Repository navigation
Inspect release readiness and reject inconsistent guard evidence - #11
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release preparation had no read-only way to list all missing evidence: the final package command stopped at its first assertion and invalidated local success records. Add
node scripts/check-release-readiness.mjs [--json], sharing evidence validation with the final package gate. The new command does not build, run tests, change artifacts or publish.The shared validator also rejects contradictory CI-guard exit codes, missing source hashes, empty cases and duplicate cases. Update the documented review snapshot to merged
ca0a02band its exact CI archive, retain the earlier bundle as history, and clarify development versus final package checks.Validation: 17 release-tool regression tests passed, including the actual release entry point rejecting development evidence; the actual tarball passed clean vanilla/React consumer checks, declarations and the expected failing React process. Local Markdown links and input hashes were checked. Runtime, browser scenarios and the reliability input set are unchanged from the existing four-round proof and successful main CI. Ordinary Linux/ARM CI now also runs the new release-tool tests.
Final 100 rounds, full release benchmarks, owner review and publication remain deferred. The read-only command currently exits 1 with the four expected pending records: reliability and the three benchmarks. No package or release was published.
PR CI 41130718880 passed on this head: Linux 169/169, macOS ARM 507/507, release-tool tests and actual package consumers on both platforms. All four raw reports, 640 unique journey IDs, source hashes, signatures and archive checksums were independently checked. ARM maximum passing-window intervals were 99.7 / 48.8 / 49.8 ms; Linux was 25.9 ms. The first ARM round was close to the unchanged 100 ms bound; this short sample is not a shared-runner latency guarantee. Dependency audits reported no known vulnerabilities for the library or React example.
Post-merge verification (31 October 2026): merged as
da7e66378619816cd9c7e065df95f0e2a6e67661, with the same tree as the reviewed head. Main CI 41172735137 passed: Linux 169/169, macOS ARM 507/507, release-tool tests and package consumers. All four raw reports, 640 unique journey IDs, source hashes and archive checksums were independently verified; retries remained zero. ARM maxima were 41.4 / 69.3 / 62.6 ms; Linux was 20.4 ms. Final 100 rounds and publication were not started.