diff --git a/devlog/_plan/261003_release_stabilization/000_plan.md b/devlog/_plan/261003_release_stabilization/000_plan.md new file mode 100644 index 00000000000..46786cdd92d --- /dev/null +++ b/devlog/_plan/261003_release_stabilization/000_plan.md @@ -0,0 +1,77 @@ +# Stabilize the next production release + +The recovered train is integrated, but new request failures and pending account, +pairing and accounting reviews need disposition before publication. Five isolated +implementation lanes prepare reviewed changes; this coordinator lands ready PRs +serially, verifies the complete candidate, and publishes the next stable release. + +## Loop contract + +- Archetype: satisfy-spec, C4 integration/release; trigger: explicit maintainer request + to use inherited parallel worktree tasks and leaf subagents through deployment. +- Goal: address the listed scope, land safe changes progressively and verify production + publication. Each lane owns its goal/FSM; leaves own neither and cannot spawn. +- Non-goals: unrelated features, native GitHub stacks, changing branch protection, + new credentials, account preference changes, or replacing the operator's installed app. +- Verifier: focused activated regressions and exact-head required PR CI, then final + candidate lane=all CI, release-line push CI and actual publication/artifact checks. +- Stop: all five work phases have evidence and production deployment is verified. + Missing native evidence remains missing; closing an issue does not prove acceptance. +- Artifacts: this numbered unit, lane-owned numbered units, and ignored + `.tmp/release-stabilization/` receipts. Unpublished security notes stay in scratch. +- Outcomes: DONE only with verified release; unresolved gates remain open. Host blocked + status follows its recurrence rule; timeout/compaction is not a terminal result. +- Escalation: unavailable required access or policy conflict; no invented approval or + weakened verification. Main reclaims only failed/retired lane work with provenance. +- Resources: existing repository/GitHub access and configured environments only; no + new paid resources. No user token/time budget. Bounded commands, one CI observer, + focused local tests under concurrent-worktree resource exception; CI covers breadth. + +## Dependency order + +1. `roadmap`: docs-only proposal, main dispositions, architect reflection, independent + audit and document checks. Locks this ownership and acceptance map. +2. `stabilize`: execute [010](010_stabilization.md). Five worktree tasks prepare + implementation PRs with inherited leaf reviews. Main integrates serially as ready. +3. `regression`: execute [015](015_independent_regression.md), a separate PABCD cycle + with parallel independent inherited regression subagents before publication. +4. `candidate`: execute [020](020_candidate.md) after regression closure. +5. `publish`: execute [030](030_publication.md) after candidate acceptance. + +Lane P phases own exact patch plans based on the current source. This coordinator +roadmap owns their dispatch and integration interfaces, not speculative implementations +of defects not yet diagnosed. No lane enters B without its own audited diff-level plan. + +## Measured starting state + +At initial inspection the previous full CI was successful at `7c59baf9597fbad188c49bb562bdd4858275766d` +(run 37110109894). Dev subsequently advanced; the initial fetched baseline for this +unit is `b82b39018b48ad489110b4165ee2cd9ba30433d5`, including #6501, #6506 and #6498. +The version sources report 2.77.0; latest stable is v2.76.0. Re-read both before selecting +the publication version. The current branch is `codex/release-stabilization-261003`. + +Repository authorities: `MAINTAINERS.md`, `scripts/release.ts`, +`structure/ops/docs-and-release.md`, `.github/workflows/ci.yml`, +`.github/workflows/service-lifecycle.yml`, `.github/workflows/release.yml`. +Structure ownership remains with each implementation area; each lane updates its +matching structure and user documentation in the same implementation PR. + +## Consultation and continuity + +Architect (receipt retained in private coordination evidence) proposed ARC-01 through ARC-05. +Main accepts ARC-01 five lanes, ARC-02 B-before-E shared ownership, ARC-03 serial +integration with A preceding final E composition, ARC-04 native acceptance ownership, +and ARC-05 version pre-move and exact release-event proof. The same architect read +these four concrete documents and returned ALIGNED with ARC-01 through ARC-05, +with no remaining architectural gaps. Independent reviewer +(receipt retained in private coordination evidence) passed the original plan and ARC-06 supplement. +Its gate-recording clarification was folded into 010 and rechecked: VERDICT PASS, +no remaining blockers. No implementation or +release readiness is claimed by this roadmap. The preceding completed recovery unit +established integration readiness, explicitly not a publication receipt; this new unit +adds the user-authorized fixes, acceptance and publication. + +User steering added ARC-06: a separate independent parallel regression PABCD cycle. +The same architect reflected ALIGNED and identified one SHA handoff gap. Main folded +it into 020: candidate C must equal the regression-approved SHA; intervening product +changes require affected regression and matrix review. This preserves the accepted flow. diff --git a/devlog/_plan/261003_release_stabilization/010_stabilization.md b/devlog/_plan/261003_release_stabilization/010_stabilization.md new file mode 100644 index 00000000000..55437c5d02e --- /dev/null +++ b/devlog/_plan/261003_release_stabilization/010_stabilization.md @@ -0,0 +1,71 @@ +# Scoped stabilization and progressive integration + +Depends on the roadmap. The change is from open/unverified source PRs to reviewed, +tested PRs landed on dev with traceable authorship and issue dispositions. + +## Dispatch change map + +NEW ignored `.tmp/release-stabilization/lanes.json`: per lane id, canonical task/host, +worktree, branch, base SHA, scope, PR/head, status and evidence. Creation receipts +retain provisional IDs separately until host evidence establishes canonical identity. +MODIFY this unit with source PR dispositions and integration proof as each lands. +No runtime edits are authorized by the roadmap cycle itself. + +Five ordinary worktree tasks start on freshly fetched dev, use inherited model settings, +and may commit, push their own branches, create/revise PRs and run relevant CI. Only the +coordinator merges, closes superseded sources, promotes or publishes. Existing PRs are +preferred when writable and coherent; carries preserve Co-authored-by trailers. + +Creation during the coordinator roadmap is planning-only: P/A/docs are allowed, +but runtime edits, pushes and CI dispatch wait for the coordinator's explicit +`ROADMAP LOCKED` message after the roadmap D receipt. Record its commit/receipt +and per-lane delivery result in the manifest. Pending creation is not permission +to recreate a lane; verify the canonical task identity before delivering the gate. + +| Lane | Scope | Primary runtime owners | Required activated evidence | +| --- | --- | --- | --- | +| A | #6504, #6508 | `src/server/responses/fetch-helpers.ts`, Messages/Responses error translation | oversized input yields actionable non-retrying error; large native UTF-8 upload preserves bytes and completes; small/non-native paths unchanged | +| B | #6496, #6507, #6505 | `src/codex/auth-api/`, `src/codex/main-account.ts`, account runtime/store, `src/combos/failover.ts`, Responses auth/combo files | revoked credential refresh/refusal; caller-owned bearer separation; plan-ineligible target hops while unrelated 400 remains terminal | +| C | #6502/#6497, #6509 | `src/providers/antigravity-models.ts`, `src/usage/expected-prices.ts`, `src/adapters/ollama-native.ts` | actual discovered wire IDs/effort routes including saved selection; live 404 comparison if accessible; tool batch/commentary/results replay with orphan and duplicate negatives | +| D | #6076 | `src/cli/gui.ts`, `src/lib/gui-pair-capability.ts`, `src/server/gui-session.ts`, management link routes/registry | independent security review; legitimate enrollment and join remain usable; unpaired attempts rejected; real bounded enrollment/join/restart acceptance | +| E | #6370, #6378 | spend ledger/continuity/budget, request accounting, `src/oauth/anthropic-routing.ts`, `src/oauth/index.ts`, token detection/store | historical upgrade admission and budget conservation; unresolved/corrupt history preserves guard; account rotation cannot adopt unrelated identity | + +Each lane owns adjacent tests and its structure/user docs. Test inventory edits are +additive and the coordinator reconciles both inventories. B owns auth changes in +`core-options.ts`/`core-combo.ts`; E owns spending changes and rebases after B before +claiming merged-tree proof. A must coordinate any auth/combo overlap before writing. +A also lands before E's final composition checks; C and D prepare independently. +No concurrent checkout has authority over another lane's branch. + +## Integration procedure + +1. Refresh live dev, source PR head/base, membership and current reviews. Capture exact + diff/commit provenance in scratch; do not replay stale patches unreviewed. +2. Each lane plans and audits its exact changes, performs activated focused tests, + typecheck, privacy/structure and applicable GUI/docs checks, then independent review. + Findings are fixed or rebutted against source evidence, never cleared by fiat. +3. PR readiness requires successful exact-head required CI with actual expected tests; + absent, skipped, cancelled or old-head tests do not pass. Record security approval + for auth/pairing/accounting boundaries. No lane runs final lane=all CI. +4. Coordinator verifies the returned diff, attribution, live head/base and review state, + records authorized maintainer integration, and merges one PR at a time. A failed + validation prevents the merge command. Refresh the next lane against landed dev. +5. Resolve post-merge review threads, close actually superseded source PRs with carry + links, and close resolved issues with truthful acceptance limits. + +Coordinator additionally owns #6220 launcher replay and #6473 Windows autostart acceptance. +Use available isolated environments, preserve production state and redact observations. +An absent launcher/account/Windows session is an explicit unmet native acceptance row, +not a passing fixture test. Classify its actual release consequence before candidate GO. + +Security-sensitive findings or draft repair reasoning remain in ignored scratch. +Public plan text records only already-public scopes. A source PR with unresolved +adoption defects may be excluded only with an explicit evidence-backed disposition; +an unresolved existing release blocker cannot be hidden by excluding its proposed fix. + +## Completion evidence + +For every named item: current state, source and landed SHA or precise exclusion, +test commands/results, CI event/run/attempt/SHA, review/security disposition and +remaining native limits. Preserve failures. Do not run five full local suites in +parallel; focused local coverage plus required hosted coverage is the declared strategy. diff --git a/devlog/_plan/261003_release_stabilization/011_native_and_merge_acceptance.md b/devlog/_plan/261003_release_stabilization/011_native_and_merge_acceptance.md new file mode 100644 index 00000000000..ce7d29534e4 --- /dev/null +++ b/devlog/_plan/261003_release_stabilization/011_native_and_merge_acceptance.md @@ -0,0 +1,72 @@ +# Coordinator stabilization acceptance + +Consumes 010 after roadmap D at commit 2152fdfeb8. The prior conclusion was a +locked five-lane plan with a separate final regression phase, not runtime success. +Architect decisions S-01 through S-06 below refine that same direction. + +## S-01: native acceptance receipts + +NEW ignored `launcher-acceptance.json` and `windows-acceptance.json` under +`.tmp/release-stabilization/`: source/artifact SHA, prerequisites, invoked synthetic +scenario, expected/observed result, cleanup and verification boundary. + +For #6220: + +1. Read-only discovery establishes whether the actual launcher is installed, reachable + and already authenticated. Do not install a browser extension or retrieve cookies. +2. If available, use a fresh isolated CLI home/session and the same synthetic prompt + against the launcher directly and through an isolated proxy at the candidate SHA. + Both must complete the same minimal current-turn request. Then exercise one bounded + synthetic client-owned tool result and its follow-up through both routes. +3. Enable only the carried per-provider compatibility opt-ins in the isolated proxy + config; preserve ordinary-provider stripping and xAI ID repair in focused tests. +4. Capture structural/error metadata only, never cookies, tokens or private histories. + Stop only owned processes and remove only owned temporary state. If the required + launcher/account is missing, record NOT EXECUTED with prerequisites and rationale; + fixtures cannot certify this acceptance. + +For #6473: + +1. Read-only discovery checks available Windows host/toolchain and installed artifact + identity. Do not toggle the operator's existing Start at Login setting or overwrite + its Run entry as an incidental test. +2. If the patched packaged app can be exercised in an isolated Windows user/session, + verify first registration quotes the executable under a path containing spaces; + seed the legacy unquoted entry in that isolated profile, run the repair path, and + read back the quoted command with arguments intact. Exercise login startup there. +3. If only native test execution is available, run a source-derived bounded probe with + a unique temporary registry value and owned executable path; verify registration, + repair and cleanup through actual Windows APIs. Report this as native component + proof, not packaged-installer or login acceptance. +4. No unavailable package/session is treated as tested. Final release disposition + distinguishes the report's observed registration defect from an unconfirmed startup + failure and states precisely which behavior the collected evidence covers. + +## S-02 through S-04: merge handoff + +S-02 preserves A/B-before-E final composition and permits C/D in independent ready slots. +S-03 adds per-head merge receipts: source PR/head, carry authors, current base, test +coverage, exact-head CI event/run/attempt, independent review/security verdict and limits. +S-04 uses `scripts/ci/assert-mergeable-review.sh --maintainer-integration` for dev only. +The helper is actor/review evidence, not CI/security proof. A failed command stops the +dependent merge. Immediately re-read live head, dev target, actor and objections before +head-pinned merge, then verify the actual merge commit and late review threads. + +The helper has been read from source and its command shape verified. It is intentionally +not run against an arbitrary PR during planning: no lane candidate exists yet. Each +candidate's actual invocation is recorded before its own merge; no passing claim exists now. + +## S-05 and S-06: phase handoff + +S-05 sends completed stabilization to 015 independent parallel regression; native +receipts and lane reviews do not replace that phase. S-06 keeps publication outside +this work phase, preserves main approval/push-CI policy and retains actual native gaps +for the final release-impact decision. A goalplan label never grants bypass authority. + +## Consultation + +Architect (receipt retained in private coordination evidence) proposed these six decisions. +Main accepted them. The same architect reflected ALIGNED on 011/010/015 with no +material gaps. Independent reviewer (receipt retained in private coordination evidence) +checked 010/011/015 and the policy boundary: VERDICT PASS, no blockers. This is +plan acceptance only; runtime/native and merge evidence is still required. diff --git a/devlog/_plan/261003_release_stabilization/012_integration_evidence.md b/devlog/_plan/261003_release_stabilization/012_integration_evidence.md new file mode 100644 index 00000000000..9151fe76aac --- /dev/null +++ b/devlog/_plan/261003_release_stabilization/012_integration_evidence.md @@ -0,0 +1,128 @@ +# Progressive integration evidence + +This records landed work and remaining gates, not a production release receipt. + +## Landed scope ledger + +| PR | Landed dev commit | Final PR CI | Disposition | +| --- | --- | --- | --- | +| #6513 | `e77bfb4901d405724edc4295caf5d9f0675a672e` | 37130246238 | #6508 fully superseded and closed | +| #6519 | `a141b83623a3f1677f23477e91b9a42a74f495f7` | 37131234397 | #6509 fully superseded and closed | +| #6516 | `36330ae2ef120daa75566280f9c0b1e51eb2a36b` | 37132320824 | #6504 proxy-error bug closed with explicit upstream/client limits | +| #6514 | `aa40fb4158260196669346ab0e0dd55f679fd13e` | 37132498856 | #6497 partially carried; source remains open | +| #6515 | `e601cefcebcc20b2e04a04821ab45df6538d98f9` | 37132811309 | #6496 fully superseded and closed | +| #6518 | `358b8ffd4c7f95237dadee1e9a5b4fedb671f4f4` | 37135487096 | #6378 superseded and closed after identity/cleanup review closure | +| #6517 | `a99de42e7a5986c2443805fa6d833b8152f967ff` | 37135315210 | #6076 subsequently marked MERGED by preserved ancestry | +| #6523 | `a41f67273c4937b852f26d726001641fe2026f63` | 37145111209 | #6507 account behavior carried; source superseded and closed, diagnostic-text logging excluded | +| #6527 | `ab68539036fa89e0734ea21aa6b525ae4cc3ae36` | 37146395644 | #6505 superseded and closed; nested-only HTTP follow-up pending | +| #6538 | `efc20e700b6fce67578e07b94336fc71aebc5a1c` | 37148359842 | Existing-format capacity guard; canonical #6370 remains excluded | + +All listed runs are successful final-head pull_request runs. Their actual checkout +logs, selected executed jobs, actor/base/head gates and post-merge review counts +were inspected. Later integrations also compare the computed union with the actual +merged parent/tree and check repository line caps plus test-map parity. Full +cross-platform candidate coverage is still a separate unmet gate. + +Canonical spend integration remains open. +The identity cleanup findings were repaired and closed at the exact merged head; +pairing's original technical objection was addressed with actual CLI/HTTP/native +evidence, without dismissing another maintainer's formal historical review. The +optional CodeRabbit queue was pending on #6517 and explicitly not counted as a +passing review; all published findings were resolved and independent review passed. +Final late-review checks remain required. A local broad import-graph run with failures is preserved as +failed diagnostic evidence, never relabeled as passing by these PR results. + +The stored-main carry includes alternate-resolution cancellation, read-fence and +late pinned-selector/diagnostic/single-snapshot repairs. A final additive hard-lock +spy changed the head; the head-pinned guard stopped the attempted old-head merge, +and the new head received its own CI and narrow independent closure before landing. + +## Large native HTTP uploads + +PR #6513 merged into dev as `e77bfb4901d405724edc4295caf5d9f0675a672e`. +Reviewed head: `db094c49c7cce13500b1f1f63678f174261fc9af`. +Required scoped CI: run 37130246238, attempt 1, pull_request event, success. +The actual checkout log binds that head to base `9f89b7265b754eb681215ad327fc9459af37b9e1`. +All four Linux shards and expected scoped auxiliary jobs ran successfully; full +macOS/Windows suites were skipped by scope and remain for the final candidate. + +The coordinator reviewed the final-send conversion, destination/egress/header/abort +boundaries and no-replay behavior, inspected local 199-pass/one-runtime-skip evidence, +and verified the six-failure mutation result. The documentation threshold finding +was fixed; zero review threads remained unresolved after merge. The maintainer +integration/security decision is recorded on the PR. + +Source #6508 remained at the fully carried head `dd4fc9a8f732699d88f46058c3298073d9aa2317`. +It was commented, labeled superseded and closed after landing, with source author +credit retained. Child #6516 must consume the actual landed dev base before merge. + +## Shared registry repair + +B's separate commit `29a9e91f400d24ac746a18dfe3af357f5da6dec3` removes 31 identical +duplicate entries from each test-layout registry. The coordinator independently +verified duplicate-value equality and unchanged parsed mappings. C/D may adopt that +same repair while retaining their unique registrations. This does not raise a cap +or remove a test; hosted union checks still govern each candidate. + +## Native acceptance limits + +The Windows production command helper compiled and ran on Windows 11: three tests +passed. A separate native CommandLineToArgvW probe passed four quoted-path cases +and the expected failure of an unquoted negative control. The source hash is +`6c8e206b36e8330c6fd1888960d798144de29319d7debb8cfbb567173117c583`. +These results do not establish packaged registration/migration or login startup. + +A focused source review falsified the suspected Task Manager override regression: +the pinned auto-launch 0.5.0 status implementation checks StartupApproved before +the migration writer is called. No code change follows that disproven hypothesis. +Native disabled-registry behavior remains untested. + +No running real launcher was available for #6220's direct/routed tool-followup +acceptance. It remains NOT EXECUTED. Neither this fact nor an administratively +closed issue is converted into passing runtime evidence. + +## Model-refusal carry and combined boundary check + +PR #6527 landed at corrected head `af350a1924ee55ddc60fe9fa04289d1aa494f437` +with independent family-level review and explicit security review. Its applicable +CI ran against current dev `a41f67273c4937b852f26d726001641fe2026f63`; the merged +union tree matched the reviewed head tree. Source #6505 was closed as superseded +after the carry landed, with attribution preserved. + +The original late-review correction was insufficient for mixed root/response +envelopes. The replacement applies a shared field-presence rule, with null and +nonmatching values covered. Local evidence records four failures before repair, +79 passes after repair, and 374 broader focused passes. The HTTP400 constraint +and existing SSE status reconstruction remain explicit limits. + +After integrating the nine implementation carries into the coordinator checkout, +`bun run test` with eight explicit files passed 281 tests / 1422 assertions. The +files cover native upload boundaries, Claude outbound and Messages errors, Ollama +replay, combo plan/model refusal, stored-main refresh, alternate cancellation and +grant refusal. The command and full output are retained in the ignored integration +receipt. This is a combined boundary check, not the separate final independent +parallel regression or complete platform CI; both remain pending. + +## Inclusion decision and outstanding repairs + +The canonical spend migration proposed for #6370 is excluded from this release. +Upgrade and recovery compatibility acceptance did not pass; the original PR stays +open and its implementation work remains preserved in the owning worktree. This +decision does not declare existing spend behavior correct. The independent existing-format capacity guard in PR #6538 landed after review +and successful exact-head CI37148359842. Its ledger format and hashing are unchanged. +Private investigation and review evidence remain in ignored scratch. + +A post-merge review of #6527 identified a nested-only HTTP error-carrier case that +still stops fallback. It is assigned to follow-up PR #6540 with independent +closure and fresh CI; final regression cannot start from the current known-defective +head. Lane C fixture repairs also remain pending. Final independent regression has +not run; it starts after pending repairs land and their required checks pass. PR #6536 +(`dd9a980ec071285e628a35d8cdefaea785b8916b`) separately archives Lane B's public +record, with corrected checkpoint counts and successful docs-only CI37147122129. +Its skipped runtime jobs are not counted as runtime verification. + +The #6538 review records a nonblocking diagnostic limitation: native handlers can +report a generic spend-exhausted reason when capacity prevented booking. The send +is refused correctly. Supplied focused evidence totals 213 passes, and the original +capacity probe changes from failure before repair to success after it. Final +combined acceptance remains pending the other scoped repairs. diff --git a/devlog/_plan/261003_release_stabilization/015_independent_regression.md b/devlog/_plan/261003_release_stabilization/015_independent_regression.md new file mode 100644 index 00000000000..c87a2b14172 --- /dev/null +++ b/devlog/_plan/261003_release_stabilization/015_independent_regression.md @@ -0,0 +1,38 @@ +# Independent adversarial regression before release + +Depends on scoped stabilization. This separate PABCD work phase implements the user's +additional requirement: parallel inherited subagents stress the integrated candidate, +then findings are repaired and rechecked before final CI and publication. + +NEW ignored `.tmp/release-stabilization/regression-matrix.json`: candidate SHA, +per-surface test commands, activated scenarios, child identity, outcomes, diagnostics, +cleanup receipts, findings and repair/retest links. MODIFY the release unit only with +sanitized outcomes. Runtime repairs require a bounded audited patch plan and PR; never +edit a frozen candidate under still-running verification workers. + +At P, pin integrated dev and prepare independent packets grounded in the actual diff. +At A, audit scenario reachability and coverage gaps. At B, dispatch fresh-context leaf +subagents with inherited settings and disjoint testing/process/state ownership: + +1. Native credential/account/combo regression: revoked grants, transient failures, + true caller credentials, replacement tokens, ineligible models and unrelated errors. +2. Requests/compaction/tools: oversized input and recovery, multi-byte large upload, + cancellation/replay refusal, partial tool batches, commentary, duplicate/orphan IDs. +3. Pairing/accounting/upgrade: legitimate enrollment and negative auth, one-time/expired + capabilities, old ledgers and ambiguous history, budget conservation, credential + identity rotation. Unpublished security diagnostics remain in ignored scratch. +4. Provider/platform integration: Antigravity discovered/saved effort paths, launcher + replay, Windows startup registration/repair and available packaged smoke evidence. + +Leaves must not run git mutations, spawn, mutate goals/FSM, change user account state, +or share OPENCODEX_HOME/temp directories. Use distinct owned fixtures and bounded +process trees; obey shared test locks and do not remove another worker's lock. +Parallel independent analysis/test preparation is required; resource-heavy commands +may be scheduled to avoid invalidating each other's evidence. No five full suites. + +C verifies every returned command/result and reproduces actionable findings. Repairs +land through reviewed PRs and trigger affected regression rechecks at the new SHA; +unrelated passing commands are not repeated without a reason. A fresh independent +reviewer audits the complete matrix and residual risks. D closes only with findings +resolved or explicitly disproven, reachable negative-path evidence, honest native +coverage limits and a concrete GO/NO-GO for final candidate CI. diff --git a/devlog/_plan/261003_release_stabilization/020_candidate.md b/devlog/_plan/261003_release_stabilization/020_candidate.md new file mode 100644 index 00000000000..32665c03d40 --- /dev/null +++ b/devlog/_plan/261003_release_stabilization/020_candidate.md @@ -0,0 +1,32 @@ +# Final candidate verification + +Depends on independent regression closure. NEW ignored candidate receipt JSON records the immutable +SHA, intended version, merged PR ledger, runtime delta and workflow observations. +MODIFY this unit with the GO/NO-GO decision; no unplanned product change belongs here. + +1. Fetch dev, verify every scoped disposition and review thread after merge, and pin C. + Inspect concurrent landed changes rather than silently adding an unreviewed release. + C must match the regression-approved SHA. Any intervening product delta returns + through affected regression checks and independent matrix review before candidate GO. +2. Run `gh workflow run ci.yml -R lidge-jun/opencodex --ref dev -f lane=all` only once + the integration set is settled. Verify the created run's head SHA equals C. If the + ref raced, preserve the receipt and obtain valid evidence for the actual candidate. +3. Observe run/attempt and jobs with bounded waits. Require Linux/macOS/Windows test + shards, applicable package/keyring/helper jobs, docs/GUI/structure/privacy and + desktop build proof. Record all skips distinctly. Use repository's existing + `.tmp/train-recovery/verify-final-ci.py` only after inspecting its assumptions; + otherwise inspect raw job and step data directly. The previous run is not proof. +4. Failure means a named repair task/cycle, regression evidence and rerun of affected + coverage plus candidate consistency. Never increase caps or weaken assertions just + to obtain green. Preserve the failed run and exact triggering command. +5. C is the code/version snapshot to promote. Later dev pre-move does not change C. + Review the candidate-to-promotion delta and require only intentional version or + history changes; additional product changes invalidate the candidate proof. + +Existing #4956 is a CI-completion risk: an incomplete/hung required job blocks GO. +An issue remaining open alone is not a failed candidate. #6220/#6473 retain explicit +native evidence limits even if their administrative issue states are closed. + +The final independent gate reads candidate SHA, coverage receipts, security dispositions, +remaining native limitations and source PR lineage. No GO with unresolved release blockers. +This full candidate run does not replace mandatory push-event CI on the main promotion SHA. diff --git a/devlog/_plan/261003_release_stabilization/030_publication.md b/devlog/_plan/261003_release_stabilization/030_publication.md new file mode 100644 index 00000000000..06f70d72d1a --- /dev/null +++ b/devlog/_plan/261003_release_stabilization/030_publication.md @@ -0,0 +1,58 @@ +# Production promotion and publication + +Depends on the accepted immutable candidate C. Intended next stable is provisionally +2.77.0, subject to fresh registry/tag ordering and concurrent release inspection. +No preview release is requested. Existing OIDC release workflow is the publication path. + +## Version and branch changes + +MODIFY exactly the four version sources through their owner command/workflow when needed: +`package.json`, `desktop/src-tauri/tauri.conf.json`, `desktop/src-tauri/Cargo.toml`, +`desktop/src-tauri/Cargo.lock`. Before: dev version equals target V. After: dev strictly +outranks V; candidate C and main promotion retain V. Do not manually rewrite lock content. + +1. Confirm V is unused on npm, Git tags and GitHub releases and outranks global release + tags under `scripts/version-line.ts`. Read live `MAINTAINERS.md` and rulesets. +2. Dispatch `dev-version-bump.yml` from main with `intended-version=V`, `mode=pre-move`. + Review/merge its dev PR after applicable CI. If dev already outranks V, retain its + explicit no-op result. Do not promote the advanced dev version by accident. +3. Prepare `codex/promote-main-V` from C. Reconcile main ancestry with documented + promotion tooling while preserving the candidate tree. A history-only merge using + the ours strategy is valid only after proving every main-only code delta is already + present or deliberately reconciled; otherwise merge normally and revalidate. +4. Open a main-targeted promotion PR using the repository template and required GUI + screenshot evidence from landed PR assets. Observe actual main review/ruleset policy; + the dev-only self-integration exception does not authorize bypassing main approval. + The owner's explicit release authorization for this unit is a separate promotion + authority: current policy says release review by both maintainers is recommended + when practical, not unconditionally required for a maintainer-authored promotion. + Use the existing admin PR-only route only after independent review/CI and current + actor entitlement are verified; record that owner authorization on the promotion PR. + This follows the documented owner-authorized promotion procedure and does not alter + rulesets, waive outstanding objections, or permit a direct main push. +5. After authorized promotion, capture exact main SHA R and its successful **push-event** + Cross-platform CI and required Service lifecycle run. C's manual run is not a substitute. +6. Verify R still owns main immediately before dispatching the supported release workflow: + `gh workflow run release.yml -R lidge-jun/opencodex --ref main -f version=V -f tag=latest + -f dry-run=false -f expected-sha=R`. This is the same guarded publication workflow + used by `scripts/release.ts`; no local npm publish or direct protected-branch push. + +## Publication proof and recovery + +Observe preflight, platform packaging, npm publication, GitHub asset attachment and +deployed docs. NEW ignored publication receipt records builder/run/attempt, exact source, +registry version/dist-tag/gitHead/integrity/provenance, release tag and all expected assets, +checksums, signed updater metadata and isolated install/launch smoke results. +Compare expected artifacts with the workflow and previous stable release, not a fixed count. +Do not upgrade the operator's installed proxy as an incidental smoke test. + +If npm publication is acknowledged but a later job fails, retain that evidence and use +the explicit `resume-after-npm-publish=true` path only when official registry gitHead +matches R. Never republish an existing version or force-move a public tag. +Recovery keeps the prior stable package/artifacts available and does not downgrade +user data; if a bad new version requires withdrawal or a tag rollback, stop that mutation +for its separate concrete decision and prepare a forward fix within scope. + +Completion: publication workflow and deployed surfaces verified, exact artifact proof +recorded, remaining platform limits stated, and this unit moved to `_fin/` only after +its public outcome exists. Release notes retain source-author attribution.