Release readiness: dev -> main

[github-actions]

Release Readiness Snapshot

• Generated at: 2026-04-16T16:33:36Z
• Workflow ref: dev
• Workflow SHA: fa9e08ee8086915e13da7e97bb3da591581db00f
• Workflow run: https://github.com/plaited/plaited/actions/runs/24521953252
• Branch-of-record: true
• Raw topology range: origin/main..origin/dev
• Raw topology compare URL: main...dev
• Effective compare URL: fa9e08e...dev
• Dev SHA sampled for check-runs: fa9e08ee8086915e13da7e97bb3da591581db00f
• Main commit count ahead of dev: 0
• Raw commits not reachable from main: 690
• Raw changed file count against main: 0
• Topology noise detected: true
• main_to_dev_sync_required: false

Effective Unreleased Range

Release PRs are squash-merged into main, so raw origin/main..origin/dev can include
historical dev commits whose content is already represented by main’s squash commit.
Human release review should use the effective unreleased range.

• Effective range base SHA: fa9e08ee8086915e13da7e97bb3da591581db00f
• Effective range base subject: chore(release): sync main back to dev
• Latest post-release sync commit found: true
• Latest post-release sync SHA: fa9e08ee8086915e13da7e97bb3da591581db00f
• Latest post-release sync subject: chore(release): sync main back to dev
• Effective range: fa9e08ee8086915e13da7e97bb3da591581db00f..origin/dev
• Effective compare URL: fa9e08e...dev
• Effective commit count: 0
• Effective changed file count: 0
• Effective range fallback: false
• Effective range fallback reason: none

Effective Changed Files (shown when count <= 50)

• (No changed files)

Effective Diff Stat

(No diff-stat entries)

Raw Topology Diagnostics

• Raw topology range: origin/main..origin/dev
• Raw topology compare URL: main...dev
• Raw commits not reachable from main: 690
• Raw changed file count against main: 0
• Topology noise detected: true

Raw Topology Commit Diagnostics (max 10)

• fa9e08e chore(release): sync main back to dev
• d72d662 fix(workflows): align release PR gate with readiness packet
• 441272d fix(eval): use secure temp directories in smoke tests
• 0bd0fdb docs(eval): document external artifact contract and add CLI schema/fixture smoke tests (docs(eval): document external artifact contract and add CLI schema/fixture smoke tests #289)
• 25ffec9 docs(skills): add plaited-eval and plaited-eval-adapters skill docs (Eval Library Extraction / Shared Eval Spine #281) (docs(skills): add plaited-eval and plaited-eval-adapters skill docs (GH-281) #292)
• ebc2b59 fix(tooling): default issue executor to headless cline (fix(tooling): default issue executor to headless cline #288)
• ce8a538 feat: add BP-mediated inference bridge skeleton (feat: add BP-mediated inference bridge skeleton #287)
• 9da5cf8 fix(tooling): align issue executor with lifecycle active state (fix(tooling): align issue executor with lifecycle active state #286)
• bf3dfdf feat(tooling): add explicit issue lifecycle apply mode (feat(tooling): add explicit issue lifecycle apply mode #275)
• 68a6035 fix(tooling): require PR template headings in executor prompts (fix(tooling): require PR template headings in executor prompts #274)
• ... truncated: showing first 10 of 690 raw topology commits

Release-Readiness Output

ready: true
reason: No P0/P1 blockers detected from deterministic checks.
risk_level: none
suggested_version_bump: none
release_notes_draft: No fresh unreleased commits after the effective post-release sync boundary.
effective_range: fa9e08ee8086915e13da7e97bb3da591581db00f..origin/dev
latest_post_release_sync_sha: fa9e08ee8086915e13da7e97bb3da591581db00f
latest_post_release_sync_found: true
effective_range_fallback: false
effective_range_fallback_reason: none
effective_commit_count: 0
effective_changed_file_count: 0
raw_topology_range: origin/main..origin/dev
raw_commits_not_reachable_from_main: 690
raw_changed_file_count_against_main: 0
topology_noise_detected: true
main_to_dev_sync_required: false
required_human_checks:
  - Confirm release scope and version bump from commit intent.
  - Confirm no undisclosed security exceptions are being accepted.
  - Confirm validation evidence for changed runtime/package surfaces.
  - Confirm post-release main -> dev sync plan (merge commit, no reset/rebase/force-push).
blocking_items:
  - none
included_prs_or_commits_summary:
  - No effective unreleased commits after the latest post-release sync boundary.
changed_surfaces:
  - (No changed files)
validation_summary: Dev checks_collection_status=available; dev_sha=fa9e08ee8086915e13da7e97bb3da591581db00f; checks_waited_seconds=60; max_check_wait_seconds=180; check_poll_interval_seconds=15; security_token_source=release-readiness-secret; codeql_collection_status=available; dependabot_collection_status=available; secret_scanning_collection_status=available; default_setup_collection_status=available; check-runs total=3; failures=0; pending=0; neutral_or_skipped=0; ignored_release_operator_checks=1.
security_summary:
  security_token_source: release-readiness-secret
  codeql_collection_status: available
  dependabot_collection_status: available
  secret_scanning_collection_status: available
  default_setup_collection_status: available
  codeql_open_by_severity: {
  "medium": 2
}
  dependabot_open_by_severity: {}
  secret_scanning_open_count: 0
  codeql_query_suite: extended
  blocking_security_items:
    - none

P0/P1 Checklist

• No open secret-scanning alert (or explicit triage/dismissal rationale documented).
• No open critical CodeQL alert.
• No open critical Dependabot alert.
• No open high/critical CodeQL alert touching shipped changed files.
• No open high Dependabot alert for shipped/runtime dependencies.
• Security checks are complete and not pending/unknown.
• Workflow/security setting changes include explicit rationale and do not weaken posture.

Deterministic Check Summary

• Dev SHA: fa9e08ee8086915e13da7e97bb3da591581db00f
• Checks collection status: available
• Waited seconds: 60
• Max wait seconds: 180
• Poll interval seconds: 15
• Final check-runs total (excluding release operator checks): 3
• Final failures: 0
• Final pending: 0
• Final neutral/skipped/stale: 0
• Ignored release operator checks: 1

Deterministic Security Summary

• Security token source: release-readiness-secret
• CodeQL collection status: available
• Dependabot collection status: available
• Secret-scanning collection status: available
• CodeQL default-setup status: available
• CodeQL open alerts by severity: { "medium": 2 }
• Dependabot open alerts by severity: {}
• Secret-scanning open alert count: 0
• CodeQL query suite: extended
• Unavailable security facts are treated as residual risk and a P1 blocker.
• Blocking security items:
• none

Included PRs (Deterministic Match)

• (No merged PRs deterministically matched this range)

Human-Review Commit List (Effective Unreleased Range)

• (No effective unreleased commits)

Changed Surfaces

• (No changed files)

Branch Strategy Reminder

• Release PR target is dev -> main.
• Release PR should use squash merge.
• After squash release, sync main -> dev with a merge commit.
• Never reset/rebase/force-push dev.
• Raw topology diagnostics remain available, but human review should prioritize the effective unreleased range.

Human Decision

• Open release PR
• Hold for P0/P1
• Request fixes
• Accept known risk with rationale

[EdwardIrby]

Post-release reset: release PR #293 was merged, publish completed, main was synced back into dev with merge commit fa9e08e, and release-readiness now reports effective_commit_count=0 with ready=true/risk_level=none. Closing this readiness packet so the next release cycle starts fresh.