diff --git a/docs/KEP-0002-hosted-candidate-correction.md b/docs/KEP-0002-hosted-candidate-correction.md new file mode 100644 index 0000000..f58d3b9 --- /dev/null +++ b/docs/KEP-0002-hosted-candidate-correction.md @@ -0,0 +1,169 @@ +# KEP-0002: Hosted candidate correction receipt + +Status: Proposed + +Decision owner: Repository owner + +Last updated: 2026-08-17 + +Target release: Before `v0.1.0-beta.1` + +## Summary + +Add a fail-closed receipt for a candidate that changes after the first public +push. Keep the pre-first-push receipt immutable. + +The correction receipt must bind the old candidate, new candidate, local +checks, remote refs, pull request, and hosted runs. It must bind the final tree. + +This KEP does not authorize a tag or a pull-request merge. + +## Context + +The first publication used an absent repository as a privacy and identity +gate. That fact cannot stay true after repository creation. + +Hosted Windows checks then found three host assumptions. The corrected +candidate passed every required hosted check before `main` moved. + +The original receipt still proves the pre-first-push boundary. It does not bind +the corrected final commit. + +## Decision request + +Approve a second receipt type for post-first-push corrections. Require that +receipt before a corrected candidate moves to `main`. + +## Required sequence + +If the first hosted candidate fails, use this sequence: + +1. Keep `main` at the reviewed bootstrap. +2. Keep the verification pull request open. +3. Fix the finding on the candidate branch. +4. Run every local release gate on the corrected commit. +5. Scan the complete history and worktree for secrets. +6. Check the complete author and committer identity set. +7. Fast-forward only the candidate branch. +8. Run every required hosted check on the corrected commit. +9. Create the private correction receipt. +10. Close the verification pull request without merging it. +11. Fast-forward `main` only to the receipt's candidate commit. +12. Check the remote commit and tree. + +Do not force-push a candidate branch. If a fast-forward is not possible, create +a new branch. + +## Receipt contract + +The command must write one new private JSON file. It must not overwrite a +file or write inside the source checkout. + +The receipt must bind: + +- the schema version and generation time. +- the target repository and visibility. +- the reviewed bootstrap commit and tree. +- the first receipt digest. +- the old candidate commit and tree. +- the new candidate commit and tree. +- the complete merge-free correction range. +- the complete reviewed delta path list. +- the local object and secret-scan results. +- the public author and committer identity result. +- the remote candidate and `main` refs. +- the pull-request number, state, head, base, and merge result. +- each required run ID, event, head commit, status, and conclusion. +- each required check context and GitHub App integration ID. + +The receipt must exclude tokens, email addresses, local paths, private reports, +and raw security logs. + +## Command behavior + +Add a Go command under `scripts/`. The command must accept explicit repository, +bootstrap, old candidate, candidate ref, and pull request values. It must also +accept explicit run, path manifest, and output values. + +The command must use bounded timeouts for GitHub, Git, and secret-scan +commands. It must reject incomplete dependency injection in tests. + +The command must stop unless: + +- the checkout is clean. +- the new candidate is the checked-out commit. +- the old candidate is an ancestor of the new candidate. +- the correction range is merge-free. +- the complete bootstrap delta matches the path manifest. +- object checks and secret scans pass. +- all history identities match the public owner identity. +- the target repository exists and is public. +- the remote candidate ref equals the new candidate. +- the pull request is open, unmerged, and points to the new candidate. +- every required hosted run succeeded on the new candidate. + +The first version must create the receipt before `main` moves. A separate mode +can check `main` after the fast-forward. + +## Failure behavior + +If a check fails, return a typed error and write no receipt. Do not weaken the +check after repository creation. + +Preserve the old receipt, candidate refs, pull request, and hosted runs after a +failure. + +## Test plan + +Test these cases: + +- exact one-commit correction success. +- multiple linear correction commits. +- moved candidate ref. +- changed path manifest. +- merge commit in the correction range. +- failed or pending hosted run. +- run for a different head commit. +- pull request with a different head. +- merged pull request. +- private or different target repository. +- changed public identity. +- secret-scan or object-check failure. +- existing output file. +- output path inside the checkout. +- open receipt directory on Unix. +- external-command timeout. +- deterministic redaction and schema validation. + +## Alternatives + +### Edit the first receipt + +Rejected. Editing an immutable receipt destroys its evidence value. + +### Rerun the pre-first-push command + +Rejected. The target repository now exists, and the checkout now has a remote. + +### Trust only the hosted check page + +Rejected. A passing page does not bind the local delta, identities, or final +tree. + +### Delete and recreate the repository + +Rejected. The public history and hosted evidence already exist. + +## Rollout gate + +Implement and test the command before the beta tag. Generate a private receipt +for the correction from `ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d` to +`206fa8b6a1dde1d97081133e4d447c0881849922`. + +Record only the redacted result in public evidence. + +## Decision log + +| Date | Decision | +| --- | --- | +| 2026-08-17 | Propose a second immutable receipt for hosted candidate corrections. | diff --git a/docs/OSS-PUBLIC-BETA.md b/docs/OSS-PUBLIC-BETA.md index 19f5b1d..2db49a0 100644 --- a/docs/OSS-PUBLIC-BETA.md +++ b/docs/OSS-PUBLIC-BETA.md @@ -26,10 +26,22 @@ The owner approved a capture-only public beta with these boundaries: - Keep branch landing, merging, pushing, and remote coordination out of scope. - Use `v0.1.0-beta.1` only after all public-beta gates pass. +## Hosted state on 2026-08-17 + +The public source repository now exists at +[`nstranquist/wip-commit`](https://github.com/nstranquist/wip-commit). +Commit `206fa8b6a1dde1d97081133e4d447c0881849922` passed the hosted candidate and +final `main` checks. + +The active `main` ruleset and security settings passed the hosted setup audit. +[PUBLICATION-EVIDENCE.md](PUBLICATION-EVIDENCE.md) contains the public record. + +No beta tag or GitHub release exists. The independent beta, conduct, correction +receipt, security-notification, tag-approval, and tagged-install gates remain. + This approval fixes the repository name, module path, and capture-only scope. -It does not approve a release tag. The project instructions require a human to -perform the first push. Follow -[PUBLICATION-HANDOFF.md](PUBLICATION-HANDOFF.md) for that exact boundary. +It does not approve a release tag. The first-push handoff ran on 2026-08-17. +Do not run [PUBLICATION-HANDOFF.md](PUBLICATION-HANDOFF.md) again. ## Why this plan exists @@ -43,7 +55,7 @@ adding a YAML dependency. Use these status values: -- `verified`: Local evidence passed on the recorded source. +- `verified`: Recorded local or hosted evidence passed on the exact source. - `prepared`: The repository artifact exists, but hosted evidence is absent. - `planned`: Owner-controlled implementation work remains. - `human-gated`: An owner decision or external mutation is required. diff --git a/docs/OSS-PUBLIC-BETA.requirements.yaml b/docs/OSS-PUBLIC-BETA.requirements.yaml index 64e691e..27a01b8 100644 --- a/docs/OSS-PUBLIC-BETA.requirements.yaml +++ b/docs/OSS-PUBLIC-BETA.requirements.yaml @@ -1,11 +1,11 @@ { "schema_version": 1, "plan_id": "wip-oss-public-beta", - "plan_status": "proposed", + "plan_status": "accepted", "target_version": "v0.1.0-beta.1", - "last_reviewed": "2026-08-16", + "last_reviewed": "2026-08-17", "status_definitions": { - "verified": "Local evidence passed on the recorded source.", + "verified": "Recorded local or hosted evidence passed on the exact source.", "prepared": "The repository artifact exists, but hosted evidence is absent.", "planned": "Owner-controlled implementation work remains.", "human-gated": "An owner decision or external mutation is required.", @@ -114,25 +114,27 @@ "id": "OSS-008", "gate": "public-beta", "title": "Run hosted operating-system tests", - "status": "external-evidence", + "status": "verified", "owner": "repository-owner", - "human_gate": true, + "human_gate": false, "acceptance": "The exact candidate passes Linux, macOS, Windows, race, vet, lint, module, and dependency-review jobs.", "evidence": [ - {"kind": "workflow", "value": ".github/workflows/ci.yml", "observed_on": "2026-08-14"} + {"kind": "workflow", "value": ".github/workflows/ci.yml", "observed_on": "2026-08-14"}, + {"kind": "hosted-run", "value": "https://github.com/nstranquist/wip-commit/actions/runs/31996057770 passed Linux, macOS, Windows, race, lint, and dependency review on commit 206fa8b6a1dde1d97081133e4d447c0881849922.", "observed_on": "2026-08-17"}, + {"kind": "hosted-run", "value": "https://github.com/nstranquist/wip-commit/actions/runs/31996220707 passed every main-push job that applies to commit 206fa8b6a1dde1d97081133e4d447c0881849922.", "observed_on": "2026-08-17"} ] }, { "id": "OSS-009", "gate": "public-beta", "title": "Configure hosted repository protections", - "status": "human-gated", + "status": "verified", "owner": "repository-owner", - "human_gate": true, + "human_gate": false, "acceptance": "main requires pull requests, review, required CI, and blocks force pushes and deletion.", "evidence": [ {"kind": "prepared-runbook", "value": "docs/HOSTED-SETUP.md defines the authority boundary, ruleset sequence, observed-check-name rule, and evidence receipt.", "observed_on": "2026-08-16"}, - {"kind": "gap", "value": "No remote is configured in the local checkout.", "observed_on": "2026-08-14"} + {"kind": "hosted-setting", "value": "https://github.com/nstranquist/wip-commit/rules/20926881 is active on main with no bypass actor, rebase-only pull requests, one approval, last-push approval, six provider-bound checks, linear history, and ref protections.", "observed_on": "2026-08-17"} ] }, { @@ -145,7 +147,9 @@ "acceptance": "Private vulnerability reporting, dependency alerts, secret scanning, and security notifications are enabled.", "evidence": [ {"kind": "prepared-policy", "value": "SECURITY.md and .github/ISSUE_TEMPLATE/config.yml", "observed_on": "2026-08-14"}, - {"kind": "prepared-runbook", "value": "docs/HOSTED-SETUP.md defines the current GitHub security-setting sequence and evidence receipt.", "observed_on": "2026-08-16"} + {"kind": "prepared-runbook", "value": "docs/HOSTED-SETUP.md defines the current GitHub security-setting sequence and evidence receipt.", "observed_on": "2026-08-16"}, + {"kind": "hosted-setting", "value": "Dependency graph, Dependabot alerts, Dependabot security updates, secret scanning, push protection, and private vulnerability reporting are enabled. GitHub serves SECURITY.md on the security policy page.", "observed_on": "2026-08-17"}, + {"kind": "gap", "value": "The maintainer's personal security-alert notification setting is not verified.", "observed_on": "2026-08-17"} ] }, { @@ -186,7 +190,8 @@ "human_gate": true, "acceptance": "A clean environment installs the tagged command through the public Go module path and runs wip version.", "evidence": [ - {"kind": "gap", "value": "The module path is not public.", "observed_on": "2026-08-14"} + {"kind": "public-install", "value": "A clean unauthenticated clone resolved commit 206fa8b6a1dde1d97081133e4d447c0881849922 and tree c0dd6638adcdc231840ad06406dc9f0caa38e45d. go install at that commit resolved the public pseudo-version and returned wip 0.1.0-beta.1.", "observed_on": "2026-08-17"}, + {"kind": "gap", "value": "No public beta tag exists, so the tagged-install acceptance rule remains open.", "observed_on": "2026-08-17"} ] }, { @@ -198,7 +203,7 @@ "human_gate": true, "acceptance": "The owner creates a signed v0.1.0-beta.1 tag only after every public-beta gate passes.", "evidence": [ - {"kind": "gap", "value": "No remote or tag exists.", "observed_on": "2026-08-14"} + {"kind": "gap", "value": "The public repository exists, but no tag, GitHub release, or explicit tag approval exists.", "observed_on": "2026-08-17"} ] }, { @@ -345,7 +350,7 @@ "human_gate": true, "acceptance": "After a beta period, the project reviews issue and pull-request response, maintainer load, unresolved security and safety defects, real concurrent use, and a tested backup-administrator, transfer, or archival path.", "evidence": [ - {"kind": "gap", "value": "A local unpublished project has no honest community-health or succession evidence.", "observed_on": "2026-08-16"} + {"kind": "gap", "value": "A new public source candidate has no beta-period community-health or succession evidence.", "observed_on": "2026-08-17"} ] }, { @@ -415,10 +420,10 @@ "status": "verified", "owner": "repository-owner", "human_gate": false, - "acceptance": "A source-current, fail-closed preflight binds a clean final candidate to the reviewed bootstrap, a merge-free linear split-commit range, the complete reviewed path delta, zero remotes and tags, owner approval, public author and committer identities, absent target repository, complete non-replaced history, passing object integrity, and passing history and worktree secret scans. It writes a no-overwrite private receipt outside the checkout. A human-only runbook preserves the exact candidate while obtaining hosted checks without merging a pull request.", + "acceptance": "A source-current, fail-closed preflight binds a clean pre-first-push candidate to the reviewed bootstrap, a merge-free linear split-commit range, the complete reviewed path delta, zero remotes and tags, owner approval, public author and committer identities, absent target repository, complete non-replaced history, passing object integrity, and passing history and worktree secret scans. It writes a no-overwrite private receipt outside the checkout. A human-only runbook preserves the exact candidate while obtaining hosted checks without merging a pull request.", "evidence": [ {"kind": "artifact", "value": "scripts/publication-handoff, docs/PUBLICATION-HANDOFF.md, docs/PUBLICATION-HANDOFF.paths, and docs/PUBLICATION-HANDOFF.schema.json", "observed_on": "2026-08-16"}, - {"kind": "gap", "value": "The project instructions prohibit an agent push. Human execution and hosted evidence remain required.", "observed_on": "2026-08-16"} + {"kind": "receipt", "value": "The validated private pre-first-push receipt bound commit ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d, tree 674a65c74d55a08b3f8d560700de1430ade99942, the reviewed bootstrap, and the then-current 17-path manifest before repository creation.", "observed_on": "2026-08-17"} ] }, { @@ -434,6 +439,19 @@ {"kind": "artifact", "value": "go.mod requires Go 1.25.12; docs/RELEASE.md and docs/OSS-PRACTICE-GUIDE.md require exact-minimum verification.", "observed_on": "2026-08-16"}, {"kind": "command", "value": "GOTOOLCHAIN=go1.25.12 GOWORK=off go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...", "observed_on": "2026-08-16"} ] + }, + { + "id": "OSS-034", + "gate": "public-beta", + "title": "Bind hosted candidate corrections", + "status": "planned", + "owner": "maintainer", + "human_gate": false, + "acceptance": "A fail-closed Go command binds each post-first-push correction to the old and new candidates, complete path manifest, local checks, remote candidate ref, unmerged pull request, required hosted runs, and final tree in one immutable private receipt before main moves.", + "evidence": [ + {"kind": "kep", "value": "docs/KEP-0002-hosted-candidate-correction.md defines the receipt contract, sequence, failure behavior, and test plan.", "observed_on": "2026-08-17"}, + {"kind": "gap", "value": "The first receipt binds ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d, while public main is 206fa8b6a1dde1d97081133e4d447c0881849922 after a hosted correction. No source command validates this correction flow yet.", "observed_on": "2026-08-17"} + ] } ] } diff --git a/docs/OSS-READINESS.md b/docs/OSS-READINESS.md index e84a4cb..2d17a73 100644 --- a/docs/OSS-READINESS.md +++ b/docs/OSS-READINESS.md @@ -2,15 +2,19 @@ ## Current decision -The project is a strong candidate for its own public repository. It is locally -publish-ready for a `v0.1.0-beta.1` candidate. It is not publicly launched, and -the local evidence does not support a stable `v1.0.0` claim. +The project now has a public source repository. The exact source candidate has +passing hosted checks and active repository controls. + +No public beta tag or GitHub release exists. The evidence does not support a +released, launched, adopted, or stable claim. The detailed release decision and current evidence are in [OSS-PUBLIC-BETA.md](OSS-PUBLIC-BETA.md) and -[OSS-PUBLIC-BETA.requirements.yaml](OSS-PUBLIC-BETA.requirements.yaml). The plan -is accepted. The approval fixes the name, module path, and capture-only scope. -It does not authorize an agent push or a release tag. +[OSS-PUBLIC-BETA.requirements.yaml](OSS-PUBLIC-BETA.requirements.yaml). Public +execution evidence is in [PUBLICATION-EVIDENCE.md](PUBLICATION-EVIDENCE.md). + +The plan is accepted. The approval fixes the name, module path, and +capture-only scope. It does not authorize a release tag. ## Ready in this checkout @@ -64,6 +68,15 @@ It does not authorize an agent push or a release tag. schema. - A human-gated hosted-repository setup and evidence runbook. - A fail-closed pre-first-push receipt and exact human publication handoff. +- Passing hosted Linux, macOS, Windows, race, lint, and dependency-review + checks on the exact public source candidate. +- An active no-bypass `main` ruleset with rebase-only pull requests, review, + provider-bound checks, linear history, and ref protections. +- Enabled dependency alerts, security updates, secret scanning, push + protection, and private vulnerability reporting. +- A clean public-module installation smoke test for the exact untagged commit. +- A proposed hosted-correction receipt KEP for the finding that occurred after + the first push. - Fail-closed tests for unsupported state directories and record schemas. - Symlink-escape and dual-domain creation-race tests. - Concurrent first-use directory and no-clobber publication tests. @@ -73,25 +86,19 @@ It does not authorize an agent push or a release tag. - Canonical Git repository and object-store binding despite inherited routing environment variables. -## Required before public beta publication +## Required before the public beta tag -1. Follow [PUBLICATION-HANDOFF.md](PUBLICATION-HANDOFF.md). Create the public - repository and add a remote. The reviewed candidate checkout currently - has no remote. -2. Run the prepared CI on hosted Linux, macOS, and Windows workers. Local cross - compilation is not a substitute for Windows runtime tests. -3. Follow [HOSTED-SETUP.md](HOSTED-SETUP.md) to require pull-request review and - the observed passing CI checks on the default branch. -4. Enable private vulnerability reporting, dependency alerts, and secret - scanning as described in the hosted setup runbook. -5. Approve a Code of Conduct and configure confidential conduct reporting - before soliciting public contributions. -6. Ask at least one independent user to follow +1. Implement and run the correction receipt in + [KEP-0002](KEP-0002-hosted-candidate-correction.md). +2. Verify the maintainer's personal security-alert notifications. +3. Approve a Code of Conduct and configure confidential conduct reporting. +4. Ask at least one independent user to follow [BETA-EXERCISE.md](BETA-EXERCISE.md) for shared and worktree flows. Retain a redacted receipt that passes [BETA-EXERCISE.schema.json](BETA-EXERCISE.schema.json). -7. Run a clean public-module installation smoke test. -8. Create and push `v0.1.0-beta.1` only after every tracked public-beta gate - passes. Check that the hosted release attestation succeeds. +5. Obtain explicit owner approval for `v0.1.0-beta.1`. +6. Create the signed tag only after every tracked public-beta gate passes. +7. Verify the hosted archives, checksums, and attestations. +8. Install the final tag through the public Go module path. ## Required before a stable release @@ -110,7 +117,8 @@ It does not authorize an agent push or a release tag. ## Publication boundary -The owner approved the public target and capture-only scope. A remote, history -push, repository setting, and release are still external changes. The project -instructions assign the first push to a human. Preparing this checkout does not -perform those actions. +The source repository, history, and hosted settings are public. The active +ruleset requires reviewed pull requests for later `main` updates. + +No tag, release, announcement, or adoption evidence exists. Do not infer those +states from public source availability. diff --git a/docs/PUBLICATION-EVIDENCE.md b/docs/PUBLICATION-EVIDENCE.md new file mode 100644 index 0000000..1ecb591 --- /dev/null +++ b/docs/PUBLICATION-EVIDENCE.md @@ -0,0 +1,113 @@ +# Public source publication evidence + +Status: Public source candidate. No tag or GitHub release exists. + +Observed on: 2026-08-17 + +Repository: [nstranquist/wip-commit](https://github.com/nstranquist/wip-commit) + +Final commit: `206fa8b6a1dde1d97081133e4d447c0881849922` + +Final tree: `c0dd6638adcdc231840ad06406dc9f0caa38e45d` + +This record contains public or redacted evidence. It contains no token, email +address, private report, local path, or raw security log. + +## Hosted discovery and correction + +The pre-first-push receipt bound candidate `ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d` +and its 17-path manifest. The first hosted run found three Windows host +assumptions and one repository setting gap. + +- [The first run](https://github.com/nstranquist/wip-commit/actions/runs/31995610617) + found CRLF-sensitive checks and a POSIX-only mode assertion. +- Dependency review also required the dependency graph. +- Commit `206fa8b6a1dde1d97081133e4d447c0881849922` fixed the three Windows findings. +- The correction expanded the complete bootstrap delta to 20 reviewed paths. +- The repository owner enabled dependency alerts and the dependency graph. + +[Pull request 1](https://github.com/nstranquist/wip-commit/pull/1) verified the +corrected commit. The pull request closed without a merge commit. + +The corrected commit passed these runs: + +- [candidate push](https://github.com/nstranquist/wip-commit/actions/runs/31996054315). +- [candidate pull request](https://github.com/nstranquist/wip-commit/actions/runs/31996057770). +- [final `main` push](https://github.com/nstranquist/wip-commit/actions/runs/31996220707). +- [dependency graph](https://github.com/nstranquist/wip-commit/actions/runs/31996222126). + +## Required checks + +All required checks came from GitHub Actions integration `15368`. + +| Required context | Passing pull-request job | +| --- | --- | +| `test (ubuntu-latest)` | [job 95287787614](https://github.com/nstranquist/wip-commit/actions/runs/31996057770/job/95287787614) | +| `test (macos-latest)` | [job 95287787690](https://github.com/nstranquist/wip-commit/actions/runs/31996057770/job/95287787690) | +| `test (windows-latest)` | [job 95287787600](https://github.com/nstranquist/wip-commit/actions/runs/31996057770/job/95287787600) | +| `race` | [job 95287787629](https://github.com/nstranquist/wip-commit/actions/runs/31996057770/job/95287787629) | +| `lint` | [job 95287787563](https://github.com/nstranquist/wip-commit/actions/runs/31996057770/job/95287787563) | +| `dependency-review` | [job 95287787528](https://github.com/nstranquist/wip-commit/actions/runs/31996057770/job/95287787528) | + +## Hosted controls + +[Ruleset 20926881](https://github.com/nstranquist/wip-commit/rules/20926881) +is active on `main`. It has no bypass actor. + +The ruleset requires: + +- a pull request. +- one approval. +- approval after the last push. +- dismissal of stale approvals. +- resolution of review conversations. +- linear history. +- the six provider-bound checks above. +- blocked force pushes and branch deletion. + +The repository permits rebase merges only. Workflow tokens use read-only +permissions by default and cannot approve pull requests. + +The owner enabled and verified: + +- the dependency graph. +- Dependabot alerts. +- Dependabot security updates. +- secret scanning. +- secret-scanning push protection. +- private vulnerability reporting. + +GitHub serves [the security policy](https://github.com/nstranquist/wip-commit/security/policy). +The maintainer's personal security-notification setting remains unverified. + +## Public source smoke test + +A clean test used an empty Git credential helper and cloned the public HTTPS +URL. The clone resolved the final commit and tree above. + +This command installed the exact untagged commit through the public Go module +path and Go proxy: + +```text +go install github.com/nstranquist/wip-commit/cmd/wip@206fa8b6a1dde1d97081133e4d447c0881849922 +``` + +The module resolved to +`v0.0.0-20260817045403-206fa8b6a1dd`. The installed command returned +`wip 0.1.0-beta.1`. + +This result proves public source installation at one commit. It does not prove +the tagged-install gate. + +## Remaining public-beta gates + +Do not create `v0.1.0-beta.1` until all these gates pass: + +- Implement the source-current correction receipt in + [KEP-0002](KEP-0002-hosted-candidate-correction.md). +- Obtain a valid receipt from one independent beta tester. +- Approve a Code of Conduct and a confidential conduct-reporting path. +- Verify the maintainer's security-alert notifications. +- Obtain explicit owner approval for the tag. +- Run and verify the tag-only archive and attestation workflow. +- Install the final tag through the public Go module path. diff --git a/docs/PUBLICATION-HANDOFF.md b/docs/PUBLICATION-HANDOFF.md index e032a87..4ebd7d3 100644 --- a/docs/PUBLICATION-HANDOFF.md +++ b/docs/PUBLICATION-HANDOFF.md @@ -1,6 +1,6 @@ # First publication handoff -Status: Ready for human execution +Status: Executed on 2026-08-17. Do not run this handoff again. Target: `github.com/nstranquist/wip-commit` @@ -8,14 +8,36 @@ Reviewed bootstrap: `b276204385636c5a8ac338491565bd4894255217` Owner approval: `owner-session-2026-08-16` +Final public `main`: `206fa8b6a1dde1d97081133e4d447c0881849922` + +Public evidence: [PUBLICATION-EVIDENCE.md](PUBLICATION-EVIDENCE.md) + +## Execution note + +The pre-first-push receipt bound +`ed3f1fadfbc74eb0aa41ef8b90e41f403213d33d` and its 17-path manifest. The first +hosted run found three Windows host assumptions and a disabled dependency +graph. + +Commit `206fa8b6a1dde1d97081133e4d447c0881849922` fixed the Windows findings and +expanded the complete bootstrap delta to 20 reviewed paths. The corrected +commit passed every required hosted check. + +Pull request 1 closed without a merge commit. Then `main` moved by a direct +fast-forward. + +The pre-first-push command cannot validate this correction because the target +now exists. [KEP-0002](KEP-0002-hosted-candidate-correction.md) defines the +source-current correction receipt that remains required before the tag. + ## Boundary The owner approved the repository name, module path, and capture-only public beta scope. The owner has not approved a release tag. -The repository instructions prohibit an agent push. A human must execute every -command in the **Human-only first push** section. Do not merge the bootstrap -pull request. Do not create a tag during this handoff. +The repository instructions prohibited an agent push without an owner +override. The owner gave one-time approval for this exact handoff. That +approval did not authorize a pull-request merge or tag. The preflight command is read-only except for one new private receipt outside the checkout. It does not create a repository, remote, tag, branch, or Git ref, @@ -82,6 +104,8 @@ to a new output path. ## Human-only first push +This section is an execution record. Do not run these commands again. + In this section, `` means the exact `candidate.commit` from the validated receipt. A human repository owner must run these commands.