feat: bind review policy and qualify maintainer delivery for 0.8.0 - #62
Merged
Merged
Conversation
Signed-off-by: David Ahmann <46606159+davidahmann@users.noreply.github.com>
Signed-off-by: David Ahmann <46606159+davidahmann@users.noreply.github.com>
Signed-off-by: David Ahmann <46606159+davidahmann@users.noreply.github.com>
Signed-off-by: David Ahmann <46606159+davidahmann@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mill previously treated every local finding as blocking, so advisory-only reviews could consume the repair budget and stop otherwise accepted work. This adds an explicitly approved, frozen P0/P1 policy while preserving all findings and the default behavior of historical reviews. Review, repair, delivery, hosted feedback, merge, and outcome reporting bind to the same policy. Required GitHub approval remains separate.
The package also supplies an exact-candidate maintainer review script, dependency-policy checks for Mill and its starter, and guidance for qualifying test infrastructure before model work. The helper produces local evidence, not a trusted CI attestation or permission to push. Release docs and exact installation pins are prepared for 0.8.0.
Validation: full native gate, installed-package lifecycle canary, independent architecture review, fresh local Codex review, and clean-candidate audit. Fresh installed-package fixtures prove opt-in P2 admission, P1 blocking, legacy P2 blocking, and rejection of provider-supplied classification. A real runtime reviewer/controller canary passed separately; it does not renew the historical support tuple. No new stack support or customer compatibility is claimed.
Local review found an identity bypass through Git replacement objects. The repaired helper rejects alternate Git history, hidden index flags, transforming configuration/attributes, and mismatched validation roots; it binds Git control files to its receipt. Forty-one focused regression cases and independent architectural review cover that boundary. Standalone P2/P3 findings remain advisory.