Skip to content

Commit the accepted SDK #38 aggregate for replacement candidate cd10a3f - #325

Merged
BunsDev merged 1 commit into
mainfrom
evidence/sdk38-aggregate-cd10a3f
Sep 26, 2026
Merged

BunsDev merged 1 commit into
mainfrom
evidence/sdk38-aggregate-cd10a3f

Conversation

@BunsDev

@BunsDev BunsDev commented Sep 26, 2026

Copy link
Copy Markdown
Member

Part of #40. This is the same shape as #319, for the replacement candidate bound in #322 and #324.

Evidence

  • Protected run: Chat run 36222464391 (attempt 1) passed every job, including Windows with the #389 run-root rename retry.
    • Producer 399e1f19 (Chat #390) is tip-only: the dispatch head equals the producer.
    • Validator 67fd5d8a validated and attested the darwin-arm64, linux-x64 and win32-x64 records.
  • Aggregate: cd10a3fa….json (132,293 bytes).
    • Built by aggregate-client-v1-conformance.mjs from a clean validator clone.
    • Inputs were fresh clones at candidate cd10a3f, Cave ecdcdcf8, Coven 8c3735f3, consumer dabcdd47 and harness 399e1f19.
  • Index: cd10a3fa….index.json names each job, deployment, artifact digest and attestation bundle digest. It was built with the contract's canonical serializer and passes parseReviewedEvidenceIndex.
  • Live verification: verify-committed-conformance-evidence.mjs passes live at the evidence commit. It re-queried GitHub and regenerated the aggregate byte-identically.
  • Readiness: strict requireConformanceEvidence passes with the frozen Cave checkout and a token.

Changes

  • The aggregate and index are added. release.config.json names the aggregate. publishingEnabled stays false. No validator runtime file changes.
  • The readiness tests expect the fail-closed "not a complete canonical aggregate" message, as in Commit the first accepted SDK #38 aggregate for the 0.0.1 candidate #319; the 30 s budgets are kept.
  • Docs:
    • the results README, RELEASING's current-state section and the workflow doc name the new record;
    • the 96804bc4 aggregate stays in place as history.
  • The platform artifacts expire 2026-10-26 (UTC).

Validation: full pnpm verify passes, 2976 passed and 2 skipped.

This PR does not issue the #40 disposition. The re-review of cd10a3f's packed bytes follows.

🤖 Generated with Claude Code

Protected Chat run 36222464391 at producer 399e1f19 produced darwin-arm64,
linux-x64 and win32-x64 records for candidate cd10a3f; validator 67fd5d8
accepted and attested all three, with the Windows run-root retry in place.
Aggregating them from clean clones at the frozen revisions yields this
record; the index names each protected job, deployment and attestation
bundle, and release.config.json now names the aggregate. Publication stays
disabled and no validator runtime file changes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings September 26, 2026 06:39

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

Unresolved documentation contradictions remain, and the change warrants human review.

Review effort: Lite
Findings: None

What changed in this PR

Adds the accepted SDK #38 conformance aggregate and evidence index for candidate cd10a3f, while keeping publishing disabled.

Changes:

  • Binds the aggregate in release.config.json.
  • Updates readiness tests and release documentation.
  • Records current and historical conformance evidence.
File Summary Review note
tests/​release-readiness.spec.ts Updates readiness expectations. —
tests/​release-environment-policy.spec.ts Updates policy expectations. —
tests/​release-artifacts.spec.ts Updates artifact expectations. —
RELEASING.md Documents accepted evidence. —
release.config.json Names the new aggregate. —
docs/​workflows/​client-v1-cross-repository-conformance.md Documents the aggregate. Nit (1 vote): contradictory current-state text remains.
docs/​client-v1-cross-repository-results/​README.md Identifies current results. Nit (1 vote): contradictory historical text remains.
docs/​client-v1-cross-repository-results/​cd10a3fa1d9900e0dbcb04bbb2477140854fba1d.json Adds platform conformance evidence. —
docs/​client-v1-cross-repository-results/​cd10a3fa1d9900e0dbcb04bbb2477140854fba1d.index.json Adds evidence metadata and digests. —

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@BunsDev
BunsDev merged commit 1248723 into main Sep 26, 2026
9 checks passed
@BunsDev
BunsDev deleted the evidence/sdk38-aggregate-cd10a3f branch September 26, 2026 06:45
BunsDev added a commit that referenced this pull request Sep 26, 2026
)

* Record the #40 disposition for replacement candidate cd10a3f: SHIP

cd10a3f has a passing, attested, live-verified aggregate (#325), and its
packed bytes carry the F4, F5 and F1 fixes that blocked 96804bc. Automated
checks pass at the candidate commit, and an independent review of the
runtime code added since aec0690 finds one Low item (R1: managed
familiarContract and familiarAnalytics skip the JS downgrade guard), which
the release owner accepted with a follow-up due 2026-10-24, plus three
informational notes. Publication stays gated by #41.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Distinguish the prepublishOnly release gate from shipped lifecycle scripts

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants