Verify current Flow admission before deriving the docs lifecycle state - #217
Open
abrichr wants to merge 9 commits into
Open
Verify current Flow admission before deriving the docs lifecycle state#217abrichr wants to merge 9 commits into
abrichr wants to merge 9 commits into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Until-revoked admissions could give the docs site an active Production label without checking current authority state or public release artifacts. The browser now requires a generated result from the canonical release verifier, binds it to the latest admission, and checks the current trust objects and the complete signed dependency chain. Missing evidence doesn't restore an older admission.
Package checks retain the current PyPI default-version requirement and verify exact GitHub release/asset IDs, hashes, sizes, uploader identity, tag source, and public tag ruleset fields. The
already-published-pypimode supports releases that predate GitHub immutability, including Flow 1.35.1. Authenticated repository immutability and ruleset bypass settings remain issuance-time evidence. Thedraft-before-tagmode keeps its stronger release-app and immutability requirements.The workflow projection accepts versioned
remote-safe-syntheticbundles while preserving exact source/object hashes and the privacy checks. Cloud and Docs admission histories remain visible; their current active labels need a public deployment observation. Product-wide Production still requires all seven targets.The existing lifecycle check and Pages build validate the retained verification record. These changes add no service, scheduled job, or credential. Tests cover changed trust identities, independent statement expiry, key revocation, missing/yanked/changed artifacts, default-version drift, tag drift, and missing verification records.
The projections and generated Flow result pin canonical commit
5b48240494a250633eec8fcf99fab26553efd0c6, which admits Flow 1.35.1 from source44e99a48ebf048c18892aa17cef6ae594db0d0c2. The full canonical CLI verified the published wheel and sdist. All 33 Python and 31 browser tests, both projection checks, the retained signature check, docs validation, and a strict MkDocs build pass. An anonymous live consumer check verified Flow 1.35.1 alone; the default-install and seven-target checks remained false.Merging this PR changes
docs/**, which starts the existingSync Documentationworkflow and publishes GitHub Pages. Keep the PR unmerged until that publication is approved.Opened by an agent session, not the founder.