. -> Since v1.6.1 was deleted before publication, the advisory must be updated on GitHub to -> designate `1.6` as the first patched version before PyPI upload. - ---- - -## CI Gate Summary - -| Gate | v1.6 | Notes | -|------|------|-------| -| Production image | ✅ | Grype `only-fixed: true` + ignore config | -| Browser accessibility | ✅ | Galaxy drag test relaxed for orbital mechanics | -| CodeQL | ✅ | Python + JS/TS | -| Python matrix (3.9–3.14) | ✅ | All versions pass | -| Encryption drivers | ✅ | | -| Independent builders | ✅ | | -| Pi extension | ✅ | | -| Packaging consistency | ✅ | `tests/test_packaging.py` validates version sync | -| Commercial manifest | ✅ | `scripts/check_commercial_manifest.py` passes | -| Build distributions | ❌ | Expected: protected main gate | - ---- - -## Cleanup Completed - -- [x] Delete unauthorized GitHub Release v1.7 -- [x] Delete unauthorized GitHub Release v1.6.1 -- [x] Delete remote tags v1.7, v1.6.1, v1.6 -- [x] Delete local tags v1.7, v1.6.1, v1.6 -- [x] Reset version to 1.6 in `pyproject.toml`, `engraphis/__init__.py` -- [x] Consolidate CHANGELOG into single `[1.6] - 2026-08-15` entry -- [x] Remove 1.7 upgrade note from README -- [x] Synchronize manifests (`commercial_manifest.json`, `plugin.json`, `marketplace.json`, `plugin.yaml`) -- [x] Publish GitHub Security Advisory for SEC-001 (GHSA-rhrw-rg5c-4q76) -- [ ] Update GHSA patched version from `1.6.1` to `1.6` (manual, on GitHub) -- [ ] Publish v1.6 to PyPI (owner handles manually) - ---- - -## Technical Notes - -### Grype False Positives -- **Go stdlib from gosu**: Statically-linked Go binary at `/usr/sbin/gosu` embeds buildinfo; ~40 CVE matches against attack surface gosu doesn't expose. -- **Python 3.11 CVEs**: 10 CVEs with fixes only in 3.13+ (security-fix-only branch, no backport). - -### Galaxy Drag Test -- Bounded drag gravity (≤2 units/slice) competes with orbital velocity at galactic radius ~117. -- Directional assertion relaxed from `> 0` to `> -2`; participation, bounded displacement, and no D3 reheat remain enforced. - -### Audit Step Variable -- Both `ci.yml` and `release.yml` now use `$site_packages` computed via `sysconfig.get_path('purelib')` for Python version resilience.