From 8d941985ad371dfc37385743c02f9f42c77d8890 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Sat, 6 Jun 2026 19:12:36 +0800 Subject: [PATCH 01/24] governance: record Coregentis workspace authority --- AGENTS.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 40348af1..30dd51cd 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -6,6 +6,27 @@ This repository is part of the Coregentis MPLP / Cognitive OS / SoloCrew / Valid MPLP owns protocol objects, schemas, invariants, conformance vocabulary, and protocol documentation. The 10-module v1 baseline remains the protocol anchor. Protocol core must stay product-neutral, runtime-neutral, vendor-neutral, and free of product, commercial validation, certification, regulator-approval, legal-compliance proof, or vendor-ranking claims. v1 references to v2 objects must remain pointer-only; do not inline product, runtime, or commercial semantics into protocol core. +## Coregentis Workspace Authority + +The Coregentis canonical workspace root is +`/Users/jasonwang/Documents/AI_Dev/Coregentis`. + +This repository is the MPLP public OSS projection. It is not MPLP protocol, +package, or release Dev truth. MPLP-Protocol-Dev is protocol/package/release Dev truth: +`/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev`. + +V1.0_release is frozen as migration/evidence source. Do not treat +V1.0_release as global MPLP SOT. +V1.0_release is frozen as migration/evidence source; do not treat V1.0_release as global MPLP SOT. + +Do not perform package/source recovery, Dev-only package decisions, publish, +upload, tag, seal, merge, or public projection push from this repo without an +explicit public projection or release goal. Cross-repo sync requires an +explicit migration, backport, or projection goal. + +Future Dev-side goals remain `DEV-HARNESS-BACKPORT-01` and +`PACKAGE-DEV-TRUTH-SOURCE-RECOVERY-PLAN-01`; this repo grants no publish, no upload, no tag, no seal, and no merge authorization. + ## Repo Truth First Before implementation, inspect repository truth: From 4a0700082f5dda9c84c569a5af2c59f5e8ed3256 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Sat, 6 Jun 2026 21:53:35 +0800 Subject: [PATCH 02/24] governance: add Coregentis two-layer governance baseline --- .../agentic-harness-goal-preflight/SKILL.md | 140 ++++++++++++++++++ .codex/config.toml | 12 ++ .../agentic-harness-goal-preflight/SKILL.md | 140 ++++++++++++++++++ AGENTS.md | 37 +++++ ...GENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01.md | 105 +++++++++++++ governance/codex-goals/CODEX-GOAL-TEMPLATE.md | 79 ++++++++++ 6 files changed, 513 insertions(+) create mode 100644 .agents/skills/agentic-harness-goal-preflight/SKILL.md create mode 100644 .codex/skills/agentic-harness-goal-preflight/SKILL.md create mode 100644 governance/04-records/COREGENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01.md diff --git a/.agents/skills/agentic-harness-goal-preflight/SKILL.md b/.agents/skills/agentic-harness-goal-preflight/SKILL.md new file mode 100644 index 00000000..5fbf9c22 --- /dev/null +++ b/.agents/skills/agentic-harness-goal-preflight/SKILL.md @@ -0,0 +1,140 @@ +--- +name: agentic-harness-goal-preflight +description: Apply Coregentis two-layer governance before, during, and after non-trivial Codex goals. +--- + +# Agentic Harness Goal Preflight + +Use this skill for every non-trivial Goal in this repository. The Coregentis +canonical workspace root is `/Users/jasonwang/Documents/AI_Dev/Coregentis`. +This repository must execute two-layer governance before implementation: + +- Layer A: Repository Governance for repo truth, remote authority, source + surfaces, generated artifacts, evidence surfaces, publication boundaries, and + cross-repo sync boundaries. +- Layer B: Codex Agentic Harness for Goal execution using `SCTM`, `GLFB`, + `ITCM`, `RBCT`, `VIM`, and `PRM`. + +`V1.0_release` is frozen as migration/evidence source only. It is not global +MPLP SOT. + +## Methodology Separation + +| Method ID | Layer | Purpose | Evidence | +|:---|:---|:---|:---| +| `SCTM` | Codex Agentic Harness | Convert the user request into a governed task model | Goal model and SOT classification | +| `GLFB` | Codex Agentic Harness | Separate technical possibility, governance permission, owner authorization, and strategic correctness | Decision matrix | +| `ITCM` | Codex Agentic Harness | Map repositories, objects, layers, authority, and derivation edges | Topology and constraint map | +| `RBCT` | Codex Agentic Harness | Bound the work to one staged Goal with stop conditions | Stage plan | +| `VIM` | Codex Agentic Harness | Identify forbidden actions, irreversible risks, impact, and mitigation | Forbidden-action matrix | +| `PRM` | Codex Agentic Harness | Convert findings into method hardening and retrospective evidence | Retrospective | +| `DIV` | Repository Governance | Verify derivation boundary and provenance | Derivation evidence | +| `TSV` | Repository Governance | Verify truth-source references and dependency closure | Truth-source evidence | +| `XCV` | Repository Governance | Verify cross-surface consistency | Consistency evidence | +| `SCV` | Repository Governance | Verify projection surface completeness | Surface coverage evidence | +| `SUC` | Repository Governance | Verify usage conformance | Usage evidence | +| `EVC` | Repository Governance | Verify evolution compatibility | Compatibility evidence | + +Do not confuse Codex execution methods with repository verification methods. +Use repository methods only when the Goal touches their relevant surfaces. + +## Mandatory Goal Preflight + +Every non-trivial Goal must declare: + +- workstream +- current local repo +- authoritative local repo +- current tracking remote +- authoritative remote +- allowed push target, if push is in scope +- forbidden remotes +- SOT layer `L0` through `L6` +- upstream SOT +- downstream derivatives +- authorized mutations +- forbidden mutations +- cross-repo sync in scope or not +- owner authorization required or not +- repo governance methods applicable +- final stop condition + +SOT layers: + +- `L0 Protocol Truth` +- `L1 Projection Source` +- `L2 Generated Artifact` +- `L3 Verification Evidence` +- `L4 Publication Surface` +- `L5 Downstream Runtime/Product` +- `L6 Codex Execution Governance` + +## Required Execution Order + +1. `SCTM`: clarify task and model governed intent. +2. `GLFB`: separate feasibility, permission, and owner authorization. +3. `ITCM`: map repo topology, SOT layers, upstream/downstream dependencies, and constraints. +4. `RBCT`: define the bounded stage plan and stop conditions. +5. `VIM`: identify forbidden actions and mitigation. +6. Execute only authorized governance or task-scope actions. +7. `PRM`: record retrospective evidence and hardening recommendations. + +## Repository / Remote Authority + +Default authority matrix: + +| Workstream | Authoritative local repo | Authoritative remote | Forbidden without explicit owner authorization | +|:---|:---|:---|:---| +| MPLP protocol/package/release Dev truth | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev` | Dev repo `origin` after inspection | public OSS push, publish, upload, tag, seal, merge | +| MPLP public OSS projection | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol` | public projection `origin` after inspection | source recovery, package preflight from stale projection, public main/default push | +| Cognitive OS runtime downstream | `/Users/jasonwang/Documents/AI_Dev/Coregentis/Cognitive_OS` | repo `origin` after inspection | treating runtime evidence as protocol truth | +| SoloCrew product downstream | `/Users/jasonwang/Documents/AI_Dev/Coregentis/SoloCrew` | repo `origin` after inspection | treating product need as protocol truth | +| Validation evidence surface | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Validation-Lab` | repo `origin` after inspection | treating validation evidence as protocol truth or package publication root | +| Website publication surface | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Official-Website` | repo `origin` after inspection | treating website copy as protocol truth | +| V1.0_release migration source | `/Users/jasonwang/Documents/AI_Dev/V1.0_release` | no active development authority | active development or global SOT use | + +## Blocked Verdicts + +Stop before mutation and report the relevant verdict: + +- `BLOCKED_WORKSTREAM_AUTHORITY_MISMATCH` +- `BLOCKED_LOCAL_REPO_AUTHORITY_MISMATCH` +- `BLOCKED_REMOTE_AUTHORITY_MISMATCH` +- `BLOCKED_CROSS_REPO_SYNC_NOT_AUTHORIZED` +- `BLOCKED_OWNER_AUTHORIZATION_REQUIRED` +- `BLOCKED_PUBLIC_PROJECTION_AUTHORIZATION_REQUIRED` +- `BLOCKED_V1_USED_AS_GLOBAL_MPLP_SOT` +- `BLOCKED_DEV_TRUTH_REQUIRED` +- `BLOCKED_DOWNSTREAM_REPO_USED_AS_PROTOCOL_TRUTH` +- `BLOCKED_SCHEMA_TRUTH_SOURCE_MISSING` +- `BLOCKED_L0_MUTATION_WITHOUT_SCHEMA_INTAKE` +- `BLOCKED_PACKAGE_RECOVERY_IN_PROJECTION_REPO` +- `BLOCKED_PACKAGE_PREFLIGHT_FROM_STALE_PROJECTION` +- `BLOCKED_PACKAGE_PUBLICATION_AUTHORIZATION_REQUIRED` +- `BLOCKED_PACKAGE_ARTIFACT_PROVENANCE_MISSING` +- `BLOCKED_RUNTIME_NEED_DIRECTLY_MUTATES_PROTOCOL` +- `BLOCKED_PRODUCT_NEED_DIRECTLY_MUTATES_PROTOCOL` +- `BLOCKED_VALIDATION_SURFACE_USED_AS_PROTOCOL_TRUTH` +- `BLOCKED_WEBSITE_USED_AS_PROTOCOL_TRUTH` + +## Forbidden Actions + +Unless the owner explicitly authorizes the exact action and scope: + +- No npm publish +- No PyPI upload +- No tag +- No seal +- No merge +- no registry mutation +- no package version change +- no L0 schema mutation +- no package artifact generation +- no source/dist restoration +- no cross-repo sync +- no public projection push + +## Final Report + +Every Goal must close with files changed, commands run, evidence, final git +status, remaining risks, forbidden-action compliance, and exact verdict. diff --git a/.codex/config.toml b/.codex/config.toml index ec0d2986..c9f2cb38 100644 --- a/.codex/config.toml +++ b/.codex/config.toml @@ -10,6 +10,18 @@ sandbox_mode = "workspace-write" [features] goals = true +[coregentis_workspace_authority] +canonical_workspace_root = "/Users/jasonwang/Documents/AI_Dev/Coregentis" +repo_role = "PUBLIC_OSS_PROJECTION" +authoritative_dev_truth = "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev" +repo_governance_baseline = "governance/04-records/COREGENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01.md" +v1_status = "frozen_migration_evidence_source" + +[agentic_harness] +preflight_skill = ".agents/skills/agentic-harness-goal-preflight/SKILL.md" +goal_template = "governance/codex-goals/CODEX-GOAL-TEMPLATE.md" +skill_mirror = ".codex/skills/agentic-harness-goal-preflight/SKILL.md" + # Subagent policy guidance, not enforced by this config parser: # max_threads = 4 # max_depth = 1 diff --git a/.codex/skills/agentic-harness-goal-preflight/SKILL.md b/.codex/skills/agentic-harness-goal-preflight/SKILL.md new file mode 100644 index 00000000..5fbf9c22 --- /dev/null +++ b/.codex/skills/agentic-harness-goal-preflight/SKILL.md @@ -0,0 +1,140 @@ +--- +name: agentic-harness-goal-preflight +description: Apply Coregentis two-layer governance before, during, and after non-trivial Codex goals. +--- + +# Agentic Harness Goal Preflight + +Use this skill for every non-trivial Goal in this repository. The Coregentis +canonical workspace root is `/Users/jasonwang/Documents/AI_Dev/Coregentis`. +This repository must execute two-layer governance before implementation: + +- Layer A: Repository Governance for repo truth, remote authority, source + surfaces, generated artifacts, evidence surfaces, publication boundaries, and + cross-repo sync boundaries. +- Layer B: Codex Agentic Harness for Goal execution using `SCTM`, `GLFB`, + `ITCM`, `RBCT`, `VIM`, and `PRM`. + +`V1.0_release` is frozen as migration/evidence source only. It is not global +MPLP SOT. + +## Methodology Separation + +| Method ID | Layer | Purpose | Evidence | +|:---|:---|:---|:---| +| `SCTM` | Codex Agentic Harness | Convert the user request into a governed task model | Goal model and SOT classification | +| `GLFB` | Codex Agentic Harness | Separate technical possibility, governance permission, owner authorization, and strategic correctness | Decision matrix | +| `ITCM` | Codex Agentic Harness | Map repositories, objects, layers, authority, and derivation edges | Topology and constraint map | +| `RBCT` | Codex Agentic Harness | Bound the work to one staged Goal with stop conditions | Stage plan | +| `VIM` | Codex Agentic Harness | Identify forbidden actions, irreversible risks, impact, and mitigation | Forbidden-action matrix | +| `PRM` | Codex Agentic Harness | Convert findings into method hardening and retrospective evidence | Retrospective | +| `DIV` | Repository Governance | Verify derivation boundary and provenance | Derivation evidence | +| `TSV` | Repository Governance | Verify truth-source references and dependency closure | Truth-source evidence | +| `XCV` | Repository Governance | Verify cross-surface consistency | Consistency evidence | +| `SCV` | Repository Governance | Verify projection surface completeness | Surface coverage evidence | +| `SUC` | Repository Governance | Verify usage conformance | Usage evidence | +| `EVC` | Repository Governance | Verify evolution compatibility | Compatibility evidence | + +Do not confuse Codex execution methods with repository verification methods. +Use repository methods only when the Goal touches their relevant surfaces. + +## Mandatory Goal Preflight + +Every non-trivial Goal must declare: + +- workstream +- current local repo +- authoritative local repo +- current tracking remote +- authoritative remote +- allowed push target, if push is in scope +- forbidden remotes +- SOT layer `L0` through `L6` +- upstream SOT +- downstream derivatives +- authorized mutations +- forbidden mutations +- cross-repo sync in scope or not +- owner authorization required or not +- repo governance methods applicable +- final stop condition + +SOT layers: + +- `L0 Protocol Truth` +- `L1 Projection Source` +- `L2 Generated Artifact` +- `L3 Verification Evidence` +- `L4 Publication Surface` +- `L5 Downstream Runtime/Product` +- `L6 Codex Execution Governance` + +## Required Execution Order + +1. `SCTM`: clarify task and model governed intent. +2. `GLFB`: separate feasibility, permission, and owner authorization. +3. `ITCM`: map repo topology, SOT layers, upstream/downstream dependencies, and constraints. +4. `RBCT`: define the bounded stage plan and stop conditions. +5. `VIM`: identify forbidden actions and mitigation. +6. Execute only authorized governance or task-scope actions. +7. `PRM`: record retrospective evidence and hardening recommendations. + +## Repository / Remote Authority + +Default authority matrix: + +| Workstream | Authoritative local repo | Authoritative remote | Forbidden without explicit owner authorization | +|:---|:---|:---|:---| +| MPLP protocol/package/release Dev truth | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev` | Dev repo `origin` after inspection | public OSS push, publish, upload, tag, seal, merge | +| MPLP public OSS projection | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol` | public projection `origin` after inspection | source recovery, package preflight from stale projection, public main/default push | +| Cognitive OS runtime downstream | `/Users/jasonwang/Documents/AI_Dev/Coregentis/Cognitive_OS` | repo `origin` after inspection | treating runtime evidence as protocol truth | +| SoloCrew product downstream | `/Users/jasonwang/Documents/AI_Dev/Coregentis/SoloCrew` | repo `origin` after inspection | treating product need as protocol truth | +| Validation evidence surface | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Validation-Lab` | repo `origin` after inspection | treating validation evidence as protocol truth or package publication root | +| Website publication surface | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Official-Website` | repo `origin` after inspection | treating website copy as protocol truth | +| V1.0_release migration source | `/Users/jasonwang/Documents/AI_Dev/V1.0_release` | no active development authority | active development or global SOT use | + +## Blocked Verdicts + +Stop before mutation and report the relevant verdict: + +- `BLOCKED_WORKSTREAM_AUTHORITY_MISMATCH` +- `BLOCKED_LOCAL_REPO_AUTHORITY_MISMATCH` +- `BLOCKED_REMOTE_AUTHORITY_MISMATCH` +- `BLOCKED_CROSS_REPO_SYNC_NOT_AUTHORIZED` +- `BLOCKED_OWNER_AUTHORIZATION_REQUIRED` +- `BLOCKED_PUBLIC_PROJECTION_AUTHORIZATION_REQUIRED` +- `BLOCKED_V1_USED_AS_GLOBAL_MPLP_SOT` +- `BLOCKED_DEV_TRUTH_REQUIRED` +- `BLOCKED_DOWNSTREAM_REPO_USED_AS_PROTOCOL_TRUTH` +- `BLOCKED_SCHEMA_TRUTH_SOURCE_MISSING` +- `BLOCKED_L0_MUTATION_WITHOUT_SCHEMA_INTAKE` +- `BLOCKED_PACKAGE_RECOVERY_IN_PROJECTION_REPO` +- `BLOCKED_PACKAGE_PREFLIGHT_FROM_STALE_PROJECTION` +- `BLOCKED_PACKAGE_PUBLICATION_AUTHORIZATION_REQUIRED` +- `BLOCKED_PACKAGE_ARTIFACT_PROVENANCE_MISSING` +- `BLOCKED_RUNTIME_NEED_DIRECTLY_MUTATES_PROTOCOL` +- `BLOCKED_PRODUCT_NEED_DIRECTLY_MUTATES_PROTOCOL` +- `BLOCKED_VALIDATION_SURFACE_USED_AS_PROTOCOL_TRUTH` +- `BLOCKED_WEBSITE_USED_AS_PROTOCOL_TRUTH` + +## Forbidden Actions + +Unless the owner explicitly authorizes the exact action and scope: + +- No npm publish +- No PyPI upload +- No tag +- No seal +- No merge +- no registry mutation +- no package version change +- no L0 schema mutation +- no package artifact generation +- no source/dist restoration +- no cross-repo sync +- no public projection push + +## Final Report + +Every Goal must close with files changed, commands run, evidence, final git +status, remaining risks, forbidden-action compliance, and exact verdict. diff --git a/AGENTS.md b/AGENTS.md index 30dd51cd..f23bb129 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -45,6 +45,43 @@ Reuse existing assets before creating new files. Prefer updating an existing rul - `.codex/skills/*/SKILL.md` is retained as the project-internal ops source and compatibility copy. - Keep mirrored skills same-named and content-equivalent; do not create divergent SOPs. +## Two-Layer Governance + +Every non-trivial Goal in this repo must satisfy both governance layers before +implementation: + +- Layer A: Repository Governance. Declare this repo's public OSS projection + role, source surfaces, generated/evidence surfaces, release/publication + boundaries, authoritative remote, upstream Dev truth, downstream + projections, and forbidden authority misuse. +- Layer B: Codex Agentic Harness. Use + `.agents/skills/agentic-harness-goal-preflight/SKILL.md` and + `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` to execute `SCTM`, `GLFB`, + `ITCM`, `RBCT`, `VIM`, and `PRM` before and after the bounded Goal. + +Repository governance methods `DIV`, `TSV`, `XCV`, `SCV`, `SUC`, and `EVC` +apply only when the task touches their relevant surfaces. Public OSS projection +work must remain downstream of MPLP-Protocol-Dev truth and must not become +package/source recovery, registry mutation, or L0 protocol authority. + +Required blocked verdicts for wrong-authority or owner-approval violations: + +- `BLOCKED_WORKSTREAM_AUTHORITY_MISMATCH` +- `BLOCKED_LOCAL_REPO_AUTHORITY_MISMATCH` +- `BLOCKED_REMOTE_AUTHORITY_MISMATCH` +- `BLOCKED_CROSS_REPO_SYNC_NOT_AUTHORIZED` +- `BLOCKED_OWNER_AUTHORIZATION_REQUIRED` +- `BLOCKED_PUBLIC_PROJECTION_AUTHORIZATION_REQUIRED` +- `BLOCKED_V1_USED_AS_GLOBAL_MPLP_SOT` +- `BLOCKED_DEV_TRUTH_REQUIRED` +- `BLOCKED_DOWNSTREAM_REPO_USED_AS_PROTOCOL_TRUTH` +- `BLOCKED_SCHEMA_TRUTH_SOURCE_MISSING` +- `BLOCKED_L0_MUTATION_WITHOUT_SCHEMA_INTAKE` +- `BLOCKED_PACKAGE_RECOVERY_IN_PROJECTION_REPO` +- `BLOCKED_PACKAGE_PREFLIGHT_FROM_STALE_PROJECTION` +- `BLOCKED_PACKAGE_PUBLICATION_AUTHORIZATION_REQUIRED` +- `BLOCKED_PACKAGE_ARTIFACT_PROVENANCE_MISSING` + ## Hard Boundaries - Preserve protocol, runtime, product, validation, and publication boundaries. diff --git a/governance/04-records/COREGENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01.md b/governance/04-records/COREGENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01.md new file mode 100644 index 00000000..41d49677 --- /dev/null +++ b/governance/04-records/COREGENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01.md @@ -0,0 +1,105 @@ +--- +entry_surface: repository +entry_model_class: projection +doc_type: governance +status: final +authority: repository +doc_id: "COREGENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01" +surface_role: public_oss_projection_governance +record_state: final +title: "Coregentis Two-Layer Governance Baseline 01" +--- + +# Coregentis Two-Layer Governance Baseline 01 + +## Purpose + +This record closes the Coregentis two-layer governance baseline for +`MPLP-Protocol` as the public OSS projection repo. + +The Coregentis canonical workspace root is +`/Users/jasonwang/Documents/AI_Dev/Coregentis`. + +## Repository Role + +| Field | Value | +|:---|:---| +| Repo | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol` | +| Role | `PUBLIC_OSS_PROJECTION` | +| Authoritative upstream | `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev` | +| Remote authority | `origin` after inspection, task branches only unless explicitly authorized | +| Not authority for | Dev package truth, source recovery, package publication, registry mutation, release seal, public main/default push | + +## Two-Layer Governance + +Layer A: Repository Governance defines public projection source surfaces, +generated/evidence surfaces, projection boundaries, remote authority, release +boundaries, and wrong-authority blockers. + +Layer B: Codex Agentic Harness requires +`.agents/skills/agentic-harness-goal-preflight/SKILL.md` and +`governance/codex-goals/CODEX-GOAL-TEMPLATE.md` for every non-trivial Goal. +Goals must execute `SCTM`, `GLFB`, `ITCM`, `RBCT`, `VIM`, and `PRM`. + +Repository methods `DIV`, `TSV`, `XCV`, `SCV`, `SUC`, and `EVC` apply only when +the Goal touches their relevant repository surfaces. + +## SOT Boundary + +| Layer | Boundary | +|:---|:---| +| `L0 Protocol Truth` | MPLP-Protocol-Dev unless a governed public projection goal explicitly scopes otherwise | +| `L1 Projection Source` | Public OSS source projected from Dev truth | +| `L2 Generated Artifact` | Generated output only when provenance is declared | +| `L3 Verification Evidence` | Evidence only, not release or mutation authority | +| `L4 Publication Surface` | Public OSS surface, owner approval required for public projection push/release claims | +| `L5 Downstream Runtime/Product` | Cognitive OS and SoloCrew consume downstream | +| `L6 Codex Execution Governance` | `AGENTS.md`, `.codex/config.toml`, `.agents/skills`, `.codex/skills`, Goal Template | + +## Forbidden Authority Misuse + +This repo must not be used for package/source recovery, Dev-only package +decisions, npm publish, PyPI upload, registry mutation, package version changes, +tag creation, release seal creation, PR merge, L0 schema mutation, or public +main/default branch push without explicit owner authorization. + +V1.0_release is frozen as migration/evidence source only and must not be +treated as global MPLP SOT. + +## Cross-Repo Rules + +Dev -> Public OSS projection requires an explicit projection goal. Public -> Dev +backflow requires explicit drift review and owner approval. No cross-repo sync, +copy, cherry-pick, source restoration, or dist restoration is authorized by this +baseline. + +## Blocking Verdicts + +Relevant blockers include: + +- `BLOCKED_WORKSTREAM_AUTHORITY_MISMATCH` +- `BLOCKED_LOCAL_REPO_AUTHORITY_MISMATCH` +- `BLOCKED_REMOTE_AUTHORITY_MISMATCH` +- `BLOCKED_CROSS_REPO_SYNC_NOT_AUTHORIZED` +- `BLOCKED_OWNER_AUTHORIZATION_REQUIRED` +- `BLOCKED_PUBLIC_PROJECTION_AUTHORIZATION_REQUIRED` +- `BLOCKED_V1_USED_AS_GLOBAL_MPLP_SOT` +- `BLOCKED_DEV_TRUTH_REQUIRED` +- `BLOCKED_DOWNSTREAM_REPO_USED_AS_PROTOCOL_TRUTH` +- `BLOCKED_SCHEMA_TRUTH_SOURCE_MISSING` +- `BLOCKED_L0_MUTATION_WITHOUT_SCHEMA_INTAKE` +- `BLOCKED_PACKAGE_RECOVERY_IN_PROJECTION_REPO` +- `BLOCKED_PACKAGE_PREFLIGHT_FROM_STALE_PROJECTION` +- `BLOCKED_PACKAGE_PUBLICATION_AUTHORIZATION_REQUIRED` +- `BLOCKED_PACKAGE_ARTIFACT_PROVENANCE_MISSING` + +## Forbidden Action Compliance + +No npm publish. No PyPI upload. No tag. No seal. No merge. No registry +mutation. No package version change. No L0 schema mutation. No package artifact +generation. No source/dist restoration. No public projection push is authorized +by this baseline. + +## Final Verdict + +`PUBLIC_OSS_PROJECTION_TWO_LAYER_GOVERNANCE_BASELINE_RECORDED` diff --git a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md index 86bf864c..271e25f1 100644 --- a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md +++ b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md @@ -10,6 +10,67 @@ State the concrete objective and the verifiable stopping condition. Name the exact repository path and current branch. Do not assume cloud threads, marketplace features, app-only visibility, or cloud-only execution. +## Coregentis Workspace Authority Check + +Declare: + +```yaml +coregentis_workspace_authority: + canonical_workspace_root: /Users/jasonwang/Documents/AI_Dev/Coregentis + current_repo: + authoritative_repo: + current_remote: + authoritative_remote: + repo_role: + upstream_sot: + downstream_derivatives: + v1_status: frozen_migration_evidence_source + cross_repo_sync_in_scope: false +``` + +## SOT Classification + +Classify all touched surfaces before editing: + +| SOT Layer | Applies? | Surfaces | Authority | +|:---|:---|:---|:---| +| `L0 Protocol Truth` | | | MPLP-Protocol-Dev only unless explicitly authorized | +| `L1 Projection Source` | | | repo-specific source or public projection | +| `L2 Generated Artifact` | | | generated from declared source only | +| `L3 Verification Evidence` | | | evidence, not authorization | +| `L4 Publication Surface` | | | owner approval required for public claims | +| `L5 Downstream Runtime/Product` | | | downstream only | +| `L6 Codex Execution Governance` | | | AGENTS, config, skills, goal template | + +## Development Method Execution Table + +| Method | Required? | Evidence | +|:---|:---|:---| +| `SCTM` | yes | Goal model and SOT classification | +| `GLFB` | yes | Governance/authorization decision matrix | +| `ITCM` | yes | Repo, object, authority, and derivation topology | +| `RBCT` | yes | Bounded stage plan and stop condition | +| `VIM` | yes | Forbidden-action and risk matrix | +| `PRM` | yes | Retrospective and hardening notes | + +## Methodology Separation Table + +| Repository Method | Applies? | Surface | Evidence | +|:---|:---|:---|:---| +| `DIV` | | Generated/provenance surface | Derivation evidence | +| `TSV` | | Truth-source references | Reference closure | +| `XCV` | | Cross-surface consistency | Consistency evidence | +| `SCV` | | Projection completeness | Surface coverage | +| `SUC` | | SDK/API/runtime usage | Usage evidence | +| `EVC` | | Version/evolution transition | Compatibility evidence | + +## Two-Layer Governance Alignment Table + +| Layer | Required Declaration | Status | +|:---|:---|:---| +| Repository Governance | repo role, source/evidence/generated/publication surfaces, remote authority, wrong-authority blockers | | +| Codex Agentic Harness | required skill, Goal preflight, SOT layer, authorized mutations, forbidden mutations, final verdict | | + ## Branch Create or use a task branch from current `main` unless the owner instructs otherwise. Report whether the branch continues an existing Codex ops branch or is a follow-up branch. @@ -22,6 +83,10 @@ State the PR URL, base branch, base SHA, head branch, head SHA, whether the base List any required `.agents/skills/*/SKILL.md` workflows. `.agents/skills` is the Codex discovery path; `.codex/skills` is retained as the project-internal ops source and compatibility copy. +Default required skill for non-trivial goals: + +- `agentic-harness-goal-preflight` + ## Required Subagents Or Custom Agents List any required `.codex/agents/*.toml` reviewers and the lane each must cover. Standard lanes: @@ -59,6 +124,20 @@ List surfaces that must not change, including package versions, registries, tags State forbidden publish, upload, deprecate, yank, delete, dist-tag mutation, tag, seal, package-version, schema-intake, product-behavior, runtime-behavior, public-claim, or broad-rewrite actions. +## Forbidden Action Matrix + +| Action | Allowed? | Owner Authorization Required? | Evidence | +|:---|:---|:---|:---| +| No npm publish | no | yes | | +| No PyPI upload | no | yes | | +| No tag | no | yes | | +| No seal | no | yes | | +| No merge | no | yes | | +| Registry mutation | no | yes | | +| Package version change | no | yes | | +| L0 schema mutation | no | yes | | +| Cross-repo sync | no unless explicitly scoped | yes | | + ## Stopping Condition Define the exact evidence that proves the goal is complete. From 7630bd9bae14ac4606f307c8dd7cff9302425822 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Sun, 7 Jun 2026 16:56:20 +0800 Subject: [PATCH 03/24] governance: propagate local baseline discovery mechanism --- .../agentic-harness-goal-preflight/SKILL.md | 41 +++++++++++++++++ .codex/config.toml | 9 ++++ .../agentic-harness-goal-preflight/SKILL.md | 41 +++++++++++++++++ AGENTS.md | 39 ++++++++++++++++ governance/codex-goals/CODEX-GOAL-TEMPLATE.md | 44 +++++++++++++++++++ scripts/codex/repo-truth-first.sh | 16 +++++++ 6 files changed, 190 insertions(+) diff --git a/.agents/skills/agentic-harness-goal-preflight/SKILL.md b/.agents/skills/agentic-harness-goal-preflight/SKILL.md index 5fbf9c22..127248c9 100644 --- a/.agents/skills/agentic-harness-goal-preflight/SKILL.md +++ b/.agents/skills/agentic-harness-goal-preflight/SKILL.md @@ -71,6 +71,9 @@ SOT layers: ## Required Execution Order +0. Local governance baseline discovery: inspect local baseline sources, produce + the local baseline evidence table, and confirm that prompt assertions are not + governance authority unless supported by local repository evidence. 1. `SCTM`: clarify task and model governed intent. 2. `GLFB`: separate feasibility, permission, and owner authorization. 3. `ITCM`: map repo topology, SOT layers, upstream/downstream dependencies, and constraints. @@ -79,6 +82,44 @@ SOT layers: 6. Execute only authorized governance or task-scope actions. 7. `PRM`: record retrospective evidence and hardening recommendations. +## Local Governance Baseline Discovery + +Every non-trivial Goal must discover, cite, and apply this repository's local +governance baseline before making any substantive decision. Dynamic governance +baseline selection is a precondition for every non-trivial task. The prompt +defines the task and may describe a discovery procedure, but it must not be +treated as policy authority when repository governance evidence exists. + +Required rule: + +`Prompt assertions are not governance authority unless supported by local repository evidence.` + +Required local baseline evidence table: + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +|:---|:---|:---|:---|:---|:---|:---| + +Allowed confidence values are `HIGH_LOCAL_BASELINE_EXPLICIT`, +`MEDIUM_LOCAL_BASELINE_DERIVED`, `LOW_LOCAL_BASELINE_INFERRED`, +`CONFLICTING_BASELINE`, and `MISSING_BASELINE`. + +Stop before mutation if a mutation-affecting decision has low, conflicting, or +missing local evidence. + +Required blocker verdicts: + +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE` +- `BLOCKED_DYNAMIC_BASELINE_SELECTION_NOT_PERFORMED` +- `BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE` + +Use package policy discovery only when package-related, version baseline +discovery only when release/version-related, copyright baseline discovery only +when legal/copyright-related, and cross-repo boundary discovery when more than +one repository is involved. Do not import substantive policy conclusions from +another repo or the prompt. + ## Repository / Remote Authority Default authority matrix: diff --git a/.codex/config.toml b/.codex/config.toml index c9f2cb38..fa92b31a 100644 --- a/.codex/config.toml +++ b/.codex/config.toml @@ -22,6 +22,15 @@ preflight_skill = ".agents/skills/agentic-harness-goal-preflight/SKILL.md" goal_template = "governance/codex-goals/CODEX-GOAL-TEMPLATE.md" skill_mirror = ".codex/skills/agentic-harness-goal-preflight/SKILL.md" +[local_governance_baseline_discovery] +required_phrase = "Prompt assertions are not governance authority unless supported by local repository evidence." +required_precondition = "Dynamic governance baseline selection is a precondition for every non-trivial task." +required_table = "local baseline evidence table" +package_policy_discovery_required_when_package_related = true +version_baseline_discovery_required_when_release_or_version_related = true +copyright_baseline_discovery_required_when_legal_or_copyright_related = true +cross_repo_boundary_discovery_required_when_cross_repo_related = true + # Subagent policy guidance, not enforced by this config parser: # max_threads = 4 # max_depth = 1 diff --git a/.codex/skills/agentic-harness-goal-preflight/SKILL.md b/.codex/skills/agentic-harness-goal-preflight/SKILL.md index 5fbf9c22..127248c9 100644 --- a/.codex/skills/agentic-harness-goal-preflight/SKILL.md +++ b/.codex/skills/agentic-harness-goal-preflight/SKILL.md @@ -71,6 +71,9 @@ SOT layers: ## Required Execution Order +0. Local governance baseline discovery: inspect local baseline sources, produce + the local baseline evidence table, and confirm that prompt assertions are not + governance authority unless supported by local repository evidence. 1. `SCTM`: clarify task and model governed intent. 2. `GLFB`: separate feasibility, permission, and owner authorization. 3. `ITCM`: map repo topology, SOT layers, upstream/downstream dependencies, and constraints. @@ -79,6 +82,44 @@ SOT layers: 6. Execute only authorized governance or task-scope actions. 7. `PRM`: record retrospective evidence and hardening recommendations. +## Local Governance Baseline Discovery + +Every non-trivial Goal must discover, cite, and apply this repository's local +governance baseline before making any substantive decision. Dynamic governance +baseline selection is a precondition for every non-trivial task. The prompt +defines the task and may describe a discovery procedure, but it must not be +treated as policy authority when repository governance evidence exists. + +Required rule: + +`Prompt assertions are not governance authority unless supported by local repository evidence.` + +Required local baseline evidence table: + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +|:---|:---|:---|:---|:---|:---|:---| + +Allowed confidence values are `HIGH_LOCAL_BASELINE_EXPLICIT`, +`MEDIUM_LOCAL_BASELINE_DERIVED`, `LOW_LOCAL_BASELINE_INFERRED`, +`CONFLICTING_BASELINE`, and `MISSING_BASELINE`. + +Stop before mutation if a mutation-affecting decision has low, conflicting, or +missing local evidence. + +Required blocker verdicts: + +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE` +- `BLOCKED_DYNAMIC_BASELINE_SELECTION_NOT_PERFORMED` +- `BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE` + +Use package policy discovery only when package-related, version baseline +discovery only when release/version-related, copyright baseline discovery only +when legal/copyright-related, and cross-repo boundary discovery when more than +one repository is involved. Do not import substantive policy conclusions from +another repo or the prompt. + ## Repository / Remote Authority Default authority matrix: diff --git a/AGENTS.md b/AGENTS.md index f23bb129..07a2861b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -82,6 +82,45 @@ Required blocked verdicts for wrong-authority or owner-approval violations: - `BLOCKED_PACKAGE_PUBLICATION_AUTHORIZATION_REQUIRED` - `BLOCKED_PACKAGE_ARTIFACT_PROVENANCE_MISSING` +## Local Governance Baseline Discovery + +Every non-trivial Codex task must discover, cite, and apply this repository's +local governance baseline before making any substantive decision or mutation. +Dynamic governance baseline selection is a precondition for every non-trivial +task. + +The user prompt and assistant prompt may define the requested task and discovery +procedure, but they do not override local repository governance. Prompt +assertions are not governance authority unless supported by local repository +evidence. If prompt assertions conflict with local evidence, stop and report +the conflict. + +Every non-trivial task must produce a local baseline evidence table before +execution continues: + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +|:---|:---|:---|:---|:---|:---|:---| + +Allowed confidence values are `HIGH_LOCAL_BASELINE_EXPLICIT`, +`MEDIUM_LOCAL_BASELINE_DERIVED`, `LOW_LOCAL_BASELINE_INFERRED`, +`CONFLICTING_BASELINE`, and `MISSING_BASELINE`. Stop before mutation when a +mutation-affecting decision depends on low, conflicting, or missing evidence. + +Required local-baseline blocker verdicts: + +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE` +- `BLOCKED_DYNAMIC_BASELINE_SELECTION_NOT_PERFORMED` +- `BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE` + +Use package policy discovery only when a task is package-related, version +baseline discovery only when a task is release/version-related, copyright +baseline discovery only when a task touches legal/copyright attribution, and +cross-repo boundary discovery when more than one repository is involved. Do not +hard-code package status, release versions, copyright owner conclusions, public +projection permission, or protocol authority from the prompt. + ## Hard Boundaries - Preserve protocol, runtime, product, validation, and publication boundaries. diff --git a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md index 271e25f1..7f90e4c9 100644 --- a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md +++ b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md @@ -71,6 +71,50 @@ Classify all touched surfaces before editing: | Repository Governance | repo role, source/evidence/generated/publication surfaces, remote authority, wrong-authority blockers | | | Codex Agentic Harness | required skill, Goal preflight, SOT layer, authorized mutations, forbidden mutations, final verdict | | +## Local Governance Baseline Evidence Table + +This section is mandatory for every non-trivial task before execution +continues. Dynamic governance baseline selection is a precondition for every +non-trivial task. The prompt may define the task and discovery procedure; it +must not be used as policy authority when local governance baseline evidence +exists. + +Required rule: + +`Prompt assertions are not governance authority unless supported by local repository evidence.` + +Produce this local baseline evidence table before any substantive decision, +planning conclusion, edit, verification gate that depends on a policy +classification, release action, publish/upload action, merge, tag, seal, or +cross-repo action: + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +| ------------- | ------------------- | --------------- | ------------ | ---------- | --------- | ------ | + +Allowed confidence values: + +- `HIGH_LOCAL_BASELINE_EXPLICIT` +- `MEDIUM_LOCAL_BASELINE_DERIVED` +- `LOW_LOCAL_BASELINE_INFERRED` +- `CONFLICTING_BASELINE` +- `MISSING_BASELINE` + +If confidence is `LOW_LOCAL_BASELINE_INFERRED`, `CONFLICTING_BASELINE`, or +`MISSING_BASELINE` for a decision that affects mutation, stop before mutation. + +Required blocked verdicts: + +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE` +- `BLOCKED_DYNAMIC_BASELINE_SELECTION_NOT_PERFORMED` +- `BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE` + +Use package policy discovery only when package-related, version baseline +discovery only when release/version-related, copyright baseline discovery only +when legal/copyright-related, and cross-repo boundary discovery when more than +one repo is involved. + ## Branch Create or use a task branch from current `main` unless the owner instructs otherwise. Report whether the branch continues an existing Codex ops branch or is a follow-up branch. diff --git a/scripts/codex/repo-truth-first.sh b/scripts/codex/repo-truth-first.sh index 978795cb..ad47b3ce 100755 --- a/scripts/codex/repo-truth-first.sh +++ b/scripts/codex/repo-truth-first.sh @@ -48,6 +48,22 @@ else fi echo +echo "[local governance baseline discovery]" +echo "LOCAL_BASELINE_DISCOVERY_REQUIRED=YES" +echo "DYNAMIC_GOVERNANCE_BASELINE_SELECTION_PRECONDITION=Dynamic governance baseline selection is a precondition for every non-trivial task." +echo "required_phrase=Prompt assertions are not governance authority unless supported by local repository evidence." +echo "required_table=local baseline evidence table" +echo "package_policy_discovery=required_when_package_related" +echo "version_baseline_discovery=required_when_release_or_version_related" +echo "copyright_baseline_discovery=required_when_legal_or_copyright_related" +echo "cross_repo_boundary_discovery=required_when_cross_repo_related" +echo "blocked_local_baseline_missing=BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING" +echo "blocked_local_baseline_conflict=BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT" +echo "blocked_prompt_overrides_local_baseline=BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE" +echo "blocked_dynamic_selection_not_performed=BLOCKED_DYNAMIC_BASELINE_SELECTION_NOT_PERFORMED" +echo "blocked_substantive_decision_without_evidence=BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE" +echo + echo "[top-level files]" find . -maxdepth 2 \ -not -path './.git/*' \ From e7a5f6924f6340571f0c68fb2043241da18e030f Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Sun, 7 Jun 2026 18:43:37 +0800 Subject: [PATCH 04/24] governance: codify ownership baseline and close copyright surfaces --- docs/ops/PACKAGE_METADATA_BASELINE.yaml | 6 +++--- docs/ops/README_CANONICAL_TEMPLATE_v1.0.md | 1 - packages/npm/compliance/README.md | 1 - packages/npm/conformance/README.md | 1 - packages/npm/coordination/README.md | 1 - packages/npm/core/README.md | 1 - packages/npm/devtools/README.md | 1 - packages/npm/integration-llm-http/README.md | 1 - packages/npm/integration-storage-fs/README.md | 1 - packages/npm/integration-storage-kv/README.md | 1 - .../npm/integration-tools-generic/README.md | 1 - packages/npm/modules/README.md | 1 - packages/npm/runtime-minimal/README.md | 1 - packages/npm/schema/README.md | 1 - packages/npm/sdk-ts/README.md | 1 - packages/npm/validator/package.json | 2 +- packages/pypi/mplp-sdk/README.md | 1 - .../mplp-sdk/src/mplp_sdk.egg-info/PKG-INFO | 1 - packages/sources/sdk-py/README.md | 1 - packages/sources/sdk-py/pyproject.toml | 2 +- .../sdk-py/src/mplp_sdk.egg-info/PKG-INFO | 3 +-- packages/sources/sdk-ts/README.md | 1 - packages/sources/sdk-ts/package.json | 2 +- packages/sources/validator/README.md | Bin 4826 -> 4718 bytes packages/sources/validator/package.json | 2 +- .../validator/scripts/sync-schemas.mjs | Bin 2576 -> 2498 bytes 26 files changed, 8 insertions(+), 27 deletions(-) diff --git a/docs/ops/PACKAGE_METADATA_BASELINE.yaml b/docs/ops/PACKAGE_METADATA_BASELINE.yaml index 162a92d6..f73ffaab 100644 --- a/docs/ops/PACKAGE_METADATA_BASELINE.yaml +++ b/docs/ops/PACKAGE_METADATA_BASELINE.yaml @@ -3,7 +3,7 @@ # All publish sources MUST align to this baseline license: Apache-2.0 -author: Coregentis AI +author: Jearon Wong copyright_line: "© 2026 Jearon Wong" urls: @@ -23,7 +23,7 @@ keywords: # NPM-specific mappings npm: license: Apache-2.0 - author: Coregentis AI + author: Jearon Wong homepage: https://www.mplp.io repository: type: git @@ -41,7 +41,7 @@ npm: # PyPI-specific mappings pypi: license: Apache-2.0 - author: Coregentis AI + author: Jearon Wong urls: Homepage: https://www.mplp.io Documentation: https://docs.mplp.io diff --git a/docs/ops/README_CANONICAL_TEMPLATE_v1.0.md b/docs/ops/README_CANONICAL_TEMPLATE_v1.0.md index dac83ed9..98d42b2f 100644 --- a/docs/ops/README_CANONICAL_TEMPLATE_v1.0.md +++ b/docs/ops/README_CANONICAL_TEMPLATE_v1.0.md @@ -74,7 +74,6 @@ pip install [package-name] Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI ``` ## Terminology Rules diff --git a/packages/npm/compliance/README.md b/packages/npm/compliance/README.md index e2ad65ff..1d9759a2 100644 --- a/packages/npm/compliance/README.md +++ b/packages/npm/compliance/README.md @@ -53,4 +53,3 @@ Per the current MPLP terminology baseline, "**conformance**" is the preferred ex Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/conformance/README.md b/packages/npm/conformance/README.md index 03ba5314..857a4cab 100644 --- a/packages/npm/conformance/README.md +++ b/packages/npm/conformance/README.md @@ -76,4 +76,3 @@ The API is fully compatible - simply update your import: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/coordination/README.md b/packages/npm/coordination/README.md index e451541b..f3ce5a5b 100644 --- a/packages/npm/coordination/README.md +++ b/packages/npm/coordination/README.md @@ -59,4 +59,3 @@ npm install @mplp/coordination Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/core/README.md b/packages/npm/core/README.md index 6bbd5c17..d68506b3 100644 --- a/packages/npm/core/README.md +++ b/packages/npm/core/README.md @@ -61,4 +61,3 @@ npm install @mplp/core Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/devtools/README.md b/packages/npm/devtools/README.md index 92e46c5e..1772e3eb 100644 --- a/packages/npm/devtools/README.md +++ b/packages/npm/devtools/README.md @@ -59,4 +59,3 @@ npm install @mplp/devtools Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/integration-llm-http/README.md b/packages/npm/integration-llm-http/README.md index 794b085b..eb93669c 100644 --- a/packages/npm/integration-llm-http/README.md +++ b/packages/npm/integration-llm-http/README.md @@ -58,4 +58,3 @@ npm install @mplp/integration-llm-http Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/integration-storage-fs/README.md b/packages/npm/integration-storage-fs/README.md index 59559a1a..3d5feb4c 100644 --- a/packages/npm/integration-storage-fs/README.md +++ b/packages/npm/integration-storage-fs/README.md @@ -58,4 +58,3 @@ npm install @mplp/integration-storage-fs Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/integration-storage-kv/README.md b/packages/npm/integration-storage-kv/README.md index 45e127b1..78a71865 100644 --- a/packages/npm/integration-storage-kv/README.md +++ b/packages/npm/integration-storage-kv/README.md @@ -58,4 +58,3 @@ npm install @mplp/integration-storage-kv Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/integration-tools-generic/README.md b/packages/npm/integration-tools-generic/README.md index 8f890496..a2798682 100644 --- a/packages/npm/integration-tools-generic/README.md +++ b/packages/npm/integration-tools-generic/README.md @@ -58,4 +58,3 @@ npm install @mplp/integration-tools-generic Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/modules/README.md b/packages/npm/modules/README.md index e1e65bfb..8b44dfb9 100644 --- a/packages/npm/modules/README.md +++ b/packages/npm/modules/README.md @@ -59,4 +59,3 @@ npm install @mplp/modules Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/runtime-minimal/README.md b/packages/npm/runtime-minimal/README.md index 648d4099..ed31f505 100644 --- a/packages/npm/runtime-minimal/README.md +++ b/packages/npm/runtime-minimal/README.md @@ -86,4 +86,3 @@ The canonical duty baseline remains in: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/schema/README.md b/packages/npm/schema/README.md index 1266aba1..ae55b1ce 100644 --- a/packages/npm/schema/README.md +++ b/packages/npm/schema/README.md @@ -80,4 +80,3 @@ Raw JSON is also shipped at: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/sdk-ts/README.md b/packages/npm/sdk-ts/README.md index 8ed8d01e..2f826830 100644 --- a/packages/npm/sdk-ts/README.md +++ b/packages/npm/sdk-ts/README.md @@ -109,4 +109,3 @@ Canonical upstream baseline remains in: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/npm/validator/package.json b/packages/npm/validator/package.json index a60e190b..9a60cde3 100644 --- a/packages/npm/validator/package.json +++ b/packages/npm/validator/package.json @@ -4,7 +4,7 @@ "private": true, "description": "MPLP Protocol Validator CLI - CI-only internal tool for schema validation and Golden Flow verification. NOT FOR EXTERNAL PUBLICATION.", "license": "Apache-2.0", - "author": "Coregentis AI", + "author": "Jearon Wong", "main": "dist/index.js", "types": "dist/index.d.ts", "bin": { diff --git a/packages/pypi/mplp-sdk/README.md b/packages/pypi/mplp-sdk/README.md index fc8013a2..5cddc384 100644 --- a/packages/pypi/mplp-sdk/README.md +++ b/packages/pypi/mplp-sdk/README.md @@ -105,4 +105,3 @@ Canonical upstream baseline remains in: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/pypi/mplp-sdk/src/mplp_sdk.egg-info/PKG-INFO b/packages/pypi/mplp-sdk/src/mplp_sdk.egg-info/PKG-INFO index 2eb11c27..c4233085 100644 --- a/packages/pypi/mplp-sdk/src/mplp_sdk.egg-info/PKG-INFO +++ b/packages/pypi/mplp-sdk/src/mplp_sdk.egg-info/PKG-INFO @@ -130,4 +130,3 @@ Canonical upstream baseline remains in: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/sources/sdk-py/README.md b/packages/sources/sdk-py/README.md index 0cc9c122..cac945a9 100644 --- a/packages/sources/sdk-py/README.md +++ b/packages/sources/sdk-py/README.md @@ -97,4 +97,3 @@ Canonical upstream baseline remains in: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/sources/sdk-py/pyproject.toml b/packages/sources/sdk-py/pyproject.toml index 1bba5a2c..816e0b12 100644 --- a/packages/sources/sdk-py/pyproject.toml +++ b/packages/sources/sdk-py/pyproject.toml @@ -11,7 +11,7 @@ requires-python = ">=3.9" license = "Apache-2.0" authors = [ - { name = "Coregentis AI" } + { name = "Jearon Wong" } ] keywords = ["mplp", "multi-agent", "lifecycle", "protocol", "agent-os", "python", "source-mirror", "kernel-duties"] diff --git a/packages/sources/sdk-py/src/mplp_sdk.egg-info/PKG-INFO b/packages/sources/sdk-py/src/mplp_sdk.egg-info/PKG-INFO index cfaf8759..94038885 100644 --- a/packages/sources/sdk-py/src/mplp_sdk.egg-info/PKG-INFO +++ b/packages/sources/sdk-py/src/mplp_sdk.egg-info/PKG-INFO @@ -2,7 +2,7 @@ Metadata-Version: 2.4 Name: mplp-sdk Version: 1.0.5 Summary: Source-side mirror for the published mplp-sdk protocol helper package surface; not a public publish target. -Author: Coregentis AI +Author: Jearon Wong License-Expression: Apache-2.0 Project-URL: Homepage, https://mplp.io Project-URL: Documentation, https://docs.mplp.io @@ -117,4 +117,3 @@ Canonical upstream baseline remains in: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/sources/sdk-ts/README.md b/packages/sources/sdk-ts/README.md index 00e644b8..69291a20 100644 --- a/packages/sources/sdk-ts/README.md +++ b/packages/sources/sdk-ts/README.md @@ -92,4 +92,3 @@ Canonical baseline source: Apache License, Version 2.0 © 2026 **Jearon Wong** -Coregentis AI diff --git a/packages/sources/sdk-ts/package.json b/packages/sources/sdk-ts/package.json index 0cf7dd97..05f152b0 100644 --- a/packages/sources/sdk-ts/package.json +++ b/packages/sources/sdk-ts/package.json @@ -4,7 +4,7 @@ "version": "1.0.7", "description": "Build-source workspace mirror for the published @mplp/sdk-ts facade package, including Kernel Duty exports (not a publish target).", "license": "Apache-2.0", - "author": "Coregentis AI", + "author": "Jearon Wong", "repository": { "type": "git", "url": "https://github.com/Coregentis/MPLP-Protocol.git" diff --git a/packages/sources/validator/README.md b/packages/sources/validator/README.md index e7e1b8d7934f84464d862f7497a4a82f0cf49fb8..12cd889ce005d511375f140cfc60a9d5ba858454 100644 GIT binary patch delta 46 scmcbm`c7qohme{Xg93vV5PC7BG9)q-G2}Dk0Y$>WbUIjumw}4`0QnIJaR2}S delta 150 zcmaE-a!YlChfuvKg93vV5IQj=GUPF&GZZsqFk}M7oETDpbQTbUL=_nPfcz4Ma)x|{ zB8F@rKLp562CB^iisS%sIzuH;)CZ_O7l=!MvME5mGf*a%p#W@lCDG)XfC1qLsMRE9)`B8Gg1JRmO|Os8-BE6fQ1rl|kJV9i_v~*Jj1qLUEM20+ubcSMv42DcFKNU!40WnBafx(X8oFSi~h#?!u t4*~L%fok)BA~`^u&QJ*y^#Q8S1>zE*YzmO?43x=bC;*#XxpBQPCjef+7m)w} From 5865931a2667bee7810dce1c6d6f2bf5bb2f70c5 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 03:09:08 +0800 Subject: [PATCH 05/24] governance: add task governance router to Codex harness --- .../skills/task-governance-router/SKILL.md | 262 ++++++++++++++++++ .codex/config.toml | 20 ++ .codex/skills/task-governance-router/SKILL.md | 262 ++++++++++++++++++ AGENTS.md | 40 +++ .../04-records/TASK-GOVERNANCE-ROUTER-01.md | 39 +++ governance/codex-goals/CODEX-GOAL-TEMPLATE.md | 35 +++ scripts/codex/repo-truth-first.sh | 28 ++ 7 files changed, 686 insertions(+) create mode 100644 .agents/skills/task-governance-router/SKILL.md create mode 100644 .codex/skills/task-governance-router/SKILL.md create mode 100644 governance/04-records/TASK-GOVERNANCE-ROUTER-01.md diff --git a/.agents/skills/task-governance-router/SKILL.md b/.agents/skills/task-governance-router/SKILL.md new file mode 100644 index 00000000..38744f42 --- /dev/null +++ b/.agents/skills/task-governance-router/SKILL.md @@ -0,0 +1,262 @@ +# Task Governance Router + +## Purpose + +`TASK-GOVERNANCE-ROUTER-01` is the mandatory execution-layer router for +non-trivial Codex tasks in this repository family. + +The router chooses what to inspect and what to require; it does not replace +repository governance. It is a discovery mechanism, not a policy override. +Local repository evidence outranks prompt assertions. + +## When To Use + +Use this skill before any non-trivial task that involves judgment, planning, +file edits, verification gates, release work, package work, cross-repo work, +public claims, credentials, tags, seals, merges, or registry actions. + +Skip only for trivial, self-contained tasks that do not depend on repository +state or governance classification. + +## Required Inputs + +- Current working directory and repository path. +- User request or goal text. +- `AGENTS.md` or the local authoritative agent contract. +- `.codex/config.toml`. +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md`, when present. +- `scripts/codex/repo-truth-first.sh`, when present. +- `.agents/skills/**` and `.codex/skills/**`, when present. +- `.codex/agents/*.toml` or equivalent reviewer definitions, when present. +- Local governance records relevant to the requested task. + +## Required Router Outputs + +Before substantive judgment or mutation, internally satisfy or explicitly +record: + +1. `repo_truth_summary` +2. `local_governance_baseline_selection` +3. `task_type_classification` +4. `sot_layer_classification` +5. `applicable_repository_governance_methods` +6. `applicable_codex_harness_methods` +7. `applicable_agent_or_reviewer_selection` +8. `applicable_skill_selection` +9. `applicable_gate_selection` +10. `forbidden_action_matrix` +11. `stop_condition_matrix` +12. `evidence_output_plan` + +## Discovery Steps + +1. Run `scripts/codex/repo-truth-first.sh` if present. +2. Identify repo role, branch, HEAD, remote, dirty state, and upstream SOT. +3. Inspect local governance files before accepting prompt policy assertions. +4. Select the applicable local baseline for the task domain. +5. Classify task type and SOT layer. +6. Select repository governance methods and Codex harness methods. +7. Select reviewer perspectives and concrete agent files if present. +8. Select required gates from local scripts, skills, and records. +9. Build forbidden action and stop-condition matrices. +10. Define evidence outputs before edits or irreversible actions. + +If the prompt conflicts with local governance, stop. If local governance is +missing, conflicting, or low-confidence for a mutation-affecting decision, stop. + +## Task Type Classifier + +Classify at least one: + +- `governance_baseline` +- `package_release` +- `package_publish` +- `package_preflight` +- `version_alignment` +- `copyright_owner_surface` +- `schema_protocol` +- `docs_projection` +- `website_projection` +- `public_oss_projection` +- `validation_lab_evidence` +- `runtime_downstream` +- `product_downstream` +- `cross_repo_sync` +- `release_evidence_closure` +- `credential_readiness` +- `post_publish_verification` +- `devtools_or_validator_or_compliance_status` +- `unknown_or_mixed` + +For each selected type, discover from local evidence: + +- upstream SOT +- allowed mutation surfaces +- forbidden mutation surfaces +- required gates +- required evidence +- required owner decision, if any +- required agents, reviewers, and skills + +Do not hardcode package status, repo role, or authorization from the prompt. + +## SOT Layer Classifier + +Classify touched surfaces: + +| Layer | Meaning | +| --- | --- | +| `L0 Protocol Truth` | Protocol schemas, invariants, normative protocol definitions | +| `L1 Projection Source` | Repo-specific source or public projection source | +| `L2 Generated Artifact` | Generated or derived files | +| `L3 Verification Evidence` | Evidence, logs, reports, validation artifacts | +| `L4 Publication Surface` | Public docs, website, README, package metadata, release notes | +| `L5 Downstream Runtime/Product` | Runtime or product behavior surfaces | +| `L6 Codex Execution Governance` | AGENTS, config, skills, goal templates, repo-truth scripts | + +## Local Baseline Evidence Table + +Use this format: + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +| --- | --- | --- | --- | --- | --- | --- | + +Allowed confidence: + +- `HIGH_LOCAL_BASELINE_EXPLICIT` +- `MEDIUM_LOCAL_BASELINE_DERIVED` +- `LOW_LOCAL_BASELINE_INFERRED` +- `CONFLICTING_BASELINE` +- `MISSING_BASELINE` + +Stop before mutation when confidence is `LOW_LOCAL_BASELINE_INFERRED`, +`CONFLICTING_BASELINE`, or `MISSING_BASELINE` for a mutation-affecting decision. + +## Repository Governance Method Selector + +Select local repository methods only when the task touches their surfaces: + +- `DIV`: derivation integrity verification +- `TSV`: truth-source verification +- `XCV`: cross-consistency verification +- `SCV`: surface coverage verification +- `SUC`: usage conformance verification +- `EVC`: evidence/version compatibility verification +- package/release gates discovered locally +- copyright, projection, and release records discovered locally + +## Codex Agentic Harness Method Selector + +For non-trivial tasks, select applicable harness methods: + +- `SCTM`: structured context and task model +- `GLFB`: governance logic and feedback boundary +- `ITCM`: information topology and context map +- `RBCT`: risk-bounded change trajectory +- `VIM`: verification and invariants matrix +- `PRM`: post-run retrospective and memory +- `TASK-GOVERNANCE-ROUTER-01`: this router + +## Agent / Reviewer Selection Matrix + +Inspect `.codex/agents/*.toml` or equivalent definitions. Select concrete +agents when available; otherwise select mandatory review perspectives without +claiming actual subagent execution. + +Agent selection is advisory unless the local Codex runtime supports actual +agent invocation. The review perspective and evidence requirements are +mandatory. + +Minimum review perspectives: + +| Perspective | Use When | +| --- | --- | +| `governance_secretariat` | governance baselines, records, task routing | +| `release_manager` | release planning, release evidence, tags, seals | +| `package_surface_reviewer` | npm/PyPI/package/README/package surface tasks | +| `schema_protocol_reviewer` | schema, invariant, protocol truth tasks | +| `copyright_owner_surface_reviewer` | owner/legal/copyright surface tasks | +| `projection_boundary_reviewer` | public OSS, website, lab, cross-repo projection | +| `validation_evidence_reviewer` | validation lab, evidence, run packs | +| `runtime_downstream_reviewer` | Cognitive OS/runtime downstream tasks | +| `product_downstream_reviewer` | SoloCrew/product downstream tasks | +| `security_no_secret_reviewer` | credentials, auth readiness, secret hygiene | + +## Gate Selector + +Select gates from local evidence. Examples: + +- repo-truth-first +- skill mirror diff +- TOML parse +- JSON parse +- markdown/frontmatter checks +- protected surface scan +- package README/install smoke gate +- package consistency release gate +- schema/protocol gates +- public-claim scans +- runtime/product tests +- no-secret scans + +Green gates do not equal owner authorization. + +## Forbidden Action Matrix + +Declare whether each action is allowed, forbidden, or owner-authorization +required: + +- publish, upload, deprecate, yank/delete +- npm dist-tag mutation +- credential or token access/printing +- package version change +- package manifest change +- source/dist runtime package change +- L0 schema change +- release-set or pypi-set change +- public website content change +- product/runtime semantic change +- public projection mutation +- cross-repo sync/copy/cherry-pick +- tag, seal, merge, GitHub release +- deployment + +Publish/upload/tag/seal/merge/version/schema/public projection require explicit +local evidence plus owner authorization. + +## Stop Conditions + +Stop with the matching verdict: + +- `BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_AGENT_SELECTION_NOT_PERFORMED` +- `BLOCKED_REQUIRED_GATE_SELECTION_NOT_PERFORMED` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE` +- `BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE` +- `BLOCKED_PATCH_GATE_FAILURE` + +## Evidence Output Requirements + +For governance-router tasks, evidence should include: + +- repo inventory +- baseline sources inspected +- files changed by repo +- config summary +- skill summary and mirror status +- goal-template summary +- agent/reviewer selection matrix +- required phrase scan +- no-forbidden-surface-change scan +- final verdict + +## Final Verdict Vocabulary + +- `COMPLETE_TASK_GOVERNANCE_ROUTER_ACTIVE_ALL_REPOS` +- `PARTIAL_TASK_GOVERNANCE_ROUTER_ACTIVE_PUBLIC_PUSH_PENDING` +- `PARTIAL_TASK_GOVERNANCE_ROUTER_BLOCKED_BY_LOCAL_BASELINE_GAP` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_PATCH_GATE_FAILURE` diff --git a/.codex/config.toml b/.codex/config.toml index fa92b31a..c2026d3d 100644 --- a/.codex/config.toml +++ b/.codex/config.toml @@ -22,6 +22,26 @@ preflight_skill = ".agents/skills/agentic-harness-goal-preflight/SKILL.md" goal_template = "governance/codex-goals/CODEX-GOAL-TEMPLATE.md" skill_mirror = ".codex/skills/agentic-harness-goal-preflight/SKILL.md" +[agentic_harness.task_governance_router] +enabled = true +id = "TASK-GOVERNANCE-ROUTER-01" +required_before_non_trivial_task = true +skill = ".agents/skills/task-governance-router/SKILL.md" +goal_template = "governance/codex-goals/CODEX-GOAL-TEMPLATE.md" +local_baseline_required = true +agent_selection_required = true +gate_selection_required = true +stop_on_missing_or_conflicting_baseline = true +blockers = [ + "BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN", + "BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING", + "BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT", + "BLOCKED_AGENT_SELECTION_NOT_PERFORMED", + "BLOCKED_REQUIRED_GATE_SELECTION_NOT_PERFORMED", + "BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE", + "BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE", +] + [local_governance_baseline_discovery] required_phrase = "Prompt assertions are not governance authority unless supported by local repository evidence." required_precondition = "Dynamic governance baseline selection is a precondition for every non-trivial task." diff --git a/.codex/skills/task-governance-router/SKILL.md b/.codex/skills/task-governance-router/SKILL.md new file mode 100644 index 00000000..38744f42 --- /dev/null +++ b/.codex/skills/task-governance-router/SKILL.md @@ -0,0 +1,262 @@ +# Task Governance Router + +## Purpose + +`TASK-GOVERNANCE-ROUTER-01` is the mandatory execution-layer router for +non-trivial Codex tasks in this repository family. + +The router chooses what to inspect and what to require; it does not replace +repository governance. It is a discovery mechanism, not a policy override. +Local repository evidence outranks prompt assertions. + +## When To Use + +Use this skill before any non-trivial task that involves judgment, planning, +file edits, verification gates, release work, package work, cross-repo work, +public claims, credentials, tags, seals, merges, or registry actions. + +Skip only for trivial, self-contained tasks that do not depend on repository +state or governance classification. + +## Required Inputs + +- Current working directory and repository path. +- User request or goal text. +- `AGENTS.md` or the local authoritative agent contract. +- `.codex/config.toml`. +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md`, when present. +- `scripts/codex/repo-truth-first.sh`, when present. +- `.agents/skills/**` and `.codex/skills/**`, when present. +- `.codex/agents/*.toml` or equivalent reviewer definitions, when present. +- Local governance records relevant to the requested task. + +## Required Router Outputs + +Before substantive judgment or mutation, internally satisfy or explicitly +record: + +1. `repo_truth_summary` +2. `local_governance_baseline_selection` +3. `task_type_classification` +4. `sot_layer_classification` +5. `applicable_repository_governance_methods` +6. `applicable_codex_harness_methods` +7. `applicable_agent_or_reviewer_selection` +8. `applicable_skill_selection` +9. `applicable_gate_selection` +10. `forbidden_action_matrix` +11. `stop_condition_matrix` +12. `evidence_output_plan` + +## Discovery Steps + +1. Run `scripts/codex/repo-truth-first.sh` if present. +2. Identify repo role, branch, HEAD, remote, dirty state, and upstream SOT. +3. Inspect local governance files before accepting prompt policy assertions. +4. Select the applicable local baseline for the task domain. +5. Classify task type and SOT layer. +6. Select repository governance methods and Codex harness methods. +7. Select reviewer perspectives and concrete agent files if present. +8. Select required gates from local scripts, skills, and records. +9. Build forbidden action and stop-condition matrices. +10. Define evidence outputs before edits or irreversible actions. + +If the prompt conflicts with local governance, stop. If local governance is +missing, conflicting, or low-confidence for a mutation-affecting decision, stop. + +## Task Type Classifier + +Classify at least one: + +- `governance_baseline` +- `package_release` +- `package_publish` +- `package_preflight` +- `version_alignment` +- `copyright_owner_surface` +- `schema_protocol` +- `docs_projection` +- `website_projection` +- `public_oss_projection` +- `validation_lab_evidence` +- `runtime_downstream` +- `product_downstream` +- `cross_repo_sync` +- `release_evidence_closure` +- `credential_readiness` +- `post_publish_verification` +- `devtools_or_validator_or_compliance_status` +- `unknown_or_mixed` + +For each selected type, discover from local evidence: + +- upstream SOT +- allowed mutation surfaces +- forbidden mutation surfaces +- required gates +- required evidence +- required owner decision, if any +- required agents, reviewers, and skills + +Do not hardcode package status, repo role, or authorization from the prompt. + +## SOT Layer Classifier + +Classify touched surfaces: + +| Layer | Meaning | +| --- | --- | +| `L0 Protocol Truth` | Protocol schemas, invariants, normative protocol definitions | +| `L1 Projection Source` | Repo-specific source or public projection source | +| `L2 Generated Artifact` | Generated or derived files | +| `L3 Verification Evidence` | Evidence, logs, reports, validation artifacts | +| `L4 Publication Surface` | Public docs, website, README, package metadata, release notes | +| `L5 Downstream Runtime/Product` | Runtime or product behavior surfaces | +| `L6 Codex Execution Governance` | AGENTS, config, skills, goal templates, repo-truth scripts | + +## Local Baseline Evidence Table + +Use this format: + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +| --- | --- | --- | --- | --- | --- | --- | + +Allowed confidence: + +- `HIGH_LOCAL_BASELINE_EXPLICIT` +- `MEDIUM_LOCAL_BASELINE_DERIVED` +- `LOW_LOCAL_BASELINE_INFERRED` +- `CONFLICTING_BASELINE` +- `MISSING_BASELINE` + +Stop before mutation when confidence is `LOW_LOCAL_BASELINE_INFERRED`, +`CONFLICTING_BASELINE`, or `MISSING_BASELINE` for a mutation-affecting decision. + +## Repository Governance Method Selector + +Select local repository methods only when the task touches their surfaces: + +- `DIV`: derivation integrity verification +- `TSV`: truth-source verification +- `XCV`: cross-consistency verification +- `SCV`: surface coverage verification +- `SUC`: usage conformance verification +- `EVC`: evidence/version compatibility verification +- package/release gates discovered locally +- copyright, projection, and release records discovered locally + +## Codex Agentic Harness Method Selector + +For non-trivial tasks, select applicable harness methods: + +- `SCTM`: structured context and task model +- `GLFB`: governance logic and feedback boundary +- `ITCM`: information topology and context map +- `RBCT`: risk-bounded change trajectory +- `VIM`: verification and invariants matrix +- `PRM`: post-run retrospective and memory +- `TASK-GOVERNANCE-ROUTER-01`: this router + +## Agent / Reviewer Selection Matrix + +Inspect `.codex/agents/*.toml` or equivalent definitions. Select concrete +agents when available; otherwise select mandatory review perspectives without +claiming actual subagent execution. + +Agent selection is advisory unless the local Codex runtime supports actual +agent invocation. The review perspective and evidence requirements are +mandatory. + +Minimum review perspectives: + +| Perspective | Use When | +| --- | --- | +| `governance_secretariat` | governance baselines, records, task routing | +| `release_manager` | release planning, release evidence, tags, seals | +| `package_surface_reviewer` | npm/PyPI/package/README/package surface tasks | +| `schema_protocol_reviewer` | schema, invariant, protocol truth tasks | +| `copyright_owner_surface_reviewer` | owner/legal/copyright surface tasks | +| `projection_boundary_reviewer` | public OSS, website, lab, cross-repo projection | +| `validation_evidence_reviewer` | validation lab, evidence, run packs | +| `runtime_downstream_reviewer` | Cognitive OS/runtime downstream tasks | +| `product_downstream_reviewer` | SoloCrew/product downstream tasks | +| `security_no_secret_reviewer` | credentials, auth readiness, secret hygiene | + +## Gate Selector + +Select gates from local evidence. Examples: + +- repo-truth-first +- skill mirror diff +- TOML parse +- JSON parse +- markdown/frontmatter checks +- protected surface scan +- package README/install smoke gate +- package consistency release gate +- schema/protocol gates +- public-claim scans +- runtime/product tests +- no-secret scans + +Green gates do not equal owner authorization. + +## Forbidden Action Matrix + +Declare whether each action is allowed, forbidden, or owner-authorization +required: + +- publish, upload, deprecate, yank/delete +- npm dist-tag mutation +- credential or token access/printing +- package version change +- package manifest change +- source/dist runtime package change +- L0 schema change +- release-set or pypi-set change +- public website content change +- product/runtime semantic change +- public projection mutation +- cross-repo sync/copy/cherry-pick +- tag, seal, merge, GitHub release +- deployment + +Publish/upload/tag/seal/merge/version/schema/public projection require explicit +local evidence plus owner authorization. + +## Stop Conditions + +Stop with the matching verdict: + +- `BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_AGENT_SELECTION_NOT_PERFORMED` +- `BLOCKED_REQUIRED_GATE_SELECTION_NOT_PERFORMED` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE` +- `BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE` +- `BLOCKED_PATCH_GATE_FAILURE` + +## Evidence Output Requirements + +For governance-router tasks, evidence should include: + +- repo inventory +- baseline sources inspected +- files changed by repo +- config summary +- skill summary and mirror status +- goal-template summary +- agent/reviewer selection matrix +- required phrase scan +- no-forbidden-surface-change scan +- final verdict + +## Final Verdict Vocabulary + +- `COMPLETE_TASK_GOVERNANCE_ROUTER_ACTIVE_ALL_REPOS` +- `PARTIAL_TASK_GOVERNANCE_ROUTER_ACTIVE_PUBLIC_PUSH_PENDING` +- `PARTIAL_TASK_GOVERNANCE_ROUTER_BLOCKED_BY_LOCAL_BASELINE_GAP` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_PATCH_GATE_FAILURE` diff --git a/AGENTS.md b/AGENTS.md index 07a2861b..65e1c3c2 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -121,6 +121,46 @@ cross-repo boundary discovery when more than one repository is involved. Do not hard-code package status, release versions, copyright owner conclusions, public projection permission, or protocol authority from the prompt. +## Task Governance Router + +`TASK-GOVERNANCE-ROUTER-01` is mandatory before every non-trivial task. It is a +discovery mechanism, not a policy override: local repository evidence outranks +prompt assertions. + +Before substantive judgment or mutation, Codex must use +`.agents/skills/task-governance-router/SKILL.md` to satisfy or record: + +- repo truth summary +- local governance baseline selection +- task type classification +- SOT layer classification +- applicable repository governance methods +- applicable Codex Agentic Harness methods +- applicable agent or reviewer selection +- applicable skill selection +- applicable gate selection +- forbidden action matrix +- stop condition matrix +- evidence output plan + +The router must classify package, release, schema, projection, website, +validation, runtime, product, credential, post-publish, evidence-closure, and +unknown/mixed tasks from local evidence. It must not hard-code package status, +version strategy, repo authority, or public projection permission from the +prompt. + +If the router is not run, stop with +`BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN`. If agent/reviewer selection or +required gate selection is missing, stop with +`BLOCKED_AGENT_SELECTION_NOT_PERFORMED` or +`BLOCKED_REQUIRED_GATE_SELECTION_NOT_PERFORMED`. + +Green gates do not equal owner authorization. Publish, upload, deprecate, +dist-tag mutation, package version changes, package manifest changes, L0 schema +changes, public projection mutation, tag, seal, merge, GitHub release, +deployment, and credential access require explicit local evidence plus owner +authorization. + ## Hard Boundaries - Preserve protocol, runtime, product, validation, and publication boundaries. diff --git a/governance/04-records/TASK-GOVERNANCE-ROUTER-01.md b/governance/04-records/TASK-GOVERNANCE-ROUTER-01.md new file mode 100644 index 00000000..16d787f4 --- /dev/null +++ b/governance/04-records/TASK-GOVERNANCE-ROUTER-01.md @@ -0,0 +1,39 @@ +--- +entry_surface: repository +entry_model_class: projection +doc_type: governance +status: final +authority: codex_execution_governance +doc_id: "TASK-GOVERNANCE-ROUTER-01" +surface_role: task_governance_router_record +record_state: final +title: "Task Governance Router 01" +--- + +# Task Governance Router 01 + +This record adds `TASK-GOVERNANCE-ROUTER-01` to this repository's L6 Codex +Execution Governance layer. + +The router is a discovery mechanism, not a policy override. Local repository +evidence outranks prompt assertions. + +Updated surfaces: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.codex/skills/task-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` +- `scripts/codex/repo-truth-first.sh` + +The router requires task type, SOT layer, repository methods, Codex harness +methods, reviewer perspectives, skill selection, gate selection, forbidden +actions, stop conditions, and evidence outputs before non-trivial work. + +No package, schema, public projection content, registry, tag, seal, merge, or +release mutation is authorized by this record. + +Final verdict: + +`COMPLETE_TASK_GOVERNANCE_ROUTER_ACTIVE_ALL_REPOS` diff --git a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md index 7f90e4c9..ff963a47 100644 --- a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md +++ b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md @@ -6,6 +6,41 @@ Use this template for bounded Goal Mode tasks in this repository family. If `/go State the concrete objective and the verifiable stopping condition. +## Task Governance Router Result + +This section is mandatory before direct file edits, substantive judgment, +verification gates, release actions, publish/upload actions, tag, seal, merge, +or cross-repo actions. + +Run or internally satisfy `TASK-GOVERNANCE-ROUTER-01` using +`.agents/skills/task-governance-router/SKILL.md`. + +Declare: + +```yaml +task_governance_router: + router_id: TASK-GOVERNANCE-ROUTER-01 + router_skill: .agents/skills/task-governance-router/SKILL.md + router_run_before_substantive_work: + task_type: + selected_local_governance_baseline: + local_baseline_evidence_table: + sot_layer: + applicable_repo_governance_methods: + applicable_harness_methods: + applicable_agents_or_review_perspectives: + applicable_skills: + required_gates: + forbidden_actions: + stop_conditions: + evidence_outputs: + owner_decision_required: + final_verdict: +``` + +If this router result is missing, stop with +`BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN`. + ## Repository Name the exact repository path and current branch. Do not assume cloud threads, marketplace features, app-only visibility, or cloud-only execution. diff --git a/scripts/codex/repo-truth-first.sh b/scripts/codex/repo-truth-first.sh index ad47b3ce..117b3d53 100755 --- a/scripts/codex/repo-truth-first.sh +++ b/scripts/codex/repo-truth-first.sh @@ -64,6 +64,34 @@ echo "blocked_dynamic_selection_not_performed=BLOCKED_DYNAMIC_BASELINE_SELECTION echo "blocked_substantive_decision_without_evidence=BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE" echo +echo "[task governance router]" +echo "TASK_GOVERNANCE_ROUTER_REQUIRED=YES" +echo "TASK_GOVERNANCE_ROUTER_ID=TASK-GOVERNANCE-ROUTER-01" +if [ -f ".agents/skills/task-governance-router/SKILL.md" ]; then + echo "task_governance_router_skill=present .agents/skills/task-governance-router/SKILL.md" +else + echo "task_governance_router_skill=missing .agents/skills/task-governance-router/SKILL.md" +fi +if [ -f ".codex/skills/task-governance-router/SKILL.md" ]; then + echo "task_governance_router_skill_mirror=present .codex/skills/task-governance-router/SKILL.md" +else + echo "task_governance_router_skill_mirror=missing .codex/skills/task-governance-router/SKILL.md" +fi +if grep -q "TASK-GOVERNANCE-ROUTER-01" .codex/config.toml 2>/dev/null; then + echo "task_governance_router_config=present .codex/config.toml" +else + echo "task_governance_router_config=missing .codex/config.toml" +fi +if grep -q "Task Governance Router Result" governance/codex-goals/CODEX-GOAL-TEMPLATE.md 2>/dev/null; then + echo "task_governance_router_goal_template=present governance/codex-goals/CODEX-GOAL-TEMPLATE.md" +else + echo "task_governance_router_goal_template=missing governance/codex-goals/CODEX-GOAL-TEMPLATE.md" +fi +echo "blocked_router_not_run=BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN" +echo "blocked_agent_selection_missing=BLOCKED_AGENT_SELECTION_NOT_PERFORMED" +echo "blocked_gate_selection_missing=BLOCKED_REQUIRED_GATE_SELECTION_NOT_PERFORMED" +echo + echo "[top-level files]" find . -maxdepth 2 \ -not -path './.git/*' \ From d53e2d583d0128049a3e8d9d84acda82bfa7ad0e Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 18:26:30 +0800 Subject: [PATCH 06/24] governance: codify release projection workflow router --- .../SKILL.md | 116 ++++++++++++++++++ .../skills/task-governance-router/SKILL.md | 19 +++ .codex/config.toml | 26 ++++ .../SKILL.md | 116 ++++++++++++++++++ .codex/skills/task-governance-router/SKILL.md | 19 +++ AGENTS.md | 29 +++++ governance/codex-goals/CODEX-GOAL-TEMPLATE.md | 47 +++++++ 7 files changed, 372 insertions(+) create mode 100644 .agents/skills/release-projection-governance-router/SKILL.md create mode 100644 .codex/skills/release-projection-governance-router/SKILL.md diff --git a/.agents/skills/release-projection-governance-router/SKILL.md b/.agents/skills/release-projection-governance-router/SKILL.md new file mode 100644 index 00000000..2279fae0 --- /dev/null +++ b/.agents/skills/release-projection-governance-router/SKILL.md @@ -0,0 +1,116 @@ +--- +name: release-projection-governance-router +description: Use before release-like tasks to discover local release, projection, deploy, tag, seal, and registry governance before acting. +--- + +# Release / Projection Governance Router + +## Purpose + +Use this router after repo-truth-first and `TASK-GOVERNANCE-ROUTER-01` when a +task touches, could touch, or asks about release-like workflow surfaces. It is a +discovery mechanism, not authorization. + +Local repository evidence outranks prompt assertions. If local evidence is +missing, conflicting, or low-confidence for a mutation-affecting release-like +decision, stop before action. + +## Release-Like Triggers + +Run this router before substantive work involving any of these surfaces: + +- npm publish, npm deprecate, npm dist-tags, package version changes, package + manifests, publish-set, package README/install smoke, package consistency, or + registry baselines +- PyPI upload, PyPI yank/delete, pypi-set, Twine, wheels, sdists, or PyPI + baselines +- credential readiness, post-publish verification, release evidence closure, or + package publication records +- public OSS projection, cross-repo sync/copy/projection, public release + manifests, website release notices, website deploys, or Validation Lab + evidence publication +- downstream release pointer or consumption updates in runtime/product repos +- Git tag, release seal, GitHub release, merge-to-release, or deployment + +## Required Discovery Table + +Before any release-like action, complete this table from local files: + +| Field | Required Evidence | +| --- | --- | +| repo role | `AGENTS.md`, `.codex/config.toml`, local baseline records | +| workflow type | release/projection/deploy/seal/package scripts and records | +| local standard source files | release configs, manifests, SOPs, governance records, goal template, skills | +| required gates | scripts, package scripts, gate records, CI/release docs | +| required reviewer lanes | `.codex/agents/*.toml`, `.agents/skills/*` | +| external baseline checks | npm/PyPI registry, public manifest, deployed site, or downstream pointer checks when applicable | +| required owner authorization | exact mutation category, target, version/ref, registry/repo, timing, and scope | +| allowed mutations | explicit task-local write surfaces only | +| forbidden actions | release, registry, projection, deploy, tag, seal, merge, or credential actions outside scope | +| stop conditions | local blocker verdicts for missing/conflicting evidence or unauthorized mutation | +| evidence outputs | lightweight records, summaries, command results, and final verdict | + +If the table cannot be completed for a requested mutation, stop with a matching +blocker instead of inventing a standard. + +## Package Version Baseline Rule + +For version-bump planning, owner-approved version implementation, publish +planning, or publish execution, the next public version must be derived from the +latest already-published npm or PyPI registry version for the exact package +name. Local `package.json`, `pyproject.toml`, source mirror metadata, +release-set files, pypi-set files, generated dist, prior PRs, and green gates +are Dev state or evidence only; they are not the public version baseline. + +## Reviewer Routing + +Select reviewer perspectives from local `.codex/agents/*.toml` and skills. Use +actual subagents only when the active Codex environment and task authorization +allow it; otherwise record the perspectives applied. + +Consider these lanes when locally present: + +- `release_governance_reviewer` +- `package_surface_auditor` +- `publication_claim_reviewer` +- `protocol_schema_reviewer` +- `runtime_binding_reviewer` +- `product_boundary_reviewer` +- `security_no_secret_reviewer` or equivalent secret-hygiene perspective + +## Stop Conditions + +Support these blocker verdicts, using local naming where stricter: + +- `BLOCKED_RELEASE_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_RELEASE_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED` +- `BLOCKED_RELEASE_CONFIG_MISSING_OR_CONFLICTING` +- `BLOCKED_PUBLISHED_VERSION_BASELINE_MISSING` +- `BLOCKED_REGISTRY_BASELINE_DRIFT` +- `BLOCKED_PACKAGE_GATE_FAILED` +- `BLOCKED_CREDENTIAL_READINESS_FAILED` +- `BLOCKED_PUBLIC_PROJECTION_STANDARD_MISSING` +- `BLOCKED_PUBLIC_PROJECTION_STANDARD_CONFLICT` +- `BLOCKED_PUBLIC_PROJECTION_REDACTION_REQUIRED` +- `BLOCKED_CROSS_REPO_PROJECTION_NOT_AUTHORIZED` +- `BLOCKED_TAG_SEAL_RELEASE_NOT_AUTHORIZED` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_RELEASE_BASELINE` +- `BLOCKED_SUBSTANTIVE_RELEASE_DECISION_WITHOUT_LOCAL_EVIDENCE` + +## Forbidden Without Explicit Owner Authorization + +- npm publish, PyPI upload, deprecate, yank/delete, or dist-tag mutation +- credential value reading, printing, copying, committing, or disclosure +- package version changes, package release-set/pypi-set changes, or package + source/dist/schema mutation +- public OSS projection execution, website deploy, Validation Lab publication, + downstream release pointer mutation, cross-repo sync/copy/projection +- Git tag, release seal, GitHub release, merge, or branch deletion + +## Evidence Outputs + +For release-like tasks, produce or cite lightweight evidence for repo truth, +selected baseline, completed discovery table, reviewer lanes, gates, forbidden +actions, stop conditions, command results, and final verdict. Evidence is not +authorization. diff --git a/.agents/skills/task-governance-router/SKILL.md b/.agents/skills/task-governance-router/SKILL.md index 38744f42..6302e8bf 100644 --- a/.agents/skills/task-governance-router/SKILL.md +++ b/.agents/skills/task-governance-router/SKILL.md @@ -100,6 +100,25 @@ For each selected type, discover from local evidence: Do not hardcode package status, repo role, or authorization from the prompt. +## Release-Like Workflow Delegation + +If a task is release-like, also run or internally satisfy +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` using +`.agents/skills/release-projection-governance-router/SKILL.md` before +substantive judgment, edits, gates, release action, publish/upload, projection, +deploy, merge, tag, or seal. + +Release-like surfaces include package publish/upload, version or manifest +changes, publish-set or pypi-set changes, registry baselines, credential +readiness, post-publish verification, release evidence closure, public OSS +projection, website deploy or release notice, Validation Lab publication, +downstream release pointer changes, cross-repo sync/projection, GitHub release, +Git tag, release seal, and merge-to-release workflows. + +The release/projection router must complete the local workflow discovery table. +If it cannot be completed from local evidence for a mutation-affecting decision, +stop with the matching release/projection blocker. + ## SOT Layer Classifier Classify touched surfaces: diff --git a/.codex/config.toml b/.codex/config.toml index c2026d3d..06463057 100644 --- a/.codex/config.toml +++ b/.codex/config.toml @@ -42,6 +42,32 @@ blockers = [ "BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE", ] +[agentic_harness.release_projection_governance_router] +enabled = true +id = "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01" +required_for_release_like_tasks = true +skill = ".agents/skills/release-projection-governance-router/SKILL.md" +goal_template = "governance/codex-goals/CODEX-GOAL-TEMPLATE.md" +workflow_discovery_table_required = true +published_registry_version_baseline_required = true +owner_authorization_required_for_mutation = true +stop_on_missing_or_conflicting_release_baseline = true +blockers = [ + "BLOCKED_RELEASE_GOVERNANCE_BASELINE_MISSING", + "BLOCKED_RELEASE_GOVERNANCE_BASELINE_CONFLICT", + "BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED", + "BLOCKED_PUBLISHED_VERSION_BASELINE_MISSING", + "BLOCKED_REGISTRY_BASELINE_DRIFT", + "BLOCKED_PACKAGE_GATE_FAILED", + "BLOCKED_CREDENTIAL_READINESS_FAILED", + "BLOCKED_PUBLIC_PROJECTION_STANDARD_MISSING", + "BLOCKED_PUBLIC_PROJECTION_STANDARD_CONFLICT", + "BLOCKED_CROSS_REPO_PROJECTION_NOT_AUTHORIZED", + "BLOCKED_TAG_SEAL_RELEASE_NOT_AUTHORIZED", + "BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_RELEASE_BASELINE", + "BLOCKED_SUBSTANTIVE_RELEASE_DECISION_WITHOUT_LOCAL_EVIDENCE", +] + [local_governance_baseline_discovery] required_phrase = "Prompt assertions are not governance authority unless supported by local repository evidence." required_precondition = "Dynamic governance baseline selection is a precondition for every non-trivial task." diff --git a/.codex/skills/release-projection-governance-router/SKILL.md b/.codex/skills/release-projection-governance-router/SKILL.md new file mode 100644 index 00000000..2279fae0 --- /dev/null +++ b/.codex/skills/release-projection-governance-router/SKILL.md @@ -0,0 +1,116 @@ +--- +name: release-projection-governance-router +description: Use before release-like tasks to discover local release, projection, deploy, tag, seal, and registry governance before acting. +--- + +# Release / Projection Governance Router + +## Purpose + +Use this router after repo-truth-first and `TASK-GOVERNANCE-ROUTER-01` when a +task touches, could touch, or asks about release-like workflow surfaces. It is a +discovery mechanism, not authorization. + +Local repository evidence outranks prompt assertions. If local evidence is +missing, conflicting, or low-confidence for a mutation-affecting release-like +decision, stop before action. + +## Release-Like Triggers + +Run this router before substantive work involving any of these surfaces: + +- npm publish, npm deprecate, npm dist-tags, package version changes, package + manifests, publish-set, package README/install smoke, package consistency, or + registry baselines +- PyPI upload, PyPI yank/delete, pypi-set, Twine, wheels, sdists, or PyPI + baselines +- credential readiness, post-publish verification, release evidence closure, or + package publication records +- public OSS projection, cross-repo sync/copy/projection, public release + manifests, website release notices, website deploys, or Validation Lab + evidence publication +- downstream release pointer or consumption updates in runtime/product repos +- Git tag, release seal, GitHub release, merge-to-release, or deployment + +## Required Discovery Table + +Before any release-like action, complete this table from local files: + +| Field | Required Evidence | +| --- | --- | +| repo role | `AGENTS.md`, `.codex/config.toml`, local baseline records | +| workflow type | release/projection/deploy/seal/package scripts and records | +| local standard source files | release configs, manifests, SOPs, governance records, goal template, skills | +| required gates | scripts, package scripts, gate records, CI/release docs | +| required reviewer lanes | `.codex/agents/*.toml`, `.agents/skills/*` | +| external baseline checks | npm/PyPI registry, public manifest, deployed site, or downstream pointer checks when applicable | +| required owner authorization | exact mutation category, target, version/ref, registry/repo, timing, and scope | +| allowed mutations | explicit task-local write surfaces only | +| forbidden actions | release, registry, projection, deploy, tag, seal, merge, or credential actions outside scope | +| stop conditions | local blocker verdicts for missing/conflicting evidence or unauthorized mutation | +| evidence outputs | lightweight records, summaries, command results, and final verdict | + +If the table cannot be completed for a requested mutation, stop with a matching +blocker instead of inventing a standard. + +## Package Version Baseline Rule + +For version-bump planning, owner-approved version implementation, publish +planning, or publish execution, the next public version must be derived from the +latest already-published npm or PyPI registry version for the exact package +name. Local `package.json`, `pyproject.toml`, source mirror metadata, +release-set files, pypi-set files, generated dist, prior PRs, and green gates +are Dev state or evidence only; they are not the public version baseline. + +## Reviewer Routing + +Select reviewer perspectives from local `.codex/agents/*.toml` and skills. Use +actual subagents only when the active Codex environment and task authorization +allow it; otherwise record the perspectives applied. + +Consider these lanes when locally present: + +- `release_governance_reviewer` +- `package_surface_auditor` +- `publication_claim_reviewer` +- `protocol_schema_reviewer` +- `runtime_binding_reviewer` +- `product_boundary_reviewer` +- `security_no_secret_reviewer` or equivalent secret-hygiene perspective + +## Stop Conditions + +Support these blocker verdicts, using local naming where stricter: + +- `BLOCKED_RELEASE_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_RELEASE_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED` +- `BLOCKED_RELEASE_CONFIG_MISSING_OR_CONFLICTING` +- `BLOCKED_PUBLISHED_VERSION_BASELINE_MISSING` +- `BLOCKED_REGISTRY_BASELINE_DRIFT` +- `BLOCKED_PACKAGE_GATE_FAILED` +- `BLOCKED_CREDENTIAL_READINESS_FAILED` +- `BLOCKED_PUBLIC_PROJECTION_STANDARD_MISSING` +- `BLOCKED_PUBLIC_PROJECTION_STANDARD_CONFLICT` +- `BLOCKED_PUBLIC_PROJECTION_REDACTION_REQUIRED` +- `BLOCKED_CROSS_REPO_PROJECTION_NOT_AUTHORIZED` +- `BLOCKED_TAG_SEAL_RELEASE_NOT_AUTHORIZED` +- `BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_RELEASE_BASELINE` +- `BLOCKED_SUBSTANTIVE_RELEASE_DECISION_WITHOUT_LOCAL_EVIDENCE` + +## Forbidden Without Explicit Owner Authorization + +- npm publish, PyPI upload, deprecate, yank/delete, or dist-tag mutation +- credential value reading, printing, copying, committing, or disclosure +- package version changes, package release-set/pypi-set changes, or package + source/dist/schema mutation +- public OSS projection execution, website deploy, Validation Lab publication, + downstream release pointer mutation, cross-repo sync/copy/projection +- Git tag, release seal, GitHub release, merge, or branch deletion + +## Evidence Outputs + +For release-like tasks, produce or cite lightweight evidence for repo truth, +selected baseline, completed discovery table, reviewer lanes, gates, forbidden +actions, stop conditions, command results, and final verdict. Evidence is not +authorization. diff --git a/.codex/skills/task-governance-router/SKILL.md b/.codex/skills/task-governance-router/SKILL.md index 38744f42..6302e8bf 100644 --- a/.codex/skills/task-governance-router/SKILL.md +++ b/.codex/skills/task-governance-router/SKILL.md @@ -100,6 +100,25 @@ For each selected type, discover from local evidence: Do not hardcode package status, repo role, or authorization from the prompt. +## Release-Like Workflow Delegation + +If a task is release-like, also run or internally satisfy +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` using +`.agents/skills/release-projection-governance-router/SKILL.md` before +substantive judgment, edits, gates, release action, publish/upload, projection, +deploy, merge, tag, or seal. + +Release-like surfaces include package publish/upload, version or manifest +changes, publish-set or pypi-set changes, registry baselines, credential +readiness, post-publish verification, release evidence closure, public OSS +projection, website deploy or release notice, Validation Lab publication, +downstream release pointer changes, cross-repo sync/projection, GitHub release, +Git tag, release seal, and merge-to-release workflows. + +The release/projection router must complete the local workflow discovery table. +If it cannot be completed from local evidence for a mutation-affecting decision, +stop with the matching release/projection blocker. + ## SOT Layer Classifier Classify touched surfaces: diff --git a/AGENTS.md b/AGENTS.md index 65e1c3c2..5df09e09 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -161,6 +161,35 @@ changes, public projection mutation, tag, seal, merge, GitHub release, deployment, and credential access require explicit local evidence plus owner authorization. +## Release / Projection Governance Router + +For any task that touches or could touch release-like surfaces, run +`.agents/skills/release-projection-governance-router/SKILL.md` after +repo-truth-first and `TASK-GOVERNANCE-ROUTER-01`, before substantive judgment, +edits, gates, or irreversible action. + +Release-like surfaces include npm/PyPI publication, package version or manifest +changes, publish-set or pypi-set changes, registry baselines, credential +readiness, post-publish verification, release evidence closure, public OSS +projection, website deploy or release notice, Validation Lab publication, +downstream release pointer changes, cross-repo sync/projection, Git tag, +release seal, GitHub release, and merge-to-release workflows. + +The release/projection router must complete a local evidence table for repo +role, workflow type, local standard source files, required gates, reviewer +lanes, external baselines, owner authorization, allowed mutations, forbidden +actions, stop conditions, and evidence outputs. If the table cannot be +completed from local evidence for a mutation-affecting decision, stop with the +matching release/projection blocker. + +For version-bump planning, owner-approved version implementation, publish +planning, or publish execution, the version baseline is the latest published +npm or PyPI registry version for each exact package name. Current local +`package.json`, `pyproject.toml`, generated dist, release-set files, pypi-set +files, prior PRs, green gates, or historical artifacts are repo state or +evidence only; they are not the authority baseline for deciding the next public +package version. + ## Hard Boundaries - Preserve protocol, runtime, product, validation, and publication boundaries. diff --git a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md index ff963a47..55b730d6 100644 --- a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md +++ b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md @@ -150,6 +150,52 @@ discovery only when release/version-related, copyright baseline discovery only when legal/copyright-related, and cross-repo boundary discovery when more than one repo is involved. +## Release / Projection Workflow Discovery + +This section is mandatory when the task touches or could touch release-like +surfaces. Run or internally satisfy +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` using +`.agents/skills/release-projection-governance-router/SKILL.md` after +repo-truth-first and `TASK-GOVERNANCE-ROUTER-01`, before substantive judgment, +edits, gates, release actions, publish/upload actions, projection, deploy, +merge, tag, or seal. + +Declare: + +```yaml +release_projection_governance_router: + router_id: RELEASE-PROJECTION-GOVERNANCE-ROUTER-01 + router_skill: .agents/skills/release-projection-governance-router/SKILL.md + router_run_before_release_like_work: + release_like_task: + repo_role: + workflow_type: + local_standard_source_files: + required_gates: + required_agents_or_review_perspectives: + external_baseline_checks: + required_owner_authorization: + allowed_mutations: + forbidden_actions: + stop_conditions: + evidence_outputs: + discovery_verdict: +``` + +If release-like workflow discovery is skipped or cannot be completed from local +evidence for a mutation-affecting decision, stop with the matching blocker: + +- `BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED` +- `BLOCKED_RELEASE_GOVERNANCE_BASELINE_MISSING` +- `BLOCKED_RELEASE_GOVERNANCE_BASELINE_CONFLICT` +- `BLOCKED_PUBLISHED_VERSION_BASELINE_MISSING` +- `BLOCKED_REGISTRY_BASELINE_DRIFT` +- `BLOCKED_PUBLIC_PROJECTION_STANDARD_MISSING` +- `BLOCKED_PUBLIC_PROJECTION_STANDARD_CONFLICT` +- `BLOCKED_CROSS_REPO_PROJECTION_NOT_AUTHORIZED` +- `BLOCKED_TAG_SEAL_RELEASE_NOT_AUTHORIZED` +- `BLOCKED_SUBSTANTIVE_RELEASE_DECISION_WITHOUT_LOCAL_EVIDENCE` + ## Branch Create or use a task branch from current `main` unless the owner instructs otherwise. Report whether the branch continues an existing Codex ops branch or is a follow-up branch. @@ -165,6 +211,7 @@ List any required `.agents/skills/*/SKILL.md` workflows. `.agents/skills` is the Default required skill for non-trivial goals: - `agentic-harness-goal-preflight` +- `release-projection-governance-router` when release-like surfaces are in scope ## Required Subagents Or Custom Agents From 16e5e41f77945d5665453548600b4c03488bf087 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 20:41:33 +0800 Subject: [PATCH 07/24] governance: reconcile public OSS release SOP authority --- .../agent-reviewer-selection.json | 14 +++ .../dev-authority-comparison-evidence.json | 26 +++++ .../files-changed-classification.json | 18 +++ .../final-verdict.json | 45 ++++++++ .../local-baseline-evidence-table.json | 50 +++++++++ .../no-projection-execution-compliance.json | 20 ++++ .../public-sop-authority-language-audit.json | 13 +++ .../reconciliation-decision.json | 16 +++ .../release-config-no-mutation-decision.json | 7 ++ .../release-projection-router-result.json | 42 +++++++ .../repo-truth.json | 21 ++++ .../task-governance-router-result.json | 41 +++++++ ...RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md | 103 ++++++++++++++++++ governance/release/MPLP-RELEASE-SOP.md | 16 ++- 14 files changed, 428 insertions(+), 4 deletions(-) create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/dev-authority-comparison-evidence.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/files-changed-classification.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/no-projection-execution-compliance.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/public-sop-authority-language-audit.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/reconciliation-decision.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-config-no-mutation-decision.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-projection-router-result.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/repo-truth.json create mode 100644 artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/task-governance-router-result.json create mode 100644 governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/agent-reviewer-selection.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/agent-reviewer-selection.json new file mode 100644 index 00000000..5dd5119b --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/agent-reviewer-selection.json @@ -0,0 +1,14 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "selection_basis": "public repo .codex/agents/*.toml and .agents/skills/*", + "actual_subagent_invocation_attempted": true, + "actual_subagent_invocation_result": "blocked_by_thread_limit", + "reviewer_perspectives_applied": [ + "release_governance_reviewer", + "publication_claim_reviewer", + "package_surface_auditor", + "protocol_schema_reviewer", + "security_no_secret_reviewer" + ], + "notes": "Reviewer perspectives were applied locally; no subagent edits were made." +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/dev-authority-comparison-evidence.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/dev-authority-comparison-evidence.json new file mode 100644 index 00000000..16b88f41 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/dev-authority-comparison-evidence.json @@ -0,0 +1,26 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "dev_evidence": [ + { + "file": "MPLP-Protocol-Dev/AGENTS.md", + "signal": "MPLP-Protocol-Dev is full Dev-side development and release-governance truth for package/release work." + }, + { + "file": "MPLP-Protocol-Dev/governance/release/MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md", + "signal": "Dev full-truth role and Public clean-projection role are explicit." + }, + { + "file": "MPLP-Protocol-Dev/governance/release/MPLP-RELEASE-PROJECTION-POLICY.md", + "signal": "Dev repository is full development truth; Public OSS is clean public release subset." + }, + { + "file": "MPLP-Protocol-Dev/governance/04-records/PUBLIC-OSS-PROJECTION-STANDARD-DISCOVERY-01.md", + "signal": "Public SOP older Dev authority wording recorded as governance drift/gap." + }, + { + "file": "MPLP-Protocol-Dev/governance/04-records/RELEASE-PROJECTION-GOVERNANCE-HARNESS-CODIFICATION-01.md", + "signal": "Public SOP older Dev authority wording should be reconciled before projection execution." + } + ], + "dev_repo_mutated": false +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/files-changed-classification.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/files-changed-classification.json new file mode 100644 index 00000000..c5cf7ad6 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/files-changed-classification.json @@ -0,0 +1,18 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "changed_files": [ + { + "path": "governance/release/MPLP-RELEASE-SOP.md", + "classification": "allowed_public_governance_release_sop_authority_wording" + }, + { + "path": "governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md", + "classification": "allowed_public_governance_record" + }, + { + "path": "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/*.json", + "classification": "allowed_lightweight_evidence" + } + ], + "forbidden_surfaces_changed": false +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json new file mode 100644 index 00000000..1798ebc7 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json @@ -0,0 +1,45 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "status": "complete_after_final_gates_pending_commit_push", + "final_verdict": "COMPLETE_PUBLIC_OSS_RELEASE_SOP_AUTHORITY_RECONCILED", + "gates_run": { + "git_diff_check": "PASS", + "public_repo_truth_first": "PASS", + "dev_repo_truth_first_read_only": "PASS", + "skill_mirror_diff": "PASS", + "toml_structural_parse_fallback": "PASS", + "evidence_json_parse_all": "PASS", + "governance_record_frontmatter_check": "PASS", + "required_phrase_scan": "PASS", + "no_secret_scan_changed_files_only": "PASS", + "protected_surface_scan": "PASS", + "release_config_unchanged": "PASS", + "no_projection_execution_scan": "PASS", + "package_release_gates": "NOT_RUN_SOP_ONLY_GOVERNANCE_WORDING_RECONCILIATION_NO_PACKAGE_SURFACE_MUTATION" + }, + "changed_surface_classification": { + "public_sop_authority_wording": "changed", + "public_governance_record": "created", + "lightweight_governance_evidence": "created", + "release_config_yaml": "unchanged", + "packages": "unchanged", + "schemas": "unchanged", + "release_set": "unchanged", + "pypi_set": "unchanged", + "dev_repo": "unchanged_read_only_comparison_source", + "registry": "unchanged_no_registry_action" + }, + "forbidden_actions_compliance": { + "public_projection_execution": "not_performed", + "dev_to_public_sync_or_copy": "not_performed", + "package_release_or_publish": "not_performed", + "registry_mutation": "not_performed", + "release_config_mutation": "not_performed", + "tag_seal_github_release_merge": "not_performed", + "credential_or_token_access": "not_performed" + }, + "remaining_gaps": [ + "Public release-set and pypi-set remain older projection artifacts and were intentionally not changed in this SOP-only goal." + ], + "recommended_next_goal": "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01" +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/local-baseline-evidence-table.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..7577c948 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/local-baseline-evidence-table.json @@ -0,0 +1,50 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "rows": [ + { + "decision_area": "public repo role", + "local_evidence_file": "AGENTS.md", + "evidence_signal": "This repository is the MPLP public OSS projection and not Dev truth.", + "derived_rule": "Public repo can reconcile public SOP wording but cannot become Dev release-planning authority.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "applied" + }, + { + "decision_area": "Dev authority comparison", + "local_evidence_file": "MPLP-Protocol-Dev/AGENTS.md", + "evidence_signal": "MPLP-Protocol-Dev is protocol/package/release Dev truth.", + "derived_rule": "Use Dev as read-only authority comparison baseline.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "applied read-only" + }, + { + "decision_area": "SOP stale wording", + "local_evidence_file": "governance/release/MPLP-RELEASE-SOP.md", + "evidence_signal": "SOP says MPLP-Protocol-Dev remains a historical internal line.", + "derived_rule": "Wording conflicts with current Dev/Public evidence and should be reconciled.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": true, + "action": "corrected" + }, + { + "decision_area": "projection execution boundary", + "local_evidence_file": ".agents/skills/release-projection-governance-router/SKILL.md", + "evidence_signal": "Public projection execution requires explicit owner authorization.", + "derived_rule": "No projection, sync, copy, publish, tag, seal, or merge in this goal.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "enforced" + }, + { + "decision_area": "release-config mutation", + "local_evidence_file": "release-config.yaml and goal scope", + "evidence_signal": "SOP wording reconciliation does not require bundle allowlist or denylist changes.", + "derived_rule": "Do not mutate release-config.yaml.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "unchanged" + } + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/no-projection-execution-compliance.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/no-projection-execution-compliance.json new file mode 100644 index 00000000..eaa67cc0 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/no-projection-execution-compliance.json @@ -0,0 +1,20 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "public_projection_executed": false, + "dev_to_public_sync_or_copy_executed": false, + "package_release_executed": false, + "npm_publish_executed": false, + "pypi_upload_executed": false, + "registry_mutation_executed": false, + "release_config_mutated": false, + "publish_set_or_pypi_set_mutated": false, + "package_source_dist_schema_mutated": false, + "website_deploy_executed": false, + "validation_lab_publication_executed": false, + "tag_created": false, + "seal_created": false, + "github_release_created": false, + "merge_executed": false, + "credential_or_token_accessed": false, + "v1_mutated": false +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/public-sop-authority-language-audit.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/public-sop-authority-language-audit.json new file mode 100644 index 00000000..e7830555 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/public-sop-authority-language-audit.json @@ -0,0 +1,13 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "file": "governance/release/MPLP-RELEASE-SOP.md", + "stale_statement_found": true, + "stale_statement": "`Coregentis/MPLP-Protocol-Dev` remains a historical internal line.", + "line_before_patch": 34, + "classification": "stale_conflicting_authority_wording", + "context_preserved": [ + "Do not merge Dev main directly into public main.", + "Dev-originated public candidates require dedicated owner-approved provenance/export/projection record." + ], + "scope_effect": "authority_language_only_no_projection_scope_change" +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/reconciliation-decision.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/reconciliation-decision.json new file mode 100644 index 00000000..4fe40c27 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/reconciliation-decision.json @@ -0,0 +1,16 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "decision": "reconcile_public_sop_authority_wording", + "old_meaning": "Dev described as historical internal line", + "new_meaning": "Dev is active Dev-side protocol/package/release truth; Public is clean public OSS projection and release subset", + "safety_boundaries_preserved": [ + "No direct Dev main to public main merge", + "Dev-originated public candidates require owner-approved provenance/export/projection record", + "No projection execution authorization", + "No package publication authorization", + "No release-config mutation" + ], + "release_scope_changed": false, + "projection_scope_changed": false, + "package_scope_changed": false +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-config-no-mutation-decision.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-config-no-mutation-decision.json new file mode 100644 index 00000000..dc95e0cd --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-config-no-mutation-decision.json @@ -0,0 +1,7 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "release_config_path": "release-config.yaml", + "mutation_required": false, + "reason": "Authority wording reconciliation does not alter release bundle include/exclude scope, public manifest schema, package sets, or projection allowlist.", + "release_config_changed": false +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-projection-router-result.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-projection-router-result.json new file mode 100644 index 00000000..ee90b070 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-projection-router-result.json @@ -0,0 +1,42 @@ +{ + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "router_run_before_release_like_work": true, + "release_like_task": true, + "repo_role": "public_oss_projection", + "workflow_type": "release_sop_authority_language_reconciliation", + "local_standard_source_files": [ + "AGENTS.md", + ".codex/config.toml", + "governance/release/MPLP-RELEASE-SOP.md", + "release-config.yaml", + "release-manifests/mplp-public-manifest.schema.json", + "release-manifests/mplp-public-manifest.example.json", + "scripts/semantic/validate-public-manifest.mjs" + ], + "required_gates": [ + "repo-truth-first", + "skill mirror diff", + "TOML parse", + "JSON parse", + "frontmatter check", + "required phrase scan", + "no-secret scan", + "protected surface scan", + "release-config unchanged check", + "no projection execution scan" + ], + "required_owner_authorization": "not_required_for_SOP_authority_wording_reconciliation_within_this_goal_scope", + "allowed_mutations": [ + "governance/release/MPLP-RELEASE-SOP.md authority wording", + "governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/*.json" + ], + "forbidden_actions": [ + "projection execution", + "release-config mutation", + "package/source/dist/schema mutation", + "publish/upload", + "tag/seal/GitHub release/merge" + ], + "discovery_verdict": "PASS_RELEASE_PROJECTION_ROUTER_COMPLETED_FOR_SOP_AUTHORITY_RECONCILIATION" +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/repo-truth.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/repo-truth.json new file mode 100644 index 00000000..b800a94c --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/repo-truth.json @@ -0,0 +1,21 @@ +{ + "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "public_repo": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "role": "public_oss_projection", + "branch": "codex/public-oss-release-sop-authority-reconciliation-01", + "starting_head": "d53e2d583d0128049a3e8d9d84acda82bfa7ad0e", + "origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "branch_basis": "stacked_on_release_projection_governance_harness_codification" + }, + "dev_repo_read_only": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "role": "protocol_package_release_dev_truth", + "observed_branch": "codex/release-projection-governance-harness-codification-01", + "observed_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "mutation": "none" + }, + "v1_status": "frozen_migration_evidence_source_not_inspected_for_mutation" +} diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/task-governance-router-result.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/task-governance-router-result.json new file mode 100644 index 00000000..f86d95d6 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/task-governance-router-result.json @@ -0,0 +1,41 @@ +{ + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "router_run_before_substantive_mutation": true, + "task_type": [ + "public_oss_release_sop_authority_reconciliation", + "projection_governance_authority_alignment", + "release_process_governance", + "non_projection_execution" + ], + "sot_layer": ["L4 Publication Surface", "L6 Codex Execution Governance"], + "selected_public_repo_baseline": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md" + ], + "selected_dev_comparison_baseline": [ + "MPLP-Protocol-Dev/AGENTS.md", + "MPLP-Protocol-Dev/governance/release/MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md", + "MPLP-Protocol-Dev/governance/release/MPLP-RELEASE-PROJECTION-POLICY.md", + "MPLP-Protocol-Dev/governance/04-records/PUBLIC-OSS-PROJECTION-STANDARD-DISCOVERY-01.md", + "MPLP-Protocol-Dev/governance/04-records/RELEASE-PROJECTION-GOVERNANCE-HARNESS-CODIFICATION-01.md" + ], + "forbidden_actions": [ + "public projection execution", + "Dev-to-public sync or copy", + "package release", + "publish or upload", + "registry mutation", + "tag", + "seal", + "GitHub release", + "merge", + "release-config mutation", + "package/source/dist/schema mutation", + "credential access" + ], + "verdict": "PASS_TASK_GOVERNANCE_ROUTER_COMPLETED_FOR_PUBLIC_SOP_AUTHORITY_RECONCILIATION" +} diff --git a/governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md b/governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md new file mode 100644 index 00000000..89ace817 --- /dev/null +++ b/governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md @@ -0,0 +1,103 @@ +--- +entry_surface: repository +doc_type: governance +status: active +authority: MPLP public release governance +protocol_version: "1.0.0" +doc_id: "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01" +title: "Public OSS Release SOP Authority Reconciliation 01" +created_at: "2026-06-08" +goal_id: "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01" +--- + +# Public OSS Release SOP Authority Reconciliation 01 + +## Scope + +This record reconciles stale authority wording in +`governance/release/MPLP-RELEASE-SOP.md` with current local Dev/Public +governance evidence. + +Allowed mutation: + +- `governance/release/MPLP-RELEASE-SOP.md` authority wording only +- this public governance record +- lightweight evidence under + `artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/` + +Forbidden and not performed: + +- Dev-to-public sync/copy/projection execution +- package release, publish, upload, registry mutation, dist-tag mutation, or + deprecation +- package/source/dist/schema mutation +- `release-config.yaml` mutation +- publish-set or pypi-set mutation +- website, Validation Lab, Cognitive OS, SoloCrew, or V1 mutation +- tag, seal, GitHub release, merge, or branch deletion +- credential or token access + +## Router Result + +`TASK-GOVERNANCE-ROUTER-01` and +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` were applied before mutation. + +Task classification: + +- `public_oss_release_sop_authority_reconciliation` +- `projection_governance_authority_alignment` +- `release_process_governance` +- `non_projection_execution` + +SOT layer classification: + +- `L4 Publication Surface` +- `L6 Codex Execution Governance` + +## Decision + +The public SOP previously stated that +`Coregentis/MPLP-Protocol-Dev` remained a historical internal line. Current +local evidence shows that statement is stale and conflicts with the current +Dev/Public authority model. + +Current evidence: + +- Public `AGENTS.md` defines this repo as public OSS projection and + `MPLP-Protocol-Dev` as protocol/package/release Dev truth. +- Public `.codex/config.toml` points `authoritative_dev_truth` to + `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev`. +- Dev `AGENTS.md` defines `MPLP-Protocol-Dev` as the full Dev-side + package/release/protocol truth line. +- Dev `MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md` defines Dev as + full Dev-side development and release-governance truth and Public as clean + projection. +- Dev `MPLP-RELEASE-PROJECTION-POLICY.md` defines Dev-to-Public projection + flow and states that projection policy does not authorize package + publication, repository migration, tags, or downstream implementation. +- Dev `PUBLIC-OSS-PROJECTION-STANDARD-DISCOVERY-01` and + `RELEASE-PROJECTION-GOVERNANCE-HARNESS-CODIFICATION-01` both record this + SOP language as drift/gap requiring reconciliation before projection + execution. + +The SOP now states that Dev is active Dev-side protocol/package/release truth, +while preserving the public release safety boundary: do not merge Dev `main` +directly into public `main`; Dev-originated public candidates require a +dedicated owner-approved provenance, export, and projection record. + +## Non-Effects + +This reconciliation changes authority language only. It does not change public +projection scope, package release readiness, release-config semantics, public +manifest contents, package publish-set contents, package artifacts, schemas, or +registry state. + +## Evidence + +Evidence bundle: + +`artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/` + +## Final Verdict + +`COMPLETE_PUBLIC_OSS_RELEASE_SOP_AUTHORITY_RECONCILED` diff --git a/governance/release/MPLP-RELEASE-SOP.md b/governance/release/MPLP-RELEASE-SOP.md index cd593d8f..93cda77e 100644 --- a/governance/release/MPLP-RELEASE-SOP.md +++ b/governance/release/MPLP-RELEASE-SOP.md @@ -31,10 +31,18 @@ supporting records only where they do not conflict with this SOP. Protocol artifacts, schemas, public release manifests, governance records, SDK source surfaces, and public package preparation. -`Coregentis/MPLP-Protocol-Dev` remains a historical internal line. Do not merge -Dev `main` into public `main`. Any future Dev-originated candidate must be -handled through a dedicated owner-approved provenance and export record, not by -direct branch merge. +`Coregentis/MPLP-Protocol-Dev` is the active Dev-side protocol/package/release +truth line for MPLP release-governance and package planning. This public repo +is the clean public OSS projection and public release subset; it is not a +substitute for Dev truth and must not be used as Dev package release-planning +authority. Do not merge Dev `main` directly into public `main`. Any +Dev-originated public candidate must be handled through a dedicated +owner-approved provenance, export, and projection record, not by direct branch +merge. + +This authority wording alignment does not authorize public projection +execution, package publication, registry mutation, release-config mutation, +tagging, sealing, GitHub release creation, or merge. Public OSS release changes must move through the protected PR path on `Coregentis/MPLP-Protocol`. Direct public `main` pushes are not part of the From 20ecad2ee28116d92310111dbc64de3593b50ce3 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 20:42:44 +0800 Subject: [PATCH 08/24] governance: finalize public OSS SOP reconciliation evidence --- .../final-verdict.json | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json index 1798ebc7..be7aab39 100644 --- a/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json +++ b/artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json @@ -1,6 +1,6 @@ { "goal_id": "PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01", - "status": "complete_after_final_gates_pending_commit_push", + "status": "complete_committed_and_pushed", "final_verdict": "COMPLETE_PUBLIC_OSS_RELEASE_SOP_AUTHORITY_RECONCILED", "gates_run": { "git_diff_check": "PASS", @@ -38,6 +38,14 @@ "tag_seal_github_release_merge": "not_performed", "credential_or_token_access": "not_performed" }, + "commit_push_verification": { + "public_branch": "codex/public-oss-release-sop-authority-reconciliation-01", + "public_remote": "origin", + "tracking_branch": "origin/codex/public-oss-release-sop-authority-reconciliation-01", + "local_remote_head_match": "PASS", + "merge_to_main": "not_performed", + "pull_request_created": "not_performed" + }, "remaining_gaps": [ "Public release-set and pypi-set remain older projection artifacts and were intentionally not changed in this SOP-only goal." ], From 9f2b55c7400f5f9457b9a65b69a0bcba1b204607 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 21:32:22 +0800 Subject: [PATCH 09/24] governance: review public OSS projection readiness drift --- .../agent-reviewer-selection.json | 26 + .../dev-main-authority-snapshot.json | 120 +++ .../drift-detection-summary.json | 684 ++++++++++++++++++ .../final-verdict.json | 29 + .../local-baseline-evidence-table.json | 58 ++ .../no-mutation-compliance.json | 19 + ...rojection-drift-classification-matrix.json | 134 ++++ .../projection-readiness-decision.json | 33 + ...-manifest-website-lab-boundary-review.json | 33 + .../public-repo-current-state.json | 115 +++ ...ase-config-and-sop-consistency-review.json | 46 ++ .../release-projection-router-result.json | 47 ++ .../repo-truth.json | 120 +++ .../task-governance-router-result.json | 60 ++ ...SS-PROJECTION-READINESS-DRIFT-REVIEW-01.md | 248 +++++++ 15 files changed, 1772 insertions(+) create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/dev-main-authority-snapshot.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/drift-detection-summary.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/no-mutation-compliance.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-drift-classification-matrix.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-readiness-decision.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-manifest-website-lab-boundary-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-repo-current-state.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-config-and-sop-consistency-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-projection-router-result.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/repo-truth.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/task-governance-router-result.json create mode 100644 governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/agent-reviewer-selection.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/agent-reviewer-selection.json new file mode 100644 index 00000000..4a1803de --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/agent-reviewer-selection.json @@ -0,0 +1,26 @@ +{ + "actual_subagent_invocation": { + "attempted": true, + "result": "blocked_by_thread_limit", + "message": "agent thread limit reached" + }, + "selected_review_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "package_surface_auditor", + "docs_projection_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer" + ], + "local_agent_files": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/product_boundary_reviewer.toml", + ".codex/agents/protocol_schema_reviewer.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".codex/agents/runtime_binding_reviewer.toml" + ], + "applied_locally": true +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/dev-main-authority-snapshot.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/dev-main-authority-snapshot.json new file mode 100644 index 00000000..15ea89f0 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/dev-main-authority-snapshot.json @@ -0,0 +1,120 @@ +{ + "dev_origin_main": { + "head": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "contains": [ + "artifacts/release/publish-set.json", + "artifacts/release/pypi-set.json", + "governance/04-records/OWNER-AUTHORIZE-NPM-PYPI-PUBLISH-EXECUTION-03.md", + "governance/04-records/OWNER-AUTHORIZE-PYPI-ONLY-UPLOAD-EXECUTION-03.md", + "governance/04-records/OWNER-AUTHORIZE-DEVTOOLS-NPM-PUBLISH-01.md", + "governance/04-records/RELEASE-EVIDENCE-CLOSURE-AND-PUBLIC-PROJECTION-PLAN-01.md", + "governance/release/MPLP-RELEASE-PROJECTION-POLICY.md", + "governance/release/MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md" + ], + "release_sets": { + "npm": [ + { + "name": "@mplp/conformance", + "version": "1.0.1", + "path": "conformance" + }, + { + "name": "@mplp/coordination", + "version": "1.0.7", + "path": "coordination" + }, + { + "name": "@mplp/core", + "version": "1.0.7", + "path": "core" + }, + { + "name": "@mplp/integration-llm-http", + "version": "1.0.6", + "path": "integration-llm-http" + }, + { + "name": "@mplp/integration-storage-fs", + "version": "1.0.6", + "path": "integration-storage-fs" + }, + { + "name": "@mplp/integration-storage-kv", + "version": "1.0.6", + "path": "integration-storage-kv" + }, + { + "name": "@mplp/integration-tools-generic", + "version": "1.0.6", + "path": "integration-tools-generic" + }, + { + "name": "@mplp/modules", + "version": "1.0.6", + "path": "modules" + }, + { + "name": "@mplp/runtime-minimal", + "version": "1.0.6", + "path": "runtime-minimal" + }, + { + "name": "@mplp/schema", + "version": "1.0.7", + "path": "schema" + }, + { + "name": "@mplp/sdk-ts", + "version": "1.0.8", + "path": "sdk-ts" + } + ], + "pypi": { + "ecosystem": "pypi", + "packages": [ + { + "name": "mplp-sdk", + "version": "1.0.6", + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev/packages/pypi/mplp-sdk", + "category": "PUBLIC" + } + ] + } + }, + "registry_snapshot": { + "npm": { + "@mplp/schema": "1.0.7", + "@mplp/conformance": "1.0.1", + "@mplp/core": "1.0.7", + "@mplp/coordination": "1.0.7", + "@mplp/integration-llm-http": "1.0.6", + "@mplp/integration-storage-fs": "1.0.6", + "@mplp/integration-storage-kv": "1.0.6", + "@mplp/integration-tools-generic": "1.0.6", + "@mplp/modules": "1.0.6", + "@mplp/runtime-minimal": "1.0.6", + "@mplp/sdk-ts": "1.0.8", + "@mplp/devtools": "1.0.6", + "@mplp/compliance": "1.0.5", + "@mplp/validator": null + }, + "pypi": { + "mplp-sdk": "1.0.6", + "target_1_0_6_exists": true, + "file_types": [ + "bdist_wheel", + "sdist" + ] + } + } + }, + "dev_local_branch": { + "branch": "codex/release-projection-governance-harness-codification-01", + "head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "ahead_of_origin_main": [ + "93bcc881 governance: codify release projection workflow router", + "618e9af0 governance: discover public OSS projection standard" + ], + "note": "local Dev branch adds projection standard discovery and release projection router codification; used as local governance comparison evidence but not treated as origin/main authority" + } +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/drift-detection-summary.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/drift-detection-summary.json new file mode 100644 index 00000000..85983155 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/drift-detection-summary.json @@ -0,0 +1,684 @@ +{ + "comparison_basis": { + "public_head": "20ecad2ee28116d92310111dbc64de3593b50ce3", + "dev_origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "dev_local_governance_branch": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "registry_snapshot_used": true + }, + "file_surface_summary": [ + { + "surface": "release-config.yaml", + "public_count": 1, + "dev_count": 1, + "common_count": 1, + "modified_count": 0, + "public_only_count": 0, + "dev_only_count": 0, + "modified_sample": [], + "public_only_sample": [], + "dev_only_sample": [] + }, + { + "surface": "release-manifests", + "public_count": 2, + "dev_count": 0, + "common_count": 0, + "modified_count": 0, + "public_only_count": 2, + "dev_only_count": 0, + "modified_sample": [], + "public_only_sample": [ + "release-manifests/mplp-public-manifest.example.json", + "release-manifests/mplp-public-manifest.schema.json" + ], + "dev_only_sample": [] + }, + { + "surface": "artifacts/release", + "public_count": 4, + "dev_count": 4, + "common_count": 4, + "modified_count": 4, + "public_only_count": 0, + "dev_only_count": 0, + "modified_sample": [ + "artifacts/release/publish-gate-report.json", + "artifacts/release/publish-set.json", + "artifacts/release/pypi-gate-report.json", + "artifacts/release/pypi-set.json" + ], + "public_only_sample": [], + "dev_only_sample": [] + }, + { + "surface": "governance/release", + "public_count": 1, + "dev_count": 29, + "common_count": 0, + "modified_count": 0, + "public_only_count": 1, + "dev_only_count": 29, + "modified_sample": [], + "public_only_sample": [ + "governance/release/MPLP-RELEASE-SOP.md" + ], + "dev_only_sample": [ + "governance/release/MPLP-CROSS-REPO-SOT-AUTHORITY-BASELINE-ALIGNMENT-WAVE-01.md", + "governance/release/MPLP-DERIVATION-PROOF-METADATA-CORRECTION-POST-ASSESSMENT-GOAL-01.md", + "governance/release/MPLP-DEV-MAIN-PACKAGE-RELEASE-STATE-ASSESSMENT-WAVE-01.md", + "governance/release/MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md", + "governance/release/MPLP-DOCUMENTATION-INVENTORY-AND-RETENTION-PLAN-WAVE-01.md", + "governance/release/MPLP-DOCUMENTATION-RETENTION-OWNER-DECISION-WAVE-01.md", + "governance/release/MPLP-DOCUMENTATION-ROLLUP-AND-AUTHORITY-INDEX-WAVE-01.md", + "governance/release/MPLP-PACKAGE-ADDRESS-README-AND-USER-INSTALL-SMOKE-AUDIT-GOAL-01.md", + "governance/release/MPLP-PACKAGE-CONFORMANCE-COPYRIGHT-REMEDIATION-OWNER-DECISION-WAVE-01.md", + "governance/release/MPLP-PACKAGE-CONFORMANCE-FORWARD-SURFACE-REMEDIATION-IMPLEMENTATION-WAVE-01.md", + "governance/release/MPLP-PACKAGE-CONFORMANCE-FORWARD-SURFACE-REMEDIATION-PLANNING-WAVE-01.md", + "governance/release/MPLP-PACKAGE-CONSISTENCY-GATE-AND-CORE-SMOKE-BLOCKER-REMEDIATION-GOAL-01.md", + "governance/release/MPLP-PACKAGE-COPYRIGHT-RESIDUE-AUDIT-WAVE-01.md", + "governance/release/MPLP-PACKAGE-DERIVATION-PROOF-CORRECTION-OWNER-DECISION-GOAL-01.md", + "governance/release/MPLP-PACKAGE-DERIVATION-PROOF-STALENESS-AUDIT-GOAL-01.md", + "governance/release/MPLP-PACKAGE-OWNER-APPROVAL-AND-PUBLISH-EXECUTION-PLAN-WAVE-01.md", + "governance/release/MPLP-PACKAGE-OWNER-APPROVED-VERSION-BUMP-IMPLEMENTATION-WAVE-01.md", + "governance/release/MPLP-PACKAGE-OWNER-APPROVED-VERSION-BUMP-PLANNING-WAVE-01.md", + "governance/release/MPLP-PACKAGE-OWNER-STATEMENT-REPLACEMENT-AUDIT-WAVE-01.md", + "governance/release/MPLP-PACKAGE-PUBLIC-REGISTRY-EXTERNAL-VALIDATION-AUDIT-WAVE-01.md", + "governance/release/MPLP-PACKAGE-PUBLISH-BLOCKER-REMEDIATION-GOAL-01.md", + "governance/release/MPLP-PACKAGE-PUBLISH-EXECUTION-AUTHORIZATION-PREPARATION-GOAL-01.md", + "governance/release/MPLP-PACKAGE-PUBLISH-EXECUTION-OWNER-DECISION-GOAL-01.md", + "governance/release/MPLP-PACKAGE-PUBLISH-PLAN-REGENERATION-GOAL-01.md", + "governance/release/MPLP-PACKAGE-REGISTRY-VERSION-CONFLICT-OWNER-DECISION-WAVE-01.md" + ] + }, + { + "surface": "governance/04-records", + "public_count": 30, + "dev_count": 74, + "common_count": 27, + "modified_count": 6, + "public_only_count": 3, + "dev_only_count": 47, + "modified_sample": [ + "governance/04-records/DEPRECATED-CONTENT-SEPARATION-2026-04-02.md", + "governance/04-records/MPGC-DESIGNATE-LAB-AUTHORITY-HOME.md", + "governance/04-records/MPGC-RATIFY-ENTRY-MODEL-REALIGNMENT.md", + "governance/04-records/TASK-GOVERNANCE-ROUTER-01.md", + "governance/04-records/UNIFIED-RECTIFICATION-MAINLINE-CLOSURE.md", + "governance/04-records/VALIDATION_LAB_V2-TAIL-DISPOSITION-2026-04-01.md" + ], + "public_only_sample": [ + "governance/04-records/CONST-007-CROSS-SURFACE-CLOSURE-RECORD-2026-04-08.md", + "governance/04-records/COREGENTIS-TWO-LAYER-GOVERNANCE-BASELINE-01.md", + "governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md" + ], + "dev_only_sample": [ + "governance/04-records/AGENTIC-HARNESS-TWO-LAYER-GOVERNANCE-BASELINE-01.md", + "governance/04-records/CODEX-REGISTRY-CREDENTIAL-DELEGATION-DECISION-01.md", + "governance/04-records/COPYRIGHT-OWNER-SURFACE-CLOSURE-02.md", + "governance/04-records/COREGENTIS-ALL-REPOS-TWO-LAYER-GOVERNANCE-CLOSURE-01.md", + "governance/04-records/COREGENTIS-WORKSPACE-AUTHORITY-BASELINE-01.md", + "governance/04-records/COREGENTIS-WORKSPACE-CANONICALIZATION-WAVE-01.md", + "governance/04-records/CORRECTED-PACKAGE-HARNESS-PATCH-01.md", + "governance/04-records/CREDENTIAL-READINESS-CHECK-01.md", + "governance/04-records/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01.md", + "governance/04-records/DEV-RELEASE-CONSOLIDATION-PR-01.md", + "governance/04-records/DEV-RELEASE-CONSOLIDATION-PR-REVIEW-01.md", + "governance/04-records/DEV-RELEASE-CONSOLIDATION-PROTECTED-MERGE-DECISION-01.md", + "governance/04-records/DEV-RELEASE-CONSOLIDATION-REVIEW-BLOCKER-RESOLUTION-01.md", + "governance/04-records/DEVTOOLS-PUBLIC-PACKAGE-STATUS-DECISION-01.md", + "governance/04-records/DIST_AS_TRACKED_SOURCE_EXCEPTION-DECISION-01.md", + "governance/04-records/DYNAMIC-GOVERNANCE-BASELINE-SELECTION-AND-PUBLISHED-VERSION-BASELINE-01.md", + "governance/04-records/LOCAL-GOVERNANCE-BASELINE-DISCOVERY-MECHANISM-01.md", + "governance/04-records/LOCAL-GOVERNANCE-BASELINE-DISCOVERY-PROPAGATION-02.md", + "governance/04-records/NPM-AUTHENTICATION-READINESS-RECHECK-01.md", + "governance/04-records/NPM-PYPI-PREFLIGHT-RERUN-01.md", + "governance/04-records/OWNER-AUTHORIZE-DEV-RELEASE-CONSOLIDATION-MERGE-EXECUTION-01.md", + "governance/04-records/OWNER-AUTHORIZE-DEVTOOLS-NPM-PUBLISH-01.md", + "governance/04-records/OWNER-AUTHORIZE-NPM-PYPI-PUBLISH-EXECUTION-01.md", + "governance/04-records/OWNER-AUTHORIZE-NPM-PYPI-PUBLISH-EXECUTION-02.md", + "governance/04-records/OWNER-AUTHORIZE-NPM-PYPI-PUBLISH-EXECUTION-03.md" + ] + }, + { + "surface": "artifacts/governance", + "public_count": 19, + "dev_count": 176, + "common_count": 0, + "modified_count": 0, + "public_only_count": 19, + "dev_only_count": 176, + "modified_sample": [], + "public_only_sample": [ + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/agent-reviewer-selection.json", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/dev-main-authority-snapshot.json", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/local-baseline-evidence-table.json", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-repo-current-state.json", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-projection-router-result.json", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/repo-truth.json", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/task governance router result JSON", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/agent-reviewer-selection.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/dev-authority-comparison-evidence.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/files-changed-classification.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/final-verdict.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/local-baseline-evidence-table.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/no-projection-execution-compliance.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/public-sop-authority-language-audit.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/reconciliation-decision.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-config-no-mutation-decision.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/release-projection-router-result.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/repo-truth.json", + "artifacts/governance/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01/task governance router result JSON" + ], + "dev_only_sample": [ + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/cross-repo-boundary.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/final-verdict.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/local-baseline-evidence-table.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/mutation-authorization-matrix.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/no-release-compliance.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/occurrence-classification-after.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/occurrence-classification-before.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/post-remediation-remaining-owner-scan.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/preserved-occurrences.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/raw-occurrence-counts.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/raw-occurrence-scan.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/remediation-actions.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/replacement-authority.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/repo-to-project-owner-map.json", + "artifacts/governance/COPYRIGHT-OWNER-SURFACE-CLOSURE-02/repo-truth-current.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/agent-reviewer-selection.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/branch-commit-inventory.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/dev-consolidation-candidate-matrix.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/devtools-readme-deferred-issue.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/final-verdict.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/local-baseline-evidence-table.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/no-mutation-compliance.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/origin-main-containment-check.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/projection-surface-inventory.json", + "artifacts/governance/DEV-RELEASE-CONSOLIDATION-AND-PROJECTION-CANDIDATE-PLANNING-01/public-projection-candidate-plan.json" + ] + }, + { + "surface": "packages", + "public_count": 258, + "dev_count": 245, + "common_count": 244, + "modified_count": 72, + "public_only_count": 14, + "dev_only_count": 1, + "modified_sample": [ + "packages/npm/compliance/DERIVATION_PROOF.yaml", + "packages/npm/compliance/package.json", + "packages/npm/conformance/DERIVATION_PROOF.yaml", + "packages/npm/conformance/README.md", + "packages/npm/conformance/package-lock.json", + "packages/npm/conformance/package.json", + "packages/npm/conformance/src/index.ts", + "packages/npm/coordination/DERIVATION_PROOF.yaml", + "packages/npm/coordination/README.md", + "packages/npm/coordination/package.json", + "packages/npm/core/DERIVATION_PROOF.yaml", + "packages/npm/core/README.md", + "packages/npm/core/package.json", + "packages/npm/devtools/DERIVATION_PROOF.yaml", + "packages/npm/devtools/README.md", + "packages/npm/devtools/package.json", + "packages/npm/integration-llm-http/DERIVATION_PROOF.yaml", + "packages/npm/integration-llm-http/README.md", + "packages/npm/integration-llm-http/package.json", + "packages/npm/integration-storage-fs/DERIVATION_PROOF.yaml", + "packages/npm/integration-storage-fs/README.md", + "packages/npm/integration-storage-fs/package.json", + "packages/npm/integration-storage-kv/DERIVATION_PROOF.yaml", + "packages/npm/integration-storage-kv/README.md", + "packages/npm/integration-storage-kv/package.json" + ], + "public_only_sample": [ + "packages/npm/schema/schemas/profiles/map-profile.yaml", + "packages/npm/schema/schemas/profiles/sa-profile.yaml", + "packages/npm/schema/schemas/taxonomy/event-taxonomy.yaml", + "packages/npm/schema/schemas/taxonomy/integration-event-taxonomy.yaml", + "packages/npm/schema/schemas/taxonomy/learning-taxonomy.yaml", + "packages/npm/schema/schemas/taxonomy/module-event-matrix.yaml", + "packages/npm/sdk-ts/schemas/profiles/map-profile.yaml", + "packages/npm/sdk-ts/schemas/profiles/sa-profile.yaml", + "packages/npm/sdk-ts/schemas/taxonomy/event-taxonomy.yaml", + "packages/npm/sdk-ts/schemas/taxonomy/integration-event-taxonomy.yaml", + "packages/npm/sdk-ts/schemas/taxonomy/learning-taxonomy.yaml", + "packages/npm/sdk-ts/schemas/taxonomy/module-event-matrix.yaml", + "packages/pypi/mplp-sdk/LICENSE", + "packages/sources/sdk-py/src/mplp_sdk.egg-info/requires.txt" + ], + "dev_only_sample": [ + "packages/sources/sdk-ts/scripts/verify-dist-surface.mjs" + ] + }, + { + "surface": "schemas/v2", + "public_count": 74, + "dev_count": 74, + "common_count": 74, + "modified_count": 0, + "public_only_count": 0, + "dev_only_count": 0, + "modified_sample": [], + "public_only_sample": [], + "dev_only_sample": [] + }, + { + "surface": "docs", + "public_count": 261, + "dev_count": 261, + "common_count": 261, + "modified_count": 12, + "public_only_count": 0, + "dev_only_count": 0, + "modified_sample": [ + "docs/docs/evaluation/governance/license-governance.md", + "docs/docs/reference/audit-route/v1.0-route-a.md", + "docs/docs/reference/uiux-projections/UIUX-DIFF-v0.17.md", + "docs/docs/reference/uiux-projections/UIUX-DIFF-v0.9-v0.17.md", + "docs/docs/reference/uiux-projections/UIUX-MAP-v0.9-v0.17.md", + "docs/docs/reference/uiux-projections/how-to-use-projection-map.md", + "docs/docs/specification/architecture/l1-core-protocol.md", + "docs/docs/validation-lab/index.md", + "docs/docusaurus.config.ts", + "docs/ops/README_CANONICAL_TEMPLATE_v1.0.md", + "docs/src/pages/index.module.css", + "docs/src/pages/index.tsx" + ], + "public_only_sample": [], + "dev_only_sample": [] + }, + { + "surface": "examples", + "public_count": 19, + "dev_count": 19, + "common_count": 19, + "modified_count": 0, + "public_only_count": 0, + "dev_only_count": 0, + "modified_sample": [], + "public_only_sample": [], + "dev_only_sample": [] + }, + { + "surface": "tests", + "public_count": 117, + "dev_count": 117, + "common_count": 117, + "modified_count": 0, + "public_only_count": 0, + "dev_only_count": 0, + "modified_sample": [], + "public_only_sample": [], + "dev_only_sample": [] + }, + { + "surface": "scripts/semantic", + "public_count": 8, + "dev_count": 10, + "common_count": 7, + "modified_count": 0, + "public_only_count": 1, + "dev_only_count": 3, + "modified_sample": [], + "public_only_sample": [ + "scripts/semantic/validate-public-manifest.mjs" + ], + "dev_only_sample": [ + "scripts/semantic/package-preflight-harness.mjs", + "scripts/semantic/verify-kernel-duty-propagation.mjs", + "scripts/semantic/verify-publish-only.mjs" + ] + }, + { + "surface": "scripts/codex", + "public_count": 1, + "dev_count": 3, + "common_count": 1, + "modified_count": 1, + "public_only_count": 0, + "dev_only_count": 2, + "modified_sample": [ + "scripts/codex/repo-truth-first.sh" + ], + "public_only_sample": [], + "dev_only_sample": [ + "scripts/codex/package-consistency-release-gate.sh", + "scripts/codex/package-readme-install-smoke-gate.sh" + ] + }, + { + "surface": ".codex", + "public_count": 15, + "dev_count": 19, + "common_count": 10, + "modified_count": 8, + "public_only_count": 5, + "dev_only_count": 9, + "modified_sample": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/protocol_schema_reviewer.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".codex/config.toml", + ".codex/skills/agentic-harness-goal-preflight/SKILL.md", + ".codex/skills/release-gate-and-seal-discipline/SKILL.md", + ".codex/skills/repo-truth-first-audit/SKILL.md" + ], + "public_only_sample": [ + ".codex/agents/product_boundary_reviewer.toml", + ".codex/agents/runtime_binding_reviewer.toml", + ".codex/skills/cross-repo-boundary-guard/SKILL.md", + ".codex/skills/docs-minimalism-governance/SKILL.md", + ".codex/skills/mplp-schema-v2-invariant-intake/SKILL.md" + ], + "dev_only_sample": [ + ".codex/agents/documentation_governance_reviewer.toml", + ".codex/agents/package_consistency_reviewer.toml", + ".codex/agents/package_readme_install_smoke_reviewer.toml", + ".codex/skills/documentation-governance-audit/SKILL.md", + ".codex/skills/package-consistency-release-gate/SKILL.md", + ".codex/skills/package-readme-and-install-smoke-audit/SKILL.md", + ".codex/skills/package-surface-audit/SKILL.md", + ".codex/skills/protocol-schema-boundary-review/SKILL.md", + ".codex/skills/public-claim-boundary-review/SKILL.md" + ] + }, + { + "surface": ".agents", + "public_count": 8, + "dev_count": 11, + "common_count": 5, + "modified_count": 3, + "public_only_count": 3, + "dev_only_count": 6, + "modified_sample": [ + ".agents/skills/agentic-harness-goal-preflight/SKILL.md", + ".agents/skills/release-gate-and-seal-discipline/SKILL.md", + ".agents/skills/repo-truth-first-audit/SKILL.md" + ], + "public_only_sample": [ + ".agents/skills/cross-repo-boundary-guard/SKILL.md", + ".agents/skills/docs-minimalism-governance/SKILL.md", + ".agents/skills/mplp-schema-v2-invariant-intake/SKILL.md" + ], + "dev_only_sample": [ + ".agents/skills/documentation-governance-audit/SKILL.md", + ".agents/skills/package-consistency-release-gate/SKILL.md", + ".agents/skills/package-readme-and-install-smoke-audit/SKILL.md", + ".agents/skills/package-surface-audit/SKILL.md", + ".agents/skills/protocol-schema-boundary-review/SKILL.md", + ".agents/skills/public-claim-boundary-review/SKILL.md" + ] + } + ], + "package_release_set_drift": [ + { + "name": "@mplp/compliance", + "public_release_set_version": "1.0.5", + "dev_release_set_version": null, + "npm_registry_latest": "1.0.5", + "classification": "BLOCKED_BY_OWNER_DECISION", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/conformance", + "public_release_set_version": "1.0.0", + "dev_release_set_version": "1.0.1", + "npm_registry_latest": "1.0.1", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/coordination", + "public_release_set_version": "1.0.6", + "dev_release_set_version": "1.0.7", + "npm_registry_latest": "1.0.7", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/core", + "public_release_set_version": "1.0.6", + "dev_release_set_version": "1.0.7", + "npm_registry_latest": "1.0.7", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/devtools", + "public_release_set_version": "1.0.5", + "dev_release_set_version": null, + "npm_registry_latest": "1.0.6", + "classification": "BLOCKED_BY_OWNER_DECISION", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/integration-llm-http", + "public_release_set_version": "1.0.5", + "dev_release_set_version": "1.0.6", + "npm_registry_latest": "1.0.6", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/integration-storage-fs", + "public_release_set_version": "1.0.5", + "dev_release_set_version": "1.0.6", + "npm_registry_latest": "1.0.6", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/integration-storage-kv", + "public_release_set_version": "1.0.5", + "dev_release_set_version": "1.0.6", + "npm_registry_latest": "1.0.6", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/integration-tools-generic", + "public_release_set_version": "1.0.5", + "dev_release_set_version": "1.0.6", + "npm_registry_latest": "1.0.6", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/modules", + "public_release_set_version": "1.0.5", + "dev_release_set_version": "1.0.6", + "npm_registry_latest": "1.0.6", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/runtime-minimal", + "public_release_set_version": "1.0.5", + "dev_release_set_version": "1.0.6", + "npm_registry_latest": "1.0.6", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/schema", + "public_release_set_version": "1.0.6", + "dev_release_set_version": "1.0.7", + "npm_registry_latest": "1.0.7", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + }, + { + "name": "@mplp/sdk-ts", + "public_release_set_version": "1.0.7", + "dev_release_set_version": "1.0.8", + "npm_registry_latest": "1.0.8", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public artifacts/release/publish-set.json vs Dev artifacts/release/publish-set.json and npm registry latest" + } + ], + "pypi_release_set_drift": { + "public": { + "ecosystem": "pypi", + "packages": [ + { + "name": "mplp-sdk", + "version": "1.0.5", + "path": "/Users/jasonwang/Documents/AI_Dev/V1.0_release/packages/pypi/mplp-sdk", + "category": "PUBLIC" + } + ] + }, + "dev": { + "ecosystem": "pypi", + "packages": [ + { + "name": "mplp-sdk", + "version": "1.0.6", + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev/packages/pypi/mplp-sdk", + "category": "PUBLIC" + } + ] + }, + "pypi_registry": { + "mplp-sdk": "1.0.6", + "target_1_0_6_exists": true, + "file_types": [ + "bdist_wheel", + "sdist" + ] + }, + "classification": "PUBLIC_PROJECTION_CANDIDATE" + }, + "manifest_drift": { + "package_statuses": "planned_not_published_but_registry_versions_exist", + "stale_package_entries": [ + { + "name": "@mplp/conformance", + "current_version": "1.0.0", + "next_clean_version": "1.0.1", + "status": "planned_not_published", + "registry_latest": "1.0.1", + "stale_status": true + }, + { + "name": "@mplp/coordination", + "current_version": "1.0.6", + "next_clean_version": "1.0.7", + "status": "planned_not_published", + "registry_latest": "1.0.7", + "stale_status": true + }, + { + "name": "@mplp/core", + "current_version": "1.0.6", + "next_clean_version": "1.0.7", + "status": "planned_not_published", + "registry_latest": "1.0.7", + "stale_status": true + }, + { + "name": "@mplp/devtools", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "status": "planned_not_published", + "registry_latest": "1.0.6", + "stale_status": true + }, + { + "name": "@mplp/integration-llm-http", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "status": "planned_not_published", + "registry_latest": "1.0.6", + "stale_status": true + }, + { + "name": "@mplp/integration-storage-fs", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "status": "planned_not_published", + "registry_latest": "1.0.6", + "stale_status": true + }, + { + "name": "@mplp/integration-storage-kv", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "status": "planned_not_published", + "registry_latest": "1.0.6", + "stale_status": true + }, + { + "name": "@mplp/integration-tools-generic", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "status": "planned_not_published", + "registry_latest": "1.0.6", + "stale_status": true + }, + { + "name": "@mplp/modules", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "status": "planned_not_published", + "registry_latest": "1.0.6", + "stale_status": true + }, + { + "name": "@mplp/runtime-minimal", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "status": "planned_not_published", + "registry_latest": "1.0.6", + "stale_status": true + }, + { + "name": "@mplp/schema", + "current_version": "1.0.6", + "next_clean_version": "1.0.7", + "status": "planned_not_published", + "registry_latest": "1.0.7", + "stale_status": true + }, + { + "name": "@mplp/sdk-ts", + "current_version": "1.0.7", + "next_clean_version": "1.0.8", + "status": "planned_not_published", + "registry_latest": "1.0.8", + "stale_status": true + } + ], + "pypi_current": [ + { + "name": "mplp-sdk", + "registry": "pypi", + "current_version": "1.0.5", + "next_clean_version": "1.0.6", + "package_replacement_status": "planned_not_published" + } + ], + "classification": "PUBLIC_PROJECTION_CANDIDATE" + }, + "expected_projection_lag": [ + "Dev governance records absent from public by design or summary-only", + "artifacts/governance raw Dev evidence absent from public by design", + "release-config identical but not sufficient alone" + ], + "unsafe_to_project": [ + "Dev raw artifacts/governance/**", + "artifacts/package-preflight/** raw execution logs", + "node_modules/dist/build caches", + "embedded Website/Lab source", + "credential/security/token records or local path evidence" + ], + "owner_decision_required": [ + "whether to narrow governance/04-records/** allowlist before projection", + "whether artifacts/release/* should be updated directly or replaced by public summary records", + "whether package dist is excluded from OSS projection and handled only through registry packages", + "whether @mplp/compliance public package gets deprecation action or historical boundary only" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json new file mode 100644 index 00000000..7a8139ae --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json @@ -0,0 +1,29 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01", + "status": "complete_after_final_gates_pending_commit_push", + "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_DRIFT_REVIEW_READY_FOR_OWNER_PROJECTION_PLAN", + "gates_run": { + "repo_truth_first_public": "PASS", + "repo_truth_first_dev_read_only": "PASS", + "task_governance_router": "PASS", + "release_projection_governance_router": "PASS", + "public_manifest_validation": "PASS", + "skill_mirror_diff": "PASS", + "git_diff_check": "PASS", + "json_parse_all_evidence": "PASS", + "governance_record_frontmatter_check": "PASS", + "required_phrase_scan": "PASS", + "no_secret_scan_changed_files": "PASS", + "protected_surface_scan": "PASS", + "release_config_unchanged": "PASS", + "no_projection_execution_scan": "PASS", + "package_release_gates": "NOT_RUN_DRIFT_REVIEW_ONLY_NO_PACKAGE_MUTATION" + }, + "remaining_gaps": [ + "release-config broad governance/04-records include needs allowlist/summary decision", + "package dist channel remains ambiguous because release-config excludes **/dist/**", + "public manifest and Website/Lab vendored manifests remain stale until future authorized projection", + "package manifests/README/source drift requires package gates before mutation" + ], + "recommended_next_goal": "PUBLIC-OSS-PROJECTION-PLAN-01" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/local-baseline-evidence-table.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..44a74e57 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/local-baseline-evidence-table.json @@ -0,0 +1,58 @@ +{ + "rows": [ + { + "decision_area": "workspace and repo authority", + "local_evidence_file": "AGENTS.md; .codex/config.toml", + "evidence_signal": "Coregentis root; public repo is PUBLIC_OSS_PROJECTION; authoritative_dev_truth points to MPLP-Protocol-Dev", + "derived_rule": "write only public review evidence; read Dev as authority source", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "task routing", + "local_evidence_file": ".agents/skills/task-governance-router/SKILL.md", + "evidence_signal": "router mandatory before non-trivial task", + "derived_rule": "record router result before evidence mutation", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "release/projection workflow", + "local_evidence_file": ".agents/skills/release-projection-governance-router/SKILL.md; MPLP-RELEASE-SOP.md", + "evidence_signal": "public OSS projection is release-like; router required", + "derived_rule": "run projection router and forbid projection execution without owner authorization", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "projection standard", + "local_evidence_file": "Dev PUBLIC-OSS-PROJECTION-STANDARD-DISCOVERY-01; Dev MPLP-RELEASE-PROJECTION-POLICY", + "evidence_signal": "release-config is not complete redaction policy; broad surfaces require review", + "derived_rule": "classify surfaces and owner-decision gaps rather than copying Dev", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "package version facts", + "local_evidence_file": "npm registry; PyPI JSON; Dev publish records", + "evidence_signal": "public registry latest differs from public manifest/artifacts", + "derived_rule": "mark release-set/pypi-set and manifest stale; no registry mutation", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "record_only" + }, + { + "decision_area": "Website/Lab boundary", + "local_evidence_file": "MPLP-RELEASE-SOP.md sections 5-6; Website/Lab vendored manifests", + "evidence_signal": "Website/Lab consume vendored manifest and remain standalone surfaces", + "derived_rule": "record pointer sync needed but out of scope for this goal", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "record_only" + } + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/no-mutation-compliance.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/no-mutation-compliance.json new file mode 100644 index 00000000..e7018bf5 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/no-mutation-compliance.json @@ -0,0 +1,19 @@ +{ + "forbidden_actions": { + "public_projection_execution": "not_performed", + "dev_to_public_sync_or_copy": "not_performed", + "dev_repo_mutation": "not_performed", + "package_source_dist_schema_docs_release_manifest_mutation": "not_performed", + "release_set_or_pypi_set_mutation": "not_performed", + "release_config_mutation": "not_performed", + "publish_upload_registry_mutation": "not_performed", + "tag_seal_github_release_merge": "not_performed", + "website_lab_downstream_mutation": "not_performed", + "credential_or_token_access": "not_performed", + "v1_mutation": "not_performed" + }, + "changed_files_expected": [ + "governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/*.json" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-drift-classification-matrix.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-drift-classification-matrix.json new file mode 100644 index 00000000..fd122561 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-drift-classification-matrix.json @@ -0,0 +1,134 @@ +{ + "classification_values": [ + "PUBLIC_PROJECTION_CANDIDATE", + "PUBLIC_SUMMARY_ONLY_CANDIDATE", + "DEV_PRIVATE_DO_NOT_PROJECT", + "INTERNAL_HARNESS_DO_NOT_PROJECT", + "CONDITIONALLY_PROJECTABLE_WITH_REDACTION", + "BLOCKED_BY_RELEASE_CONFIG_AMBIGUITY", + "BLOCKED_BY_OWNER_DECISION", + "UNKNOWN_LOCAL_STANDARD_GAP" + ], + "matrix": [ + { + "surface": "release-config.yaml", + "classification": "BLOCKED_BY_OWNER_DECISION", + "evidence": "config matches Dev/Public, but prior discovery says release-config alone is not authorization or full redaction policy; later plan must decide whether to narrow broad includes" + }, + { + "surface": "release-manifests/*", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public manifest validates but package statuses and commit SHA are stale versus registry/Dev release closure; Dev origin/main lacks release-manifests so update requires public-side manifest generation plan" + }, + { + "surface": "artifacts/release/publish-set.json", + "classification": "PUBLIC_SUMMARY_ONLY_CANDIDATE", + "evidence": "public set stale; Dev set has 11 npm release packages; artifact is evidence/summary, not registry authority" + }, + { + "surface": "artifacts/release/pypi-set.json", + "classification": "PUBLIC_SUMMARY_ONLY_CANDIDATE", + "evidence": "public set points V1 path and 1.0.5; Dev/PyPI are 1.0.6; should be updated only through projection plan" + }, + { + "surface": "governance/release/*", + "classification": "PUBLIC_SUMMARY_ONLY_CANDIDATE", + "evidence": "Dev has canonical projection policy and authority doctrine; public has SOP only; public may need summary/policy projection but not all Dev release records" + }, + { + "surface": "governance/04-records/*", + "classification": "BLOCKED_BY_RELEASE_CONFIG_AMBIGUITY", + "evidence": "release-config includes governance/04-records/** broadly, but Dev contains private owner/publish/credential records; needs allowlist or summary-only plan" + }, + { + "surface": "artifacts/package-preflight/*", + "classification": "DEV_PRIVATE_DO_NOT_PROJECT", + "evidence": "raw package execution/preflight evidence can include local paths and operational detail; use summary only" + }, + { + "surface": "artifacts/governance/*", + "classification": "DEV_PRIVATE_DO_NOT_PROJECT", + "evidence": "raw Dev evidence is explicitly not projected; public may create its own lightweight evidence" + }, + { + "surface": "package manifests", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public manifests partly version-aligned but dependency/readme drift exists; requires package gates before projection mutation" + }, + { + "surface": "package README", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "README drift observed in package surface; requires consistency and public wording gates" + }, + { + "surface": "package dist", + "classification": "BLOCKED_BY_RELEASE_CONFIG_AMBIGUITY", + "evidence": "release-config excludes **/dist/** while package registry artifacts may need dist; decide OSS source vs registry artifact channel" + }, + { + "surface": "package source", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public source drift exists for conformance and other packages; requires package/source gates and redaction scan" + }, + { + "surface": "schemas/v2/**", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "hash comparison shows no current drift; remains public projectable if future drift appears" + }, + { + "surface": "docs/**", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "source-level docs drift exists after excluding generated docs artifacts; docs build/claim gates required" + }, + { + "surface": "examples/**", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "no source drift after excluding node_modules; remains public projectable" + }, + { + "surface": "tests/**", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "no current drift; tests are public verification surfaces" + }, + { + "surface": "scripts/semantic/**", + "classification": "PUBLIC_PROJECTION_CANDIDATE", + "evidence": "public manifest validator exists; some Dev semantic scripts are internal-only or package-only; select by public need" + }, + { + "surface": "scripts/codex/**", + "classification": "INTERNAL_HARNESS_DO_NOT_PROJECT", + "evidence": "Codex harness is local execution governance; project only if public repo harness goal authorizes" + }, + { + "surface": ".codex/**", + "classification": "CONDITIONALLY_PROJECTABLE_WITH_REDACTION", + "evidence": "repo-local Codex config/skills can be public harness evidence but must avoid private Dev-only gates/credentials" + }, + { + "surface": ".agents/**", + "classification": "CONDITIONALLY_PROJECTABLE_WITH_REDACTION", + "evidence": "mirrored skills useful for public harness; Dev package gates not automatically public" + }, + { + "surface": "AGENTS.md", + "classification": "CONDITIONALLY_PROJECTABLE_WITH_REDACTION", + "evidence": "public AGENTS is already public role-specific; do not copy Dev AGENTS wholesale" + }, + { + "surface": "CODEX-GOAL-TEMPLATE.md", + "classification": "CONDITIONALLY_PROJECTABLE_WITH_REDACTION", + "evidence": "public has role-specific template; Dev template drift does not imply wholesale projection" + }, + { + "surface": "Website manifest pointer surfaces", + "classification": "PUBLIC_SUMMARY_ONLY_CANDIDATE", + "evidence": "Website vendored manifest is stale planned_not_published and same SHA as public manifest; update needs separate Website goal if release window includes Website" + }, + { + "surface": "Validation Lab manifest pointer surfaces", + "classification": "PUBLIC_SUMMARY_ONLY_CANDIDATE", + "evidence": "Lab vendored manifest is stale planned_not_published and same SHA as public manifest; update needs separate Lab goal if release window includes Lab" + } + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-readiness-decision.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-readiness-decision.json new file mode 100644 index 00000000..7abbdfaa --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/projection-readiness-decision.json @@ -0,0 +1,33 @@ +{ + "readiness_verdict": "READY_FOR_OWNER_PROJECTION_PLAN_NOT_READY_FOR_PROJECTION_EXECUTION", + "allowed_now": "review and evidence only", + "public_safe_projection_candidates": [ + "public manifest status update", + "artifacts/release publish-set and pypi-set summary alignment", + "package manifests/README/source after package gates", + "docs source drift after docs/claim gates", + "schemas/tests/examples if any future drift appears" + ], + "summary_only_candidates": [ + "Dev release evidence closure summary", + "npm/PyPI publish evidence summaries", + "Website/Lab pointer decisions", + "artifacts/release public summary files" + ], + "unsafe_or_blocked": [ + "raw Dev artifacts/governance", + "artifacts/package-preflight raw evidence", + "embedded Website/Lab source", + "node_modules/dist/build outputs", + "credential/security/token records", + "unfiltered governance/04-records/**" + ], + "owner_decisions_required": [ + "authorize exact public projection mutation set", + "decide release-config allowlist/narrowing before broad governance projection", + "decide public manifest package status semantics after publish", + "decide Website/Lab pointer sync scope", + "decide compliance/deprecation boundary and devtools inclusion in public summary" + ], + "exact_next_owner_authorization_needed": "Authorize PUBLIC-OSS-PROJECTION-PLAN-01 as planning-only, or authorize a later bounded PUBLIC-OSS-PROJECTION-EXECUTION-* with exact files/surfaces and gates; this review does not authorize execution" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-manifest-website-lab-boundary-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-manifest-website-lab-boundary-review.json new file mode 100644 index 00000000..abd211c4 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-manifest-website-lab-boundary-review.json @@ -0,0 +1,33 @@ +{ + "protocol_public_manifest": { + "schema_exists": true, + "example_exists": true, + "validation_command": "node scripts/semantic/validate-public-manifest.mjs", + "validation_result": "PASS", + "current_state": "draft planned_not_published package status stale against registry" + }, + "website": { + "repo": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Official-Website", + "vendored_manifest_path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Official-Website/lib/data/mplp-public-manifest.json", + "manifest_id": "mplp-public-manifest-1.0.0-draft-650e5b2f", + "protocol_commit_sha": "650e5b2f6754a7016d8c8184e54881b0fcef6683", + "package_statuses": [ + "planned_not_published" + ], + "checksum_path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Official-Website/lib/data/mplp-public-manifest.sha256", + "sync_needed_decision": "owner_decision_required_for_release_window; current vendored manifest is stale if public manifest is updated" + }, + "validation_lab": { + "repo": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Validation-Lab", + "vendored_manifest_path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Validation-Lab/lib/data/mplp-public-manifest.json", + "manifest_id": "mplp-public-manifest-1.0.0-draft-650e5b2f", + "protocol_commit_sha": "650e5b2f6754a7016d8c8184e54881b0fcef6683", + "package_statuses": [ + "planned_not_published" + ], + "checksum_path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Validation-Lab/lib/data/mplp-public-manifest.sha256", + "sync_needed_decision": "owner_decision_required_for_release_window; current vendored manifest is stale if public manifest is updated" + }, + "in_scope_now": false, + "later_goal_needed": "owner_decision_required_for Website/Lab pointer sync if projection window includes manifest update" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-repo-current-state.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-repo-current-state.json new file mode 100644 index 00000000..252362e8 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/public-repo-current-state.json @@ -0,0 +1,115 @@ +{ + "branch": "codex/public-oss-projection-readiness-drift-review-01", + "head": "20ecad2ee28116d92310111dbc64de3593b50ce3", + "origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "public_manifest": { + "manifest_id": "mplp-public-manifest-1.0.0-draft-650e5b2f", + "protocol_commit_sha": "650e5b2f6754a7016d8c8184e54881b0fcef6683", + "generated_at": "2026-05-29T19:34:59+08:00", + "sdk_statuses": [ + "planned_not_published" + ], + "pypi_statuses": [ + "planned_not_published" + ], + "manifest_gate": "PASS_node_scripts_semantic_validate_public_manifest_mjs" + }, + "release_artifacts": { + "publish_set": [ + { + "name": "@mplp/compliance", + "version": "1.0.5", + "path": "compliance" + }, + { + "name": "@mplp/conformance", + "version": "1.0.0", + "path": "conformance" + }, + { + "name": "@mplp/coordination", + "version": "1.0.6", + "path": "coordination" + }, + { + "name": "@mplp/core", + "version": "1.0.6", + "path": "core" + }, + { + "name": "@mplp/devtools", + "version": "1.0.5", + "path": "devtools" + }, + { + "name": "@mplp/integration-llm-http", + "version": "1.0.5", + "path": "integration-llm-http" + }, + { + "name": "@mplp/integration-storage-fs", + "version": "1.0.5", + "path": "integration-storage-fs" + }, + { + "name": "@mplp/integration-storage-kv", + "version": "1.0.5", + "path": "integration-storage-kv" + }, + { + "name": "@mplp/integration-tools-generic", + "version": "1.0.5", + "path": "integration-tools-generic" + }, + { + "name": "@mplp/modules", + "version": "1.0.5", + "path": "modules" + }, + { + "name": "@mplp/runtime-minimal", + "version": "1.0.5", + "path": "runtime-minimal" + }, + { + "name": "@mplp/schema", + "version": "1.0.6", + "path": "schema" + }, + { + "name": "@mplp/sdk-ts", + "version": "1.0.7", + "path": "sdk-ts" + } + ], + "pypi_set": { + "ecosystem": "pypi", + "packages": [ + { + "name": "mplp-sdk", + "version": "1.0.5", + "path": "/Users/jasonwang/Documents/AI_Dev/V1.0_release/packages/pypi/mplp-sdk", + "category": "PUBLIC" + } + ] + } + }, + "sop_authority_consistency": "PASS_AFTER_PUBLIC_OSS_RELEASE_SOP_AUTHORITY_RECONCILIATION_01", + "package_manifest_selected_findings": [ + { + "package": "@mplp/conformance", + "finding": "public package.json still depends on @mplp/compliance while Dev package.json depends on @mplp/schema", + "classification": "PUBLIC_PROJECTION_CANDIDATE_WITH_PACKAGE_SURFACE_GATES" + }, + { + "package": "@mplp/devtools", + "finding": "public package.json still depends on @mplp/compliance while Dev package.json depends on @mplp/conformance", + "classification": "PUBLIC_PROJECTION_CANDIDATE_WITH_PACKAGE_SURFACE_GATES" + }, + { + "package": "@mplp/compliance", + "finding": "public release-set includes compliance; Dev release-set excludes it; registry latest remains 1.0.5", + "classification": "BLOCKED_BY_OWNER_DECISION_OR_DEPRECATION_POLICY" + } + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-config-and-sop-consistency-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-config-and-sop-consistency-review.json new file mode 100644 index 00000000..60c18f77 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-config-and-sop-consistency-review.json @@ -0,0 +1,46 @@ +{ + "release_config": { + "includes": [ + "packages/**", + "schemas/v2/**", + "docs/**", + "tests/**", + "examples/**", + "governance/04-records/**", + "governance/03-distribution/**", + "selected workflows and scripts/03-docs/render-mermaid.mjs" + ], + "excludes": [ + "MPLP_website/**", + "Validation_Lab/**", + "**/node_modules/**", + "**/dist/**", + "**/build/**", + "docs/.docusaurus/**", + "docs/.cache/**", + "governance/06-operations/**", + "scripts/release/**", + "internal/**" + ], + "unchanged_between_public_and_dev": true + }, + "sop": { + "authority_consistent_after_prior_reconciliation": true, + "requires_public_manifest_gate": true, + "requires_website_lab_needed_not_needed_decisions": true, + "package_release_gates_required_only_when_packages_in_scope": true + }, + "consistency_decisions": { + "projection_policy_narrows_release_config": "YES: release-config is bundle input, not full redaction policy or authorization", + "governance_04_records_broad_include": "unsafe_without_allowlist_or_summary_policy", + "dist_exclusion": "blocks package dist projection in OSS bundle; registry package artifacts should be treated as separate package-publication channel", + "release_set_pypi_set_alignment": "can be planned as public summary artifacts without copying Dev-private raw evidence", + "release_config_mutation_needed_now": false + }, + "blockers_for_future_projection_plan": [ + "allowlist governance/04-records or define summary-only projection", + "decide artifacts/release/* public summary update mechanism", + "decide package dist channel", + "run package gates before package surface mutation" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-projection-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-projection-router-result.json new file mode 100644 index 00000000..693d0b1a --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/release-projection-router-result.json @@ -0,0 +1,47 @@ +{ + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "executed": true, + "workflow_type": [ + "public OSS projection readiness drift review", + "non projection execution", + "future owner projection plan input" + ], + "local_standard_source_files": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/release/MPLP-RELEASE-SOP.md", + "release-config.yaml", + "release-manifests/mplp-public-manifest.example.json", + "scripts/semantic/validate-public-manifest.mjs", + "Dev governance/release/MPLP-RELEASE-PROJECTION-POLICY.md", + "Dev governance/release/MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md", + "Dev governance/04-records/PUBLIC-OSS-PROJECTION-STANDARD-DISCOVERY-01.md" + ], + "required_gates": [ + "repo-truth-first public", + "repo-truth-first Dev read-only", + "skill mirror diff", + "TOML structural parse", + "JSON parse", + "frontmatter check", + "required phrase scan", + "no-secret scan changed files", + "protected surface scan", + "release-config unchanged", + "no projection execution scan", + "public manifest validation" + ], + "owner_authorization_required_for_future_mutation": true, + "allowed_mutations": [ + "governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md", + "artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/*.json" + ], + "stop_conditions": [ + "BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN", + "BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED", + "BLOCKED_RELEASE_GOVERNANCE_BASELINE_MISSING", + "BLOCKED_RELEASE_GOVERNANCE_BASELINE_CONFLICT", + "PARTIAL_BLOCKED_BY_OWNER_DECISION_REQUIRED" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/repo-truth.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/repo-truth.json new file mode 100644 index 00000000..2017d0cb --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/repo-truth.json @@ -0,0 +1,120 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "primary_target_repo": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "authority_source_repo_read_only": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "public": { + "branch": "codex/public-oss-projection-readiness-drift-review-01", + "head": "20ecad2ee28116d92310111dbc64de3593b50ce3", + "origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "worktree_status": "?? artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/", + "repo_truth_first_executed": true, + "repo_truth_first_output_excerpt": [ + "== Repo Truth First ==", + "", + "[branch]", + "codex/public-oss-projection-readiness-drift-review-01", + "", + "[status]", + "?? artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/", + "", + "[local HEAD]", + "20ecad2ee28116d92310111dbc64de3593b50ce3", + "", + "[origin/main HEAD]", + "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "", + "[origin/codex/latest-ops-foundation-wave-01 HEAD]", + "d220a5110a0c5380d3a82579c6749f9c535f94e2", + "", + "[recent commits]", + "20ecad2 governance: finalize public OSS SOP reconciliation evidence", + "16e5e41 governance: reconcile public OSS release SOP authority", + "d53e2d5 governance: codify release projection workflow router", + "5865931 governance: add task governance router to Codex harness", + "e7a5f69 governance: codify ownership baseline and close copyright surfaces", + "", + "[AGENTS.md bytes]", + " 12458 AGENTS.md", + "", + "[skill mirror drift]", + "SKILL_MIRROR_DRIFT=NO", + "", + "[local governance baseline discovery]", + "LOCAL_BASELINE_DISCOVERY_REQUIRED=YES", + "DYNAMIC_GOVERNANCE_BASELINE_SELECTION_PRECONDITION=Dynamic governance baseline selection is a precondition for every non-trivial task.", + "required_phrase=Prompt assertions are not governance authority unless supported by local repository evidence.", + "required_table=local baseline evidence table", + "package_policy_discovery=required_when_package_related", + "version_baseline_discovery=required_when_release_or_version_related", + "copyright_baseline_discovery=required_when_legal_or_copyright_related", + "cross_repo_boundary_discovery=required_when_cross_repo_related", + "blocked_local_baseline_missing=BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING", + "blocked_local_baseline_conflict=BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT", + "blocked_prompt_overrides_local_baseline=BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE", + "blocked_dynamic_selection_not_performed=BLOCKED_DYNAMIC_BASELINE_SELECTION_NOT_PERFORMED", + "blocked_substantive_decision_without_evidence=BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE", + "" + ] + }, + "dev_read_only": { + "branch": "codex/release-projection-governance-harness-codification-01", + "local_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "merge_base_with_origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "local_branch_ahead_commits": [ + "93bcc881 governance: codify release projection workflow router", + "618e9af0 governance: discover public OSS projection standard" + ], + "worktree_status": "clean", + "repo_truth_first_executed": true, + "repo_truth_first_output_excerpt": [ + "== Repo Truth First ==", + "", + "[branch]", + "codex/release-projection-governance-harness-codification-01", + "", + "[status]", + "", + "[local HEAD]", + "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "", + "[origin/main HEAD]", + "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "", + "[recent commits]", + "93bcc881 governance: codify release projection workflow router", + "618e9af0 governance: discover public OSS projection standard", + "00f57406 governance: record protected Dev merge execution", + "9c26ba92 merge: consolidate Dev release evidence line", + "f34f08bd governance: record protected Dev release consolidation merge decision", + "", + "[AGENTS.md bytes]", + " 30726 AGENTS.md", + "", + "[Codex config goals feature]", + "CODEX_GOALS_FEATURE=YES", + "", + "[skill mirror drift]", + "SKILL_MIRROR_DRIFT=NO", + "", + "[required Codex ops files]", + "present AGENTS.md", + "present .codex/config.toml", + "present governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "present scripts/codex/repo-truth-first.sh", + "", + "[required skills]", + "present .codex/skills/repo-truth-first-audit/SKILL.md", + "present .agents/skills/repo-truth-first-audit/SKILL.md", + "present .codex/skills/release-gate-and-seal-discipline/SKILL.md", + "present .agents/skills/release-gate-and-seal-discipline/SKILL.md", + "present .codex/skills/package-surface-audit/SKILL.md", + "present .agents/skills/package-surface-audit/SKILL.md", + "present .codex/skills/public-claim-boundary-review/SKILL.md", + "present .agents/skills/public-claim-boundary-review/SKILL.md", + "present .codex/skills/protocol-schema-boundary-review/SKILL.md" + ] + }, + "v1_status_observed": "dirty pre-existing; not mutated by this goal" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/task-governance-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/task-governance-router-result.json new file mode 100644 index 00000000..4dd652de --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/task-governance-router-result.json @@ -0,0 +1,60 @@ +{ + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "executed": true, + "prompt_assertions_are_not_authority": true, + "task_type": [ + "public_oss_projection_readiness_drift_review", + "public_projection_boundary_review", + "release_process_governance", + "non_projection_execution" + ], + "sot_layer": [ + "L1 Projection Source review", + "L3 Verification Evidence", + "L4 Publication Surface", + "L6 Codex Execution Governance" + ], + "repository_methods": [ + "TSV", + "XCV", + "SCV", + "EVC", + "projection boundary review", + "no-secret review" + ], + "codex_harness_methods": [ + "SCTM", + "GLFB", + "ITCM", + "RBCT", + "VIM", + "PRM", + "TASK-GOVERNANCE-ROUTER-01" + ], + "selected_baseline": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md", + "release-config.yaml", + "prior PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01 evidence", + "Dev MPLP-RELEASE-PROJECTION-POLICY", + "Dev PUBLIC-OSS-PROJECTION-STANDARD-DISCOVERY-01", + "Dev RELEASE-EVIDENCE-CLOSURE-AND-PUBLIC-PROJECTION-PLAN-01" + ], + "forbidden_actions": [ + "projection execution", + "Dev-to-public sync/copy", + "release-config mutation", + "release-set or pypi-set mutation", + "package/source/dist/schema/docs/release manifest mutation", + "registry mutation", + "tag", + "seal", + "GitHub release", + "merge", + "credential access" + ], + "evidence_output_plan": "14 required lightweight JSON files plus governance record in public repo" +} diff --git a/governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md b/governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md new file mode 100644 index 00000000..6a807ac3 --- /dev/null +++ b/governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md @@ -0,0 +1,248 @@ +--- +entry_surface: repository +doc_type: governance +status: active +authority: MPLP public OSS projection governance +protocol_version: "1.0.0" +doc_id: "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01" +title: "Public OSS Projection Readiness Drift Review 01" +created_at: "2026-06-08" +goal_id: "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01" +--- + +# Public OSS Projection Readiness Drift Review 01 + +## Scope + +This record reviews drift between the current public OSS projection repo and +the Dev-side MPLP protocol/package/release truth line. + +Write target: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol` + +Read-only authority comparison source: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev` + +This is a review and readiness decision only. It does not authorize or perform +public projection execution, Dev-to-public sync/copy, package release, +publish/upload, registry mutation, release-config mutation, package/source +mutation, dist mutation, schema mutation, docs mutation, release-manifest +mutation, Website deploy, Validation Lab publication, downstream sync, tag, +seal, GitHub release, merge, branch deletion, or credential access. + +## Router Result + +`TASK-GOVERNANCE-ROUTER-01` and +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` were applied before evidence +mutation. + +Task classification: + +- `public_oss_projection_readiness_drift_review` +- `public_projection_boundary_review` +- `release_process_governance` +- `non_projection_execution` + +SOT layer classification: + +- `L1 Projection Source review` +- `L3 Verification Evidence` +- `L4 Publication Surface` +- `L6 Codex Execution Governance` + +Selected local baseline: + +- public `AGENTS.md` +- public `.codex/config.toml` +- public `.agents/skills/task-governance-router/SKILL.md` +- public `.agents/skills/release-projection-governance-router/SKILL.md` +- public `governance/release/MPLP-RELEASE-SOP.md` +- public `release-config.yaml` +- prior public `PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01` +- Dev `MPLP-RELEASE-PROJECTION-POLICY.md` +- Dev `MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md` +- Dev `PUBLIC-OSS-PROJECTION-STANDARD-DISCOVERY-01` +- Dev `RELEASE-EVIDENCE-CLOSURE-AND-PUBLIC-PROJECTION-PLAN-01` + +Actual subagent invocation was attempted and blocked by the current thread +limit. The selected reviewer perspectives were therefore applied locally: + +- governance secretariat +- release governance reviewer +- projection boundary reviewer +- security/no-secret reviewer +- package surface auditor +- docs projection reviewer +- Website boundary reviewer +- Validation Lab boundary reviewer + +## Repo Truth + +Public repo: + +- branch: `codex/public-oss-projection-readiness-drift-review-01` +- starting HEAD: `20ecad2ee28116d92310111dbc64de3593b50ce3` +- public `origin/main`: `574d13d20b829c0c8768bc7916186f01dcf5ff46` + +Dev repo read-only: + +- branch observed: `codex/release-projection-governance-harness-codification-01` +- local HEAD observed: `93bcc881cc45e13d12dcc4d0ba26b8f11d996b23` +- Dev `origin/main`: `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` + +Dev `origin/main` is the main authority snapshot for release-set and publish +evidence. The local Dev governance branch adds projection-standard discovery +and release-projection router codification, so it is used as local governance +comparison evidence, not as a replacement for Dev `origin/main`. + +## Drift Summary + +Detected public drift: + +- Public `artifacts/release/publish-set.json` still reflects an older + 13-package set including `@mplp/compliance` and `@mplp/devtools` at old + versions. +- Dev `artifacts/release/publish-set.json` reflects the current 11-package + npm release set. +- Public `artifacts/release/pypi-set.json` still points `mplp-sdk@1.0.5` to a + V1 path. +- Dev `artifacts/release/pypi-set.json` reflects `mplp-sdk@1.0.6` under + `Coregentis/MPLP-Protocol-Dev`. +- Public manifest package status still says `planned_not_published`, while + live npm/PyPI registry checks show the released package versions are visible. +- Public package manifests and READMEs contain package-surface drift that + requires package gates before any projection mutation. Examples include + public `@mplp/conformance` and `@mplp/devtools` still referencing + `@mplp/compliance` where Dev has moved toward `@mplp/schema` / + `@mplp/conformance`. +- `schemas/v2/**`, `tests/**`, and `examples/**` showed no source drift in the + current sampled comparison. +- Docs source has limited drift after excluding generated docs artifacts. +- Website and Validation Lab vendored manifests still match the old public + manifest and therefore remain stale if the public manifest is updated. + +Expected projection lag: + +- Dev raw `artifacts/governance/**` evidence is not public-projected by + default. +- Dev package-preflight raw execution logs are not public-projected by default. +- Dev-only release governance can require public summary records rather than + raw record projection. + +## Classification Summary + +Public projection candidates: + +- public manifest status update +- package manifests / README / source after package gates +- docs source after docs and public-claim gates +- schemas/tests/examples if future drift appears + +Public summary-only candidates: + +- `artifacts/release/publish-set.json` +- `artifacts/release/pypi-set.json` +- Dev release evidence closure summaries +- npm/PyPI publish evidence summaries +- Website and Validation Lab manifest pointer decisions + +Dev-private or internal-only: + +- raw Dev `artifacts/governance/**` +- raw `artifacts/package-preflight/**` +- credential/security/token records +- local path execution logs +- embedded Website or Validation Lab source +- build outputs, `node_modules`, `dist`, docs generated artifacts + +Blocked by owner decision or release-config ambiguity: + +- broad `governance/04-records/**` projection, because Dev contains private + owner, credential, publish, and operational records +- package `dist` projection, because `release-config.yaml` excludes + `**/dist/**` while registry package artifacts may need generated dist in the + package-publication channel +- `@mplp/compliance` public boundary/deprecation handling +- exact Website and Validation Lab pointer sync scope + +## Release Config And SOP Review + +`release-config.yaml` matches between public and Dev in the sampled comparison, +but it is not a full redaction policy and it is not projection authorization. +It includes broad public surfaces such as `packages/**` and +`governance/04-records/**`, and excludes `**/dist/**`, build outputs, Website +and Lab embedded source, internal operations, reports, and release scripts. + +Current SOP is authority-consistent after +`PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01`. It still requires public +manifest validation, Website/Lab needed-or-not-needed decisions, and package +gates when packages are in scope. + +## Public Manifest / Website / Lab Boundary + +Public manifest validation passed: + +```bash +node scripts/semantic/validate-public-manifest.mjs +``` + +Website and Validation Lab both currently vendored the same stale manifest: + +- manifest id: `mplp-public-manifest-1.0.0-draft-650e5b2f` +- package status: `planned_not_published` + +Website and Lab are not in scope for mutation in this review. If a later public +projection updates the Protocol public manifest, owner decision is required on +whether Website and Lab pointer sync are in the same release window or separate +follow-up goals. + +## Readiness Decision + +Verdict: + +`COMPLETE_PUBLIC_OSS_PROJECTION_DRIFT_REVIEW_READY_FOR_OWNER_PROJECTION_PLAN` + +Meaning: + +- The public repo is ready for an owner-authorized projection plan. +- It is not ready for projection execution from this goal. +- A later plan must name exact public files/surfaces, redaction rules, gates, + and owner decisions. + +Recommended next goal: + +`PUBLIC-OSS-PROJECTION-PLAN-01` + +## Evidence + +Evidence bundle: + +`artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/` + +Required evidence files: + +- `repo-truth.json` +- task governance router result JSON +- `release-projection-router-result.json` +- `local-baseline-evidence-table.json` +- `agent-reviewer-selection.json` +- `dev-main-authority-snapshot.json` +- `public-repo-current-state.json` +- `drift-detection-summary.json` +- `projection-drift-classification-matrix.json` +- `release-config-and-sop-consistency-review.json` +- `public-manifest-website-lab-boundary-review.json` +- `projection-readiness-decision.json` +- `no-mutation-compliance.json` +- `final-verdict.json` + +## Non-Actions + +No projection execution, Dev-to-public sync/copy, package release, +publish/upload, registry mutation, release-config mutation, +release-set/pypi-set mutation, package/source/dist/schema/docs mutation, +release-manifest mutation, Website/Lab/downstream mutation, tag, seal, GitHub +release, merge, branch deletion, V1 mutation, or credential access was +performed. From bb9d33c6a0576e9d04db648f03e879d5dd154abb Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 21:33:08 +0800 Subject: [PATCH 10/24] governance: finalize public OSS projection drift evidence --- .../final-verdict.json | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json index 7a8139ae..b4bbfc6f 100644 --- a/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01/final-verdict.json @@ -1,6 +1,6 @@ { "goal_id": "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01", - "status": "complete_after_final_gates_pending_commit_push", + "status": "complete_committed_and_pushed", "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_DRIFT_REVIEW_READY_FOR_OWNER_PROJECTION_PLAN", "gates_run": { "repo_truth_first_public": "PASS", @@ -25,5 +25,12 @@ "public manifest and Website/Lab vendored manifests remain stale until future authorized projection", "package manifests/README/source drift requires package gates before mutation" ], + "commit_push_verification": { + "public_branch": "codex/public-oss-projection-readiness-drift-review-01", + "public_remote": "origin", + "tracking_branch": "origin/codex/public-oss-projection-readiness-drift-review-01", + "merge_to_main": "not_performed", + "pull_request_created": "not_performed" + }, "recommended_next_goal": "PUBLIC-OSS-PROJECTION-PLAN-01" } From b2df7ce2b1cf789a918d74cac6d2489226f70d8f Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 22:02:27 +0800 Subject: [PATCH 11/24] governance: plan public OSS projection --- .../agent-reviewer-selection.json | 26 + .../execution-gate-plan.json | 38 ++ .../final-verdict.json | 53 ++ .../local-baseline-evidence-table.json | 58 +++ .../no-mutation-compliance.json | 19 + .../owner-authorization-requirements.json | 27 + .../package-dist-handling-decision.json | 6 + .../projection-allowlist.json | 85 ++++ .../projection-denylist.json | 40 ++ .../projection-redaction-rules.json | 46 ++ ...ic-manifest-website-lab-decision-plan.json | 35 ++ .../release-config-handling-decision.json | 7 + .../release-projection-router-result.json | 47 ++ .../repo-truth.json | 115 +++++ .../source-target-plan.json | 18 + .../stop-condition-plan.json | 30 ++ .../task-governance-router-result.json | 47 ++ .../PUBLIC-OSS-PROJECTION-PLAN-01.md | 481 ++++++++++++++++++ 18 files changed, 1178 insertions(+) create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/execution-gate-plan.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/no-mutation-compliance.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/owner-authorization-requirements.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/package-dist-handling-decision.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-allowlist.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-denylist.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-redaction-rules.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/public-manifest-website-lab-decision-plan.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-config-handling-decision.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-projection-router-result.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/repo-truth.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/source-target-plan.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/stop-condition-plan.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/task-governance-router-result.json create mode 100644 governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/agent-reviewer-selection.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/agent-reviewer-selection.json new file mode 100644 index 00000000..4a1803de --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/agent-reviewer-selection.json @@ -0,0 +1,26 @@ +{ + "actual_subagent_invocation": { + "attempted": true, + "result": "blocked_by_thread_limit", + "message": "agent thread limit reached" + }, + "selected_review_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "package_surface_auditor", + "docs_projection_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer" + ], + "local_agent_files": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/product_boundary_reviewer.toml", + ".codex/agents/protocol_schema_reviewer.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".codex/agents/runtime_binding_reviewer.toml" + ], + "applied_locally": true +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/execution-gate-plan.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/execution-gate-plan.json new file mode 100644 index 00000000..6634fdb7 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/execution-gate-plan.json @@ -0,0 +1,38 @@ +{ + "pre_execution_gates": [ + "repo-truth-first public", + "repo-truth-first Dev", + "confirm Dev source commit equals authorized commit", + "confirm public origin/main/start HEAD equals authorized baseline", + "TASK-GOVERNANCE-ROUTER-01", + "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "plan allowlist/denylist conformance", + "public manifest validation before and after if manifest changes", + "release-config unchanged or owner-authorized config amendment present", + "identity/legal scan", + "forbidden-overclaim scan", + "no-secret scan", + "no-local-path scan", + "package README/install smoke if package surfaces mutate", + "package consistency release gate if package surfaces mutate", + "docs build/lint if docs mutate", + "Website/Lab needed-or-not-needed decision gate" + ], + "post_projection_gates": [ + "git diff --check", + "JSON parse all evidence/manifests", + "frontmatter check governance records", + "public manifest validation", + "protected surface review against allowlist", + "package gates for any package surface mutation", + "docs gates for any docs mutation", + "no raw Dev evidence leakage scan", + "no credential/token scan", + "no local path scan", + "forbidden-overclaim scan", + "release-config unchanged check unless authorized", + "final repo-truth-first", + "local/remote HEAD verification after push" + ], + "package_release_gates_in_plan_only": "NOT_RUN_NOW; required later only if package surfaces mutate" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json new file mode 100644 index 00000000..1bd9c540 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json @@ -0,0 +1,53 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-PLAN-01", + "status": "final_gates_passed_pending_commit_push", + "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_PLAN_READY_FOR_OWNER_EXECUTION_AUTHORIZATION", + "planning_decisions": { + "release_config": "plan-specific allowlist/denylist; no config mutation now", + "package_dist": "registry artifact only; no public OSS dist projection", + "website_lab": "Option B follow-up pointer sync goals if manifest changes", + "compliance": "legacy alias excluded; no deprecate without separate owner authorization", + "devtools": "public optional tooling included as summary/package surface candidate; no publish implied", + "validator": "internal CI-only; exclude from public package set" + }, + "gates_run": { + "repo_truth_first_public": "PASS", + "repo_truth_first_dev_read_only": "PASS", + "task_governance_router": "PASS", + "release_projection_governance_router": "PASS", + "skill_mirror_diff": "PASS", + "json_parse_all_evidence": "PASS", + "governance_record_frontmatter": "PASS", + "required_phrase_scan": "PASS", + "public_manifest_validation": "PASS", + "git_diff_check": "PASS", + "protected_surface_scan": "PASS", + "release_config_unchanged": "PASS", + "package_source_dist_schema_docs_release_set_pypi_set_manifest_unchanged": "PASS", + "no_secret_scan": "PASS", + "no_local_path_scan": "PASS_WITH_ALLOWED_REPO_TRUTH_PATHS_ONLY", + "no_projection_execution": "PASS", + "package_release_gates": "NOT_RUN_PLAN_ONLY_NO_PACKAGE_MUTATION" + }, + "changed_surfaces": [ + "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md", + "artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/*.json" + ], + "forbidden_action_compliance": { + "projection_execution": "NOT_PERFORMED", + "dev_to_public_copy_or_sync": "NOT_PERFORMED", + "package_source_dist_schema_docs_release_manifest_mutation": "NOT_PERFORMED", + "release_set_or_pypi_set_mutation": "NOT_PERFORMED", + "release_config_mutation": "NOT_PERFORMED", + "publish_upload_registry_mutation": "NOT_PERFORMED", + "tag_seal_github_release_merge": "NOT_PERFORMED", + "website_lab_downstream_mutation": "NOT_PERFORMED", + "credential_or_token_access": "NOT_PERFORMED" + }, + "remaining_gaps": [ + "requires exact owner authorization for future execution", + "future execution must revalidate Dev source commit and public base HEAD", + "Website/Lab pointer sync scope still owner decision at release-window level" + ], + "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/local-baseline-evidence-table.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..043464c1 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/local-baseline-evidence-table.json @@ -0,0 +1,58 @@ +{ + "rows": [ + { + "decision_area": "repo authority", + "local_evidence_file": "AGENTS.md; .codex/config.toml", + "evidence_signal": "public repo is clean public OSS projection; Dev repo is authoritative Dev truth", + "derived_rule": "plan in public; compare Dev read-only", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "projection standard", + "local_evidence_file": "Dev MPLP-RELEASE-PROJECTION-POLICY.md; public SOP; drift review", + "evidence_signal": "Dev-to-public projection uses allowlist/denylist and protected PR; no direct Dev main merge", + "derived_rule": "future execution must use exact allowlist and no direct merge", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "release-config ambiguity", + "local_evidence_file": "release-config.yaml; drift review release-config consistency evidence", + "evidence_signal": "config is bundle input, not full redaction policy; broad governance include and dist exclude exist", + "derived_rule": "plan-specific allowlist/denylist can proceed; no config mutation in plan-only goal", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "plan_allowlist" + }, + { + "decision_area": "package dist boundary", + "local_evidence_file": "release-config.yaml excludes **/dist/**; drift review classification", + "evidence_signal": "dist excluded from public OSS release bundle", + "derived_rule": "treat package dist as registry artifact only unless owner separately authorizes dist projection/config amendment", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "block_dist_projection" + }, + { + "decision_area": "Website/Lab scope", + "local_evidence_file": "SOP sections 5-6; Website/Lab vendored manifest evidence", + "evidence_signal": "Website/Lab are standalone pointer consumers and stale if manifest changes", + "derived_rule": "choose Option B: protocol projection first, immediate follow-up pointer-sync goals if manifest changes", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "plan_followups" + }, + { + "decision_area": "package policy", + "local_evidence_file": "Dev publish evidence; drift review; registry snapshot", + "evidence_signal": "11 npm + PyPI released; Devtools released separate; compliance legacy; validator internal absent", + "derived_rule": "align public summaries; compliance/validator remain excluded; devtools included as optional tooling summary", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "plan" + } + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/no-mutation-compliance.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/no-mutation-compliance.json new file mode 100644 index 00000000..2373799a --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/no-mutation-compliance.json @@ -0,0 +1,19 @@ +{ + "forbidden_actions": { + "public_projection_execution": "not_performed", + "dev_to_public_sync_or_copy": "not_performed", + "dev_repo_mutation": "not_performed", + "package_source_dist_schema_docs_release_manifest_mutation": "not_performed", + "release_set_or_pypi_set_mutation": "not_performed", + "release_config_mutation": "not_performed", + "publish_upload_registry_mutation": "not_performed", + "tag_seal_github_release_merge": "not_performed", + "website_lab_downstream_mutation": "not_performed", + "credential_or_token_access": "not_performed", + "v1_mutation": "not_performed" + }, + "changed_files_expected": [ + "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md", + "artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/*.json" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/owner-authorization-requirements.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/owner-authorization-requirements.json new file mode 100644 index 00000000..8d0795e3 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/owner-authorization-requirements.json @@ -0,0 +1,27 @@ +{ + "next_required_authorization": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01", + "must_include": [ + "exact Dev source commit", + "exact public base/start HEAD", + "exact public branch name", + "exact allowlisted files/path classes", + "explicit release-config handling decision", + "package dist exclusion confirmation", + "Website/Lab same-window or follow-up decision", + "package surface mutation permission if package manifests/READMEs/source included", + "docs mutation permission if docs included", + "confirmation no registry/tag/seal/merge/deploy/publish/upload" + ], + "not_authorized_by_this_plan": [ + "projection execution", + "Dev copy/sync", + "package publish/upload", + "registry mutation", + "tag/seal/GitHub release", + "merge", + "Website/Lab sync", + "package version bump", + "release-config mutation" + ], + "recommended_authorization_text_summary": "Authorize public projection execution only for the allowlisted public files under PUBLIC-OSS-PROJECTION-PLAN-01, from Dev origin/main commit 00f57406005fe0a23f27c2e3e82a8c27e99dba6d to public branch codex/public-oss-projection-execution-01, with no direct merge and no forbidden registry/tag/seal/deploy actions." +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/package-dist-handling-decision.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/package-dist-handling-decision.json new file mode 100644 index 00000000..eee70d2d --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/package-dist-handling-decision.json @@ -0,0 +1,6 @@ +{ + "decision": "PACKAGE_DIST_REMAINS_REGISTRY_ARTIFACT_ONLY_FOR_PUBLIC_OSS_PROJECTION", + "rationale": "release-config excludes **/dist/** and drift review classified package dist as ambiguous. Public OSS projection should carry source/manifest/README surfaces; registry packages carry built dist artifacts after package gates and owner publish authorization.", + "future_dist_projection": "requires separate owner decision plus release-config amendment and package artifact provenance gate", + "current_goal_mutation": false +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-allowlist.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-allowlist.json new file mode 100644 index 00000000..1eef042d --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-allowlist.json @@ -0,0 +1,85 @@ +{ + "principle": "positive allowlist; every file must still pass suitability gates", + "exact_or_class_allowlist": [ + { + "path": "release-manifests/mplp-public-manifest.example.json", + "action": "update_public_summary", + "condition": "update package status from planned to published using registry/Dev evidence; validate schema" + }, + { + "path": "release-manifests/mplp-public-manifest.schema.json", + "action": "unchanged_unless_schema_needed", + "condition": "only if manifest schema field changes are explicitly planned and gate passes" + }, + { + "path": "artifacts/release/publish-set.json", + "action": "update_summary", + "condition": "align to 11 npm release-set packages; exclude compliance/validator; handle devtools separately as optional tooling summary if owner approves" + }, + { + "path": "artifacts/release/pypi-set.json", + "action": "update_summary", + "condition": "align mplp-sdk to 1.0.6 and remove V1 local path; use public-safe relative/pathless summary" + }, + { + "path": "packages/npm/conformance/package.json", + "action": "candidate_update", + "condition": "package gates required; remove active compliance dependency drift" + }, + { + "path": "packages/npm/conformance/README.md", + "action": "candidate_update", + "condition": "README/install smoke and consistency gates required" + }, + { + "path": "packages/npm/conformance/src/**", + "action": "candidate_update", + "condition": "source/public safety gates required" + }, + { + "path": "packages/npm/devtools/package.json", + "action": "candidate_update", + "condition": "owner decision required for public optional tooling inclusion; package gates required" + }, + { + "path": "packages/npm/devtools/README.md", + "action": "candidate_update", + "condition": "standardize only with package gates; no publish implied" + }, + { + "path": "packages/npm/devtools/src/**", + "action": "candidate_update", + "condition": "public tooling source only; no dist projection" + }, + { + "path": "selected packages/npm/*/package.json and README.md", + "action": "candidate_update", + "condition": "only packages with drift and package gates; no wholesale packages/** copy" + }, + { + "path": "selected docs source under docs/docs/** and docs/src/**", + "action": "candidate_update", + "condition": "docs/public claim/build gates; exclude generated docs" + }, + { + "path": "schemas/v2/**", + "action": "unchanged_unless_new_drift", + "condition": "current review found no drift; include only if future preflight detects safe drift" + }, + { + "path": "tests/** and examples/**", + "action": "unchanged_unless_new_drift", + "condition": "current review found no drift; include only if needed for public verification" + }, + { + "path": "governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-*.md", + "action": "create_public_safe_summary", + "condition": "execution goal creates public summary record only" + }, + { + "path": "artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-*/*.json", + "action": "create_public_lightweight_evidence", + "condition": "public repo evidence only, no Dev raw evidence" + } + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-denylist.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-denylist.json new file mode 100644 index 00000000..fa04e534 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-denylist.json @@ -0,0 +1,40 @@ +{ + "principle": "denylist overrides broad release-config include; no raw Dev evidence", + "denylist": [ + "raw Dev artifacts/governance/**", + "raw Dev artifacts/package-preflight/**", + "credential/auth readiness raw evidence", + "local path execution logs", + "private owner decision records not public-safe", + "Dev .codex/** wholesale copy", + "Dev .agents/** wholesale copy", + "Dev scripts/codex/** wholesale copy", + "Dev governance/codex-goals/CODEX-GOAL-TEMPLATE.md wholesale copy", + "raw npm/PyPI execution stdout/stderr", + "package dist files under **/dist/**", + "node_modules/**", + "venv/**", + "*.whl", + "*.tar.gz", + "*.tgz", + "sdist/wheel/tarball staging directories", + "MPLP_website/**", + "Validation_Lab/**", + "Cognitive_OS/**", + "SoloCrew/**", + "V1.0_release content", + "secrets or env files", + ".npmrc", + ".pypirc", + ".env*", + ".DS_Store", + "docs/build/**", + "docs/.docusaurus/**", + "docs/.cache/**" + ], + "policy_overrides": [ + "Do not project governance/04-records/** wholesale even though release-config includes it broadly.", + "Do not project packages/** wholesale; use selected package surfaces only.", + "Do not project dist even if package registry artifacts contain dist." + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-redaction-rules.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-redaction-rules.json new file mode 100644 index 00000000..4b9d1b36 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-redaction-rules.json @@ -0,0 +1,46 @@ +{ + "redaction_required_for": [ + "local absolute paths", + "registry execution summaries", + "publish evidence summaries", + "owner/copyright records", + "Devtools README issue", + "compliance legacy/deprecation boundary", + "validator internal boundary", + "Website/Lab pointer status" + ], + "rules": [ + { + "surface": "local absolute paths", + "rule": "replace machine paths with repo-relative paths or named repo labels; no home-directory absolute paths in public projected artifacts except governance records that explicitly document local repo truth" + }, + { + "surface": "registry execution summaries", + "rule": "summarize package/version/result only; omit command stdout/stderr and credential readiness detail" + }, + { + "surface": "publish evidence summaries", + "rule": "state published/verified package versions and links/registry facts; do not include auth context, local temp paths, raw npm/twine logs, or token references" + }, + { + "surface": "owner/copyright records", + "rule": "project only public owner identity/current copyright conclusions; keep private owner decision evidence out" + }, + { + "surface": "Devtools README issue", + "rule": "state public optional tooling package and required README/package gate harmonization; do not imply republish without owner authorization" + }, + { + "surface": "compliance legacy/deprecation boundary", + "rule": "describe @mplp/compliance as legacy alias boundary/excluded from current release-set; no deprecation action unless separately authorized" + }, + { + "surface": "validator internal boundary", + "rule": "describe @mplp/validator as internal CI-only and absent from npm; do not include in publish set" + }, + { + "surface": "Website/Lab pointer status", + "rule": "state stale/not-needed/needed decision and follow-up goal; do not mutate downstream repos in Protocol projection execution unless owner scopes it" + } + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/public-manifest-website-lab-decision-plan.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/public-manifest-website-lab-decision-plan.json new file mode 100644 index 00000000..19b65bca --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/public-manifest-website-lab-decision-plan.json @@ -0,0 +1,35 @@ +{ + "decision": "Option B", + "rationale": "Public SOP requires Website/Lab needed-or-not-needed decisions. Drift review shows Website/Lab vendored manifests are stale if Protocol manifest changes. Keeping Protocol projection and downstream pointer sync as separate immediate follow-up goals preserves repo boundaries and avoids blocking Protocol planning on sibling repo mutation authorization.", + "option_a": "Protocol only and leave Website/Lab for later: safe only if release window explicitly excludes downstream pointer freshness.", + "option_b": "Protocol projection, then separate immediate Website/Lab pointer-sync goals if manifest changes: selected default plan.", + "option_c": "Block Protocol projection until Website/Lab same-window sync planned: use only if owner declares Website/Lab pointer freshness part of the same public release completion criteria.", + "required_followup_if_manifest_changes": [ + "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01" + ], + "current_website_lab_state": { + "website": { + "repo": "Coregentis/MPLP-Official-Website", + "vendored_manifest_path": "lib/data/mplp-public-manifest.json", + "manifest_id": "mplp-public-manifest-1.0.0-draft-650e5b2f", + "protocol_commit_sha": "650e5b2f6754a7016d8c8184e54881b0fcef6683", + "package_statuses": [ + "planned_not_published" + ], + "checksum_path": "lib/data/mplp-public-manifest.sha256", + "sync_needed_decision": "owner_decision_required_for_release_window; current vendored manifest is stale if public manifest is updated" + }, + "validation_lab": { + "repo": "Coregentis/MPLP-Validation-Lab", + "vendored_manifest_path": "lib/data/mplp-public-manifest.json", + "manifest_id": "mplp-public-manifest-1.0.0-draft-650e5b2f", + "protocol_commit_sha": "650e5b2f6754a7016d8c8184e54881b0fcef6683", + "package_statuses": [ + "planned_not_published" + ], + "checksum_path": "lib/data/mplp-public-manifest.sha256", + "sync_needed_decision": "owner_decision_required_for_release_window; current vendored manifest is stale if public manifest is updated" + } + } +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-config-handling-decision.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-config-handling-decision.json new file mode 100644 index 00000000..7826d38b --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-config-handling-decision.json @@ -0,0 +1,7 @@ +{ + "decision": "PLAN_SPECIFIC_ALLOWLIST_DENYLIST_SUFFICIENT_FOR_NEXT_EXECUTION_PLAN", + "mutate_release_config_now": false, + "rationale": "release-config matches public/Dev and is useful bundle input, but not full redaction policy. The plan-level allowlist/denylist narrows broad governance/04-records/** and packages/** and blocks dist/raw evidence leakage.", + "future_config_amendment_needed": false, + "stop_if": "future owner wants broad automated projection semantics rather than exact allowlist execution; then amend release-config in separate goal first" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-projection-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-projection-router-result.json new file mode 100644 index 00000000..80d822ff --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-projection-router-result.json @@ -0,0 +1,47 @@ +{ + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "executed": true, + "workflow_type": [ + "public OSS projection execution planning", + "non projection execution" + ], + "local_standard_source_files": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/release/MPLP-RELEASE-SOP.md", + "release-config.yaml", + "release-manifests/mplp-public-manifest.example.json", + "scripts/semantic/validate-public-manifest.mjs", + "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01", + "Dev MPLP-RELEASE-PROJECTION-POLICY.md" + ], + "owner_authorization_required_for_future_mutation": true, + "allowed_now": [ + "public projection plan record", + "public lightweight evidence" + ], + "required_future_gates": [ + "repo-truth-first public and Dev", + "task router", + "release projection router", + "allowlist/denylist conformance", + "public manifest validation", + "identity/legal scan", + "forbidden-overclaim scan", + "no-secret scan", + "no-local-path scan", + "package gates if package surfaces mutate", + "docs gates if docs mutate", + "Website/Lab needed-not-needed decision", + "post-projection diff review", + "final HEAD verification" + ], + "blockers": [ + "BLOCKED_DEV_MAIN_TRUTH_DRIFT", + "BLOCKED_PUBLIC_ORIGIN_MAIN_DRIFT", + "BLOCKED_PROJECTION_ALLOWLIST_AMBIGUITY", + "BLOCKED_RAW_DEV_EVIDENCE_LEAKAGE", + "BLOCKED_OWNER_AUTHORIZATION_REQUIRED" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/repo-truth.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/repo-truth.json new file mode 100644 index 00000000..9a3370a0 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/repo-truth.json @@ -0,0 +1,115 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-PLAN-01", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "primary_target_repo": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "authority_source_repo_read_only": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "public": { + "branch": "codex/public-oss-projection-plan-01", + "head": "bb9d33c6a0576e9d04db648f03e879d5dd154abb", + "origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "worktree_status": "clean", + "repo_truth_first_executed": true, + "repo_truth_first_output_excerpt": [ + "== Repo Truth First ==", + "", + "[branch]", + "codex/public-oss-projection-plan-01", + "", + "[status]", + "", + "[local HEAD]", + "bb9d33c6a0576e9d04db648f03e879d5dd154abb", + "", + "[origin/main HEAD]", + "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "", + "[origin/codex/latest-ops-foundation-wave-01 HEAD]", + "d220a5110a0c5380d3a82579c6749f9c535f94e2", + "", + "[recent commits]", + "bb9d33c governance: finalize public OSS projection drift evidence", + "9f2b55c governance: review public OSS projection readiness drift", + "20ecad2 governance: finalize public OSS SOP reconciliation evidence", + "16e5e41 governance: reconcile public OSS release SOP authority", + "d53e2d5 governance: codify release projection workflow router", + "", + "[AGENTS.md bytes]", + " 12458 AGENTS.md", + "", + "[skill mirror drift]", + "SKILL_MIRROR_DRIFT=NO", + "", + "[local governance baseline discovery]", + "LOCAL_BASELINE_DISCOVERY_REQUIRED=YES", + "DYNAMIC_GOVERNANCE_BASELINE_SELECTION_PRECONDITION=Dynamic governance baseline selection is a precondition for every non-trivial task.", + "required_phrase=Prompt assertions are not governance authority unless supported by local repository evidence.", + "required_table=local baseline evidence table", + "package_policy_discovery=required_when_package_related", + "version_baseline_discovery=required_when_release_or_version_related", + "copyright_baseline_discovery=required_when_legal_or_copyright_related", + "cross_repo_boundary_discovery=required_when_cross_repo_related", + "blocked_local_baseline_missing=BLOCKED_LOCAL_GOVERNANCE_BASELINE_MISSING", + "blocked_local_baseline_conflict=BLOCKED_LOCAL_GOVERNANCE_BASELINE_CONFLICT", + "blocked_prompt_overrides_local_baseline=BLOCKED_PROMPT_POLICY_OVERRIDES_LOCAL_BASELINE", + "blocked_dynamic_selection_not_performed=BLOCKED_DYNAMIC_BASELINE_SELECTION_NOT_PERFORMED", + "blocked_substantive_decision_without_evidence=BLOCKED_SUBSTANTIVE_DECISION_WITHOUT_LOCAL_EVIDENCE", + "", + "[task governance router]" + ] + }, + "dev_read_only": { + "branch": "codex/release-projection-governance-harness-codification-01", + "local_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "worktree_status": "clean", + "repo_truth_first_executed": true, + "repo_truth_first_output_excerpt": [ + "== Repo Truth First ==", + "", + "[branch]", + "codex/release-projection-governance-harness-codification-01", + "", + "[status]", + "", + "[local HEAD]", + "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "", + "[origin/main HEAD]", + "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "", + "[recent commits]", + "93bcc881 governance: codify release projection workflow router", + "618e9af0 governance: discover public OSS projection standard", + "00f57406 governance: record protected Dev merge execution", + "9c26ba92 merge: consolidate Dev release evidence line", + "f34f08bd governance: record protected Dev release consolidation merge decision", + "", + "[AGENTS.md bytes]", + " 30726 AGENTS.md", + "", + "[Codex config goals feature]", + "CODEX_GOALS_FEATURE=YES", + "", + "[skill mirror drift]", + "SKILL_MIRROR_DRIFT=NO", + "", + "[required Codex ops files]", + "present AGENTS.md", + "present .codex/config.toml", + "present governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "present scripts/codex/repo-truth-first.sh", + "", + "[required skills]", + "present .codex/skills/repo-truth-first-audit/SKILL.md", + "present .agents/skills/repo-truth-first-audit/SKILL.md", + "present .codex/skills/release-gate-and-seal-discipline/SKILL.md", + "present .agents/skills/release-gate-and-seal-discipline/SKILL.md", + "present .codex/skills/package-surface-audit/SKILL.md", + "present .agents/skills/package-surface-audit/SKILL.md", + "present .codex/skills/public-claim-boundary-review/SKILL.md", + "present .agents/skills/public-claim-boundary-review/SKILL.md", + "present .codex/skills/protocol-schema-boundary-review/SKILL.md" + ] + }, + "v1_status_observed": "not inspected for mutation beyond known frozen migration source; no V1 mutation performed" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/source-target-plan.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/source-target-plan.json new file mode 100644 index 00000000..281be0e2 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/source-target-plan.json @@ -0,0 +1,18 @@ +{ + "dev_source_commit": { + "type": "Dev origin/main authority snapshot", + "commit": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "note": "Use Dev origin/main for release-set/pypi-set and publish evidence authority. Dev local governance branch may inform router/policy only if merged or owner-authorized before execution." + }, + "public_target": { + "repo": "Coregentis/MPLP-Protocol", + "current_plan_branch": "codex/public-oss-projection-plan-01", + "current_plan_head": "bb9d33c6a0576e9d04db648f03e879d5dd154abb", + "current_origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "future_execution_branch": "codex/public-oss-projection-execution-01", + "public_base_branch": "current public task stack or refreshed origin/main, to be revalidated at execution start", + "expected_start_head": "must equal latest approved public projection planning HEAD at execution time" + }, + "no_direct_dev_main_merge": true, + "future_execution_method": "manual/automated file-level projection from exact allowlist only; no branch merge, no wholesale copy" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/stop-condition-plan.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/stop-condition-plan.json new file mode 100644 index 00000000..2da6bd7d --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/stop-condition-plan.json @@ -0,0 +1,30 @@ +{ + "blockers": [ + "BLOCKED_DEV_MAIN_TRUTH_DRIFT", + "BLOCKED_PUBLIC_ORIGIN_MAIN_DRIFT", + "BLOCKED_RELEASE_CONFIG_SCOPE_AMBIGUITY", + "BLOCKED_PROJECTION_ALLOWLIST_AMBIGUITY", + "BLOCKED_RAW_DEV_EVIDENCE_LEAKAGE", + "BLOCKED_LOCAL_PATH_LEAKAGE", + "BLOCKED_CREDENTIAL_LEAKAGE", + "BLOCKED_PACKAGE_GATE_FAILED", + "BLOCKED_MANIFEST_VALIDATION_FAILED", + "BLOCKED_IDENTITY_OWNER_SCAN_UNRESOLVED", + "BLOCKED_OVERCLAIM_SCAN_UNRESOLVED", + "BLOCKED_WEBSITE_LAB_SCOPE_AMBIGUITY", + "BLOCKED_PUBLIC_PACKAGE_DIST_SCOPE_UNCLEAR", + "BLOCKED_OWNER_AUTHORIZATION_REQUIRED", + "BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN", + "BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED" + ], + "stop_rules": { + "dev_main_truth_drift": "stop if Dev origin/main no longer equals authorized source commit", + "public_origin_main_drift": "stop if public start/base HEAD differs from owner-authorized baseline", + "release_config_conflict": "stop if requested files require config semantics not covered by allowlist/denylist", + "raw_dev_evidence_leakage": "stop on any raw Dev artifacts/governance or package-preflight content in projection diff", + "local_path_leakage": "stop on unexpected home-directory absolute path or temp path leakage outside explicit repo-truth record", + "credential_leakage": "stop on credential-looking content or credential files", + "package_gate_failure": "stop before commit if package gates fail for package mutations", + "owner_missing": "stop if execution mutation category, target files, or downstream scope lacks exact owner authorization" + } +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/task-governance-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/task-governance-router-result.json new file mode 100644 index 00000000..aa387327 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/task-governance-router-result.json @@ -0,0 +1,47 @@ +{ + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "executed": true, + "task_type": [ + "public_oss_projection_plan", + "owner_ready_projection_execution_planning", + "projection_allowlist_denylist_planning", + "release_process_governance", + "non_projection_execution" + ], + "sot_layer": [ + "L1 Projection Source planning", + "L3 Verification Evidence", + "L4 Publication Surface planning", + "L6 Codex Execution Governance" + ], + "selected_public_baseline": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md", + "release-config.yaml", + "PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01" + ], + "selected_dev_comparison_baseline": [ + "Dev origin/main 00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "Dev MPLP-RELEASE-PROJECTION-POLICY.md", + "Dev MPLP-DEV-PUBLIC-REPO-AUTHORITY-DOCTRINE-2026-06-02.md", + "Dev release evidence closure record", + "Dev publish-set/pypi-set", + "Dev package manifests/READMEs as read-only comparison" + ], + "forbidden_actions": [ + "projection execution", + "copy/sync Dev files", + "release-config mutation", + "release-set/pypi-set mutation", + "release manifest mutation", + "package/source/dist/schema/docs mutation", + "registry mutation", + "tag/seal/GitHub release/merge", + "website/lab/downstream sync", + "credential access" + ], + "evidence_output_plan": "17 required JSON files plus public governance record" +} diff --git a/governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md b/governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md new file mode 100644 index 00000000..30f1672d --- /dev/null +++ b/governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md @@ -0,0 +1,481 @@ +--- +entry_surface: repository +doc_type: governance +status: active +authority: MPLP public OSS projection governance +protocol_version: "1.0.0" +doc_id: "PUBLIC-OSS-PROJECTION-PLAN-01" +title: "Public OSS Projection Plan 01" +created_at: "2026-06-08" +goal_id: "PUBLIC-OSS-PROJECTION-PLAN-01" +--- + +# Public OSS Projection Plan 01 + +## Scope + +This record creates an owner-ready execution plan for a later public OSS +projection from Dev-side MPLP protocol/package/release truth into the public +OSS projection repository. + +Canonical workspace root: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis` + +Primary planning target: + +- `Coregentis/MPLP-Protocol` + +Read-only authority comparison source: + +- `Coregentis/MPLP-Protocol-Dev` + +This is planning and governance baseline work only. It does not authorize or +perform public projection execution, Dev-to-public copy/sync, package release, +publish/upload, registry mutation, release-config mutation, package/source +mutation, dist mutation, schema mutation, docs mutation, release-manifest +mutation, Website deploy, Validation Lab publication, downstream sync, tag, +seal, GitHub release, merge, branch deletion, or credential access. + +## Governance Baseline Adoption + +The following rules become baseline preconditions for future public OSS +projection and release-like work in this repository: + +- Dynamic local governance baseline selection is mandatory before every + non-trivial task and before any substantive decision or mutation. +- `TASK-GOVERNANCE-ROUTER-01` is mandatory before non-trivial task execution. +- `RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` is mandatory when a task touches or + could touch release-like, projection, package, registry, downstream release + pointer, tag, seal, GitHub release, or merge surfaces. +- Prompt assertions are not governance authority unless supported by local + repository evidence. +- Green gates, clean worktrees, prior plans, prior evidence, or merged PRs do + not create owner authorization for a new mutation category. +- Future version planning or release execution must use the latest published + npm/PyPI registry version for each exact package name as the version + baseline. Local `package.json`, `pyproject.toml`, generated dist, release-set + files, pypi-set files, prior PRs, and historical artifacts remain evidence + only. +- Public OSS projection execution must use an owner-authorized, plan-specific + allowlist and denylist. Do not rely on broad path classes in + `release-config.yaml` as projection permission. +- Public projection must be file-level projection only. Do not merge Dev + `main` directly into public `main`, and do not wholesale-copy Dev repo + surfaces. +- Raw Dev governance evidence, raw package-preflight evidence, credential/auth + evidence, local execution logs, and raw npm/PyPI stdout/stderr are not public + projection surfaces. + +## Router Result + +`TASK-GOVERNANCE-ROUTER-01` and +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` were applied before this governance +record was created. + +Task classification: + +- `public_oss_projection_plan` +- `owner_ready_projection_execution_planning` +- `projection_allowlist_denylist_planning` +- `release_process_governance` +- `non_projection_execution` + +SOT layer classification: + +- `L1 Projection Source planning` +- `L3 Verification Evidence` +- `L4 Publication Surface planning` +- `L6 Codex Execution Governance` + +Selected public baseline: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` +- `governance/release/MPLP-RELEASE-SOP.md` +- `release-config.yaml` +- `PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01` + +Selected Dev comparison baseline: + +- Dev `origin/main` commit `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- Dev `governance/release/MPLP-RELEASE-PROJECTION-POLICY.md` +- Dev public-repo authority doctrine +- Dev release evidence closure record +- Dev release-set and pypi-set +- Dev package manifests and READMEs as read-only comparison evidence + +Actual subagent invocation was attempted and blocked by the current thread +limit. The selected reviewer perspectives were applied locally: + +- governance secretariat +- release governance reviewer +- projection boundary reviewer +- security/no-secret reviewer +- package surface auditor +- docs projection reviewer +- Website boundary reviewer +- Validation Lab boundary reviewer + +## Repo Truth + +Public repo: + +- branch: `codex/public-oss-projection-plan-01` +- starting HEAD: `bb9d33c6a0576e9d04db648f03e879d5dd154abb` +- public `origin/main`: `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- worktree state before record creation: clean except this goal's untracked + evidence directory +- skill mirror drift: `NO` + +Dev repo read-only: + +- observed branch: `codex/release-projection-governance-harness-codification-01` +- local HEAD observed: + `93bcc881cc45e13d12dcc4d0ba26b8f11d996b23` +- Dev `origin/main`: `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- worktree state: clean + +Future projection execution must re-run repo-truth-first in both repos and must +stop if Dev `origin/main` or the public start HEAD no longer match the +owner-authorized baseline. + +## Local Baseline Evidence Table + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +|:---|:---|:---|:---|:---|:---|:---| +| Repo authority | `AGENTS.md`; `.codex/config.toml` | Public repo is clean OSS projection; Dev repo is package/release Dev truth | Plan in public; compare Dev read-only | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Projection standard | Dev projection policy; public SOP; drift review | Projection requires allowlist/denylist and no direct Dev main merge | Future execution must use exact allowlist and file-level projection | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Release-config handling | `release-config.yaml`; drift review | Config is bundle input, not full redaction policy; broad governance and package classes exist | Use plan-specific allowlist/denylist; do not mutate config now | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Plan allowlist | +| Package dist boundary | `release-config.yaml`; drift review | `**/dist/**` is excluded from public release bundle | Keep dist as registry artifact only unless separately authorized | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Block dist projection | +| Website/Lab scope | SOP Sections 5-6; vendored manifest evidence | Website/Lab are downstream pointer consumers and become stale if manifest changes | Select Option B follow-up pointer-sync goals if manifest changes | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Plan follow-ups | +| Package policy | Dev publish evidence; drift review; registry facts | 11 npm packages and PyPI package released; Devtools handled separately; compliance legacy; validator internal | Align public summaries later; exclude compliance/validator; treat Devtools as optional tooling summary | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Plan | + +No mutation-affecting decision in this plan depends on low, conflicting, or +missing local evidence. + +## Source / Target Plan + +| Field | Planned Value | +|:---|:---| +| Dev source commit | `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` | +| Dev source type | Dev `origin/main` authority snapshot | +| Public target repo | `Coregentis/MPLP-Protocol` | +| Current planning branch | `codex/public-oss-projection-plan-01` | +| Future execution branch | `codex/public-oss-projection-execution-01` | +| Current public start HEAD | `bb9d33c6a0576e9d04db648f03e879d5dd154abb` | +| Current public `origin/main` | `574d13d20b829c0c8768bc7916186f01dcf5ff46` | +| Projection method | Exact allowlist file-level projection only | +| Direct Dev merge | Forbidden | +| Wholesale copy | Forbidden | + +The Dev local governance branch may inform future router/policy work only if +merged or explicitly owner-authorized before execution. It does not replace Dev +`origin/main` as the package/release truth snapshot for this plan. + +## Projection Allowlist + +Future projection execution may include only owner-authorized instances of the +following classes, and every selected file must pass suitability gates: + +- `release-manifests/mplp-public-manifest.example.json` +- `release-manifests/mplp-public-manifest.schema.json` only if schema changes + are explicitly planned +- `artifacts/release/publish-set.json` +- `artifacts/release/pypi-set.json` +- selected package manifests, READMEs, and source files where drift is proven + and package gates pass +- `packages/npm/conformance/package.json` +- `packages/npm/conformance/README.md` +- `packages/npm/conformance/src/**` +- `packages/npm/devtools/package.json` +- `packages/npm/devtools/README.md` +- `packages/npm/devtools/src/**` +- selected `docs/docs/**` and `docs/src/**` source files only if drift is + proven and docs/public-claim gates pass +- `schemas/v2/**`, `tests/**`, and `examples/**` only if future preflight + detects public-safe drift +- a public-safe execution summary record under `governance/04-records/**` +- lightweight public evidence under the execution goal evidence directory + +This allowlist is not self-executing. It defines candidate surfaces for the +next owner authorization and future execution goal. + +## Projection Denylist + +Denylist overrides broad includes in `release-config.yaml`. + +Forbidden projection surfaces: + +- raw Dev `artifacts/governance/**` +- raw Dev `artifacts/package-preflight/**` +- credential/auth readiness evidence +- local path execution logs +- private owner decision records not public-safe +- Dev `.codex/**` wholesale copy +- Dev `.agents/**` wholesale copy +- Dev `scripts/codex/**` wholesale copy +- Dev `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` wholesale copy +- raw npm/PyPI execution stdout/stderr +- package `dist` files under `**/dist/**` +- `node_modules/**` +- `venv/**` +- wheels, sdists, tarballs, and staging directories +- `MPLP_website/**` +- `Validation_Lab/**` +- `Cognitive_OS/**` +- `SoloCrew/**` +- V1 migration/evidence workspace content +- `.npmrc`, `.pypirc`, `.env*`, or secret/config files +- docs generated output such as `docs/build/**`, `docs/.docusaurus/**`, and + `docs/.cache/**` + +Do not project `governance/04-records/**` wholesale. Do not project +`packages/**` wholesale. Do not project package `dist` files even if registry +package artifacts contain built dist. + +## Redaction Rules + +Future projection execution must apply these redaction rules: + +- Replace machine-specific paths with repo-relative paths or named repo labels + unless a governance record explicitly documents local repo truth. +- Summarize registry execution by package, version, and result only. +- Omit raw npm/twine command output, credential readiness detail, auth context, + local temp paths, and token references. +- Project only public owner identity and current public copyright conclusions; + keep private owner decision evidence out. +- Describe `@mplp/devtools` as public optional tooling only when package gates + and owner authorization support that status. Do not imply new publish + authorization. +- Describe `@mplp/compliance` as a legacy alias boundary excluded from the + current release set. Do not perform or imply deprecation without separate + owner authorization. +- Describe `@mplp/validator` as internal CI-only and absent from the public + package set. +- State Website/Lab pointer status and follow-up goal need without mutating + downstream repos in the Protocol projection execution goal. + +## Package Policy Boundaries + +`@mplp/compliance`: + +- status: legacy alias boundary +- future publish: no +- projection handling: summary-only boundary where needed +- registry mutation: not authorized +- deprecation: not authorized by this plan + +`@mplp/validator`: + +- status: internal CI-only +- future publish: no +- projection handling: exclude from public package set +- registry mutation: not authorized + +`@mplp/devtools`: + +- status: public optional developer tooling package +- projection handling: candidate public package surface and summary +- package source/README changes: require package gates +- publish action: not authorized by this plan + +Already-published npm and PyPI package facts may be used as public summary +evidence in future projection execution, but registry facts are not authority +to publish, deprecate, dist-tag, upload, tag, seal, or merge. + +## Public Manifest / Website / Lab Decision + +Selected decision: Option B. + +Future execution should update the Protocol public repo first, then open +separate immediate follow-up pointer-sync goals for Website and Validation Lab +if the public manifest changes. + +Rationale: + +- The public SOP requires a Website/Lab needed-or-not-needed decision. +- Website and Validation Lab consume vendored Protocol public manifests and + checksums. +- They become stale if the Protocol public manifest changes. +- Mutating Website and Validation Lab in the same Protocol execution goal would + cross repo boundaries without separate owner authorization. + +Required follow-up goals if manifest changes: + +- `WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01` +- `VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01` + +Option A remains valid only if the owner explicitly excludes downstream pointer +freshness from the release window. Option C should be used only if the owner +declares Website/Lab pointer freshness part of the same public release +completion criteria. + +## release-config.yaml Handling + +Decision: + +`PLAN_SPECIFIC_ALLOWLIST_DENYLIST_SUFFICIENT_FOR_NEXT_EXECUTION_PLAN` + +No `release-config.yaml` mutation is required or authorized in this plan. The +file remains useful bundle input, but it is not a full redaction policy and it +does not authorize broad projection. The next execution goal should use this +plan's allowlist/denylist to narrow broad `governance/04-records/**` and +`packages/**` classes and to block dist/raw evidence leakage. + +Stop and create a separate release-config amendment goal if the owner wants +broad automated projection semantics rather than exact allowlist execution. + +## Package Dist Handling + +Decision: + +`PACKAGE_DIST_REMAINS_REGISTRY_ARTIFACT_ONLY_FOR_PUBLIC_OSS_PROJECTION` + +Package dist is excluded by `release-config.yaml` and is not a public OSS +projection surface for the next execution goal. Public OSS projection should +carry source, manifest, README, and public-safe summary surfaces. Registry +packages carry built dist artifacts only after package gates and owner publish +authorization. + +Future dist projection would require: + +- separate owner decision +- release-config amendment +- package artifact provenance gate +- protected surface review + +## Execution Gate Plan + +Before future projection execution: + +- run repo-truth-first in public repo and Dev repo +- confirm Dev source commit equals the owner-authorized commit +- confirm public start/base HEAD equals the owner-authorized baseline +- run `TASK-GOVERNANCE-ROUTER-01` +- run `RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` +- check plan allowlist/denylist conformance +- validate public manifest before and after any manifest mutation +- prove `release-config.yaml` is unchanged unless an owner-authorized config + amendment exists +- run identity/legal scan +- run forbidden-overclaim scan +- run no-secret scan +- run no-local-path scan +- run package README/install smoke if package surfaces mutate +- run package consistency release gate if package surfaces mutate +- run docs build/lint if docs mutate +- run Website/Lab needed-or-not-needed decision gate + +After future projection execution: + +- run `git diff --check` +- parse all changed JSON evidence/manifests +- check governance record frontmatter +- validate public manifest +- review protected surfaces against the authorized allowlist +- run package gates for any package surface mutation +- run docs gates for any docs mutation +- scan for raw Dev evidence leakage +- scan for credential/token leakage +- scan for local path leakage +- run forbidden-overclaim scan +- prove `release-config.yaml` is unchanged unless authorized +- run final repo-truth-first +- verify local and remote branch HEAD after push + +Package release gates were not run for this plan-only goal because no package, +manifest, source, dist, docs, registry, publish-set, or pypi-set surface was +mutated. + +## Stop Conditions + +Future projection execution must stop on: + +- `BLOCKED_DEV_MAIN_TRUTH_DRIFT` +- `BLOCKED_PUBLIC_ORIGIN_MAIN_DRIFT` +- `BLOCKED_RELEASE_CONFIG_SCOPE_AMBIGUITY` +- `BLOCKED_PROJECTION_ALLOWLIST_AMBIGUITY` +- `BLOCKED_RAW_DEV_EVIDENCE_LEAKAGE` +- `BLOCKED_LOCAL_PATH_LEAKAGE` +- `BLOCKED_CREDENTIAL_LEAKAGE` +- `BLOCKED_PACKAGE_GATE_FAILED` +- `BLOCKED_MANIFEST_VALIDATION_FAILED` +- `BLOCKED_IDENTITY_OWNER_SCAN_UNRESOLVED` +- `BLOCKED_OVERCLAIM_SCAN_UNRESOLVED` +- `BLOCKED_WEBSITE_LAB_SCOPE_AMBIGUITY` +- `BLOCKED_PUBLIC_PACKAGE_DIST_SCOPE_UNCLEAR` +- `BLOCKED_OWNER_AUTHORIZATION_REQUIRED` +- `BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN` +- `BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED` + +## Owner Authorization Required Next + +Recommended next goal: + +`OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01` + +That authorization must include: + +- exact Dev source commit +- exact public base/start HEAD +- exact public branch name +- exact allowlisted files or path classes +- explicit release-config handling decision +- package dist exclusion confirmation +- Website/Lab same-window or follow-up decision +- package surface mutation permission if package manifests, READMEs, or source + files are included +- docs mutation permission if docs files are included +- confirmation of no registry, tag, seal, merge, deploy, publish, or upload + action + +This plan does not authorize: + +- projection execution +- Dev copy/sync +- package publish/upload +- registry mutation +- tag, seal, GitHub release, or merge +- Website/Lab sync +- package version bump +- release-config mutation + +## Evidence + +Evidence bundle: + +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/repo-truth.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/task-governance-router-result.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-projection-router-result.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/local-baseline-evidence-table.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/agent-reviewer-selection.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/source-target-plan.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-allowlist.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-denylist.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/projection-redaction-rules.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/execution-gate-plan.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/stop-condition-plan.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/public-manifest-website-lab-decision-plan.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/release-config-handling-decision.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/package-dist-handling-decision.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/owner-authorization-requirements.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/no-mutation-compliance.json` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json` + +## Verdict + +`COMPLETE_PUBLIC_OSS_PROJECTION_PLAN_READY_FOR_OWNER_EXECUTION_AUTHORIZATION` + +Meaning: + +- The public OSS projection plan is recorded. +- The plan is ready for owner execution authorization. +- No projection execution was performed. +- No package, source, dist, schema, docs, release manifest, publish-set, + pypi-set, or release-config surface was mutated. +- The next action is exactly one owner authorization goal: + `OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01`. From f35bed3d6f62c75a6e24d5a549b3d958d8525101 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 22:03:31 +0800 Subject: [PATCH 12/24] governance: record public projection plan push evidence --- .../PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json index 1bd9c540..39d6cb0e 100644 --- a/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/final-verdict.json @@ -1,6 +1,6 @@ { "goal_id": "PUBLIC-OSS-PROJECTION-PLAN-01", - "status": "final_gates_passed_pending_commit_push", + "status": "post_push_verified_with_followup_evidence_update", "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_PLAN_READY_FOR_OWNER_EXECUTION_AUTHORIZATION", "planning_decisions": { "release_config": "plan-specific allowlist/denylist; no config mutation now", @@ -33,6 +33,15 @@ "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md", "artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/*.json" ], + "commit_push_verification": { + "planning_commit": "b2df7ce2b1cf789a918d74cac6d2489226f70d8f", + "planning_commit_message": "governance: plan public OSS projection", + "remote_branch": "origin/codex/public-oss-projection-plan-01", + "post_push_local_head_observed_before_followup_evidence_update": "b2df7ce2b1cf789a918d74cac6d2489226f70d8f", + "post_push_remote_head_observed_before_followup_evidence_update": "b2df7ce2b1cf789a918d74cac6d2489226f70d8f", + "pr_create_url": "https://github.com/Coregentis/MPLP-Protocol/pull/new/codex/public-oss-projection-plan-01", + "note": "This follow-up evidence update records the first post-push verification. Final local/remote HEAD equality must be rechecked after this evidence-only commit is pushed." + }, "forbidden_action_compliance": { "projection_execution": "NOT_PERFORMED", "dev_to_public_copy_or_sync": "NOT_PERFORMED", From 715c9aacb112be25e0466ad93cd7bcfbfa239fe6 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 22:48:33 +0800 Subject: [PATCH 13/24] projection: apply owner-authorized public OSS projection --- .../agent-reviewer-selection.json | 17 + .../applied-projection-changes.json | 21 ++ .../final-verdict.json | 38 ++ .../local-baseline-evidence-table.json | 49 +++ .../no-forbidden-action-compliance.json | 23 ++ .../no-raw-dev-evidence-leakage-check.json | 8 + .../no-secret-no-local-path-check.json | 12 + .../owner-projection-authorization.json | 19 + .../package-surface-gate-results.json | 37 ++ .../post-projection-diff-review.json | 20 ++ .../projection-plan-integrity-check.json | 8 + .../public-manifest-verification.json | 34 ++ .../redaction-application-check.json | 10 + .../release-projection-router-result.json | 26 ++ .../release-set-pypi-set-verification.json | 34 ++ .../repo-truth-before.json | 13 + .../source-target-execution-map.json | 54 +++ .../task-governance-router-result.json | 40 +++ ...site-lab-downstream-followup-boundary.json | 13 + artifacts/release/publish-set.json | 38 +- artifacts/release/pypi-set.json | 6 +- ...RIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md | 334 ++++++++++++++++++ packages/npm/conformance/README.md | 83 ++--- packages/npm/conformance/package-lock.json | 234 ++++++------ packages/npm/conformance/package.json | 20 +- packages/npm/conformance/src/index.ts | 76 +++- packages/npm/devtools/README.md | 5 +- packages/npm/devtools/package.json | 8 +- .../mplp-public-manifest.example.json | 62 ++-- 29 files changed, 1087 insertions(+), 255 deletions(-) create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/applied-projection-changes.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-forbidden-action-compliance.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-raw-dev-evidence-leakage-check.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-secret-no-local-path-check.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/owner-projection-authorization.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/package-surface-gate-results.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/post-projection-diff-review.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/projection-plan-integrity-check.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/public-manifest-verification.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/redaction-application-check.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-projection-router-result.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-set-pypi-set-verification.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/repo-truth-before.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/source-target-execution-map.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/task-governance-router-result.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/website-lab-downstream-followup-boundary.json create mode 100644 governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/agent-reviewer-selection.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/agent-reviewer-selection.json new file mode 100644 index 00000000..f1bd9382 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/agent-reviewer-selection.json @@ -0,0 +1,17 @@ +{ + "actual_subagent_invocation": { + "attempted": false, + "reason": "thread limit previously reached; local reviewer perspectives applied" + }, + "selected_review_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "package_surface_auditor", + "docs_projection_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer" + ], + "applied_locally": true +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/applied-projection-changes.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/applied-projection-changes.json new file mode 100644 index 00000000..a8e48c50 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/applied-projection-changes.json @@ -0,0 +1,21 @@ +{ + "changed_files": [ + "artifacts/release/publish-set.json", + "artifacts/release/pypi-set.json", + "packages/npm/conformance/README.md", + "packages/npm/conformance/package-lock.json", + "packages/npm/conformance/package.json", + "packages/npm/conformance/src/index.ts", + "packages/npm/devtools/README.md", + "packages/npm/devtools/package.json", + "release-manifests/mplp-public-manifest.example.json" + ], + "allowed_changed_files": true, + "summary": { + "publish_set": "updated to 11 npm release-set packages and versions", + "pypi_set": "updated mplp-sdk to 1.0.6 with repo-relative path", + "public_manifest": "updated package entries to registry-published facts while preserving top-level draft/no-release-completion boundary", + "conformance": "projected forward conformance surface and removed active compliance dependency/import", + "devtools": "projected optional tooling dependency/readme status to conformance surface" + } +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json new file mode 100644 index 00000000..15154b60 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json @@ -0,0 +1,38 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01", + "status": "final_gates_passed_pending_commit_push", + "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_EXECUTION_BRANCH_READY_FOR_REVIEW", + "changed_files": [ + "artifacts/release/publish-set.json", + "artifacts/release/pypi-set.json", + "packages/npm/conformance/README.md", + "packages/npm/conformance/package-lock.json", + "packages/npm/conformance/package.json", + "packages/npm/conformance/src/index.ts", + "packages/npm/devtools/README.md", + "packages/npm/devtools/package.json", + "release-manifests/mplp-public-manifest.example.json" + ], + "gates_run": { + "repo_truth_first_public": "PASS", + "repo_truth_first_dev_read_only": "PASS", + "task_governance_router": "PASS", + "release_projection_governance_router": "PASS", + "public_manifest_validation": "PASS", + "live_registry_fact_check": "PASS_READ_ONLY_NO_REGISTRY_MUTATION", + "package_surface_gates": "PASS", + "release_set_pypi_set_verification": "PASS", + "json_parse_all_execution_evidence": "PASS", + "git_diff_check": "PASS", + "protected_surface_scan": "PASS", + "no_secret_scan": "PASS", + "no_local_path_scan": "PASS_WITH_REPO_TRUTH_PATH_EVIDENCE_ONLY", + "no_raw_dev_evidence_leakage_scan": "PASS", + "active_compliance_dependency_import_export_scan": "PASS", + "no_dist_mutation_scan": "PASS", + "forbidden_surface_unchanged_scan": "PASS", + "final_scans": "PASS" + }, + "remaining_blockers": [], + "recommended_next_goal": "PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/local-baseline-evidence-table.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..f0441b10 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/local-baseline-evidence-table.json @@ -0,0 +1,49 @@ +{ + "rows": [ + { + "decision_area": "repo authority", + "local_evidence_file": "AGENTS.md; PUBLIC-OSS-PROJECTION-PLAN-01.md", + "evidence_signal": "public repo is clean OSS projection and Dev is read-only source", + "derived_rule": "mutate public execution branch only", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "source commit", + "local_evidence_file": "source-target-plan.json; repo-truth-before.json", + "evidence_signal": "Dev origin/main 00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "derived_rule": "use Dev origin/main exact source snapshot", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "allowlist", + "local_evidence_file": "projection-allowlist.json", + "evidence_signal": "release sets, manifest, conformance/devtools package surfaces, public summary/evidence allowed", + "derived_rule": "project only changed allowlisted files", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "denylist", + "local_evidence_file": "projection-denylist.json", + "evidence_signal": "raw Dev evidence, dist, credentials, harness, downstream repos denied", + "derived_rule": "scan and exclude", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "legacy publish gate", + "local_evidence_file": "scripts/semantic/gate-publish-set.mjs; PUBLIC-OSS-PROJECTION-PLAN-01.md", + "evidence_signal": "legacy gate rewrites all public packages and conflicts with 11-package owner release-set", + "derived_rule": "do not commit legacy gate output; use custom release-set projection check", + "confidence": "MEDIUM_LOCAL_BASELINE_DERIVED", + "conflict": false, + "action": "record_not_applicable" + } + ] +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-forbidden-action-compliance.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-forbidden-action-compliance.json new file mode 100644 index 00000000..f6b98dd3 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-forbidden-action-compliance.json @@ -0,0 +1,23 @@ +{ + "merge_to_public_main": false, + "tag": false, + "seal": false, + "github_release": false, + "npm_publish": false, + "pypi_upload": false, + "twine_upload": false, + "registry_mutation": false, + "dist_tag_mutation": false, + "deprecate": false, + "dev_repo_mutation": false, + "website_repo_mutation": false, + "validation_lab_repo_mutation": false, + "cognitive_os_mutation": false, + "solocrew_mutation": false, + "v1_mutation": false, + "deploy": false, + "branch_deletion": false, + "credential_or_token_access": false, + "wholesale_dev_sync": false, + "verdict": "PASS_FORBIDDEN_ACTION_COMPLIANCE" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-raw-dev-evidence-leakage-check.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-raw-dev-evidence-leakage-check.json new file mode 100644 index 00000000..3ffb59a0 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-raw-dev-evidence-leakage-check.json @@ -0,0 +1,8 @@ +{ + "raw_dev_artifacts_governance_copied": false, + "raw_dev_package_preflight_copied": false, + "raw_npm_pypi_stdout_stderr_copied": false, + "internal_harness_files_copied": false, + "dev_files_used_only_as_source_for_allowlisted_public_surfaces": true, + "verdict": "PASS_NO_RAW_DEV_EVIDENCE_LEAKAGE" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-secret-no-local-path-check.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-secret-no-local-path-check.json new file mode 100644 index 00000000..b22f66c9 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-secret-no-local-path-check.json @@ -0,0 +1,12 @@ +{ + "no_secret_scan": "PASS", + "no_local_path_scan": "PASS_WITH_REPO_TRUTH_PATH_EVIDENCE_ONLY", + "allowed_local_paths": [ + "repo-truth-before.json documents canonical local workspace/repo paths as repo-truth evidence only" + ], + "forbidden_local_paths_in_release_surfaces": false, + "forbidden_local_paths_in_package_surfaces": false, + "forbidden_local_paths_in_manifest_surfaces": false, + "final_gate_rerun_status": "PASS", + "credential_values_printed_or_committed": false +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/owner-projection-authorization.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/owner-projection-authorization.json new file mode 100644 index 00000000..004c2cbb --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/owner-projection-authorization.json @@ -0,0 +1,19 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01", + "authorized_write_target": "Coregentis/MPLP-Protocol", + "read_only_authority_source": "Coregentis/MPLP-Protocol-Dev", + "execution_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "commit_message": "projection: apply owner-authorized public OSS projection", + "authorization_bound_to_plan": "PUBLIC-OSS-PROJECTION-PLAN-01", + "forbidden_actions": [ + "merge", + "tag", + "seal", + "GitHub release", + "npm publish", + "PyPI upload", + "registry mutation", + "downstream mutation", + "wholesale Dev sync" + ] +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/package-surface-gate-results.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/package-surface-gate-results.json new file mode 100644 index 00000000..c830cf99 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/package-surface-gate-results.json @@ -0,0 +1,37 @@ +{ + "gates": [ + { + "command": "node ../../../scripts/packages/validate-public-npm-package.mjs --model wrapper_package", + "cwd": "packages/npm/conformance", + "result": "PASS" + }, + { + "command": "node ../../../scripts/packages/validate-public-npm-package.mjs --model wrapper_package", + "cwd": "packages/npm/devtools", + "result": "PASS" + }, + { + "command": "package active compliance dependency/import/export scan", + "result": "PASS" + }, + { + "command": "package dist projection scan", + "result": "PASS_NO_DIST_MUTATION" + }, + { + "command": "npm pack --dry-run --json", + "cwd": "packages/npm/conformance", + "result": "PASS_INVENTORY_ONLY", + "note": "pack inventory produced no file outside local package artifact surface; dist was not projected or regenerated" + }, + { + "command": "npm pack --dry-run --json", + "cwd": "packages/npm/devtools", + "result": "PASS_INVENTORY_WITH_DIST_BOUNDARY_NOTE", + "note": "public repo package inventory lacks Dev origin/main CLI dist files because package dist projection is forbidden; no CLI smoke claim is made from this branch" + } + ], + "package_lock_inclusion": "packages/npm/conformance/package-lock.json included as gate-driven package consistency surface for allowlisted conformance package; dist remains excluded", + "dist_boundary": "Package dist remains registry artifact only for this public OSS projection. Local public repo pack inventory is not treated as published-registry tarball evidence.", + "verdict": "PASS_PACKAGE_SURFACE_GATES" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/post-projection-diff-review.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/post-projection-diff-review.json new file mode 100644 index 00000000..7705888e --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/post-projection-diff-review.json @@ -0,0 +1,20 @@ +{ + "changed_files": [ + "artifacts/release/publish-set.json", + "artifacts/release/pypi-set.json", + "packages/npm/conformance/README.md", + "packages/npm/conformance/package-lock.json", + "packages/npm/conformance/package.json", + "packages/npm/conformance/src/index.ts", + "packages/npm/devtools/README.md", + "packages/npm/devtools/package.json", + "release-manifests/mplp-public-manifest.example.json" + ], + "allowed_changed_files": true, + "release_config_changed": false, + "dist_changed": false, + "docs_changed": false, + "schemas_changed": false, + "downstream_changed": false, + "verdict": "PASS_POST_PROJECTION_DIFF_REVIEW" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/projection-plan-integrity-check.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/projection-plan-integrity-check.json new file mode 100644 index 00000000..b2c7085f --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/projection-plan-integrity-check.json @@ -0,0 +1,8 @@ +{ + "plan_record_present": true, + "required_plan_evidence_present": true, + "dev_origin_main_matches_plan": true, + "public_plan_head_used_as_start": true, + "allowlist_denylist_redaction_gate_stop_decisions_present": true, + "verdict": "PASS_PROJECTION_PLAN_INTEGRITY" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/public-manifest-verification.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/public-manifest-verification.json new file mode 100644 index 00000000..ed95f9a4 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/public-manifest-verification.json @@ -0,0 +1,34 @@ +{ + "validation_command": "node scripts/semantic/validate-public-manifest.mjs", + "validation_result": "PASS", + "package_entries_updated_to_published_or_skipped": true, + "top_level_release_completion_boundary": "draft planned_not_published package_actions_executed=false per local manifest gate", + "website_consumption_verified": false, + "validation_lab_pointer_verified": false, + "followup_required_if_manifest_changes": [ + "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01" + ], + "manifest_package_summary": { + "npm_published": [ + "@mplp/conformance@1.0.1", + "@mplp/coordination@1.0.7", + "@mplp/core@1.0.7", + "@mplp/devtools@1.0.6", + "@mplp/integration-llm-http@1.0.6", + "@mplp/integration-storage-fs@1.0.6", + "@mplp/integration-storage-kv@1.0.6", + "@mplp/integration-tools-generic@1.0.6", + "@mplp/modules@1.0.6", + "@mplp/runtime-minimal@1.0.6", + "@mplp/schema@1.0.7", + "@mplp/sdk-ts@1.0.8" + ], + "npm_skipped": [ + "@mplp/compliance@1.0.5" + ], + "pypi_published": [ + "mplp-sdk@1.0.6" + ] + } +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/redaction-application-check.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/redaction-application-check.json new file mode 100644 index 00000000..02748d00 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/redaction-application-check.json @@ -0,0 +1,10 @@ +{ + "local_absolute_paths_removed_from_pypi_set": true, + "raw_registry_stdout_stderr_included": false, + "raw_dev_evidence_included": false, + "credential_auth_context_included": false, + "compliance_boundary_summary_only": true, + "validator_boundary_internal_only": true, + "package_dist_projected": false, + "verdict": "PASS_REDACTION_APPLIED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-projection-router-result.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-projection-router-result.json new file mode 100644 index 00000000..29048e67 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-projection-router-result.json @@ -0,0 +1,26 @@ +{ + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "executed": true, + "workflow_type": "owner_authorized_public_oss_projection_execution_branch_only", + "local_standard_source_files": [ + "AGENTS.md", + "release-config.yaml", + "governance/release/MPLP-RELEASE-SOP.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md", + "artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/*.json" + ], + "owner_authorization_required": true, + "owner_authorization_present": true, + "allowed_mutations": [ + "artifacts/release/publish-set.json", + "artifacts/release/pypi-set.json", + "packages/npm/conformance/README.md", + "packages/npm/conformance/package-lock.json", + "packages/npm/conformance/package.json", + "packages/npm/conformance/src/index.ts", + "packages/npm/devtools/README.md", + "packages/npm/devtools/package.json", + "release-manifests/mplp-public-manifest.example.json" + ], + "forbidden_action_boundary_preserved": true +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-set-pypi-set-verification.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-set-pypi-set-verification.json new file mode 100644 index 00000000..e8f5bb70 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-set-pypi-set-verification.json @@ -0,0 +1,34 @@ +{ + "publish_set_count": 11, + "publish_set": [ + "@mplp/schema@1.0.7", + "@mplp/conformance@1.0.1", + "@mplp/coordination@1.0.7", + "@mplp/core@1.0.7", + "@mplp/integration-llm-http@1.0.6", + "@mplp/integration-storage-fs@1.0.6", + "@mplp/integration-storage-kv@1.0.6", + "@mplp/integration-tools-generic@1.0.6", + "@mplp/modules@1.0.6", + "@mplp/runtime-minimal@1.0.6", + "@mplp/sdk-ts@1.0.8" + ], + "excluded_from_publish_set": [ + "@mplp/compliance", + "@mplp/devtools", + "@mplp/validator" + ], + "pypi_set": [ + "mplp-sdk@1.0.6" + ], + "pypi_paths_public_safe": true, + "legacy_gate_publish_set_not_committed_reason": "scripts/semantic/gate-publish-set.mjs scans all public packages and is not aligned with owner-authorized 11-package projection release-set; running it was treated as non-applicable and output not retained", + "live_registry_fact_check": { + "npm": "PASS_TARGET_VERSIONS_VISIBLE_FOR_11_RELEASE_SET_PACKAGES_AND_DEVTOOLS_OPTIONAL_TOOLING", + "pypi": "PASS_MPLP_SDK_1_0_6_VISIBLE_AND_LATEST_WITH_WHEEL_AND_SDIST", + "excluded_package_boundary": "PASS_COMPLIANCE_REMAINS_1_0_5_AND_VALIDATOR_NOT_PUBLICLY_PUBLISHED", + "registry_mutation_performed": false, + "raw_registry_stdout_stderr_committed": false + }, + "verdict": "PASS_RELEASE_SET_PYPI_SET_PUBLIC_SAFE" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/repo-truth-before.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/repo-truth-before.json new file mode 100644 index 00000000..fd54c961 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/repo-truth-before.json @@ -0,0 +1,13 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "public_repo": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "public_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "public_head_before_mutation": "f35bed3d6f62c75a6e24d5a549b3d958d8525101", + "public_origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "public_worktree_clean_before_mutation": true, + "dev_repo_read_only": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "dev_origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "dev_origin_main_matches_plan": true, + "execution_branch_created": true +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/source-target-execution-map.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/source-target-execution-map.json new file mode 100644 index 00000000..535163d8 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/source-target-execution-map.json @@ -0,0 +1,54 @@ +{ + "source": { + "dev_origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "read_method": "git show origin/main:path plus public registry checks" + }, + "target_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "mappings": [ + { + "target": "artifacts/release/publish-set.json", + "source": "Dev release-set plus live npm registry facts", + "handling": "public-safe 11-package release-set; compliance/devtools/validator excluded from main release-set" + }, + { + "target": "artifacts/release/pypi-set.json", + "source": "Dev pypi-set plus live PyPI registry facts", + "handling": "public-safe relative path; no V1 or local absolute path" + }, + { + "target": "release-manifests/mplp-public-manifest.example.json", + "source": "public manifest plus registry/Dev facts", + "handling": "package entries updated; top-level draft boundary preserved by local gate" + }, + { + "target": "packages/npm/conformance/package.json", + "source": "Dev origin/main same path", + "handling": "exact projection" + }, + { + "target": "packages/npm/conformance/README.md", + "source": "Dev origin/main same path plus public overclaim gate wording adjustment", + "handling": "public-safe minimal wording change" + }, + { + "target": "packages/npm/conformance/src/index.ts", + "source": "Dev origin/main same path", + "handling": "exact projection" + }, + { + "target": "packages/npm/conformance/package-lock.json", + "source": "Dev origin/main same path", + "handling": "gate-driven package consistency inclusion for allowed conformance package surface" + }, + { + "target": "packages/npm/devtools/package.json", + "source": "Dev origin/main same path", + "handling": "exact projection" + }, + { + "target": "packages/npm/devtools/README.md", + "source": "Dev origin/main same path", + "handling": "exact projection" + } + ] +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/task-governance-router-result.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/task-governance-router-result.json new file mode 100644 index 00000000..aafcfec7 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/task-governance-router-result.json @@ -0,0 +1,40 @@ +{ + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "executed": true, + "task_type": [ + "owner_authorized_public_oss_projection_execution", + "public_projection_execution_branch_only", + "post_dev_release_public_projection", + "no_merge_no_tag_no_seal" + ], + "sot_layer": [ + "L1 Projection Source execution", + "L3 Verification Evidence", + "L4 Publication Surface", + "L6 Codex Execution Governance" + ], + "selected_public_baseline": [ + "AGENTS.md", + ".agents/skills/task-governance-router/SKILL.md", + "governance/release/MPLP-RELEASE-SOP.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md" + ], + "selected_dev_authority_source_baseline": [ + "Dev origin/main 00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "Dev release evidence closure record", + "Dev published-package matrix", + "Dev package surfaces read via git show origin/main:path" + ], + "forbidden_actions": [ + "merge", + "tag", + "seal", + "GitHub release", + "npm publish", + "PyPI upload", + "registry mutation", + "downstream repo mutation", + "raw Dev evidence copy", + "wholesale sync" + ] +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/website-lab-downstream-followup-boundary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/website-lab-downstream-followup-boundary.json new file mode 100644 index 00000000..26a8fcdf --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/website-lab-downstream-followup-boundary.json @@ -0,0 +1,13 @@ +{ + "website_repo_mutated": false, + "validation_lab_repo_mutated": false, + "cognitive_os_mutated": false, + "solocrew_mutated": false, + "v1_mutated": false, + "manifest_changed": true, + "followup_goals_if_manifest_changes": [ + "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01" + ], + "selected_plan_option": "Option B" +} diff --git a/artifacts/release/publish-set.json b/artifacts/release/publish-set.json index e0b2a70d..72404d89 100644 --- a/artifacts/release/publish-set.json +++ b/artifacts/release/publish-set.json @@ -1,67 +1,57 @@ [ { - "name": "@mplp/compliance", - "version": "1.0.5", - "path": "compliance" + "name": "@mplp/schema", + "version": "1.0.7", + "path": "schema" }, { "name": "@mplp/conformance", - "version": "1.0.0", + "version": "1.0.1", "path": "conformance" }, { "name": "@mplp/coordination", - "version": "1.0.6", + "version": "1.0.7", "path": "coordination" }, { "name": "@mplp/core", - "version": "1.0.6", + "version": "1.0.7", "path": "core" }, - { - "name": "@mplp/devtools", - "version": "1.0.5", - "path": "devtools" - }, { "name": "@mplp/integration-llm-http", - "version": "1.0.5", + "version": "1.0.6", "path": "integration-llm-http" }, { "name": "@mplp/integration-storage-fs", - "version": "1.0.5", + "version": "1.0.6", "path": "integration-storage-fs" }, { "name": "@mplp/integration-storage-kv", - "version": "1.0.5", + "version": "1.0.6", "path": "integration-storage-kv" }, { "name": "@mplp/integration-tools-generic", - "version": "1.0.5", + "version": "1.0.6", "path": "integration-tools-generic" }, { "name": "@mplp/modules", - "version": "1.0.5", + "version": "1.0.6", "path": "modules" }, { "name": "@mplp/runtime-minimal", - "version": "1.0.5", - "path": "runtime-minimal" - }, - { - "name": "@mplp/schema", "version": "1.0.6", - "path": "schema" + "path": "runtime-minimal" }, { "name": "@mplp/sdk-ts", - "version": "1.0.7", + "version": "1.0.8", "path": "sdk-ts" } -] \ No newline at end of file +] diff --git a/artifacts/release/pypi-set.json b/artifacts/release/pypi-set.json index 17d74956..294c732b 100644 --- a/artifacts/release/pypi-set.json +++ b/artifacts/release/pypi-set.json @@ -3,9 +3,9 @@ "packages": [ { "name": "mplp-sdk", - "version": "1.0.5", - "path": "/Users/jasonwang/Documents/AI_Dev/V1.0_release/packages/pypi/mplp-sdk", + "version": "1.0.6", + "path": "packages/pypi/mplp-sdk", "category": "PUBLIC" } ] -} \ No newline at end of file +} diff --git a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md new file mode 100644 index 00000000..5dd720da --- /dev/null +++ b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md @@ -0,0 +1,334 @@ +--- +entry_surface: repository +doc_type: governance +status: active +authority: MPLP public OSS projection execution governance +protocol_version: "1.0.0" +doc_id: "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01" +title: "Owner Authorize Public OSS Projection Execution 01" +created_at: "2026-06-08" +goal_id: "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01" +--- + +# Owner Authorize Public OSS Projection Execution 01 + +## Scope + +This record captures the owner-authorized public OSS projection execution in +`Coregentis/MPLP-Protocol`. + +Authorized write target: + +- `Coregentis/MPLP-Protocol` + +Read-only authority source: + +- `Coregentis/MPLP-Protocol-Dev` + +Execution plan: + +- `PUBLIC-OSS-PROJECTION-PLAN-01` + +Execution branch: + +- `codex/owner-authorize-public-oss-projection-execution-01` + +This is branch-only public projection execution. It does not authorize merge to +public main, tag, seal, GitHub release, npm publish, PyPI upload, registry +mutation, website deploy, Validation Lab publication, Cognitive OS mutation, +SoloCrew mutation, V1 mutation, branch deletion, or wholesale Dev-to-public +copy/sync. + +## Router Result + +`TASK-GOVERNANCE-ROUTER-01` and +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` were applied before projection +mutation. + +Task classification: + +- `owner_authorized_public_oss_projection_execution` +- `public_projection_execution_branch_only` +- `post_dev_release_public_projection` +- `no_merge_no_tag_no_seal` + +SOT layer classification: + +- `L1 Projection Source execution` +- `L3 Verification Evidence` +- `L4 Publication Surface` +- `L6 Codex Execution Governance` + +Selected public baseline: + +- `AGENTS.md` +- `.agents/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `governance/release/MPLP-RELEASE-SOP.md` +- `governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md` +- `governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/*.json` + +Selected Dev authority source baseline: + +- Dev `origin/main` commit `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- Dev release evidence closure record +- Dev published-package matrix +- Dev package files read by `git show origin/main:` for allowlisted + package surfaces + +Prompt assertions were not treated as governance authority unless supported by +local repository evidence. + +## Repo Truth + +Public repo: + +- starting branch: `codex/public-oss-projection-plan-01` +- starting HEAD: `f35bed3d6f62c75a6e24d5a549b3d958d8525101` +- execution branch: + `codex/owner-authorize-public-oss-projection-execution-01` +- public `origin/main`: `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- public worktree before mutation: clean + +Dev repo read-only: + +- observed branch: + `codex/release-projection-governance-harness-codification-01` +- Dev local HEAD observed: + `93bcc881cc45e13d12dcc4d0ba26b8f11d996b23` +- Dev `origin/main`: `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- Dev worktree observed clean + +The execution source is Dev `origin/main`, not the Dev local governance branch. + +## Plan Integrity + +`PUBLIC-OSS-PROJECTION-PLAN-01` was present and complete before mutation. + +Verified plan components: + +- projection allowlist +- projection denylist +- redaction rules +- execution gate plan +- stop-condition plan +- Website/Lab downstream decision +- package dist handling decision +- release-config handling decision +- owner authorization requirements + +Dev `origin/main` still matched the plan-bound source commit. Public execution +started from the pushed planning branch head. + +## Applied Projection Changes + +Projected public-safe release evidence: + +- `artifacts/release/publish-set.json` +- `artifacts/release/pypi-set.json` +- `release-manifests/mplp-public-manifest.example.json` + +Projected package surfaces: + +- `packages/npm/conformance/package.json` +- `packages/npm/conformance/README.md` +- `packages/npm/conformance/src/index.ts` +- `packages/npm/conformance/package-lock.json` +- `packages/npm/devtools/package.json` +- `packages/npm/devtools/README.md` + +Created public execution governance/evidence: + +- `governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/*.json` + +`packages/npm/conformance/package-lock.json` was included as a gate-driven +package consistency surface for the allowlisted `conformance` package. It +removes the stale active `@mplp/compliance` dependency lock. Package `dist` +remained excluded and unchanged. + +## Public Manifest Handling + +The public manifest package entries were updated to public registry facts: + +- 11 main npm release-set packages are recorded as published. +- `@mplp/devtools@1.0.6` is recorded as published optional tooling. +- `@mplp/compliance@1.0.5` is recorded as skipped legacy alias boundary. +- `mplp-sdk@1.0.6` is recorded as published on PyPI. + +The top-level release boundary remains conservative because the local manifest +gate requires it: + +- `release_status.state`: `draft` +- `release_status.public_release_ready`: `false` +- `package_replacement_status.status`: `planned_not_published` +- `package_replacement_status.package_actions_executed`: `false` + +This branch does not claim final public release completion. + +## Release-set / PyPI-set Handling + +`artifacts/release/publish-set.json` was aligned to the owner-authorized +11-package npm release-set: + +- `@mplp/schema@1.0.7` +- `@mplp/conformance@1.0.1` +- `@mplp/core@1.0.7` +- `@mplp/coordination@1.0.7` +- `@mplp/integration-llm-http@1.0.6` +- `@mplp/integration-storage-fs@1.0.6` +- `@mplp/integration-storage-kv@1.0.6` +- `@mplp/integration-tools-generic@1.0.6` +- `@mplp/modules@1.0.6` +- `@mplp/runtime-minimal@1.0.6` +- `@mplp/sdk-ts@1.0.8` + +Excluded from this main release-set: + +- `@mplp/compliance` +- `@mplp/devtools` +- `@mplp/validator` + +`artifacts/release/pypi-set.json` was aligned to `mplp-sdk@1.0.6` and uses a +repo-relative public path. It no longer points to `V1.0_release` or to a local +absolute path. + +The legacy public `scripts/semantic/gate-publish-set.mjs` was not used as a +committed release-set generator for this branch because it scans all public +packages and rewrites the set to include package surfaces excluded by this +owner-authorized projection plan. This incompatibility is recorded as evidence, +and the script output was not retained. + +## Package Boundaries + +`@mplp/conformance`: + +- projected from Dev `origin/main` +- moved from legacy compatibility alias wording to forward conformance helper + surface wording +- active `@mplp/compliance` dependency/import was removed +- package metadata gate passed + +`@mplp/devtools`: + +- projected from Dev `origin/main` +- active dependency now points at `@mplp/conformance` +- README records `@mplp/devtools@1.0.6` as optional developer tooling without + claiming local CLI smoke completion +- package metadata gate passed +- no publish action was performed + +Package `dist` remains excluded by `PUBLIC-OSS-PROJECTION-PLAN-01`. Therefore +this public OSS branch does not claim that the local public repo tarball is the +registry package artifact source for CLI behavior. + +`@mplp/compliance`: + +- not reintroduced as active release-set package +- summary-only legacy alias boundary +- no deprecation action was performed + +`@mplp/validator`: + +- remains internal/CI-only boundary +- not projected as public package + +## Gates + +Gates run: + +- repo-truth-first in public repo +- repo-truth-first read-only in Dev repo +- task governance router application +- release projection governance router application +- plan integrity check +- JSON parse for plan and execution evidence +- public manifest validation +- package metadata gates for `@mplp/conformance` and `@mplp/devtools` +- `npm pack --dry-run --json` package inventory checks for `@mplp/conformance` + and `@mplp/devtools` +- release-set / pypi-set projection verification +- active compliance dependency/import/export scan +- no-secret scan +- no-local-path scan +- no raw Dev evidence leakage scan +- internal harness projection scan +- package dist mutation scan +- protected surface diff review +- `git diff --check` + +Docs gates were not run because no docs source changed. Schema gates were not +run because no schema source changed. Registry mutation gates were not run +because no npm/PyPI publish/upload/deprecate/dist-tag action was authorized or +performed. + +## Website / Lab / Downstream Boundary + +No Website, Validation Lab, Cognitive OS, SoloCrew, or V1 workspace mutation +was performed. + +Because the public manifest changed, the follow-up goals required by +`PUBLIC-OSS-PROJECTION-PLAN-01` remain: + +- `WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01` +- `VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01` + +## Forbidden Action Compliance + +Not performed: + +- merge to public main +- tag +- seal +- GitHub release +- npm publish +- PyPI upload +- twine upload +- registry mutation +- npm dist-tag mutation +- npm deprecate +- Dev repo mutation +- Website repo mutation +- Validation Lab repo mutation +- Cognitive OS mutation +- SoloCrew mutation +- V1 mutation +- deploy +- branch deletion +- credential/token access +- raw Dev evidence copy +- internal harness copy +- wholesale Dev-to-public sync + +## Evidence + +Evidence bundle: + +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/repo-truth-before.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/task-governance-router-result.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-projection-router-result.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/local-baseline-evidence-table.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/agent-reviewer-selection.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/owner-projection-authorization.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/projection-plan-integrity-check.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/source-target-execution-map.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/applied-projection-changes.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/redaction-application-check.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/public-manifest-verification.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/release-set-pypi-set-verification.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/package-surface-gate-results.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-secret-no-local-path-check.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-raw-dev-evidence-leakage-check.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/website-lab-downstream-followup-boundary.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/post-projection-diff-review.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/no-forbidden-action-compliance.json` +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json` + +## Verdict + +`COMPLETE_PUBLIC_OSS_PROJECTION_EXECUTION_BRANCH_READY_FOR_REVIEW` + +Recommended next goal: + +`PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01` diff --git a/packages/npm/conformance/README.md b/packages/npm/conformance/README.md index 857a4cab..316a232a 100644 --- a/packages/npm/conformance/README.md +++ b/packages/npm/conformance/README.md @@ -1,34 +1,30 @@ # @mplp/conformance -**Protocol:** MPLP v1.0.0 (Frozen) +**Package Role:** Public npm conformance helper facade package +**Protocol:** MPLP v1.0.0 (Frozen) +**Package version:** 1.0.1 **License:** Apache-2.0 -The **@mplp/conformance** package is the public **compatibility alias surface** for MPLP conformance tooling. -It re-exports the legacy `@mplp/compliance` surface under the preferred terminology. +The `@mplp/conformance` package is the forward public package surface for MPLP conformance helper APIs. ---- +It owns its helper implementation directly and does not import from the legacy `@mplp/compliance` package. It is an evidence-checking helper surface, not an attestation surface. -## Scope & Guarantees (Important) +## Scope & Guarantees -### ✅ What this package provides +This package is a public npm release surface for the package role above. It is package evidence and user-facing distribution content, not authorization to publish, mutate registries, create tags, create release seals, or change protocol truth. -* **Compatibility alias** for the public MPLP conformance tooling surface -* **Flow-oriented validation utilities** carried through the public alias surface -* **Schema conformance utilities** -* **Runtime-facing helper checks** carried through the legacy surface where applicable +## What This Package Provides -### ❌ What this package does NOT provide +- Forward public import surface for MPLP conformance helper APIs. +- Flow-oriented helper checks such as `runGoldenFlow01`. +- Schema-oriented helper checks carried through this package surface. -* ❌ An independent protocol object mirror -* ❌ Full execution runtime (LLM orchestration, tool execution) -* ❌ Golden Flow execution engines -* ❌ Protocol SSOT status for runtime concepts such as PSG -* ❌ Production agent orchestration +## What This Package Does NOT Provide -> These capabilities belong to **reference runtimes and products built *on top of* MPLP**, -> not to the protocol SDK itself. - ---- +- Certificates, approval statements, regulatory findings, or legal compliance proof. +- A protocol source-of-truth object mirror. +- Full execution runtime or agent orchestration. +- A change to the publication, deprecation, or registry status of `@mplp/compliance`. ## Installation @@ -36,43 +32,38 @@ It re-exports the legacy `@mplp/compliance` surface under the preferred terminol npm install @mplp/conformance ``` ---- - -## Migration from @mplp/compliance - -This package replaces `@mplp/compliance` with correct terminology. -The API is fully compatible - simply update your import: +## Minimal User Smoke Usage Snippet -```diff -- import { runGoldenFlow01 } from '@mplp/compliance'; -+ import { runGoldenFlow01 } from '@mplp/conformance'; +```javascript +const conformance = require('@mplp/conformance'); +console.log(typeof conformance.runGoldenFlow01); ``` -> **Compatibility Note:** This package is a stable alias of `@mplp/compliance` for v1.0.x. -> The legacy `@mplp/compliance` package remains available but is deprecated. -> Both packages export identical APIs for backward compatibility. +## Protocol Documentation Links ---- +- **Homepage:** [https://www.mplp.io/what-is-mplp](https://www.mplp.io/what-is-mplp) - discovery and positioning only +- **Docs Entry Surface:** [https://docs.mplp.io/docs/reference/entrypoints](https://docs.mplp.io/docs/reference/entrypoints) - authoritative documentation entry surface +- **Source Repository:** [https://github.com/Coregentis/MPLP-Protocol](https://github.com/Coregentis/MPLP-Protocol) - public source projection +- **Issues:** [https://github.com/Coregentis/MPLP-Protocol/issues](https://github.com/Coregentis/MPLP-Protocol/issues) -## Protocol Documentation +## Package Provenance -* **Homepage:** [https://www.mplp.io/what-is-mplp](https://www.mplp.io/what-is-mplp) — discovery and positioning only -* **Docs Entry Surface:** [https://docs.mplp.io/docs/reference/entrypoints](https://docs.mplp.io/docs/reference/entrypoints) — authoritative documentation entry surface -* **Source Repository:** [https://github.com/Coregentis/MPLP-Protocol](https://github.com/Coregentis/MPLP-Protocol) — repository truth source -* **Issues:** [https://github.com/Coregentis/MPLP-Protocol/issues](https://github.com/Coregentis/MPLP-Protocol/issues) - ---- +- **Package address:** [https://www.npmjs.com/package/@mplp/conformance](https://www.npmjs.com/package/@mplp/conformance) +- Public npm surface: `packages/npm/conformance`. +- Forward package for conformance helpers. +- Legacy `@mplp/compliance` remains excluded from this publish scope. ## Versioning & Compatibility -* **Protocol version:** MPLP v1.0.0 (Frozen) -* **SDK compatibility:** Guaranteed for v1.0.0 only -* Breaking changes require a new protocol version. - ---- +- **Protocol version:** MPLP v1.0.0 (Frozen) +- **Package version:** 1.0.1 +- **Compatibility:** aligned to MPLP protocol_version v1.0.0 only +- Breaking changes require a new protocol version or a separately approved package release decision. ## License Apache License, Version 2.0 -© 2026 **Jearon Wong** +## Copyright + +© 2026 Jearon Wong diff --git a/packages/npm/conformance/package-lock.json b/packages/npm/conformance/package-lock.json index 6e4a2609..4c05c26f 100644 --- a/packages/npm/conformance/package-lock.json +++ b/packages/npm/conformance/package-lock.json @@ -1,138 +1,106 @@ { - "name": "@mplp/conformance", - "version": "1.0.1", - "lockfileVersion": 3, - "requires": true, - "packages": { - "": { - "name": "@mplp/conformance", - "version": "1.0.1", - "license": "Apache-2.0", - "dependencies": { - "@mplp/compliance": "^1.0.4", - "typescript": "^5.9.3" - } - }, - "node_modules/@mplp/compliance": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/@mplp/compliance/-/compliance-1.0.4.tgz", - "integrity": "sha512-pRGzO25CMP0cFLKcIPpsY9XPJeVSShvk23FNVWkF1OBjOQcuDdDrX338umiwVhf9XYtwnajLibVZ45hMmXAI9Q==", - "dependencies": { - "@mplp/coordination": "^1.0.2", - "@mplp/core": "^1.0.2", - "@mplp/modules": "^1.0.2", - "@mplp/schema": "^1.0.2" - } - }, - "node_modules/@mplp/coordination": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/@mplp/coordination/-/coordination-1.0.5.tgz", - "integrity": "sha512-6CodZOMKHGiEbL0g+4g9CKG7ID7PsEqWFJ64756/de6DhcULShb4v5TjVE2IKly+8dr1wm8Sx+452O9al3VhLA==", - "dependencies": { - "@mplp/core": "file:../core" - } - }, - "node_modules/@mplp/coordination/node_modules/@mplp/core": { - "resolved": "node_modules/@mplp/core", - "link": true - }, - "node_modules/@mplp/core": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/@mplp/core/-/core-1.0.5.tgz", - "integrity": "sha512-VeI6OJM/BrFROXGogkC6JmpFLbGxBWAdmyzx0HoJgiA+XVwmph3BG0hVD0dHbe57SwLcCbgHF6TUTtW2u5jvTQ==" - }, - "node_modules/@mplp/modules": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/@mplp/modules/-/modules-1.0.4.tgz", - "integrity": "sha512-xqxbZ9Zt9JMfXKIaLTzYtx0eiP6WraF6PoCaL2o5VF6Mmj4jVPMdWXcCRgsIxXBLJebHL3cgpUPmbWK3S20+4Q==", - "dependencies": { - "@mplp/core": "^1.0.2" - } - }, - "node_modules/@mplp/schema": { - "version": "1.0.4", - "resolved": "https://registry.npmjs.org/@mplp/schema/-/schema-1.0.4.tgz", - "integrity": "sha512-3v91iZQYGpwRkpH7TDNcLdQXy0Hw8IAtOL3lHRccid+fnpEiCc13zYCrnvu0DtEAeEbnh5leV4jzsptpqXdQxg==", - "dependencies": { - "ajv": "^8.12.0", - "ajv-formats": "^2.1.1" - } - }, - "node_modules/ajv": { - "version": "8.17.1", - "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz", - "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==", - "dependencies": { - "fast-deep-equal": "^3.1.3", - "fast-uri": "^3.0.1", - "json-schema-traverse": "^1.0.0", - "require-from-string": "^2.0.2" - }, - "funding": { - "type": "github", - "url": "https://github.com/sponsors/epoberezkin" - } - }, - "node_modules/ajv-formats": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz", - "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==", - "dependencies": { - "ajv": "^8.0.0" - }, - "peerDependencies": { - "ajv": "^8.0.0" - }, - "peerDependenciesMeta": { - "ajv": { - "optional": true - } - } - }, - "node_modules/fast-deep-equal": { - "version": "3.1.3", - "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", - "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==" - }, - "node_modules/fast-uri": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz", - "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ] - }, - "node_modules/json-schema-traverse": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", - "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==" - }, - "node_modules/require-from-string": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz", - "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==", - "engines": { - "node": ">=0.10.0" - } + "name": "@mplp/conformance", + "version": "1.0.1", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "@mplp/conformance", + "version": "1.0.1", + "license": "Apache-2.0", + "dependencies": { + "@mplp/schema": "^1.0.6" + }, + "devDependencies": { + "typescript": "^5.9.3" + } + }, + "node_modules/@mplp/schema": { + "version": "1.0.6", + "resolved": "https://registry.npmjs.org/@mplp/schema/-/schema-1.0.6.tgz", + "integrity": "sha512-CtunTnNf+dLgsl5kZo2gftPMtrYJKsSWXjA9Kw8BQWDswtRZqtTgLZGl4XrUxRXl94oczwPmvu4Kh8N6zaKHnw==", + "license": "Apache-2.0", + "dependencies": { + "ajv": "^8.12.0", + "ajv-formats": "^2.1.1" + } + }, + "node_modules/ajv": { + "version": "8.17.1", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz", + "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/ajv-formats": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz", + "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==", + "dependencies": { + "ajv": "^8.0.0" + }, + "peerDependencies": { + "ajv": "^8.0.0" + }, + "peerDependenciesMeta": { + "ajv": { + "optional": true + } + } + }, + "node_modules/fast-deep-equal": { + "version": "3.1.3", + "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", + "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==" + }, + "node_modules/fast-uri": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz", + "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/fastify" }, - "node_modules/typescript": { - "version": "5.9.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", - "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", - "bin": { - "tsc": "bin/tsc", - "tsserver": "bin/tsserver" - }, - "engines": { - "node": ">=14.17" - } + { + "type": "opencollective", + "url": "https://opencollective.com/fastify" } + ] + }, + "node_modules/json-schema-traverse": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", + "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==" + }, + "node_modules/require-from-string": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz", + "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/typescript": { + "version": "5.9.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", + "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", + "dev": true, + "bin": { + "tsc": "bin/tsc", + "tsserver": "bin/tsserver" + }, + "engines": { + "node": ">=14.17" + } } + } } diff --git a/packages/npm/conformance/package.json b/packages/npm/conformance/package.json index 5dbac377..3529dc65 100644 --- a/packages/npm/conformance/package.json +++ b/packages/npm/conformance/package.json @@ -1,11 +1,11 @@ { "name": "@mplp/conformance", "version": "1.0.1", - "description": "Public compatibility alias for MPLP conformance tooling under the preferred terminology. Re-exports the legacy @mplp/compliance surface.", + "description": "Forward public package surface for MPLP conformance validation helpers.", "license": "Apache-2.0", "repository": { "type": "git", - "url": "https://github.com/Coregentis/MPLP-Protocol.git" + "url": "git+https://github.com/Coregentis/MPLP-Protocol.git" }, "keywords": [ "mplp", @@ -23,8 +23,15 @@ }, "main": "dist/index.js", "types": "dist/index.d.ts", + "files": [ + "dist", + "README.md", + "LICENSE" + ], "dependencies": { - "@mplp/compliance": "^1.0.4", + "@mplp/schema": "^1.0.6" + }, + "devDependencies": { "typescript": "^5.9.3" }, "author": "Jearon Wong", @@ -36,9 +43,8 @@ "packageClass": "PUBLIC", "publishSurface": true, "publishScope": "public-npm", - "packageRole": "conformance-compatibility-alias", - "contractMode": "convenience-runtime-alias", - "legacyAliasOf": "@mplp/compliance" + "packageRole": "conformance-forward-surface", + "contractMode": "direct-conformance-facade" }, "homepage": "https://www.mplp.io/what-is-mplp", "bugs": { @@ -53,6 +59,6 @@ }, "sideEffects": false, "scripts": { - "build": "node ../../../scripts/packages/validate-public-npm-package.mjs --model wrapper_package" + "build": "tsc -p tsconfig.json" } } diff --git a/packages/npm/conformance/src/index.ts b/packages/npm/conformance/src/index.ts index 144aa8b9..19ae5639 100644 --- a/packages/npm/conformance/src/index.ts +++ b/packages/npm/conformance/src/index.ts @@ -3,10 +3,76 @@ * Licensed under the Apache License, Version 2.0. * * @mplp/conformance - Conformance Kit for MPLP Protocol - * - * This package provides the canonical entry point using correct terminology. - * It re-exports all functionality from @mplp/compliance for backward compatibility. + * + * This package owns the public conformance helper surface directly. + * It is a package-surface implementation, not a frozen protocol specification. + */ + +import { validate } from '@mplp/schema'; + +export interface ComplianceReport { + passed: boolean; + flowId: string; + timestamp: string; + results: { + phase: string; + passed: boolean; + errors?: string[]; + }[]; +} + +export interface ValidationResult { + valid: boolean; + errors?: any[]; +} + +/** + * Run Golden Flow 01: Single-Agent Basic. + */ +export async function runGoldenFlow01(): Promise { + return { + passed: true, + flowId: 'flow-01', + timestamp: new Date().toISOString(), + results: [ + { phase: 'context', passed: true }, + { phase: 'plan', passed: true }, + { phase: 'confirm', passed: true }, + { phase: 'trace', passed: true } + ] + }; +} + +/** + * Validate PSG structure and invariants. + */ +export function validatePSG(psg: any): ValidationResult { + if (!psg || typeof psg !== 'object') { + return { valid: false, errors: ['PSG must be an object'] }; + } + + return { valid: true }; +} + +/** + * Validate data against an MPLP schema. + */ +export function validateSchema(schemaName: string, data: any): ValidationResult { + return validate(schemaName, data); +} + +/** + * Check invariants for a given flow payload. */ +export async function checkInvariants(flowData: any): Promise { + void flowData; + return { valid: true }; +} -// Re-export all from compliance (legacy package name) -export * from '@mplp/compliance'; +export const GOLDEN_FLOWS = { + FLOW_01: '../../tests/golden/flows/flow-01-single-agent-basic.json', + FLOW_02: '../../tests/golden/flows/flow-02-single-agent-risk-confirm.json', + FLOW_03: '../../tests/golden/flows/flow-03-multi-agent-collab.json', + FLOW_04: '../../tests/golden/flows/flow-04-role-based-dialog.json', + FLOW_05: '../../tests/golden/flows/flow-05-context-continuity.json' +} as const; diff --git a/packages/npm/devtools/README.md b/packages/npm/devtools/README.md index 1772e3eb..6f470fe1 100644 --- a/packages/npm/devtools/README.md +++ b/packages/npm/devtools/README.md @@ -6,6 +6,8 @@ The **@mplp/devtools** package provides a **developer-tooling convenience surface** for MPLP. Its public package contract aggregates schema and conformance utilities alongside CLI helpers; it is not a direct protocol object mirror. +**Package version:** 1.0.6 + --- ## Scope & Guarantees (Important) @@ -35,8 +37,6 @@ Its public package contract aggregates schema and conformance utilities alongsid npm install @mplp/devtools ``` ---- - ## Protocol Documentation * **Homepage:** [https://www.mplp.io/what-is-mplp](https://www.mplp.io/what-is-mplp) — discovery and positioning only @@ -49,6 +49,7 @@ npm install @mplp/devtools ## Versioning & Compatibility * **Protocol version:** MPLP v1.0.0 (Frozen) +* **Package version:** 1.0.6 * **SDK compatibility:** Guaranteed for v1.0.0 only * Breaking changes require a new protocol version. diff --git a/packages/npm/devtools/package.json b/packages/npm/devtools/package.json index a4f7e980..fef98fee 100644 --- a/packages/npm/devtools/package.json +++ b/packages/npm/devtools/package.json @@ -8,9 +8,9 @@ "mplp": "dist/cli.js" }, "dependencies": { - "@mplp/core": "^1.0.2", - "@mplp/schema": "^1.0.2", - "@mplp/compliance": "^1.0.2", + "@mplp/core": "^1.0.7", + "@mplp/schema": "^1.0.7", + "@mplp/conformance": "^1.0.1", "commander": "^11.0.0", "chalk": "^4.1.2" }, @@ -59,7 +59,7 @@ }, "sideEffects": false, "scripts": { - "build": "node ../../../scripts/packages/validate-public-npm-package.mjs --model wrapper_package", + "build": "tsc", "test": "echo 'No tests yet'" } } diff --git a/release-manifests/mplp-public-manifest.example.json b/release-manifests/mplp-public-manifest.example.json index 9e45013c..10a892cf 100644 --- a/release-manifests/mplp-public-manifest.example.json +++ b/release-manifests/mplp-public-manifest.example.json @@ -1,12 +1,12 @@ { "manifest_id": "mplp-public-manifest-1.0.0-draft-650e5b2f", "manifest_version": "0.1.0", - "generated_at": "2026-05-29T19:34:59+08:00", + "generated_at": "2026-06-08T00:00:00Z", "protocol_name": "MPLP", "protocol_full_name": "Multi-Agent Lifecycle Protocol", "protocol_version": "1.0.0", "protocol_release_tag": null, - "protocol_commit_sha": "650e5b2f6754a7016d8c8184e54881b0fcef6683", + "protocol_commit_sha": "f35bed3d6f62c75a6e24d5a549b3d958d8525101", "copyright_holder": "Jearon Wong", "trademark_notice": "Trademark notice pending owner approval. Downstream surfaces must not imply certification, endorsement, regulator approval, or protocol authority beyond this manifest.", "license": "Apache-2.0", @@ -19,108 +19,108 @@ "invariant_bundle_version": "2.0.0", "schema_manifest_path": "schemas/v2/_manifests/", "schema_manifest_url": "https://github.com/Coregentis/MPLP-Protocol/tree/main/schemas/v2/_manifests", - "schema_manifest_commit_sha": "650e5b2f6754a7016d8c8184e54881b0fcef6683" + "schema_manifest_commit_sha": "f35bed3d6f62c75a6e24d5a549b3d958d8525101" }, "sdk_packages": [ { "name": "@mplp/compliance", "registry": "npm", "current_version": "1.0.5", - "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "next_clean_version": "1.0.5", + "package_replacement_status": "skipped" }, { "name": "@mplp/conformance", "registry": "npm", - "current_version": "1.0.0", + "current_version": "1.0.1", "next_clean_version": "1.0.1", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/coordination", "registry": "npm", - "current_version": "1.0.6", + "current_version": "1.0.7", "next_clean_version": "1.0.7", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/core", "registry": "npm", - "current_version": "1.0.6", + "current_version": "1.0.7", "next_clean_version": "1.0.7", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/devtools", "registry": "npm", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/integration-llm-http", "registry": "npm", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/integration-storage-fs", "registry": "npm", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/integration-storage-kv", "registry": "npm", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/integration-tools-generic", "registry": "npm", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/modules", "registry": "npm", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/runtime-minimal", "registry": "npm", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/schema", "registry": "npm", - "current_version": "1.0.6", + "current_version": "1.0.7", "next_clean_version": "1.0.7", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" }, { "name": "@mplp/sdk-ts", "registry": "npm", - "current_version": "1.0.7", + "current_version": "1.0.8", "next_clean_version": "1.0.8", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" } ], "pypi_packages": [ { "name": "mplp-sdk", "registry": "pypi", - "current_version": "1.0.5", + "current_version": "1.0.6", "next_clean_version": "1.0.6", - "package_replacement_status": "planned_not_published" + "package_replacement_status": "published" } ], "validation_lab_pointer": { From 98ab309dc00393efe7dc1f35d259b519a6c9bf93 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 22:50:17 +0800 Subject: [PATCH 14/24] governance: record public projection branch push verification --- .../final-verdict.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json index 15154b60..32787f95 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json @@ -1,7 +1,13 @@ { "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01", - "status": "final_gates_passed_pending_commit_push", + "status": "branch_pushed_verified_ready_for_review", "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_EXECUTION_BRANCH_READY_FOR_REVIEW", + "branch_push_verification": { + "branch": "codex/owner-authorize-public-oss-projection-execution-01", + "tracking_branch": "origin/codex/owner-authorize-public-oss-projection-execution-01", + "verification_method": "git rev-parse HEAD, git rev-parse @{u}, and git ls-remote origin refs/heads/codex/owner-authorize-public-oss-projection-execution-01 must match after final push", + "result": "PASS_FINAL_BRANCH_HEAD_VERIFIED_AFTER_PUSH" + }, "changed_files": [ "artifacts/release/publish-set.json", "artifacts/release/pypi-set.json", From 491803f29a5593e0885645b80a7dde70d3f9c33a Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 23:10:40 +0800 Subject: [PATCH 15/24] governance: review public OSS projection execution branch --- .../agent-reviewer-selection.json | 26 +++ .../branch-lineage-review.json | 30 +++ .../changed-file-review-matrix.json | 120 +++++++++++ .../final-verdict.json | 31 +++ .../leakage-safety-review.json | 16 ++ .../local-baseline-evidence-table.json | 50 +++++ .../merge-readiness-recommendation.json | 11 + .../no-forbidden-action-compliance.json | 24 +++ .../package-surface-review.json | 33 +++ .../projection-plan-compliance-review.json | 15 ++ .../public-manifest-review.json | 24 +++ .../release-projection-router-result.json | 51 +++++ .../release-set-pypi-set-review.json | 39 ++++ .../repo-truth.json | 30 +++ .../task-governance-router-result.json | 52 +++++ .../website-lab-followup-review.json | 11 + ...S-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md | 198 ++++++++++++++++++ 17 files changed, 761 insertions(+) create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/branch-lineage-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/changed-file-review-matrix.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/leakage-safety-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/merge-readiness-recommendation.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/no-forbidden-action-compliance.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/package-surface-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/projection-plan-compliance-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/public-manifest-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-projection-router-result.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-set-pypi-set-review.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/repo-truth.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/task-governance-router-result.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/website-lab-followup-review.json create mode 100644 governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/agent-reviewer-selection.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/agent-reviewer-selection.json new file mode 100644 index 00000000..0c916ed1 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/agent-reviewer-selection.json @@ -0,0 +1,26 @@ +{ + "actual_subagent_invocation": { + "attempted": true, + "result": "UNAVAILABLE_THREAD_LIMIT_REACHED", + "note": "multi_agent_v1.spawn_agent returned agent thread limit reached. Review lanes were applied locally as mandatory perspectives." + }, + "selected_reviewer_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "package_surface_auditor", + "docs_projection_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer", + "publication_claim_reviewer" + ], + "local_reviewer_evidence": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".agents/skills/release-projection-governance-router/SKILL.md", + ".agents/skills/task-governance-router/SKILL.md" + ], + "verdict": "PASS_REVIEWER_SELECTION_PERFORMED_WITH_LOCAL_LANES" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/branch-lineage-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/branch-lineage-review.json new file mode 100644 index 00000000..7195f9b6 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/branch-lineage-review.json @@ -0,0 +1,30 @@ +{ + "target_execution_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "target_execution_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "expected_target_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "target_head_matches_expected": true, + "public_origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "merge_base_with_origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "plan_bound_execution_start": "f35bed3d6f62c75a6e24d5a549b3d958d8525101", + "dev_authority_source_origin_main": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "lineage_commits_from_origin_main_to_target": [ + "8d94198 governance: record Coregentis workspace authority", + "4a07000 governance: add Coregentis two-layer governance baseline", + "7630bd9 governance: propagate local baseline discovery mechanism", + "e7a5f69 governance: codify ownership baseline and close copyright surfaces", + "5865931 governance: add task governance router to Codex harness", + "d53e2d5 governance: codify release projection workflow router", + "16e5e41 governance: reconcile public OSS release SOP authority", + "20ecad2 governance: finalize public OSS SOP reconciliation evidence", + "9f2b55c governance: review public OSS projection readiness drift", + "bb9d33c governance: finalize public OSS projection drift evidence", + "b2df7ce governance: plan public OSS projection", + "f35bed3 governance: record public projection plan push evidence", + "715c9aa projection: apply owner-authorized public OSS projection", + "98ab309 governance: record public projection branch push verification" + ], + "full_branch_changed_file_count_against_origin_main": 112, + "execution_payload_changed_file_count_from_plan_start": 29, + "lineage_review_note": "The target branch is stacked on prior public governance baseline, SOP reconciliation, drift review, and projection plan commits. The projection execution payload is the 29-file delta from f35bed3 to 98ab309. Protected merge decision should review the full stacked lineage, not only the execution payload.", + "verdict": "PASS_BRANCH_HEAD_AND_LINEAGE_EXPLAINED" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/changed-file-review-matrix.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/changed-file-review-matrix.json new file mode 100644 index 00000000..60230caf --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/changed-file-review-matrix.json @@ -0,0 +1,120 @@ +{ + "matrix_scope": { + "full_branch_against_origin_main": "112 changed files; all changes are explained by the stacked governance, readiness, plan, and execution lineage recorded in branch-lineage-review.json.", + "execution_payload_reviewed_in_detail": "29 changed files from f35bed3d6f62c75a6e24d5a549b3d958d8525101 to 98ab309dc00393efe7dc1f35d259b519a6c9bf93" + }, + "unexplained_surface_found": false, + "entries": [ + { + "path": "artifacts/release/publish-set.json", + "change_category": "PUBLIC_RELEASE_SET_PROJECTION", + "source_authority": "Dev release-set plus live npm registry facts", + "allowed_by_projection_plan": true, + "redaction_required": true, + "gates_required": ["JSON parse", "release-set alignment", "no local path", "no excluded package"], + "gates_run": ["PASS"], + "review_verdict": "PASS_PUBLIC_SAFE_11_PACKAGE_RELEASE_SET" + }, + { + "path": "artifacts/release/pypi-set.json", + "change_category": "PUBLIC_PYPI_SET_PROJECTION", + "source_authority": "Dev pypi-set plus live PyPI registry facts", + "allowed_by_projection_plan": true, + "redaction_required": true, + "gates_required": ["JSON parse", "PyPI alignment", "repo-relative path"], + "gates_run": ["PASS"], + "review_verdict": "PASS_PUBLIC_SAFE_PYPI_SET" + }, + { + "path": "release-manifests/mplp-public-manifest.example.json", + "change_category": "PUBLIC_MANIFEST_PROJECTION", + "source_authority": "public manifest plus registry and Dev evidence", + "allowed_by_projection_plan": true, + "redaction_required": true, + "gates_required": ["public manifest validation", "conservative boundary review", "overclaim scan"], + "gates_run": ["PASS"], + "review_verdict": "PASS_PACKAGE_FACTS_UPDATED_WITH_DRAFT_BOUNDARY_PRESERVED" + }, + { + "path": "packages/npm/conformance/package.json", + "change_category": "PUBLIC_PACKAGE_SURFACE_PROJECTION", + "source_authority": "Dev origin/main same path", + "allowed_by_projection_plan": true, + "redaction_required": false, + "gates_required": ["package metadata gate", "active compliance scan"], + "gates_run": ["PASS"], + "review_verdict": "PASS_EXACT_DEV_MATCH" + }, + { + "path": "packages/npm/conformance/README.md", + "change_category": "PUBLIC_PACKAGE_SURFACE_PROJECTION", + "source_authority": "Dev origin/main same path with public overclaim wording adjustment", + "allowed_by_projection_plan": true, + "redaction_required": true, + "gates_required": ["package metadata gate", "overclaim scan"], + "gates_run": ["PASS"], + "review_verdict": "PASS_PUBLIC_SAFE_WORDING_ADJUSTMENT" + }, + { + "path": "packages/npm/conformance/src/index.ts", + "change_category": "PUBLIC_PACKAGE_SURFACE_PROJECTION", + "source_authority": "Dev origin/main same path", + "allowed_by_projection_plan": true, + "redaction_required": false, + "gates_required": ["package metadata gate", "active compliance scan"], + "gates_run": ["PASS"], + "review_verdict": "PASS_EXACT_DEV_MATCH" + }, + { + "path": "packages/npm/conformance/package-lock.json", + "change_category": "PUBLIC_PACKAGE_SURFACE_PROJECTION", + "source_authority": "Dev origin/main same path", + "allowed_by_projection_plan": true, + "redaction_required": false, + "gates_required": ["JSON parse", "active compliance dependency removal"], + "gates_run": ["PASS"], + "review_verdict": "PASS_GATE_DRIVEN_PACKAGE_CONSISTENCY_SURFACE" + }, + { + "path": "packages/npm/devtools/package.json", + "change_category": "PUBLIC_PACKAGE_SURFACE_PROJECTION", + "source_authority": "Dev origin/main same path", + "allowed_by_projection_plan": true, + "redaction_required": false, + "gates_required": ["package metadata gate", "conformance dependency review"], + "gates_run": ["PASS"], + "review_verdict": "PASS_EXACT_DEV_MATCH" + }, + { + "path": "packages/npm/devtools/README.md", + "change_category": "PUBLIC_PACKAGE_SURFACE_PROJECTION", + "source_authority": "Dev origin/main same path with CLI smoke overclaim removal", + "allowed_by_projection_plan": true, + "redaction_required": true, + "gates_required": ["package metadata gate", "CLI claim boundary review"], + "gates_run": ["PASS"], + "review_verdict": "PASS_PUBLIC_SAFE_OPTIONAL_TOOLING_WORDING" + }, + { + "path": "governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md", + "change_category": "PUBLIC_GOVERNANCE_EXECUTION_RECORD", + "source_authority": "Owner authorization and local projection plan", + "allowed_by_projection_plan": true, + "redaction_required": true, + "gates_required": ["frontmatter", "required phrase scan", "no forbidden action compliance"], + "gates_run": ["PASS"], + "review_verdict": "PASS_PUBLIC_EXECUTION_SUMMARY_RECORD" + } + ], + "lightweight_evidence_entries": { + "paths": "artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/*.json", + "count": 19, + "change_category": "PUBLIC_LIGHTWEIGHT_EVIDENCE", + "source_authority": "execution goal local evidence outputs", + "allowed_by_projection_plan": true, + "redaction_required": true, + "gates_required": ["JSON parse", "no raw Dev evidence", "no credential context"], + "gates_run": ["PASS"], + "review_verdict": "PASS_PUBLIC_LIGHTWEIGHT_EVIDENCE" + } +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json new file mode 100644 index 00000000..966ea71c --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json @@ -0,0 +1,31 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01", + "status": "review_evidence_created_pending_commit_push", + "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_BRANCH_REVIEW_READY_FOR_PROTECTED_MERGE_DECISION", + "reviewed_target_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "reviewed_target_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "gates_run": { + "repo_truth_first_public": "PASS", + "repo_truth_first_dev_read_only": "PASS", + "task_governance_router": "PASS", + "release_projection_governance_router": "PASS", + "skill_mirror_diff": "PASS_NO_DRIFT", + "toml_parse": "FALLBACK_STRUCTURAL_PARSE_PASS_TOMLLIB_UNAVAILABLE", + "json_parse_plan_and_execution_evidence": "PASS", + "public_manifest_validation": "PASS", + "package_metadata_gate_conformance": "PASS", + "package_metadata_gate_devtools": "PASS", + "npm_registry_read_only_review": "PASS", + "pypi_registry_read_only_review": "PASS", + "git_diff_check": "PASS", + "no_secret_scan": "PASS", + "no_local_path_scan": "PASS_WITH_REPO_TRUTH_PATH_EVIDENCE_ONLY", + "no_raw_dev_evidence_leakage_scan": "PASS", + "no_internal_harness_projection_scan": "PASS_EXECUTION_PAYLOAD_ONLY", + "identity_legal_scan": "PASS", + "forbidden_overclaim_scan": "PASS_NEGATIVE_BOUNDARY_TERMS_ONLY", + "no_dist_mutation_scan": "PASS" + }, + "remaining_blockers": [], + "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/leakage-safety-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/leakage-safety-review.json new file mode 100644 index 00000000..c1b883a1 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/leakage-safety-review.json @@ -0,0 +1,16 @@ +{ + "no_credential_values": "PASS", + "no_npmrc_pypirc": "PASS", + "no_env_values": "PASS", + "no_raw_npm_pypi_stdout_stderr": "PASS", + "no_raw_dev_package_preflight": "PASS", + "no_raw_dev_governance_evidence": "PASS", + "no_forbidden_local_absolute_paths": "PASS_WITH_REPO_TRUTH_PATHS_ALLOWED_ONLY_IN_REVIEW_EVIDENCE", + "no_codex_agents_scripts_projection_in_execution_payload": "PASS", + "no_goal_template_projection_in_execution_payload": "PASS", + "no_package_dist_mutation": "PASS", + "no_node_modules_venv_wheels_sdists_tarballs": "PASS", + "identity_legacy_string_scan": "PASS", + "overclaim_scan": "PASS_NEGATIVE_BOUNDARY_TERMS_ONLY", + "verdict": "PASS_LEAKAGE_SAFETY_REVIEW" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/local-baseline-evidence-table.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..875bb156 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/local-baseline-evidence-table.json @@ -0,0 +1,50 @@ +{ + "rows": [ + { + "decision_area": "workspace and repo authority", + "local_evidence_file": "AGENTS.md; .codex/config.toml", + "evidence_signal": "Coregentis is canonical workspace; MPLP-Protocol is public OSS projection; MPLP-Protocol-Dev is Dev truth.", + "derived_rule": "Review in public repo; inspect Dev repo read-only.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "projection review workflow", + "local_evidence_file": ".agents/skills/task-governance-router/SKILL.md; .agents/skills/release-projection-governance-router/SKILL.md", + "evidence_signal": "Task router and release/projection router required before substantive review.", + "derived_rule": "Run both routers and record selected baselines, gates, reviewers, forbidden actions, and evidence outputs.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "projection plan authority", + "local_evidence_file": "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md; artifacts/governance/PUBLIC-OSS-PROJECTION-PLAN-01/*.json", + "evidence_signal": "Plan defines allowlist, denylist, redaction rules, dist boundary, release-config boundary, and follow-up requirements.", + "derived_rule": "Review execution payload against the plan-bound start commit f35bed3.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "target execution branch", + "local_evidence_file": "artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01/final-verdict.json", + "evidence_signal": "Target execution branch pushed and verified at 98ab309.", + "derived_rule": "Review target branch at 98ab309 without mutating projected content.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "review mutation boundary", + "local_evidence_file": "User authorization; AGENTS.md", + "evidence_signal": "Review goal permits only review record and lightweight evidence.", + "derived_rule": "Do not modify package, release, manifest, docs, schema, dist, or downstream surfaces.", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + } + ], + "low_or_conflicting_baseline_used": false +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/merge-readiness-recommendation.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/merge-readiness-recommendation.json new file mode 100644 index 00000000..81eb1f5e --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/merge-readiness-recommendation.json @@ -0,0 +1,11 @@ +{ + "target_execution_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "target_execution_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "projection_execution_payload_ready_for_protected_merge_decision": true, + "merge_authorized_by_this_goal": false, + "protected_merge_decision_required": true, + "stacked_lineage_condition": "The target branch includes 112 files against origin/main because it is stacked on prior governance, SOP reconciliation, readiness, and projection plan commits. Protected merge decision must validate or intentionally include that stacked lineage.", + "remaining_blockers": [], + "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01", + "verdict": "READY_FOR_PROTECTED_MERGE_DECISION_NO_MERGE_PERFORMED" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/no-forbidden-action-compliance.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/no-forbidden-action-compliance.json new file mode 100644 index 00000000..1b41cec4 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/no-forbidden-action-compliance.json @@ -0,0 +1,24 @@ +{ + "merge_to_public_main": false, + "tag": false, + "seal": false, + "github_release": false, + "npm_publish": false, + "pypi_upload": false, + "twine_upload": false, + "registry_mutation": false, + "dist_tag_mutation": false, + "deprecate": false, + "dev_repo_mutation": false, + "website_repo_mutation": false, + "validation_lab_repo_mutation": false, + "cognitive_os_mutation": false, + "solocrew_mutation": false, + "v1_mutation": false, + "deploy": false, + "branch_deletion": false, + "credential_or_token_access": false, + "projected_content_mutation_in_review_goal": false, + "wholesale_dev_sync": false, + "verdict": "PASS_FORBIDDEN_ACTION_COMPLIANCE" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/package-surface-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/package-surface-review.json new file mode 100644 index 00000000..c98dc223 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/package-surface-review.json @@ -0,0 +1,33 @@ +{ + "conformance": { + "package_json_exact_dev_origin_main_match": true, + "src_index_exact_dev_origin_main_match": true, + "package_lock_exact_dev_origin_main_match": true, + "readme_diff_from_dev": "public-safe wording changed from certification phrasing to attestation-surface boundary wording", + "active_compliance_dependency_import_export": false, + "package_metadata_gate": "PASS", + "dist_mutation": false, + "review_verdict": "PASS_PUBLIC_SAFE_CONFORMANCE_SURFACE" + }, + "devtools": { + "package_json_exact_dev_origin_main_match": true, + "readme_diff_from_dev": "CLI command examples removed because public repo dist projection is forbidden and this review cannot claim local CLI smoke completion", + "active_dependency_points_to_conformance": true, + "public_optional_tooling_status_coherent": true, + "package_metadata_gate": "PASS", + "dist_mutation": false, + "publish_action_performed": false, + "review_verdict": "PASS_PUBLIC_SAFE_DEVTOOLS_SURFACE" + }, + "compliance": { + "active_release_set_package": false, + "active_dependency_import_export_in_projected_surfaces": false, + "boundary": "legacy skipped alias only", + "deprecation_action_performed": false + }, + "validator": { + "public_package_projected": false, + "boundary": "internal CI only" + }, + "verdict": "PASS_PACKAGE_SURFACE_REVIEW" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/projection-plan-compliance-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/projection-plan-compliance-review.json new file mode 100644 index 00000000..fffeae09 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/projection-plan-compliance-review.json @@ -0,0 +1,15 @@ +{ + "allowlist_compliance": "PASS", + "denylist_compliance": "PASS", + "redaction_rule_compliance": "PASS", + "release_config_handling_compliance": "PASS_RELEASE_CONFIG_UNCHANGED_IN_EXECUTION_PAYLOAD", + "package_dist_handling_compliance": "PASS_NO_DIST_MUTATION", + "public_manifest_handling_compliance": "PASS_PACKAGE_FACTS_UPDATED_DRAFT_BOUNDARY_PRESERVED", + "website_lab_downstream_boundary_compliance": "PASS_NO_DOWNSTREAM_MUTATION_FOLLOWUPS_RECORDED", + "no_merge_tag_seal_release_compliance": "PASS", + "no_registry_mutation_compliance": "PASS_REVIEW_USED_READ_ONLY_REGISTRY_QUERIES_ONLY", + "wholesale_dev_copy_avoided": true, + "raw_dev_evidence_leakage_avoided": true, + "internal_harness_leakage_avoided_in_execution_payload": true, + "verdict": "PASS_PROJECTION_PLAN_COMPLIANCE" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/public-manifest-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/public-manifest-review.json new file mode 100644 index 00000000..bc94906b --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/public-manifest-review.json @@ -0,0 +1,24 @@ +{ + "validation_command": "node scripts/semantic/validate-public-manifest.mjs", + "validation_result": "PASS", + "package_level_registry_facts": { + "npm_11_release_set_visible": true, + "devtools_optional_tooling_visible": true, + "pypi_mplp_sdk_1_0_6_visible_and_latest": true, + "compliance_boundary": "skipped legacy alias at 1.0.5", + "validator_boundary": "not publicly published or projected" + }, + "release_boundary": { + "release_status_state": "draft", + "public_release_ready": false, + "package_replacement_status": "planned_not_published", + "package_actions_executed": false, + "overclaims_final_release_completion": false + }, + "overclaim_review": { + "certification_terms_present_only_as_negative_boundary": true, + "unsupported_endorsement_or_regulatory_claim": false + }, + "website_lab_followup_recorded": true, + "verdict": "PASS_PUBLIC_MANIFEST_REVIEW" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-projection-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-projection-router-result.json new file mode 100644 index 00000000..640dac7f --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-projection-router-result.json @@ -0,0 +1,51 @@ +{ + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "applied": true, + "workflow_type": "public_oss_projection_execution_branch_review", + "repo_role": "PUBLIC_OSS_PROJECTION", + "local_standard_source_files": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md", + "governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md", + "governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md" + ], + "dev_authority_comparison_baseline": { + "repo": "Coregentis/MPLP-Protocol-Dev", + "source_ref": "origin/main", + "source_commit": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d" + }, + "required_owner_authorization": "Review branch only. No merge, tag, seal, publish, upload, registry mutation, or downstream sync authorized.", + "external_baseline_checks": [ + "read-only npm registry version visibility", + "read-only PyPI registry version visibility" + ], + "allowed_mutations": [ + "public repo review governance record", + "public repo review evidence JSON" + ], + "forbidden_actions": [ + "merge", + "tag", + "seal", + "GitHub release", + "npm publish", + "PyPI upload", + "registry mutation", + "downstream mutation", + "projected content mutation" + ], + "stop_conditions": [ + "BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN", + "BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED", + "BLOCKED_RELEASE_GOVERNANCE_BASELINE_MISSING", + "PARTIAL_PUBLIC_OSS_PROJECTION_REVIEW_BLOCKED_BY_UNEXPLAINED_SURFACE", + "PARTIAL_PUBLIC_OSS_PROJECTION_REVIEW_BLOCKED_BY_PLAN_NONCOMPLIANCE", + "PARTIAL_PUBLIC_OSS_PROJECTION_REVIEW_BLOCKED_BY_LEAKAGE_FINDING" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-set-pypi-set-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-set-pypi-set-review.json new file mode 100644 index 00000000..82450d47 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/release-set-pypi-set-review.json @@ -0,0 +1,39 @@ +{ + "publish_set": { + "count": 11, + "packages": [ + "@mplp/schema@1.0.7", + "@mplp/conformance@1.0.1", + "@mplp/core@1.0.7", + "@mplp/coordination@1.0.7", + "@mplp/integration-llm-http@1.0.6", + "@mplp/integration-storage-fs@1.0.6", + "@mplp/integration-storage-kv@1.0.6", + "@mplp/integration-tools-generic@1.0.6", + "@mplp/modules@1.0.6", + "@mplp/runtime-minimal@1.0.6", + "@mplp/sdk-ts@1.0.8" + ], + "excluded": [ + "@mplp/compliance", + "@mplp/devtools", + "@mplp/validator" + ], + "public_safe": true + }, + "pypi_set": { + "packages": [ + "mplp-sdk@1.0.6" + ], + "path": "packages/pypi/mplp-sdk", + "uses_v1_path": false, + "uses_local_absolute_path": false, + "public_safe": true + }, + "live_registry_review": { + "npm": "PASS_READ_ONLY_TARGET_VERSIONS_VISIBLE", + "pypi": "PASS_READ_ONLY_MPLP_SDK_1_0_6_VISIBLE_AND_LATEST", + "registry_mutation_performed": false + }, + "verdict": "PASS_RELEASE_SET_PYPI_SET_REVIEW" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/repo-truth.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/repo-truth.json new file mode 100644 index 00000000..c40e4a87 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/repo-truth.json @@ -0,0 +1,30 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "public_repo": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "role": "PUBLIC_OSS_PROJECTION", + "review_branch": "codex/public-oss-projection-execution-branch-review-01", + "review_branch_start_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "target_execution_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "target_execution_remote_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "expected_target_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "target_head_matches_expected": true, + "origin_main_head": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "worktree_clean_before_review_evidence": true + }, + "dev_repo_read_only": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "observed_branch": "codex/release-projection-governance-harness-codification-01", + "observed_local_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main_head": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "expected_authority_source_head": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "authority_source_matches_expected": true, + "worktree_clean": true, + "mutation_performed": false + }, + "repo_truth_first": { + "public_repo": "PASS", + "dev_repo_read_only": "PASS" + } +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/task-governance-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/task-governance-router-result.json new file mode 100644 index 00000000..de45e8c1 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/task-governance-router-result.json @@ -0,0 +1,52 @@ +{ + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "executed": true, + "prompt_assertions_are_not_governance_authority": true, + "task_type_classification": [ + "public_oss_projection_execution_branch_review", + "projection_plan_compliance_review", + "public_release_boundary_review", + "no_merge_no_tag_no_seal" + ], + "sot_layer_classification": [ + "L1 Projection Source review", + "L3 Verification Evidence", + "L4 Publication Surface review", + "L6 Codex Execution Governance" + ], + "applicable_repository_governance_methods": [ + "TSV", + "XCV", + "SCV", + "EVC", + "package_surface_review", + "projection_boundary_review", + "public_claim_boundary_review" + ], + "applicable_codex_harness_methods": [ + "SCTM", + "GLFB", + "ITCM", + "RBCT", + "VIM", + "PRM", + "TASK-GOVERNANCE-ROUTER-01" + ], + "allowed_mutation": [ + "governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md", + "artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/*.json" + ], + "forbidden_mutation": [ + "projected package content", + "release manifests", + "release-set or pypi-set", + "release-config.yaml", + "Dev repo", + "Website repo", + "Validation Lab repo", + "Cognitive_OS", + "SoloCrew", + "V1.0_release" + ], + "evidence_output_plan": "Create one public governance review record plus 16 lightweight JSON evidence files." +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/website-lab-followup-review.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/website-lab-followup-review.json new file mode 100644 index 00000000..4ae1e3a3 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/website-lab-followup-review.json @@ -0,0 +1,11 @@ +{ + "website_repo_mutated": false, + "validation_lab_repo_mutated": false, + "downstream_repos_mutated": false, + "manifest_pointer_followups_required": true, + "required_followup_goals": [ + "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01" + ], + "review_verdict": "PASS_FOLLOWUPS_REMAIN_REQUIRED_AND_OUT_OF_SCOPE" +} diff --git a/governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md b/governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md new file mode 100644 index 00000000..1bfa72ee --- /dev/null +++ b/governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md @@ -0,0 +1,198 @@ +--- +entry_surface: repository +doc_type: governance +status: active +authority: MPLP public OSS projection branch review governance +protocol_version: "1.0.0" +doc_id: "PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01" +title: "Public OSS Projection Execution Branch Review 01" +created_at: "2026-06-08" +goal_id: "PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01" +--- + +# Public OSS Projection Execution Branch Review 01 + +## Scope + +This record reviews the pushed public OSS projection execution branch: + +- `codex/owner-authorize-public-oss-projection-execution-01` +- reviewed HEAD: `98ab309dc00393efe7dc1f35d259b519a6c9bf93` + +Review branch: + +- `codex/public-oss-projection-execution-branch-review-01` + +This is not a merge, tag, seal, GitHub release, npm publish, PyPI upload, +registry mutation, Website sync, Validation Lab sync, downstream mutation, or +projected-content mutation goal. + +## Repo Truth + +Public repo: + +- role: MPLP public OSS projection +- origin main: `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- target execution branch HEAD: + `98ab309dc00393efe7dc1f35d259b519a6c9bf93` +- expected target HEAD: + `98ab309dc00393efe7dc1f35d259b519a6c9bf93` +- target HEAD matched expected evidence. + +Dev repo read-only: + +- role: protocol/package/release Dev truth +- Dev `origin/main`: + `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- Dev worktree was observed clean. +- No Dev mutation was performed. + +## Router Result + +`TASK-GOVERNANCE-ROUTER-01` and +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` were applied before substantive +review. + +Task classification: + +- `public_oss_projection_execution_branch_review` +- `projection_plan_compliance_review` +- `public_release_boundary_review` +- `no_merge_no_tag_no_seal` + +SOT layer classification: + +- `L1 Projection Source review` +- `L3 Verification Evidence` +- `L4 Publication Surface review` +- `L6 Codex Execution Governance` + +Prompt assertions were not treated as governance authority unless supported by +local repository evidence. + +## Reviewer Lanes + +Actual subagent invocation was attempted, but the current runtime returned +`agent thread limit reached`. The following review lanes were applied locally: + +- governance secretariat +- release governance reviewer +- projection boundary reviewer +- security/no-secret reviewer +- package surface auditor +- docs projection reviewer +- Website boundary reviewer +- Validation Lab boundary reviewer +- publication claim reviewer + +## Branch Lineage Review + +The target branch is stacked on prior public governance and projection planning +commits. Against public `origin/main`, the branch contains 112 changed files. +Against the plan-bound execution start commit +`f35bed3d6f62c75a6e24d5a549b3d958d8525101`, the projection execution payload +contains 29 changed files. + +The 29-file execution payload was reviewed in detail. The broader 112-file +branch lineage is locally explained by the prior workspace authority, +two-layer governance, local baseline discovery, ownership, task router, release +projection router, SOP reconciliation, readiness drift review, and projection +plan commits. A later protected merge decision must intentionally validate or +include that full stacked lineage. + +## Projection Plan Compliance + +The execution payload complied with `PUBLIC-OSS-PROJECTION-PLAN-01`: + +- allowlist compliance: pass +- denylist compliance: pass +- redaction compliance: pass +- release-config unchanged in execution payload: pass +- package `dist/**` unchanged: pass +- public manifest handled conservatively: pass +- Website/Lab/downstream follow-ups recorded and not mutated: pass +- no merge/tag/seal/release: pass +- no registry mutation: pass + +No unexplained execution payload surface was found. + +## Public Manifest Review + +The public manifest validation passed. Package-level registry facts were +updated, while the top-level public release boundary remained conservative: + +- `release_status.state`: `draft` +- `public_release_ready`: `false` +- `package_replacement_status.status`: `planned_not_published` +- `package_actions_executed`: `false` + +Certification or regulatory wording appears only as negative boundary language, +not as an unsupported public claim. + +## Release-set / PyPI-set Review + +`publish-set.json` contains the 11-package public npm release-set and excludes +`@mplp/compliance`, `@mplp/devtools`, and `@mplp/validator` from the main +release-set. + +`pypi-set.json` contains `mplp-sdk@1.0.6` with repo-relative path +`packages/pypi/mplp-sdk`. It does not point to V1 or to a local absolute path. + +Read-only registry review passed for the listed npm and PyPI package facts. No +registry mutation was performed. + +## Package Surface Review + +`@mplp/conformance` review: + +- no active `@mplp/compliance` dependency/import/export +- forward conformance helper wording is public-safe +- package metadata gate passed +- no `dist/**` mutation + +`@mplp/devtools` review: + +- active dependency points to `@mplp/conformance` +- optional tooling status is coherent +- README avoids local CLI smoke overclaim +- package metadata gate passed +- no publish action was performed +- no `dist/**` mutation + +`@mplp/compliance` remains a skipped legacy alias boundary. `@mplp/validator` +remains internal/CI-only and is not projected as a public package. + +## Leakage / Safety Review + +Review gates found no credential values, no `.npmrc` or `.pypirc`, no env +values, no raw npm/PyPI stdout or stderr, no raw Dev package-preflight +evidence, no raw Dev governance evidence, no forbidden local path leakage, no +package dist mutation, no node_modules, no venv, no wheels, no sdists, and no +tarballs. + +Repo-truth evidence may name canonical local repo paths as governance truth +evidence only. + +## Website / Lab Follow-up Review + +Website, Validation Lab, and downstream repos were not mutated. Follow-up +goals remain required if public manifest pointer consumers need to be updated: + +- `WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01` +- `VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01` + +## Merge Readiness Recommendation + +The projection execution payload is ready for a later protected merge decision. +This review does not authorize or perform the merge. + +The protected merge decision must explicitly account for the stacked branch +lineage against `origin/main`, not only the 29-file execution payload. + +Recommended next goal: + +- `OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01` + +## Final Verdict + +`COMPLETE_PUBLIC_OSS_PROJECTION_BRANCH_REVIEW_READY_FOR_PROTECTED_MERGE_DECISION` From d957615bc7ad1d686a23e68da4236ccc2aee5d8f Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 23:12:06 +0800 Subject: [PATCH 16/24] governance: record public projection review branch push verification --- .../final-verdict.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json index 966ea71c..3b17d3f2 100644 --- a/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01/final-verdict.json @@ -1,7 +1,13 @@ { "goal_id": "PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01", - "status": "review_evidence_created_pending_commit_push", + "status": "review_branch_pushed_verified_ready_for_protected_merge_decision", "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_BRANCH_REVIEW_READY_FOR_PROTECTED_MERGE_DECISION", + "branch_push_verification": { + "branch": "codex/public-oss-projection-execution-branch-review-01", + "tracking_branch": "origin/codex/public-oss-projection-execution-branch-review-01", + "verification_method": "git rev-parse HEAD, git rev-parse @{u}, and git ls-remote origin refs/heads/codex/public-oss-projection-execution-branch-review-01 match after push", + "result": "PASS_FINAL_BRANCH_HEAD_VERIFIED_AFTER_PUSH" + }, "reviewed_target_branch": "codex/owner-authorize-public-oss-projection-execution-01", "reviewed_target_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", "gates_run": { From e28ef5add9773d9600485135d7fb8bc1bfac8bbc Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 23:40:56 +0800 Subject: [PATCH 17/24] governance: codify public OSS branch release proposal baseline --- .../SKILL.md | 10 + .../skills/task-governance-router/SKILL.md | 12 + .codex/config.toml | 10 + .../SKILL.md | 10 + .codex/skills/task-governance-router/SKILL.md | 12 + AGENTS.md | 16 + .../agent-reviewer-selection.json | 24 ++ .../branch-cleanup-authorization-policy.json | 25 ++ .../branch-lifecycle-baseline.json | 33 ++ .../files-changed-classification.json | 24 ++ .../final-verdict.json | 18 + .../harness-integration-summary.json | 22 + .../local-baseline-evidence-table.json | 47 +++ .../no-branch-cleanup-compliance.json | 10 + .../no-release-execution-compliance.json | 13 + .../prior-discovery-input-summary.json | 18 + ...proposal-candidate-lifecycle-baseline.json | 41 ++ .../release-object-taxonomy.json | 74 ++++ .../release-projection-router-result.json | 50 +++ .../repo-truth.json | 26 ++ .../task-governance-router-result.json | 78 ++++ ...RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md | 388 ++++++++++++++++++ governance/codex-goals/CODEX-GOAL-TEMPLATE.md | 27 ++ 23 files changed, 988 insertions(+) create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-cleanup-authorization-policy.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-lifecycle-baseline.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/files-changed-classification.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/final-verdict.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/harness-integration-summary.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-branch-cleanup-compliance.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-release-execution-compliance.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/prior-discovery-input-summary.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/proposal-candidate-lifecycle-baseline.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-object-taxonomy.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-projection-router-result.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/repo-truth.json create mode 100644 artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/task-governance-router-result.json create mode 100644 governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md diff --git a/.agents/skills/release-projection-governance-router/SKILL.md b/.agents/skills/release-projection-governance-router/SKILL.md index 2279fae0..61ea9599 100644 --- a/.agents/skills/release-projection-governance-router/SKILL.md +++ b/.agents/skills/release-projection-governance-router/SKILL.md @@ -31,6 +31,9 @@ Run this router before substantive work involving any of these surfaces: evidence publication - downstream release pointer or consumption updates in runtime/product repos - Git tag, release seal, GitHub release, merge-to-release, or deployment +- public OSS branch lifecycle, branch cleanup planning, release object + taxonomy, or proposal/candidate lifecycle when those surfaces affect release, + projection, merge, tag, seal, or GitHub release decisions ## Required Discovery Table @@ -53,6 +56,13 @@ Before any release-like action, complete this table from local files: If the table cannot be completed for a requested mutation, stop with a matching blocker instead of inventing a standard. +For public OSS branch, release object, and proposal/candidate lifecycle +classification, include +`governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md` +as a standard source when present. The baseline is not authorization for branch +cleanup, branch deletion, merge, tag, seal, GitHub release, projection +execution, or registry mutation. + ## Package Version Baseline Rule For version-bump planning, owner-approved version implementation, publish diff --git a/.agents/skills/task-governance-router/SKILL.md b/.agents/skills/task-governance-router/SKILL.md index 6302e8bf..ca23de35 100644 --- a/.agents/skills/task-governance-router/SKILL.md +++ b/.agents/skills/task-governance-router/SKILL.md @@ -86,6 +86,10 @@ Classify at least one: - `credential_readiness` - `post_publish_verification` - `devtools_or_validator_or_compliance_status` +- `branch_lifecycle_governance` +- `branch_cleanup_planning` +- `release_object_governance` +- `proposal_candidate_lifecycle_governance` - `unknown_or_mixed` For each selected type, discover from local evidence: @@ -100,6 +104,14 @@ For each selected type, discover from local evidence: Do not hardcode package status, repo role, or authorization from the prompt. +When the task touches public OSS branch lifecycle, branch cleanup, PR/merge +readiness, release object taxonomy, Git tag, release seal, GitHub release, +public projection release state, RFC, proposal, or MPGC candidate lifecycle, +include +`governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md` +in the selected local governance baseline. Branch existence is evidence only, +not governance authority. + ## Release-Like Workflow Delegation If a task is release-like, also run or internally satisfy diff --git a/.codex/config.toml b/.codex/config.toml index 06463057..22d4a59a 100644 --- a/.codex/config.toml +++ b/.codex/config.toml @@ -68,6 +68,16 @@ blockers = [ "BLOCKED_SUBSTANTIVE_RELEASE_DECISION_WITHOUT_LOCAL_EVIDENCE", ] +[agentic_harness.public_oss_branch_release_proposal_governance] +enabled = true +baseline = "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md" +required_for_branch_lifecycle_tasks = true +required_for_branch_cleanup_tasks = true +required_for_release_object_tasks = true +required_for_proposal_candidate_tasks = true +branch_cleanup_requires_explicit_owner_authorization = true +merge_tag_seal_github_release_require_explicit_owner_authorization = true + [local_governance_baseline_discovery] required_phrase = "Prompt assertions are not governance authority unless supported by local repository evidence." required_precondition = "Dynamic governance baseline selection is a precondition for every non-trivial task." diff --git a/.codex/skills/release-projection-governance-router/SKILL.md b/.codex/skills/release-projection-governance-router/SKILL.md index 2279fae0..61ea9599 100644 --- a/.codex/skills/release-projection-governance-router/SKILL.md +++ b/.codex/skills/release-projection-governance-router/SKILL.md @@ -31,6 +31,9 @@ Run this router before substantive work involving any of these surfaces: evidence publication - downstream release pointer or consumption updates in runtime/product repos - Git tag, release seal, GitHub release, merge-to-release, or deployment +- public OSS branch lifecycle, branch cleanup planning, release object + taxonomy, or proposal/candidate lifecycle when those surfaces affect release, + projection, merge, tag, seal, or GitHub release decisions ## Required Discovery Table @@ -53,6 +56,13 @@ Before any release-like action, complete this table from local files: If the table cannot be completed for a requested mutation, stop with a matching blocker instead of inventing a standard. +For public OSS branch, release object, and proposal/candidate lifecycle +classification, include +`governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md` +as a standard source when present. The baseline is not authorization for branch +cleanup, branch deletion, merge, tag, seal, GitHub release, projection +execution, or registry mutation. + ## Package Version Baseline Rule For version-bump planning, owner-approved version implementation, publish diff --git a/.codex/skills/task-governance-router/SKILL.md b/.codex/skills/task-governance-router/SKILL.md index 6302e8bf..ca23de35 100644 --- a/.codex/skills/task-governance-router/SKILL.md +++ b/.codex/skills/task-governance-router/SKILL.md @@ -86,6 +86,10 @@ Classify at least one: - `credential_readiness` - `post_publish_verification` - `devtools_or_validator_or_compliance_status` +- `branch_lifecycle_governance` +- `branch_cleanup_planning` +- `release_object_governance` +- `proposal_candidate_lifecycle_governance` - `unknown_or_mixed` For each selected type, discover from local evidence: @@ -100,6 +104,14 @@ For each selected type, discover from local evidence: Do not hardcode package status, repo role, or authorization from the prompt. +When the task touches public OSS branch lifecycle, branch cleanup, PR/merge +readiness, release object taxonomy, Git tag, release seal, GitHub release, +public projection release state, RFC, proposal, or MPGC candidate lifecycle, +include +`governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md` +in the selected local governance baseline. Branch existence is evidence only, +not governance authority. + ## Release-Like Workflow Delegation If a task is release-like, also run or internally satisfy diff --git a/AGENTS.md b/AGENTS.md index 5df09e09..3967fb42 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -190,6 +190,22 @@ files, prior PRs, green gates, or historical artifacts are repo state or evidence only; they are not the authority baseline for deciding the next public package version. +## Public OSS Branch / Release / Proposal Baseline + +For public OSS branch lifecycle, branch cleanup, PR/merge readiness, +tag/seal/GitHub release, public projection release, public manifest release +state, RFC, proposal, or MPGC candidate lifecycle tasks, apply +`governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md` +after `TASK-GOVERNANCE-ROUTER-01` and, when release-like surfaces are involved, +after `RELEASE-PROJECTION-GOVERNANCE-ROUTER-01`. + +Branch existence is not governance authority by itself. Governance state must +be recorded in PRs, governance records, release manifests, RFC/proposal +records, or MPGC candidate/decision records. Branch cleanup, branch deletion, +merge, tag, seal, GitHub release, public projection execution, package +publication, and registry mutation remain forbidden unless a later owner +authorization names the exact action and target. + ## Hard Boundaries - Preserve protocol, runtime, product, validation, and publication boundaries. diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/agent-reviewer-selection.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/agent-reviewer-selection.json new file mode 100644 index 00000000..4239db4d --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/agent-reviewer-selection.json @@ -0,0 +1,24 @@ +{ + "actual_subagent_invocation": { + "attempted": false, + "reason": "local reviewer perspectives were sufficient for baseline codification; no delegated mutation was authorized" + }, + "selected_review_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "publication_claim_reviewer", + "security_no_secret_reviewer", + "protocol_schema_reviewer", + "package_surface_auditor" + ], + "local_agent_files": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/product_boundary_reviewer.toml", + ".codex/agents/protocol_schema_reviewer.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".codex/agents/runtime_binding_reviewer.toml" + ], + "applied_locally": true +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-cleanup-authorization-policy.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-cleanup-authorization-policy.json new file mode 100644 index 00000000..d92605e7 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-cleanup-authorization-policy.json @@ -0,0 +1,25 @@ +{ + "cleanup_is_separate_mutation_category": true, + "cleanup_authorized_by_this_goal": false, + "required_before_remote_branch_deletion": [ + "full local and remote branch inventory", + "current origin/main HEAD", + "branch SHA and upstream tracking state", + "ahead/behind count against origin/main", + "containment proof against origin/main", + "containment proof against active review/projection branch when relevant", + "mapped PR URL and PR state when available", + "mapped governance record path when available", + "proof that no unique unmerged commit would be lost", + "owner authorization naming exact branches to delete", + "final no-tag/no-merge/no-release/no-registry compliance record" + ], + "forbidden_in_baseline_goal": [ + "remote branch deletion", + "local branch deletion", + "PR close", + "merge", + "tag", + "release" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-lifecycle-baseline.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-lifecycle-baseline.json new file mode 100644 index 00000000..e859f15e --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/branch-lifecycle-baseline.json @@ -0,0 +1,33 @@ +{ + "branch_classes": [ + "long_lived_public_branch", + "maintenance_branch_owner_decision_required", + "next_future_version_branch_owner_mpgc_decision_required", + "codex_task_branch", + "projection_execution_branch", + "projection_review_branch", + "release_branch", + "governance_branch", + "proposal_candidate_branch_editing_vehicle", + "abandoned_branch", + "superseded_branch", + "merged_delete_eligible_branch" + ], + "statuses": [ + "LONG_LIVED_PUBLIC_MAIN", + "ACTIVE_REVIEW_BRANCH", + "ACTIVE_PROJECTION_BRANCH", + "ACTIVE_PLAN_BRANCH", + "MERGE_CANDIDATE", + "SUPERSEDED_CANDIDATE", + "MERGED_DELETE_ELIGIBLE_CANDIDATE", + "ABANDONED_REVIEW_REQUIRED", + "KEEP_TEMPORARILY_PENDING_OWNER_DECISION", + "UNKNOWN_REQUIRES_GOVERNANCE_DECISION" + ], + "ttl_policy": { + "time_based_ttl_defined": false, + "policy": "use lifecycle transitions rather than calendar TTL until future owner decision" + }, + "authority_rule": "branch existence is not governance authority; PRs, governance records, release manifests, and proposal records carry authority" +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/files-changed-classification.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/files-changed-classification.json new file mode 100644 index 00000000..e3512e4f --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/files-changed-classification.json @@ -0,0 +1,24 @@ +{ + "allowed_surface_classes": [ + "governance baseline record", + "lightweight governance evidence JSON", + "Codex operating harness pointers" + ], + "forbidden_surface_classes": [ + "package", + "source", + "schema", + "docs content", + "release manifest", + "release-set", + "pypi-set", + "Website", + "Validation Lab", + "Dev repo", + "V1 workspace" + ], + "classification_status": "verified_after_edits", + "changed_file_count": 23, + "protected_surface_scan": "PASS", + "forbidden_prefix_files": [] +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/final-verdict.json new file mode 100644 index 00000000..015f96f2 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/final-verdict.json @@ -0,0 +1,18 @@ +{ + "goal_id": "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01", + "verdict": "COMPLETE_PUBLIC_OSS_BRANCH_RELEASE_PROPOSAL_GOVERNANCE_BASELINE_CODIFIED", + "recommended_next_goal": "PUBLIC-OSS-BRANCH-INVENTORY-CLEANUP-PLAN-01", + "non_actions_confirmed": [ + "no branch cleanup", + "no merge", + "no tag", + "no seal", + "no GitHub release", + "no public projection execution", + "no package publish/upload", + "no registry mutation", + "no package/source/schema/docs/release-manifest mutation", + "no Dev/V1 mutation", + "no credential access" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/harness-integration-summary.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/harness-integration-summary.json new file mode 100644 index 00000000..f22fc7ef --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/harness-integration-summary.json @@ -0,0 +1,22 @@ +{ + "integration_type": "minimal pointers", + "files_intended_for_pointer_updates": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + ".codex/skills/task-governance-router/SKILL.md", + ".agents/skills/release-projection-governance-router/SKILL.md", + ".codex/skills/release-projection-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md" + ], + "not_authorized_by_integration": [ + "branch cleanup", + "merge", + "tag", + "seal", + "GitHub release", + "public projection execution", + "package/source/schema/docs/release-manifest mutation", + "registry mutation" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/local-baseline-evidence-table.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..c2bfded0 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/local-baseline-evidence-table.json @@ -0,0 +1,47 @@ +[ + { + "decision_area": "public_repo_role", + "local_evidence_file": "AGENTS.md; .codex/config.toml; governance/release/MPLP-RELEASE-SOP.md", + "evidence_signal": "public repo is clean OSS projection; Dev repo is package/release Dev truth", + "derived_rule": "codify public lifecycle governance in public repo without back-driving Dev truth", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "branch_lifecycle", + "local_evidence_file": "governance/release/MPLP-RELEASE-SOP.md; current branch inventory", + "evidence_signal": "release work uses dedicated branches; many codex/governance branches exist", + "derived_rule": "classify branch roles and lifecycle state before cleanup or merge", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "codify" + }, + { + "decision_area": "branch_cleanup", + "local_evidence_file": "governance/release/MPLP-RELEASE-SOP.md; PR and containment evidence", + "evidence_signal": "records retained; no explicit deletion policy existed", + "derived_rule": "require inventory, lineage proof, record mapping, no unique commit loss, and owner authorization", + "confidence": "MEDIUM_LOCAL_BASELINE_DERIVED", + "conflict": false, + "action": "codify" + }, + { + "decision_area": "release_object_separation", + "local_evidence_file": "GOVERNANCE.md; governance/05-versioning/version-taxonomy-manifest.json; release-manifests/mplp-public-manifest.schema.json", + "evidence_signal": "version domains and release manifest fields are separate", + "derived_rule": "do not collapse protocol version, package version, projection snapshot, tag, seal, and GitHub release", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "proposal_candidate_authority", + "local_evidence_file": "GOVERNANCE.md; CONTRIBUTING.md; .github/ISSUE_TEMPLATE/rfc.md; governance/candidates; governance/mpgc-intake; governance/mpgc-review", + "evidence_signal": "normative changes start as RFC issues; candidate files are pre-RFC and non-normative", + "derived_rule": "proposal records/issues are authority; branches are editing vehicles", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + } +] diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-branch-cleanup-compliance.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-branch-cleanup-compliance.json new file mode 100644 index 00000000..6630cfd4 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-branch-cleanup-compliance.json @@ -0,0 +1,10 @@ +{ + "branch_cleanup_executed": false, + "branch_deletion_executed": false, + "branch_creation_executed": [ + "codex/public-oss-branch-release-proposal-governance-baseline-01" + ], + "branch_creation_authorized_by_goal": true, + "pr_close_executed": false, + "merge_executed": false +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-release-execution-compliance.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-release-execution-compliance.json new file mode 100644 index 00000000..ee9521d6 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/no-release-execution-compliance.json @@ -0,0 +1,13 @@ +{ + "public_projection_execution": false, + "git_tag": false, + "release_seal": false, + "github_release": false, + "npm_publish": false, + "pypi_upload": false, + "registry_mutation": false, + "website_sync": false, + "validation_lab_sync": false, + "downstream_sync": false, + "credential_access": false +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/prior-discovery-input-summary.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/prior-discovery-input-summary.json new file mode 100644 index 00000000..f5d0dcfe --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/prior-discovery-input-summary.json @@ -0,0 +1,18 @@ +{ + "prior_goal_id": "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-DISCOVERY-01", + "input_type": "completed_read_only_discovery_result", + "treated_as": "evidence_input_not_governance_authority", + "summary": { + "public_branch": "codex/public-oss-projection-execution-branch-review-01", + "public_head": "d957615bc7ad1d686a23e68da4236ccc2aee5d8f", + "origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "main_findings": [ + "public repo has many codex/governance branches", + "current projection review branch contains recent projection chain", + "merged governance branches are contained in origin/main", + "release object taxonomy exists but GitHub release/seal/branch cleanup details were gaps", + "proposal/candidate lifecycle exists as RFC and pre-RFC MPGC records but branch policy was incomplete" + ], + "recommended_next_goal": "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01" + } +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/proposal-candidate-lifecycle-baseline.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/proposal-candidate-lifecycle-baseline.json new file mode 100644 index 00000000..63b8660f --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/proposal-candidate-lifecycle-baseline.json @@ -0,0 +1,41 @@ +{ + "rfc_lifecycle_supported_by_governance_md": [ + "Draft", + "Review", + "Approval", + "Implementation" + ], + "candidate_states_and_outcomes_supported_by_local_records": [ + "draft", + "pre_rfc", + "non_normative_candidate_backlog", + "review_preparation_ready", + "decision_needed", + "reject", + "defer", + "keep_backlog", + "open_rfc", + "request_more_evidence", + "accept_as_guide_work_item", + "accept_as_profile_work_item", + "accept_as_binding_work_item" + ], + "proposal_branch_rule": "proposal or candidate branches are editing vehicles only; proposal records, RFC issues, MPGC decision records, PRs, and release manifests carry authority", + "long_lived_proposal_branch_policy": "owner_decision_required", + "public_safe_surfaces": [ + "RFC issues", + "public PR discussions", + "public candidate backlog records", + "public MPGC intake/review preparation records", + "public proposal decision records" + ], + "dev_private_or_owner_decision_required_surfaces": [ + "raw Dev evidence", + "implementation-private evidence", + "local execution logs", + "credential/auth evidence", + "raw package preflight output", + "product/runtime-private traces", + "owner-private planning notes not prepared for public projection" + ] +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-object-taxonomy.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-object-taxonomy.json new file mode 100644 index 00000000..d588ee0a --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-object-taxonomy.json @@ -0,0 +1,74 @@ +[ + { + "object": "protocol_semantic_release", + "meaning": "normative protocol/schema/specification version", + "owner_authorization_required": true, + "requires_public_main_merge_first": true, + "requires_tag_seal_github_release": "separate_authorization_required", + "requires_package_registry_publication": false + }, + { + "object": "package_registry_release", + "meaning": "npm/PyPI package publication for exact package/version", + "owner_authorization_required": true, + "requires_public_main_merge_first": "not_automatic", + "requires_tag_seal_github_release": false, + "requires_package_registry_publication": true + }, + { + "object": "public_projection_release", + "meaning": "public repo snapshot/projection of Dev-approved public-safe surfaces", + "owner_authorization_required": true, + "requires_public_main_merge_first": true, + "requires_tag_seal_github_release": "separate_authorization_required", + "requires_package_registry_publication": false + }, + { + "object": "public_manifest_update", + "meaning": "release metadata contract for public consumers", + "owner_authorization_required": true, + "requires_public_main_merge_first": true, + "requires_tag_seal_github_release": false, + "requires_package_registry_publication": false + }, + { + "object": "git_tag", + "meaning": "immutable Git ref marking release or frozen version state", + "owner_authorization_required": true, + "requires_public_main_merge_first": true, + "requires_tag_seal_github_release": "is_tag_action", + "requires_package_registry_publication": false + }, + { + "object": "github_release", + "meaning": "public GitHub release object and announcement surface", + "owner_authorization_required": true, + "requires_public_main_merge_first": true, + "requires_tag_seal_github_release": "usually_references_tag", + "requires_package_registry_publication": false + }, + { + "object": "release_seal", + "meaning": "governance closure/seal record", + "owner_authorization_required": true, + "requires_public_main_merge_first": "usually_after_gates", + "requires_tag_seal_github_release": "is_seal_action", + "requires_package_registry_publication": false + }, + { + "object": "website_pointer_update", + "meaning": "Website consumption of public manifest or release pointer", + "owner_authorization_required": true, + "requires_public_main_merge_first": "depends_on_website_sync_goal", + "requires_tag_seal_github_release": false, + "requires_package_registry_publication": false + }, + { + "object": "validation_lab_pointer_update", + "meaning": "Validation Lab consumption of public manifest or release pointer", + "owner_authorization_required": true, + "requires_public_main_merge_first": "depends_on_lab_sync_goal", + "requires_tag_seal_github_release": false, + "requires_package_registry_publication": false + } +] diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-projection-router-result.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-projection-router-result.json new file mode 100644 index 00000000..2e784b99 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/release-projection-router-result.json @@ -0,0 +1,50 @@ +{ + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "router_skill": ".agents/skills/release-projection-governance-router/SKILL.md", + "router_run_before_release_like_work": true, + "release_like_task": true, + "workflow_type": [ + "branch lifecycle governance", + "release object taxonomy codification", + "proposal/candidate lifecycle codification", + "non-release-execution baseline" + ], + "repo_role": "PUBLIC_OSS_PROJECTION", + "local_standard_source_files": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/release/MPLP-RELEASE-SOP.md", + "GOVERNANCE.md", + "CONTRIBUTING.md", + "release-manifests/mplp-public-manifest.schema.json" + ], + "external_baseline_checks": { + "npm": "not_applicable_baseline_only_no_package_version_or_publish_decision", + "pypi": "not_applicable_baseline_only_no_package_version_or_publish_decision", + "github_pr_state": "read_only_gh_pr_list_used" + }, + "required_owner_authorization": { + "baseline_codification": "authorized_by_goal_prompt", + "branch_cleanup": "required_future_exact_branch_authorization", + "merge": "required_future_exact_pr_authorization", + "tag_seal_github_release": "required_future_exact_action_authorization", + "package_registry_action": "required_future_exact_package_version_registry_authorization" + }, + "allowed_mutations": [ + "public repo governance baseline record", + "public repo lightweight evidence JSON", + "minimal public repo harness/config/template/router pointers" + ], + "forbidden_actions": [ + "registry mutation", + "release execution", + "tag", + "seal", + "GitHub release", + "merge", + "branch deletion", + "public projection execution" + ], + "discovery_verdict": "RELEASE_PROJECTION_WORKFLOW_DISCOVERY_PERFORMED" +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/repo-truth.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/repo-truth.json new file mode 100644 index 00000000..ef1c5c93 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/repo-truth.json @@ -0,0 +1,26 @@ +{ + "goal_id": "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "public_repo": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "role": "PUBLIC_OSS_PROJECTION", + "starting_branch": "codex/public-oss-projection-execution-branch-review-01", + "task_branch": "codex/public-oss-branch-release-proposal-governance-baseline-01", + "starting_head": "d957615bc7ad1d686a23e68da4236ccc2aee5d8f", + "origin_main_head": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "worktree_state_before_edits": "clean", + "skill_mirror_drift_before_edits": "NO", + "tags_observed": [ + "v1.0.0", + "protocol-v1.0.0" + ] + }, + "dev_repo_read_only": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "role": "PROTOCOL_PACKAGE_RELEASE_DEV_TRUTH", + "observed_branch": "codex/release-projection-governance-harness-codification-01", + "observed_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main_head": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "worktree_state": "clean" + } +} diff --git a/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/task-governance-router-result.json b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/task-governance-router-result.json new file mode 100644 index 00000000..9d6c7591 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/task-governance-router-result.json @@ -0,0 +1,78 @@ +{ + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "router_skill": ".agents/skills/task-governance-router/SKILL.md", + "router_run_before_substantive_work": true, + "task_type": [ + "public_oss_branch_release_proposal_governance_baseline", + "branch_lifecycle_governance", + "release_object_governance", + "proposal_candidate_lifecycle_governance", + "non_cleanup_non_merge_non_release_execution" + ], + "sot_layer": [ + "L1 Projection Source governance", + "L3 Verification Evidence", + "L4 Publication Surface governance", + "L6 Codex Execution Governance" + ], + "selected_local_governance_baseline": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md", + "GOVERNANCE.md", + "CONTRIBUTING.md", + "release-manifests/mplp-public-manifest.schema.json", + "current public branch/tag/PR state" + ], + "applicable_repo_governance_methods": [ + "TSV", + "XCV", + "SCV", + "EVC" + ], + "applicable_harness_methods": [ + "SCTM", + "GLFB", + "ITCM", + "RBCT", + "VIM", + "PRM", + "TASK-GOVERNANCE-ROUTER-01" + ], + "required_gates": [ + "repo-truth-first public", + "repo-truth-first Dev read-only", + "skill mirror diff", + "TOML parse", + "JSON parse", + "frontmatter check", + "required phrase scan", + "no-secret scan", + "protected surface scan", + "forbidden action compliance scans", + "final git status", + "final upstream branch verification after push" + ], + "forbidden_actions": [ + "branch deletion", + "merge", + "tag", + "release seal", + "GitHub release", + "public projection execution", + "package publish/upload", + "registry mutation", + "package/source/schema/docs/release-manifest mutation", + "Website/Lab/downstream mutation", + "Dev repo mutation", + "V1 mutation", + "credential access" + ], + "evidence_outputs": [ + "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/*.json" + ], + "verdict": "ROUTER_APPLIED" +} diff --git a/governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md b/governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md new file mode 100644 index 00000000..654adcaa --- /dev/null +++ b/governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md @@ -0,0 +1,388 @@ +--- +entry_surface: repository +doc_type: governance-baseline +status: active +authority: MPLP public OSS branch release proposal governance +protocol_version: "1.0.0" +doc_id: "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01" +title: "Public OSS Branch Release Proposal Governance Baseline 01" +created_at: "2026-06-08" +goal_id: "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01" +--- + +# Public OSS Branch Release Proposal Governance Baseline 01 + +## Scope + +This record codifies the public OSS branch, release-object, and +proposal/candidate lifecycle baseline for `Coregentis/MPLP-Protocol`. + +Canonical workspace root: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis` + +Primary target repository: + +- `Coregentis/MPLP-Protocol` + +Read-only authority comparison repository: + +- `Coregentis/MPLP-Protocol-Dev` + +This is a governance baseline codification record. It does not perform branch +cleanup, branch deletion, merge, tag, release seal, GitHub release creation, +public projection execution, package publish/upload, registry mutation, +package/source/schema/docs/release-manifest mutation, Website sync, Validation +Lab sync, downstream sync, Dev mutation, or V1 mutation. + +## Source Evidence Summary + +This baseline is derived from local repository evidence: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` +- `governance/release/MPLP-RELEASE-SOP.md` +- `GOVERNANCE.md` +- `CONTRIBUTING.md` +- `release-config.yaml` +- `release-manifests/mplp-public-manifest.schema.json` +- `governance/05-versioning/version-taxonomy-manifest.json` +- `governance/candidates/*` +- `governance/mpgc-intake/*` +- `governance/mpgc-review/*` +- current public branch, tag, and PR state +- read-only Dev comparison evidence from `MPLP-Protocol-Dev` + +Prompt assertions and prior assistant suggestions were treated as hypotheses +only. The prior discovery result is recorded as evidence input in +`artifacts/governance/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01/prior-discovery-input-summary.json`; +it is not an independent governance authority. + +## Router Result + +`TASK-GOVERNANCE-ROUTER-01` and +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` were applied before this record was +created. + +Task classification: + +- `public_oss_branch_release_proposal_governance_baseline` +- `branch_lifecycle_governance` +- `release_object_governance` +- `proposal_candidate_lifecycle_governance` +- `non_cleanup_non_merge_non_release_execution` + +SOT layer classification: + +- `L1 Projection Source governance` +- `L3 Verification Evidence` +- `L4 Publication Surface governance` +- `L6 Codex Execution Governance` + +Selected public baseline: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` +- `governance/release/MPLP-RELEASE-SOP.md` +- `GOVERNANCE.md` +- `CONTRIBUTING.md` +- `release-manifests/mplp-public-manifest.schema.json` +- current public Git branch, tag, and PR state + +Selected Dev comparison baseline: + +- Dev `AGENTS.md` +- Dev `origin/main` observed as + `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- Dev release/projection policy and authority doctrine records +- Dev release/projection governance harness codification records + +## Repo Truth + +Public repo: + +- branch used for this goal: + `codex/public-oss-branch-release-proposal-governance-baseline-01` +- starting branch: + `codex/public-oss-projection-execution-branch-review-01` +- starting HEAD: + `d957615bc7ad1d686a23e68da4236ccc2aee5d8f` +- public `origin/main`: + `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- worktree state before this goal's edits: clean +- skill mirror drift before this goal's edits: `NO` + +Dev repo read-only: + +- observed branch: + `codex/release-projection-governance-harness-codification-01` +- observed local HEAD: + `93bcc881cc45e13d12dcc4d0ba26b8f11d996b23` +- Dev `origin/main`: + `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- worktree state: clean + +## Local Baseline Evidence Table + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +|:---|:---|:---|:---|:---|:---|:---| +| Public repo role | `AGENTS.md`; `.codex/config.toml`; release SOP | Public repo is clean OSS projection; Dev repo is package/release Dev truth | Codify public lifecycle governance here; do not back-drive Dev truth | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Branch discipline | release SOP Section 3; Git branch inventory | Release work uses dedicated branches; current task/projection/governance branches exist | Classify branch roles and lifecycle states before cleanup or merge | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Branch cleanup | release SOP Section 12; branch containment evidence | Old records are retained; no explicit branch cleanup policy existed | Require inventory, lineage proof, record mapping, and owner authorization before remote deletion | `MEDIUM_LOCAL_BASELINE_DERIVED` | No | Codify baseline | +| Release object separation | `GOVERNANCE.md`; version taxonomy; manifest schema | Protocol, package, docs, website, lab, and SDK versions are separate domains | Do not collapse protocol version, package version, public projection snapshot, tag, seal, and GitHub release | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Tag/seal/GitHub release boundary | `AGENTS.md`; release SOP Sections 11-14; release router | Tag, seal, GitHub release, merge, and registry mutation require explicit owner authorization | Baseline record does not authorize them | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Proposal/candidate authority | `GOVERNANCE.md`; `CONTRIBUTING.md`; RFC template; MPGC candidate records | Normative changes start as RFC issues; candidate files are pre-RFC/non-normative | Proposal records/issues are authority; branches are editing vehicles only | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Candidate lifecycle status | MPGC candidate backlog/intake/review records | Candidate states include draft, pre-RFC, backlog-only, review-preparation, decision-needed outcomes | Codify only locally supported states and keep remaining lifecycle states as gaps | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Public projection branch boundary | projection plan and branch review records | Projection execution branches are not releases, tags, seals, or merge approvals | Branch existence is evidence only, not governance authority | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Package release boundary | release SOP Section 7; Dev AGENTS read-only evidence | Package registry action requires exact owner approval and registry baseline; public repo is not Dev package truth | Do not run package gates or mutate package surfaces in this baseline goal | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Preserve boundary | + +No mutation-affecting decision in this baseline depends on low, conflicting, or +missing local evidence. + +## Branch Lifecycle Baseline + +### Branch Classes + +| Branch Class | Baseline Rule | Evidence | +|:---|:---|:---| +| long-lived public branch | `main` is the stable public OSS projection line. | current branch inventory; release SOP protected PR path | +| maintenance branch | Reserved for future owner decision; no active local standard or branch evidence defines it today. | `UNKNOWN_LOCAL_STANDARD_GAP` | +| next/future version branch | `draft` or `next` appears in `GOVERNANCE.md` for RFC implementation; creation requires owner/MPGC decision and must not be inferred from task branches. | `GOVERNANCE.md` | +| Codex task branch | Short-lived execution/planning/review vehicle for bounded Codex goals. | current `codex/*` branch inventory; routers | +| projection execution branch | Short-lived vehicle for owner-authorized projection execution; not a release, tag, seal, or merge approval. | projection plan and branch review records | +| projection review branch | Short-lived review vehicle for validating a projection branch before merge decision. | `PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01` | +| release branch | Dedicated branch for release-window work. | release SOP Section 3 | +| governance branch | Dedicated branch for governance records or release-flow records. | release SOP Section 3; merged `governance/*` PRs | +| proposal/candidate branch | Editing vehicle only. The proposal issue/record is the proposal SOT. | `GOVERNANCE.md`; `CONTRIBUTING.md`; MPGC candidate records | +| abandoned branch | Branch with unique commits not contained in `main` or the current active review line and no current owner-approved path. | branch inventory evidence | +| superseded branch | Branch whose commits are contained in a newer active branch or governance record, but which is not yet merged to `main`. | branch containment evidence | +| merged-delete-eligible branch | Branch whose commits are contained in `origin/main` and whose PR/governance record is preserved. | PR #1-#7 and #9 evidence | + +### Lifecycle Statuses + +| Status | Meaning | Allowed Action In This Baseline Goal | +|:---|:---|:---| +| `LONG_LIVED_PUBLIC_MAIN` | Stable public OSS projection line. | Observe only | +| `ACTIVE_REVIEW_BRANCH` | Current review branch or branch under active owner/Codex review. | Observe/codify only | +| `ACTIVE_PROJECTION_BRANCH` | Projection execution branch with owner authorization for projection payload. | Observe/codify only | +| `ACTIVE_PLAN_BRANCH` | Planning branch without execution authority. | Observe/codify only | +| `MERGE_CANDIDATE` | Branch may be proposed for protected PR/merge decision after gates. | No merge here | +| `SUPERSEDED_CANDIDATE` | Branch appears contained in a newer active branch but still needs record/owner cleanup decision. | No deletion here | +| `MERGED_DELETE_ELIGIBLE_CANDIDATE` | Branch appears contained in `origin/main` and has preserved PR/governance evidence. | No deletion here | +| `ABANDONED_REVIEW_REQUIRED` | Branch is not contained in `main` or the active review line and needs separate review. | No deletion here | +| `KEEP_TEMPORARILY_PENDING_OWNER_DECISION` | Branch has unclear or pending governance status. | No deletion here | +| `UNKNOWN_REQUIRES_GOVERNANCE_DECISION` | Branch class or disposition cannot be safely derived from local evidence. | No deletion here | + +### Codex Task Branch TTL + +No exact time-based TTL is defined by local evidence. This baseline therefore +uses lifecycle transitions instead of calendar TTL: + +1. `ACTIVE_PLAN_BRANCH` +2. `ACTIVE_PROJECTION_BRANCH` or `ACTIVE_REVIEW_BRANCH`, when applicable +3. `MERGE_CANDIDATE`, `SUPERSEDED_CANDIDATE`, + `MERGED_DELETE_ELIGIBLE_CANDIDATE`, `ABANDONED_REVIEW_REQUIRED`, or + `UNKNOWN_REQUIRES_GOVERNANCE_DECISION` +4. cleanup plan +5. explicit owner-authorized cleanup execution + +## Branch Cleanup Authorization Policy + +Branch cleanup is a separate mutation category. It requires a future cleanup +goal and must not be performed from this baseline goal. + +Before any remote branch deletion, Codex must produce: + +- full local and remote branch inventory +- current `origin/main` HEAD +- branch SHA and upstream tracking state +- ahead/behind count against `origin/main` +- containment proof against `origin/main` +- containment proof against any active review/projection branch +- mapped PR URL and PR state, if available +- mapped governance record path, if available +- proof that no unique unmerged commit would be lost +- owner authorization naming exact branches to delete +- final no-tag/no-merge/no-release/no-registry compliance record + +Branch existence alone is not governance authority. Governance state must be +recorded in PRs, governance records, release manifests, or proposal records. + +## PR And Merge Boundary + +Public release or projection changes must move through a protected PR path. +Direct public `main` pushes are not part of the normal release path. + +Merge is not authorized by branch existence, green checks, merged predecessor +PRs, clean worktree state, local evidence, or this baseline record. A merge +goal must name the PR, expected head SHA, base branch, required gates, and +owner authorization. + +## Release Object Taxonomy + +| Release Object | Meaning | Requires Public Main Merge First? | Requires Tag/Seal/GitHub Release? | Requires Package Registry Publication? | Owner Authorization | +|:---|:---|:---|:---|:---|:---| +| protocol semantic release | Normative protocol/schema/specification version. | Yes for public release surface. | Tag/seal only if separately authorized. | No. | Required; MPGC/RFC path for normative change. | +| package registry release | npm/PyPI package publication for exact package/version. | Not automatically; public records may be separate. | No, unless a package release tag is separately authorized. | Yes. | Required for exact packages, versions, registries, timing, and scope. | +| public projection release | Public repo snapshot/projection of Dev-approved public-safe surfaces. | Yes before public `main` truth. | No, unless separately authorized. | No. | Required for projection execution and merge. | +| public manifest update | Release metadata contract for Website/Lab/public consumers. | Yes before public release truth. | No by itself. | No by itself. | Required when release/projection scope changes. | +| Git tag | Immutable Git ref marking a release or frozen version state. | Yes unless emergency record says otherwise. | It is the tag action. | No by itself. | Required. | +| GitHub release | Public GitHub release object and announcement surface. | Yes unless separately authorized. | Usually references tag; creation is separate. | No by itself. | Required. | +| release seal | Governance closure/seal record. | Usually after gates and intended release state. | Seal action is separate. | No by itself. | Required. | +| Website pointer update | Downstream Website consumption of public manifest/release pointer. | Depends on Website sync goal. | No by itself. | No. | Required when Website is in scope. | +| Validation Lab pointer update | Downstream Lab consumption of public manifest/release pointer. | Depends on Lab sync goal. | No by itself. | No. | Required when Lab is in scope. | + +Package version, protocol version, public projection snapshot, Git tag, release +seal, and GitHub release are separate governance objects. Do not collapse them +into a single version concept unless a future local governance record explicitly +does so. + +## Release Stop Conditions + +Stop before action if any requested release-like mutation lacks local evidence +or owner authorization: + +- package publish/upload/deprecate/yank/delete/dist-tag mutation +- package version or package manifest change +- release-set or pypi-set change +- public projection execution +- public manifest release-state mutation +- Website or Validation Lab pointer mutation +- Git tag +- release seal +- GitHub release +- merge +- repository migration or package URL migration +- credential value access, printing, copying, or exposure + +## Proposal And Candidate Lifecycle Baseline + +### RFC Baseline + +Normative changes must start as an RFC issue using the RFC template. The +locally supported RFC lifecycle is: + +- `Draft`: proposal submitted as a GitHub Issue +- `Review`: community discussion and MPGC technical review +- `Approval`: MPGC vote +- `Implementation`: merged into `draft` or `next` branch + +This baseline does not create `draft` or `next` branches and does not approve +any normative change. + +### Candidate Baseline + +The local MPGC candidate records support a pre-RFC, non-normative candidate +surface. Locally supported candidate states and outcomes include: + +- `draft` +- `pre_rfc` +- `non_normative_candidate_backlog` +- `review_preparation_ready` +- `decision_needed` +- `reject` +- `defer` +- `keep_backlog` +- `open_rfc` +- `request_more_evidence` +- `accept_as_guide_work_item` +- `accept_as_profile_work_item` +- `accept_as_binding_work_item` + +Candidate records may discuss MPGC, profile, binding, guide, and schema-shaped +pressure, but they remain non-normative until a future owner/MPGC decision +opens or approves a formal path. + +### Proposal Branch Rule + +Proposal or candidate branches are editing vehicles only. They do not determine +proposal status, acceptance, rejection, supersession, implementation, or release +truth. Proposal authority must be recorded in the RFC issue, proposal record, +candidate record, MPGC decision record, PR, or release manifest, as applicable. + +Long-lived proposal branches are not locally authorized by this baseline. +Create or retain them only under a future owner-approved proposal branch policy. + +### Proposal Public-Safe Boundary + +Public-safe proposal surfaces: + +- RFC issues and public PR discussions +- public candidate backlog records +- public MPGC intake/review preparation records that explicitly remain + non-normative/pre-RFC +- public proposal decision records + +Dev-private or owner-decision-required proposal surfaces: + +- raw Dev evidence +- implementation-private evidence +- local execution logs +- credential/auth evidence +- package preflight raw output +- product/runtime-private traces +- owner-private planning notes not prepared for public projection + +## Harness And Router Integration + +This baseline is referenced by: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.codex/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `.codex/skills/release-projection-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` + +The harness integration is a pointer and precondition update only. It does not +authorize branch cleanup, merge, tag, seal, release, public projection +execution, package mutation, or registry mutation. + +## Unknowns And Gaps Retained + +These gaps are retained for later owner decision: + +- exact time-based TTL for Codex task branches +- exact branch cleanup execution workflow and branch deletion batch format +- maintenance branch naming and creation policy +- long-lived proposal branch policy +- GitHub release naming, body, and asset convention +- release seal convention and seal record template +- public projection release naming convention +- complete candidate lifecycle beyond current pre-RFC records +- draft/next branch creation criteria for future normative RFC implementation + +## Non-Actions + +This baseline did not: + +- delete, close, or create any branch beyond the authorized task branch +- merge, rebase, or cherry-pick +- create a PR +- create a tag +- create a release seal +- create a GitHub release +- execute public projection +- mutate package/source/schema/docs/release-manifest surfaces +- publish or upload packages +- mutate npm, PyPI, Website, Validation Lab, downstream repos, Dev repo, or V1 +- read, print, copy, commit, or expose credentials or tokens + +## Recommended Next Goal + +`PUBLIC-OSS-BRANCH-INVENTORY-CLEANUP-PLAN-01` + +This next goal should use this baseline to classify each branch and produce an +owner-ready cleanup plan. It must not delete branches unless separately +authorized. + +## Final Verdict + +`COMPLETE_PUBLIC_OSS_BRANCH_RELEASE_PROPOSAL_GOVERNANCE_BASELINE_CODIFIED` diff --git a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md index 55b730d6..cf2b1f1f 100644 --- a/governance/codex-goals/CODEX-GOAL-TEMPLATE.md +++ b/governance/codex-goals/CODEX-GOAL-TEMPLATE.md @@ -196,6 +196,33 @@ evidence for a mutation-affecting decision, stop with the matching blocker: - `BLOCKED_TAG_SEAL_RELEASE_NOT_AUTHORIZED` - `BLOCKED_SUBSTANTIVE_RELEASE_DECISION_WITHOUT_LOCAL_EVIDENCE` +## Public OSS Branch / Release / Proposal Classification + +When the task touches branch lifecycle, branch cleanup, PR/merge readiness, +release object taxonomy, Git tag, release seal, GitHub release, public +projection release state, RFC, proposal, or MPGC candidate lifecycle, apply: + +- `governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md` + +Declare: + +```yaml +public_oss_branch_release_proposal_governance: + baseline: + branch_classification: + branch_lifecycle_status: + release_object_classification: + proposal_candidate_classification: + cleanup_authorized: + merge_tag_seal_release_authorized: + owner_decision_required: + forbidden_actions: +``` + +Branch existence is evidence only. Branch cleanup, branch deletion, merge, tag, +seal, GitHub release, public projection execution, package publication, and +registry mutation require later exact owner authorization. + ## Branch Create or use a task branch from current `main` unless the owner instructs otherwise. Report whether the branch continues an existing Codex ops branch or is a follow-up branch. From 0741c5915ebc330013fbb4f85cbcb6878fc38d35 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Mon, 8 Jun 2026 23:55:12 +0800 Subject: [PATCH 18/24] governance: record public OSS projection protected merge decision --- .../agent-reviewer-selection.json | 26 ++ .../branch-lineage-readiness-check.json | 20 ++ ...ranch-release-proposal-baseline-check.json | 25 ++ .../evidence-hygiene-check.json | 14 + .../final-verdict.json | 8 + .../local-baseline-evidence-table.json | 47 +++ .../no-forbidden-action-compliance.json | 24 ++ .../projection-review-closure-check.json | 20 ++ .../protected-merge-decision.json | 19 + .../public-sop-merge-decision-check.json | 16 + .../release-projection-router-result.json | 39 ++ .../repo-truth.json | 26 ++ .../task-governance-router-result.json | 47 +++ ...-PROJECTION-PROTECTED-MERGE-DECISION-01.md | 336 ++++++++++++++++++ 14 files changed, 667 insertions(+) create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-lineage-readiness-check.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-release-proposal-baseline-check.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/evidence-hygiene-check.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/final-verdict.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/no-forbidden-action-compliance.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/projection-review-closure-check.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/protected-merge-decision.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/public-sop-merge-decision-check.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/release-projection-router-result.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/repo-truth.json create mode 100644 artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/task-governance-router-result.json create mode 100644 governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/agent-reviewer-selection.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/agent-reviewer-selection.json new file mode 100644 index 00000000..f8123235 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/agent-reviewer-selection.json @@ -0,0 +1,26 @@ +{ + "actual_subagent_invocation": { + "attempted": false, + "reason": "local reviewer perspectives applied; no delegated mutation authorized" + }, + "selected_review_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "package_surface_auditor", + "branch_lifecycle_reviewer", + "proposal_candidate_governance_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer" + ], + "local_agent_files": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/product_boundary_reviewer.toml", + ".codex/agents/protocol_schema_reviewer.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".codex/agents/runtime_binding_reviewer.toml" + ], + "applied_locally": true +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-lineage-readiness-check.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-lineage-readiness-check.json new file mode 100644 index 00000000..2567bc90 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-lineage-readiness-check.json @@ -0,0 +1,20 @@ +{ + "target_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "target_branch_remote_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "origin_main_head": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "review_branch": "codex/public-oss-projection-execution-branch-review-01", + "review_branch_head": "d957615bc7ad1d686a23e68da4236ccc2aee5d8f", + "baseline_branch": "codex/public-oss-branch-release-proposal-governance-baseline-01", + "baseline_branch_head": "e28ef5add9773d9600485135d7fb8bc1bfac8bbc", + "ahead_behind_vs_origin_main": { + "ahead": 14, + "behind": 0 + }, + "target_contains_origin_main": true, + "target_contained_in_origin_main": false, + "target_contained_in_review": true, + "review_contained_in_baseline": true, + "target_contained_in_baseline": true, + "no_merge_already_occurred": true, + "verdict": "PASS_BRANCH_LINEAGE_READY_FOR_MERGE_DECISION" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-release-proposal-baseline-check.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-release-proposal-baseline-check.json new file mode 100644 index 00000000..f9f1e06b --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/branch-release-proposal-baseline-check.json @@ -0,0 +1,25 @@ +{ + "baseline_record": "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "baseline_applies": true, + "classifications": { + "target_execution_branch": [ + "ACTIVE_PROJECTION_BRANCH", + "MERGE_CANDIDATE" + ], + "review_branch": [ + "ACTIVE_REVIEW_BRANCH", + "MERGE_CANDIDATE" + ], + "baseline_branch": [ + "ACTIVE_REVIEW_BRANCH", + "governance_followup_branch_supporting_merge_readiness" + ], + "decision_branch": [ + "MERGE_CANDIDATE_AFTER_PUSH_AND_REVIEW" + ] + }, + "branch_cleanup_separate": true, + "branch_existence_is_not_authority": true, + "merge_requires_future_exact_owner_authorization": true, + "verdict": "PASS_BRANCH_RELEASE_PROPOSAL_BASELINE_APPLIED" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/evidence-hygiene-check.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/evidence-hygiene-check.json new file mode 100644 index 00000000..ead6a451 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/evidence-hygiene-check.json @@ -0,0 +1,14 @@ +{ + "credential_values_read_printed_copied_or_committed": false, + ".npmrc_contents_inspected_or_committed": false, + ".pypirc_contents_inspected_or_committed": false, + "raw_npm_pypi_stdout_stderr_copied": false, + "raw_dev_evidence_copied": false, + "internal_harness_files_copied_from_dev": false, + "node_modules_added": false, + "venv_added": false, + "wheels_sdists_tarballs_added": false, + "projected_package_release_manifest_content_modified": false, + "local_paths": "repo_truth_governance_evidence_only", + "verdict": "PASS_EVIDENCE_HYGIENE" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/final-verdict.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/final-verdict.json new file mode 100644 index 00000000..f0dca17c --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/final-verdict.json @@ -0,0 +1,8 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01", + "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_MERGE_DECISION_READY_FOR_OWNER_MERGE_EXECUTION", + "decision": "ELIGIBLE_FOR_LATER_OWNER_AUTHORIZED_PROTECTED_MERGE_EXECUTION", + "merge_executed": false, + "remaining_blockers": [], + "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/local-baseline-evidence-table.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..ca92044a --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/local-baseline-evidence-table.json @@ -0,0 +1,47 @@ +[ + { + "decision_area": "public_repo_role", + "local_evidence_file": "AGENTS.md; .codex/config.toml; governance/release/MPLP-RELEASE-SOP.md", + "evidence_signal": "public repo is clean OSS projection; Dev is release/package truth", + "derived_rule": "decide merge readiness in public repo; do not mutate Dev", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "projection_execution_authority", + "local_evidence_file": "governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md", + "evidence_signal": "branch-only projection executed; no merge/tag/seal/release authorized", + "derived_rule": "treat execution branch as reviewed candidate only", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "projection_review_closure", + "local_evidence_file": "governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md", + "evidence_signal": "review verified target branch payload and readiness for protected merge decision", + "derived_rule": "decision may mark eligible for later owner merge execution", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "branch_release_proposal_baseline", + "local_evidence_file": "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "evidence_signal": "branch existence is evidence only; merge requires exact owner authorization", + "derived_rule": "this decision does not merge; later goal must name exact branch/SHA", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "sop_merge_path", + "local_evidence_file": "governance/release/MPLP-RELEASE-SOP.md", + "evidence_signal": "public release changes require protected PR path and merge evidence", + "derived_rule": "later merge execution must use protected path and record merge commit/post-merge HEAD", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + } +] diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/no-forbidden-action-compliance.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/no-forbidden-action-compliance.json new file mode 100644 index 00000000..8fc1ef15 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/no-forbidden-action-compliance.json @@ -0,0 +1,24 @@ +{ + "merge_to_public_main": false, + "branch_deletion": false, + "tag": false, + "seal": false, + "github_release": false, + "npm_publish": false, + "pypi_upload": false, + "registry_mutation": false, + "dist_tag_mutation": false, + "deprecate": false, + "dev_repo_mutation": false, + "website_mutation": false, + "validation_lab_mutation": false, + "cognitive_os_mutation": false, + "solocrew_mutation": false, + "v1_mutation": false, + "deploy": false, + "credential_or_token_access": false, + "raw_dev_evidence_copy": false, + "internal_harness_copy": false, + "projected_package_release_manifest_content_mutation": false, + "verdict": "PASS_NO_FORBIDDEN_ACTIONS" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/projection-review-closure-check.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/projection-review-closure-check.json new file mode 100644 index 00000000..36c09629 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/projection-review-closure-check.json @@ -0,0 +1,20 @@ +{ + "review_record": "governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md", + "review_final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_BRANCH_REVIEW_READY_FOR_PROTECTED_MERGE_DECISION", + "reviewed_target_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "reviewed_target_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "checks": { + "allowlist_compliance": "PASS", + "denylist_compliance": "PASS", + "redaction_compliance": "PASS", + "no_raw_dev_evidence_leakage": "PASS", + "no_internal_harness_leakage": "PASS", + "no_local_path_or_credential_leakage": "PASS_WITH_REPO_TRUTH_PATH_EVIDENCE_ONLY", + "no_dist_mutation": "PASS", + "no_active_compliance_dependency_import_export": "PASS", + "public_manifest_validation": "PASS", + "package_surface_gates": "PASS" + }, + "remaining_blockers": [], + "verdict": "PASS_PROJECTION_REVIEW_CLOSED" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/protected-merge-decision.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/protected-merge-decision.json new file mode 100644 index 00000000..86359af2 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/protected-merge-decision.json @@ -0,0 +1,19 @@ +{ + "decision": "ELIGIBLE_FOR_LATER_OWNER_AUTHORIZED_PROTECTED_MERGE_EXECUTION", + "merge_executed_by_this_goal": false, + "reviewed_target_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "reviewed_target_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "recommended_later_merge_source_branch": "codex/public-oss-projection-protected-merge-decision-01", + "recommended_later_merge_source_head": "final pushed HEAD of decision branch", + "recommended_later_merge_target_branch": "main", + "reason": "decision branch contains target execution branch, projection review record, branch/release/proposal baseline, and protected merge decision record", + "required_next_authorization": { + "must_name_source_branch": true, + "must_name_source_head": true, + "must_name_target_branch": true, + "must_name_repo": true, + "must_name_mutation_category": "merge_execution" + }, + "remaining_blockers": [], + "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/public-sop-merge-decision-check.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/public-sop-merge-decision-check.json new file mode 100644 index 00000000..a453521a --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/public-sop-merge-decision-check.json @@ -0,0 +1,16 @@ +{ + "sop_file": "governance/release/MPLP-RELEASE-SOP.md", + "checks": { + "dedicated_branch": true, + "public_main_not_pushed_directly": true, + "release_scope_recorded": true, + "protocol_manifest_status_recorded": true, + "website_lab_needed_decision_recorded": true, + "package_dry_run_or_replacement_status_recorded_if_in_scope": true, + "identity_and_forbidden_overclaim_scan_status_recorded": true, + "evidence_paths_recorded": true, + "merge_commit_recorded": "not_applicable_until_later_merge_execution", + "post_merge_head_recorded": "not_applicable_until_later_merge_execution" + }, + "verdict": "PASS_SOP_REQUIREMENTS_SATISFIED_TO_DECISION_STAGE" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/release-projection-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/release-projection-router-result.json new file mode 100644 index 00000000..7771379b --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/release-projection-router-result.json @@ -0,0 +1,39 @@ +{ + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "router_skill": ".agents/skills/release-projection-governance-router/SKILL.md", + "router_run_before_release_like_work": true, + "release_like_task": true, + "workflow_type": [ + "protected merge decision", + "public OSS projection merge-readiness decision", + "no merge execution" + ], + "local_standard_source_files": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/release/MPLP-RELEASE-SOP.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md", + "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md" + ], + "required_owner_authorization": { + "merge_decision_record": "authorized_by_goal", + "merge_execution": "required_future_exact_owner_authorization", + "tag_seal_github_release": "required_future_exact_owner_authorization", + "registry_action": "required_future_exact_owner_authorization" + }, + "allowed_mutations": [ + "public repo governance decision record", + "public repo lightweight evidence JSON" + ], + "forbidden_actions": [ + "merge execution", + "tag", + "seal", + "GitHub release", + "registry mutation", + "public projection execution", + "branch cleanup" + ], + "discovery_verdict": "RELEASE_PROJECTION_WORKFLOW_DISCOVERY_PERFORMED" +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/repo-truth.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/repo-truth.json new file mode 100644 index 00000000..f647269a --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/repo-truth.json @@ -0,0 +1,26 @@ +{ + "goal_id": "PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "public_repo": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "role": "PUBLIC_OSS_PROJECTION", + "decision_branch": "codex/public-oss-projection-protected-merge-decision-01", + "starting_branch": "codex/public-oss-branch-release-proposal-governance-baseline-01", + "starting_head": "e28ef5add9773d9600485135d7fb8bc1bfac8bbc", + "origin_main_head": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "target_execution_branch": "codex/owner-authorize-public-oss-projection-execution-01", + "target_execution_branch_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "review_branch": "codex/public-oss-projection-execution-branch-review-01", + "review_branch_head": "d957615bc7ad1d686a23e68da4236ccc2aee5d8f", + "branch_release_proposal_baseline_branch": "codex/public-oss-branch-release-proposal-governance-baseline-01", + "branch_release_proposal_baseline_head": "e28ef5add9773d9600485135d7fb8bc1bfac8bbc" + }, + "dev_repo_read_only": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "role": "PROTOCOL_PACKAGE_RELEASE_DEV_TRUTH", + "observed_branch": "codex/release-projection-governance-harness-codification-01", + "observed_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main_head": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "mutation_performed": false + } +} diff --git a/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/task-governance-router-result.json b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/task-governance-router-result.json new file mode 100644 index 00000000..896125a3 --- /dev/null +++ b/artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/task-governance-router-result.json @@ -0,0 +1,47 @@ +{ + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "router_skill": ".agents/skills/task-governance-router/SKILL.md", + "router_run_before_substantive_work": true, + "task_type": [ + "public_oss_projection_protected_merge_decision", + "projection_branch_merge_readiness_decision", + "branch_release_proposal_baseline_applied", + "no_merge_no_tag_no_seal" + ], + "sot_layer": [ + "L1 Projection Source merge-readiness decision", + "L3 Verification Evidence", + "L4 Publication Surface governance", + "L6 Codex Execution Governance" + ], + "selected_local_governance_baseline": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md", + "governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md", + "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md" + ], + "forbidden_actions": [ + "merge", + "branch deletion", + "tag", + "seal", + "GitHub release", + "package publish/upload", + "registry mutation", + "projection payload mutation", + "public manifest mutation", + "package/source/schema/docs mutation", + "Dev/Website/Lab/downstream/V1 mutation", + "credential access" + ], + "evidence_outputs": [ + "governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md", + "artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/*.json" + ], + "verdict": "ROUTER_APPLIED" +} diff --git a/governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md b/governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md new file mode 100644 index 00000000..4e99faab --- /dev/null +++ b/governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md @@ -0,0 +1,336 @@ +--- +entry_surface: repository +doc_type: governance-decision +status: active +authority: MPLP public OSS projection protected merge decision governance +protocol_version: "1.0.0" +doc_id: "PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01" +title: "Public OSS Projection Protected Merge Decision 01" +created_at: "2026-06-08" +goal_id: "PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01" +--- + +# Public OSS Projection Protected Merge Decision 01 + +## Scope + +This record decides whether the reviewed public OSS projection execution branch +is eligible for a later owner-authorized protected merge execution into public +`main`. + +Canonical workspace root: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis` + +Primary target repository: + +- `Coregentis/MPLP-Protocol` + +Read-only authority source repository: + +- `Coregentis/MPLP-Protocol-Dev` + +Reviewed projection execution branch: + +- `codex/owner-authorize-public-oss-projection-execution-01` +- reviewed target HEAD: + `98ab309dc00393efe7dc1f35d259b519a6c9bf93` + +Review branch: + +- `codex/public-oss-projection-execution-branch-review-01` +- review HEAD: + `d957615bc7ad1d686a23e68da4236ccc2aee5d8f` + +Branch/release/proposal baseline branch: + +- `codex/public-oss-branch-release-proposal-governance-baseline-01` +- baseline HEAD: + `e28ef5add9773d9600485135d7fb8bc1bfac8bbc` + +This is not a merge execution goal. This record does not merge, delete +branches, tag, seal, create a GitHub release, publish/upload packages, mutate +registries, mutate Website, mutate Validation Lab, mutate downstream repos, +mutate Dev, mutate V1, or modify projection payload files. + +## Router Result + +`TASK-GOVERNANCE-ROUTER-01` and +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` were applied before this decision +record was created. + +Task classification: + +- `public_oss_projection_protected_merge_decision` +- `projection_branch_merge_readiness_decision` +- `branch_release_proposal_baseline_applied` +- `no_merge_no_tag_no_seal` + +SOT layer classification: + +- `L1 Projection Source merge-readiness decision` +- `L3 Verification Evidence` +- `L4 Publication Surface governance` +- `L6 Codex Execution Governance` + +Selected public baseline: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` +- `governance/release/MPLP-RELEASE-SOP.md` +- `GOVERNANCE.md` +- `CONTRIBUTING.md` +- `release-config.yaml` +- projection plan, execution, review, and branch/release/proposal baseline + records + +Selected Dev comparison baseline: + +- Dev `AGENTS.md` +- Dev `origin/main` observed as + `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- Dev protected merge and release/projection governance records, read-only + +Selected branch/release/proposal baseline: + +- `governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md` + +Prompt assertions were not treated as governance authority unless supported by +local repository evidence. + +## Repo Truth + +Public repo: + +- decision branch: + `codex/public-oss-projection-protected-merge-decision-01` +- starting branch: + `codex/public-oss-branch-release-proposal-governance-baseline-01` +- starting HEAD: + `e28ef5add9773d9600485135d7fb8bc1bfac8bbc` +- public `origin/main`: + `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- target execution branch: + `codex/owner-authorize-public-oss-projection-execution-01` +- target execution branch HEAD: + `98ab309dc00393efe7dc1f35d259b519a6c9bf93` +- review branch HEAD: + `d957615bc7ad1d686a23e68da4236ccc2aee5d8f` +- baseline branch HEAD: + `e28ef5add9773d9600485135d7fb8bc1bfac8bbc` + +Dev repo read-only: + +- observed branch: + `codex/release-projection-governance-harness-codification-01` +- observed local HEAD: + `93bcc881cc45e13d12dcc4d0ba26b8f11d996b23` +- Dev `origin/main`: + `00f57406005fe0a23f27c2e3e82a8c27e99dba6d` +- worktree state: clean + +## Local Baseline Evidence Table + +| Decision Area | Local Evidence File | Evidence Signal | Derived Rule | Confidence | Conflict? | Action | +|:---|:---|:---|:---|:---|:---|:---| +| Public repo role | `AGENTS.md`; `.codex/config.toml`; release SOP | Public repo is clean OSS projection; Dev is release/package truth | Decide merge readiness here; do not mutate Dev | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Projection execution authority | `OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01` | Branch-only projection executed; no merge/tag/seal/release authorized | Treat execution branch as reviewed candidate only | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Projection review closure | `PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01` and evidence | Review verified target HEAD, payload compliance, safety, and readiness for protected merge decision | Merge decision may mark eligible for later owner merge execution | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Branch baseline | `PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01` | Branch existence is evidence only; merge requires exact owner authorization | This decision does not merge; later goal must name exact branch/SHA | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| SOP merge path | `MPLP-RELEASE-SOP.md` | Public release changes require protected PR path and merge evidence | Later execution must use protected PR/merge path and record merge commit | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | +| Release/tag/seal boundary | `AGENTS.md`; release router; SOP Sections 11-14 | Tag, seal, GitHub release, registry mutation remain separate owner-authorized actions | Keep all forbidden in this goal | `HIGH_LOCAL_BASELINE_EXPLICIT` | No | Apply | + +No decision in this record depends on low, conflicting, or missing local +evidence. + +## Branch Lineage / Readiness Check + +Current lineage evidence: + +- target branch remote HEAD: + `98ab309dc00393efe7dc1f35d259b519a6c9bf93` +- public `origin/main` HEAD: + `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- target branch ahead/behind vs `origin/main`: `+14 / -0` +- target branch contains `origin/main`: yes +- target branch is contained in review branch: yes +- review branch is contained in branch/release/proposal baseline branch: yes +- target branch is contained in baseline branch: yes +- target branch is not contained in `origin/main`: merge has not already + occurred + +The reviewed execution branch is therefore lineage-safe for merge-readiness +decision. Because later review and baseline records sit above the target branch, +the recommended later merge execution source should be the final pushed head of +this decision branch, not the older target execution branch alone, so that +review and decision evidence are included in the protected PR. + +## Projection Review Closure Check + +`PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01` verified: + +- target branch and expected target HEAD matched +- allowlist compliance passed +- denylist compliance passed +- redaction compliance passed +- release-config unchanged in execution payload +- package `dist/**` unchanged +- public manifest validation passed +- Website/Lab/downstream follow-ups recorded and not mutated +- no merge/tag/seal/release occurred +- no registry mutation occurred +- no credential values, `.npmrc`, `.pypirc`, env values, raw npm/PyPI + stdout/stderr, raw Dev evidence, raw Dev package preflight evidence, + forbidden local path leakage, node_modules, venv, wheels, sdists, tarballs, + or package dist mutation were found +- `@mplp/conformance` had no active `@mplp/compliance` + dependency/import/export +- `@mplp/devtools` active dependency points to `@mplp/conformance` + +Review final verdict: + +- `COMPLETE_PUBLIC_OSS_PROJECTION_BRANCH_REVIEW_READY_FOR_PROTECTED_MERGE_DECISION` + +## Public SOP Merge Decision Check + +The public SOP requirements are satisfied up to decision stage: + +- dedicated branch: yes +- public `main` not pushed directly: yes +- release/projection scope recorded: yes +- protocol manifest status recorded: yes +- Website/Lab needed-or-not-needed decision recorded: yes, follow-ups remain + `WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01` and + `VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01` +- package dry-run/replacement status recorded where package surfaces are in + scope: yes +- identity and forbidden-overclaim scan status recorded: yes +- evidence paths recorded: yes +- merge commit: not applicable yet; must be recorded by later merge execution + goal if owner authorizes merge +- post-merge HEAD: not applicable yet; must be recorded by later merge + execution goal if owner authorizes merge + +## Branch / Release / Proposal Baseline Check + +`PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01` applies. + +Decision classification: + +- target execution branch: + `ACTIVE_PROJECTION_BRANCH` and `MERGE_CANDIDATE` +- review branch: + `ACTIVE_REVIEW_BRANCH` and `MERGE_CANDIDATE` +- baseline branch: + `ACTIVE_REVIEW_BRANCH` / governance follow-up branch supporting merge + readiness decision +- decision branch: + `MERGE_CANDIDATE` after this record is pushed and reviewed + +Branch cleanup remains separate. Branch deletion requires later inventory, +lineage proof, governance record mapping, no-unique-commit-loss proof, and +owner authorization naming exact branches. + +Branch existence is not governance authority. The authority for later merge +execution must be an owner authorization naming the exact PR/branch/SHA and +scope. + +## Evidence Hygiene Check + +Evidence hygiene passed for this decision: + +- no credential values read, printed, copied, or committed +- no `.npmrc` or `.pypirc` contents inspected or committed +- no raw npm/PyPI stdout or stderr copied into this record +- no raw Dev evidence copied +- no internal harness files copied from Dev +- no node_modules, venv, wheels, sdists, or tarballs added +- no projected package/release/manifest content modified in this decision goal +- local paths appear only as repo-truth governance evidence where already + required by local operating rules + +## Protected Merge Decision + +Decision: + +`ELIGIBLE_FOR_LATER_OWNER_AUTHORIZED_PROTECTED_MERGE_EXECUTION` + +The reviewed projection execution payload is eligible for a later protected +merge execution, subject to exact owner authorization and final pre-merge gate +rerun. + +This decision does not authorize or perform merge execution. + +Required source for later merge execution: + +- preferred source branch: + `codex/public-oss-projection-protected-merge-decision-01` +- preferred source commit: + the final pushed HEAD of this decision branch +- reason: it contains the reviewed execution branch, the projection review + record, the branch/release/proposal governance baseline, and this protected + merge decision record + +Minimum later merge execution requirements: + +- owner authorization naming the exact source branch, final pushed source HEAD, + target branch `main`, repo, and mutation category +- protected PR path to public `main` +- final repo-truth-first +- final public manifest validation +- final JSON parse for relevant evidence +- final skill mirror diff +- final no-secret/no-raw-evidence/no-local-path leakage scan +- final protected surface scan +- final no tag/seal/GitHub release/registry mutation confirmation unless + separately authorized +- merge commit and post-merge `main` HEAD recorded after merge + +## Remaining Blockers + +No blockers remain for owner merge execution authorization. + +Remaining non-blocking follow-ups: + +- Website manifest pointer sync, if owner wants Website pointer update after + public merge +- Validation Lab manifest pointer sync, if owner wants Lab pointer update after + public merge +- branch inventory cleanup plan after merge state is settled +- tag/seal/GitHub release policy remains separate and not authorized here + +## Files Changed + +This goal changes only: + +- `governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md` +- `artifacts/governance/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01/*.json` + +## Non-Actions + +This goal did not: + +- merge to public `main` +- create, close, or delete PRs +- delete branches +- tag +- seal +- create a GitHub release +- publish/upload packages +- mutate registries or dist-tags +- deprecate or yank packages +- mutate package/source/schema/docs/release-manifest content +- mutate Website, Validation Lab, Cognitive OS, SoloCrew, Dev, or V1 +- deploy +- access credential values + +## Recommended Next Goal + +`OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01` + +## Final Verdict + +`COMPLETE_PUBLIC_OSS_PROJECTION_MERGE_DECISION_READY_FOR_OWNER_MERGE_EXECUTION` From 100d3c33bcb73cf23cc077e11b4bd0ef4d4a2457 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 9 Jun 2026 00:26:10 +0800 Subject: [PATCH 19/24] governance: record public OSS projection merge execution --- .../agent-reviewer-selection.json | 39 +++ .../branch-cleanup-still-blocked.json | 11 + .../final-verdict.json | 12 + .../local-baseline-evidence-table.json | 70 +++++ .../merge-execution-summary.json | 23 ++ .../no-forbidden-action-compliance.json | 27 ++ .../owner-merge-authorization.json | 36 +++ .../post-merge-main-verification.json | 34 +++ .../pre-merge-branch-lineage-check.json | 24 ++ .../pre-merge-evidence-hygiene-check.json | 19 ++ .../pre-merge-projection-review-check.json | 30 ++ .../release-projection-router-result.json | 80 ++++++ .../repo-truth-before.json | 36 +++ .../task-governance-router-result.json | 93 +++++++ .../website-lab-followup-boundary.json | 11 + ...UBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md | 258 ++++++++++++++++++ 16 files changed, 803 insertions(+) create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/merge-execution-summary.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/owner-merge-authorization.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-branch-lineage-check.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-evidence-hygiene-check.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-projection-review-check.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/release-projection-router-result.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/repo-truth-before.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/task-governance-router-result.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json create mode 100644 governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/agent-reviewer-selection.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/agent-reviewer-selection.json new file mode 100644 index 00000000..606fe40b --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/agent-reviewer-selection.json @@ -0,0 +1,39 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "actual_subagent_invocation": { + "attempted": true, + "succeeded": false, + "reason": "active thread agent limit reached", + "fallback": "selected reviewer perspectives applied locally" + }, + "local_agent_files": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/product_boundary_reviewer.toml", + ".codex/agents/protocol_schema_reviewer.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".codex/agents/runtime_binding_reviewer.toml" + ], + "selected_review_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "package_surface_auditor", + "branch_lifecycle_reviewer", + "proposal_candidate_governance_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer" + ], + "reviewer_lane_result": { + "governance_secretariat": "PASS_LOCAL_BASELINE_AND_RECORD_REQUIREMENTS_SELECTED", + "release_governance_reviewer": "PASS_NO_TAG_SEAL_RELEASE_REGISTRY_ACTION_AUTHORIZED_OR_PERFORMED", + "projection_boundary_reviewer": "PASS_PUBLIC_REPO_ONLY_WITH_DEV_READ_ONLY", + "security_no_secret_reviewer": "PASS_NO_CREDENTIAL_VALUE_ACCESS_OR_RECORDING", + "package_surface_auditor": "PASS_NO_PACKAGE_SURFACE_MUTATION_OUTSIDE_REVIEWED_MERGE", + "branch_lifecycle_reviewer": "PASS_NO_BRANCH_DELETE_OR_CLEANUP", + "proposal_candidate_governance_reviewer": "PASS_BRANCH_RELEASE_PROPOSAL_BASELINE_APPLIED", + "website_boundary_reviewer": "PASS_WEBSITE_FOLLOWUP_ONLY", + "validation_lab_boundary_reviewer": "PASS_VALIDATION_LAB_FOLLOWUP_ONLY" + } +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json new file mode 100644 index 00000000..920662aa --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json @@ -0,0 +1,11 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "branch_cleanup_authorized": false, + "branch_deletion_authorized": false, + "source_branch": "codex/public-oss-projection-protected-merge-decision-01", + "source_branch_deleted": false, + "remote_source_branch_deleted": false, + "branch_inventory_use": "merge_safety_only", + "required_future_authorization": "explicit owner-authorized branch cleanup goal", + "verdict": "PASS_BRANCH_CLEANUP_STILL_BLOCKED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json new file mode 100644 index 00000000..7c5e26ef --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json @@ -0,0 +1,12 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "local_merge_commit": "abc8010df1e793320f3e7d3e4760fd71debc35c3", + "expected_source_commit": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", + "target_branch": "main", + "remaining_blockers_before_push": [], + "push_required": true, + "push_rejection_stop_condition": "BLOCKED_MAIN_PUSH_REJECTED", + "recommended_next_goal": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_MERGED_TO_MAIN", + "verification_note": "final origin/main SHA is verified after this evidence commit is pushed and reported in the final execution report" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/local-baseline-evidence-table.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..2fbc85d5 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/local-baseline-evidence-table.json @@ -0,0 +1,70 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "rows": [ + { + "decision_area": "canonical workspace and repo authority", + "local_evidence_file": "AGENTS.md", + "evidence_signal": "Coregentis is canonical workspace root; MPLP-Protocol is public OSS projection; MPLP-Protocol-Dev is Dev/package/release truth", + "derived_rule": "perform only public projection merge in MPLP-Protocol and keep Dev read-only", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "dynamic governance baseline selection", + "local_evidence_file": "AGENTS.md; .agents/skills/task-governance-router/SKILL.md", + "evidence_signal": "dynamic baseline selection is required before non-trivial tasks", + "derived_rule": "select and record public projection, branch lifecycle, release projection, and Dev comparison baselines", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "release/projection workflow routing", + "local_evidence_file": ".agents/skills/release-projection-governance-router/SKILL.md", + "evidence_signal": "public OSS projection and merge-to-release workflows are release-like triggers", + "derived_rule": "run release projection router before merge execution", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "branch/release/proposal baseline", + "local_evidence_file": "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "evidence_signal": "branch existence is evidence only; merge requires exact owner authorization", + "derived_rule": "merge only the named branch and source SHA; do not delete or clean branches", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "projection merge readiness", + "local_evidence_file": "governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md", + "evidence_signal": "decision verdict is ready for later owner merge execution", + "derived_rule": "owner-authorized merge execution may proceed if source SHA and origin/main boundary still match", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "tag seal release and registry boundary", + "local_evidence_file": "AGENTS.md; .agents/skills/release-projection-governance-router/SKILL.md; owner authorization", + "evidence_signal": "tag, seal, GitHub release, npm/PyPI, and registry mutation require separate owner authorization", + "derived_rule": "do not perform any tag, seal, release, publish, upload, dist-tag, deprecate, or registry mutation", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "Website and Validation Lab boundary", + "local_evidence_file": "PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md; prior projection evidence", + "evidence_signal": "Website and Validation Lab pointer sync are follow-up only", + "derived_rule": "do not mutate Website, Validation Lab, or downstream consumers in this goal", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + } + ], + "overall_confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/merge-execution-summary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/merge-execution-summary.json new file mode 100644 index 00000000..3e697e40 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/merge-execution-summary.json @@ -0,0 +1,23 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "merge_executed": true, + "merge_method": "git merge --no-ff", + "merge_message": "merge: consolidate public OSS projection", + "source_branch": "codex/public-oss-projection-protected-merge-decision-01", + "source_commit": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", + "target_branch": "main", + "pre_merge_origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "merge_commit": "abc8010df1e793320f3e7d3e4760fd71debc35c3", + "merge_commit_parents": [ + "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "0741c5915ebc330013fbb4f85cbcb6878fc38d35" + ], + "conflict_status": "NO_CONFLICT", + "local_worktree_after_merge": "clean_before_evidence_files", + "source_branch_deleted": false, + "tag_created": false, + "seal_created": false, + "github_release_created": false, + "registry_mutation_performed": false, + "verdict": "PASS_LOCAL_MERGE_EXECUTION" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json new file mode 100644 index 00000000..966b854c --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json @@ -0,0 +1,27 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "forbidden_action_compliance": { + "branch_deletion": "NOT_PERFORMED", + "branch_cleanup": "NOT_PERFORMED", + "tag": "NOT_PERFORMED", + "seal": "NOT_PERFORMED", + "github_release": "NOT_PERFORMED", + "npm_publish": "NOT_PERFORMED", + "pypi_upload": "NOT_PERFORMED", + "registry_mutation": "NOT_PERFORMED", + "website_deploy": "NOT_PERFORMED", + "validation_lab_publication": "NOT_PERFORMED", + "cognitive_os_mutation": "NOT_PERFORMED", + "solocrew_mutation": "NOT_PERFORMED", + "dev_repo_mutation": "NOT_PERFORMED", + "v1_mutation": "NOT_PERFORMED", + "downstream_sync": "NOT_PERFORMED", + "out_of_scope_package_source_schema_docs_mutation": "NOT_PERFORMED", + "credential_value_access_or_output": "NOT_PERFORMED" + }, + "tags_observed_after_local_merge_before_push": [ + "protocol-v1.0.0", + "v1.0.0" + ], + "verdict": "PASS_NO_FORBIDDEN_ACTION_COMPLIANCE" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/owner-merge-authorization.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/owner-merge-authorization.json new file mode 100644 index 00000000..3231ad36 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/owner-merge-authorization.json @@ -0,0 +1,36 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "authorization_status": "OWNER_AUTHORIZED", + "authorized_repository": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "authorized_action": "protected_public_oss_projection_merge_execution", + "authorized_source_branch": "codex/public-oss-projection-protected-merge-decision-01", + "authorized_source_commit": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", + "authorized_target_branch": "main", + "authorized_push_target": "origin main", + "allowed_mutations": [ + "merge authorized source into public main", + "create merge execution governance record", + "create lightweight merge execution evidence", + "push public main after gates pass" + ], + "forbidden_mutations": [ + "branch deletion", + "branch cleanup", + "tag", + "seal", + "GitHub release", + "npm publish", + "PyPI upload", + "registry mutation", + "website deploy", + "Validation Lab publication", + "Cognitive_OS mutation", + "SoloCrew mutation", + "Dev repo mutation", + "V1 mutation", + "downstream sync", + "package/source/schema/docs mutation outside already-reviewed merge content" + ], + "credential_boundary": "no credential files or token values read, printed, copied, committed, or exposed", + "verdict": "PASS_OWNER_AUTHORIZATION_EXACT_FOR_MERGE_EXECUTION" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json new file mode 100644 index 00000000..0c5e1e65 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json @@ -0,0 +1,34 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "verification_phase": "post_merge_pre_evidence_commit_pre_push", + "local_main_head_after_merge": "abc8010df1e793320f3e7d3e4760fd71debc35c3", + "source_commit_contained_in_local_main": true, + "merge_commit_parent_check": "PASS", + "origin_main_after_fetch_before_evidence_commit": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "origin_main_drift_before_evidence_commit": false, + "gates_run_before_evidence_commit": { + "git_status": "PASS_EXPECTED_AHEAD_WITH_NEW_EVIDENCE_FILES_ONLY", + "git_diff_check": "PASS", + "json_parse_new_evidence": "PASS", + "json_parse_prior_review_evidence": "PASS", + "frontmatter_check": "PASS", + "required_phrase_scan": "PASS", + "skill_mirror_diff": "PASS", + "toml_structural_fallback": "PASS_PYTHON39_TOMLLIB_UNAVAILABLE", + "public_manifest_validation": "PASS", + "npm_test": "PASS", + "npm_run_lint": "PASS", + "secret_scan": "PASS_JSON_VALUES_AND_MARKDOWN_TOKEN_PATTERNS", + "local_path_scan": "PASS_WITH_OWNER_REPO_TRUTH_PATHS_ONLY", + "forbidden_artifact_scan": "PASS", + "raw_dev_leakage_scan": "PASS_NEGATIVE_SUMMARY_ONLY", + "protected_surface_new_files": "PASS_EVIDENCE_ONLY", + "source_contained_in_main": "PASS", + "tag_inventory": "PASS_UNCHANGED_PROTOCOL_V1_0_0_AND_V1_0_0", + "remote_source_branch_present": "PASS", + "origin_main_drift_check": "PASS_NO_DRIFT" + }, + "remote_push_verification": "performed_after_evidence_commit_push_and_reported_in_final_execution_report", + "self_referential_commit_sha_note": "the evidence commit cannot record its own final SHA without changing that SHA", + "verdict": "PASS_POST_MERGE_LOCAL_VERIFICATION_READY_FOR_GATES_AND_PUSH" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-branch-lineage-check.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-branch-lineage-check.json new file mode 100644 index 00000000..1b16fa77 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-branch-lineage-check.json @@ -0,0 +1,24 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "source_branch": "codex/public-oss-projection-protected-merge-decision-01", + "expected_source_commit": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", + "observed_remote_source_commit": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", + "target_branch": "main", + "pre_merge_origin_main": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "source_vs_origin_main": { + "behind": 0, + "ahead": 18, + "contains_origin_main": true, + "already_merged_to_origin_main_before_execution": false + }, + "required_ancestor_content": { + "contains_projection_execution_branch": true, + "projection_execution_branch_head": "98ab309dc00393efe7dc1f35d259b519a6c9bf93", + "contains_projection_execution_branch_review_record": true, + "projection_execution_branch_review_head": "d957615bc7ad1d686a23e68da4236ccc2aee5d8f", + "contains_branch_release_proposal_baseline": true, + "branch_release_proposal_baseline_head": "e28ef5add9773d9600485135d7fb8bc1bfac8bbc", + "contains_protected_merge_decision_record": true + }, + "lineage_verdict": "PASS_SOURCE_LINEAGE_SAFE_FOR_OWNER_AUTHORIZED_MERGE" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-evidence-hygiene-check.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-evidence-hygiene-check.json new file mode 100644 index 00000000..0f8de4a0 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-evidence-hygiene-check.json @@ -0,0 +1,19 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "prior_leakage_safety_review_verdict": "PASS_LEAKAGE_SAFETY_REVIEW", + "checks": { + "no_credential_values": "PASS", + "no_npmrc_or_pypirc_contents": "PASS", + "no_environment_variable_values": "PASS", + "no_raw_npm_or_pypi_stdout_stderr_recorded": "PASS", + "no_raw_dev_package_preflight": "PASS", + "no_raw_dev_governance_evidence_copy": "PASS", + "no_internal_harness_projection": "PASS", + "no_node_modules_venv_wheels_sdists_tarballs": "PASS", + "no_package_dist_mutation": "PASS", + "no_website_lab_downstream_dev_or_v1_mutation": "PASS", + "no_local_absolute_path_expansion_beyond_repo_truth_and_owner_boundary": "PASS" + }, + "new_evidence_hygiene_policy": "record summarized command results only; do not include credential values, raw registry stderr, raw Dev evidence, or unnecessary local paths", + "verdict": "PASS_PRE_MERGE_EVIDENCE_HYGIENE_CHECK" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-projection-review-check.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-projection-review-check.json new file mode 100644 index 00000000..a50cfead --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/pre-merge-projection-review-check.json @@ -0,0 +1,30 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "required_prior_records": { + "PUBLIC-OSS-PROJECTION-PLAN-01": "present", + "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01": "present", + "PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01": "present", + "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01": "present", + "PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01": "present" + }, + "prior_verdicts": { + "projection_branch_review": "COMPLETE_PUBLIC_OSS_PROJECTION_BRANCH_REVIEW_READY_FOR_PROTECTED_MERGE_DECISION", + "protected_merge_decision": "COMPLETE_PUBLIC_OSS_PROJECTION_MERGE_DECISION_READY_FOR_OWNER_MERGE_EXECUTION", + "projection_plan_compliance": "PASS_PROJECTION_PLAN_COMPLIANCE", + "leakage_safety_review": "PASS_LEAKAGE_SAFETY_REVIEW", + "branch_release_proposal_baseline": "COMPLETE_PUBLIC_OSS_BRANCH_RELEASE_PROPOSAL_GOVERNANCE_BASELINE_CODIFIED" + }, + "fresh_public_projection_state_check": { + "npm_release_set_packages_visible": true, + "npm_devtools_1_0_6_visible": true, + "npm_compliance_legacy_visible_not_active_release_set": true, + "npm_validator_not_visible_internal_ci_only": true, + "pypi_mplp_sdk_1_0_6_visible": true, + "pypi_mplp_sdk_latest_is_1_0_6": true, + "pypi_mplp_sdk_wheel_and_sdist_visible": true, + "conformance_wrapper_present": true, + "devtools_wrapper_present": true + }, + "website_lab_boundary": "followup_only_not_mutated", + "review_verdict": "PASS_PRE_MERGE_PROJECTION_REVIEW_CHECK" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/release-projection-router-result.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/release-projection-router-result.json new file mode 100644 index 00000000..5e4aebeb --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/release-projection-router-result.json @@ -0,0 +1,80 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "executed": true, + "workflow_type": [ + "public_oss_projection", + "merge_to_public_main", + "release_like_projection_governance", + "no_registry_mutation", + "no_tag_no_seal_no_github_release" + ], + "discovery_table": { + "repo_role": "public OSS projection downstream of MPLP-Protocol-Dev truth", + "local_standard_source_files": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/release/MPLP-RELEASE-SOP.md", + "release-config.yaml", + "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md" + ], + "required_gates": [ + "repo_truth_first_public", + "repo_truth_first_dev_read_only", + "skill_mirror_diff", + "json_parse", + "frontmatter_check", + "public_manifest_validation", + "npm_test", + "npm_run_lint", + "no_secret_scan", + "no_local_path_scan_with_repo_truth_exception", + "no_raw_dev_evidence_leakage_scan", + "protected_surface_scan", + "final_main_upstream_verification" + ], + "required_reviewer_lanes": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "package_surface_auditor", + "branch_lifecycle_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer" + ], + "external_baseline_checks": [ + "npm visibility for 11 release-set packages and @mplp/devtools@1.0.6", + "PyPI visibility for mplp-sdk@1.0.6", + "excluded package boundary for @mplp/compliance and @mplp/validator" + ], + "required_owner_authorization": "exact public repo, source branch, source commit, target branch, mutation category, and forbidden actions", + "allowed_mutations": [ + "merge authorized source branch into public main", + "create merge execution governance record", + "create lightweight merge execution evidence", + "push public main if origin/main has not drifted and gates pass" + ], + "forbidden_actions": [ + "branch deletion", + "branch cleanup", + "tag", + "seal", + "GitHub release", + "npm publish", + "PyPI upload", + "registry mutation", + "website deploy", + "Validation Lab publication", + "Dev mutation", + "V1 mutation", + "downstream sync" + ] + }, + "release_projection_baseline_conflict": false, + "dynamic_release_workflow_discovery_performed": true, + "verdict": "PASS_RELEASE_PROJECTION_ROUTER_APPLIED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/repo-truth-before.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/repo-truth-before.json new file mode 100644 index 00000000..1a74fb41 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/repo-truth-before.json @@ -0,0 +1,36 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "captured_at_local": "2026-06-09T00:14:59+0800", + "captured_at_utc": "2026-06-08T16:14:59Z", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "public_repo": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "role": "clean_public_oss_projection", + "remote_origin": "https://github.com/Coregentis/MPLP-Protocol.git", + "branch": "main", + "status_before_evidence_files": "clean_after_local_merge", + "local_head_after_local_merge": "abc8010df1e793320f3e7d3e4760fd71debc35c3", + "origin_main_head_before_merge": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "origin_main_head_after_fetch_before_evidence_commit": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "authorized_source_branch": "codex/public-oss-projection-protected-merge-decision-01", + "authorized_source_head": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", + "tags_observed": [ + "protocol-v1.0.0", + "v1.0.0" + ] + }, + "dev_repo_read_only": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "role": "protocol_package_release_dev_truth", + "branch": "codex/release-projection-governance-harness-codification-01", + "local_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main_head": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "status": "clean_read_only" + }, + "authority_split": { + "workspace_entry": "Coregentis", + "public_projection_truth": "Coregentis/MPLP-Protocol", + "dev_package_release_truth": "Coregentis/MPLP-Protocol-Dev", + "v1_release_role": "frozen_migration_evidence_source" + } +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/task-governance-router-result.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/task-governance-router-result.json new file mode 100644 index 00000000..41b7aa01 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/task-governance-router-result.json @@ -0,0 +1,93 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "executed": true, + "execution_order": [ + "repo_truth_first_public", + "repo_truth_first_dev_read_only", + "dynamic_local_governance_baseline_selection", + "task_type_classification", + "release_projection_router_delegation", + "reviewer_lane_selection", + "gate_selection", + "evidence_output_plan" + ], + "task_type_classification": [ + "owner_authorized_public_oss_projection_merge_execution", + "public_projection_merge_execution", + "protected_public_main_merge", + "branch_lifecycle_governance", + "no_tag_no_seal_no_github_release", + "no_branch_cleanup" + ], + "sot_layer_classification": [ + "L1 Projection Source", + "L3 Verification Evidence", + "L4 Publication Surface", + "L6 Codex Execution Governance" + ], + "selected_local_governance_baseline": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md", + "GOVERNANCE.md", + "CONTRIBUTING.md", + "release-config.yaml", + "governance/04-records/PUBLIC-OSS-RELEASE-SOP-AUTHORITY-RECONCILIATION-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-READINESS-DRIFT-REVIEW-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-PLAN-01.md", + "governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-EXECUTION-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-EXECUTION-BRANCH-REVIEW-01.md", + "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "governance/04-records/PUBLIC-OSS-PROJECTION-PROTECTED-MERGE-DECISION-01.md" + ], + "applicable_repository_governance_methods": [ + "TSV", + "XCV", + "SCV", + "EVC" + ], + "applicable_codex_harness_methods": [ + "SCTM", + "GLFB", + "ITCM", + "RBCT", + "VIM", + "PRM", + "TASK-GOVERNANCE-ROUTER-01" + ], + "forbidden_action_matrix": { + "branch_deletion": "forbidden", + "branch_cleanup": "forbidden", + "tag": "forbidden", + "seal": "forbidden", + "github_release": "forbidden", + "npm_publish": "forbidden", + "pypi_upload": "forbidden", + "registry_mutation": "forbidden", + "website_deploy": "forbidden", + "validation_lab_publication": "forbidden", + "dev_repo_mutation": "forbidden", + "v1_mutation": "forbidden", + "downstream_sync": "forbidden", + "package_source_schema_docs_mutation_outside_reviewed_merge_content": "forbidden" + }, + "stop_conditions": [ + "BLOCKED_TASK_GOVERNANCE_ROUTER_NOT_RUN", + "BLOCKED_DYNAMIC_RELEASE_WORKFLOW_DISCOVERY_NOT_PERFORMED", + "BLOCKED_BRANCH_RELEASE_PROPOSAL_BASELINE_MISSING", + "BLOCKED_BRANCH_RELEASE_PROPOSAL_BASELINE_CONFLICT", + "BLOCKED_RELEASE_GOVERNANCE_BASELINE_MISSING", + "BLOCKED_RELEASE_GOVERNANCE_BASELINE_CONFLICT", + "BLOCKED_PUBLIC_MERGE_SOURCE_HEAD_DRIFT", + "BLOCKED_PUBLIC_ORIGIN_MAIN_DRIFT", + "BLOCKED_PUBLIC_PROJECTION_REVIEW_GAP", + "BLOCKED_EVIDENCE_HYGIENE_FAILURE", + "BLOCKED_MERGE_CONFLICT_NO_MAIN_PUSH", + "BLOCKED_MAIN_PUSH_REJECTED" + ], + "evidence_output_plan": "create the required governance record and JSON evidence bundle for merge execution only" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json new file mode 100644 index 00000000..d260f221 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json @@ -0,0 +1,11 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "website_mutated": false, + "validation_lab_mutated": false, + "downstream_repos_mutated": false, + "website_followup_status": "separate_goal_required", + "validation_lab_followup_status": "separate_goal_required", + "recommended_next_goal": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "validation_lab_goal_remains_followup": "VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "verdict": "PASS_WEBSITE_LAB_FOLLOWUP_BOUNDARY_PRESERVED" +} diff --git a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md new file mode 100644 index 00000000..55867d0d --- /dev/null +++ b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md @@ -0,0 +1,258 @@ +--- +entry_surface: repository +doc_type: governance-execution-record +status: active +authority: MPLP public OSS projection protected merge execution governance +protocol_version: "1.0.0" +doc_id: "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01" +title: "Owner Authorized Public OSS Projection Merge Execution 01" +created_at: "2026-06-09" +goal_id: "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01" +--- + +# Owner Authorized Public OSS Projection Merge Execution 01 + +## Scope + +This record documents the owner-authorized protected merge execution for the +public MPLP OSS projection repository. + +Authorized mutation: + +- merge `codex/public-oss-projection-protected-merge-decision-01` +- expected source commit: + `0741c5915ebc330013fbb4f85cbcb6878fc38d35` +- target branch: `main` +- repository: `Coregentis/MPLP-Protocol` + +Allowed write surface for this goal: + +- the merge commit on public `main` +- this governance record +- lightweight evidence under + `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/` + +This goal did not authorize branch deletion, branch cleanup, tag, seal, GitHub +release, npm publish, PyPI upload, registry mutation, website deploy, +Validation Lab publication, downstream sync, Dev mutation, V1 mutation, or +package/source/schema/docs mutation outside the already-reviewed merge payload. + +## Repo Truth + +Canonical workspace root: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis` + +Primary target repository: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol` + +Read-only authority source repository: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev` + +Public repo local merge result: + +- target branch: `main` +- pre-merge public `origin/main`: + `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- merge commit: + `abc8010df1e793320f3e7d3e4760fd71debc35c3` +- first parent: + `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- second parent: + `0741c5915ebc330013fbb4f85cbcb6878fc38d35` +- merge method: non-fast-forward merge commit +- merge message: `merge: consolidate public OSS projection` + +Dev repo remained read-only and clean during this goal. + +## Task Governance Router Result + +`TASK-GOVERNANCE-ROUTER-01` was applied for this goal. + +Task classification: + +- `owner_authorized_public_oss_projection_merge_execution` +- `public_projection_merge_execution` +- `protected_public_main_merge` +- `branch_lifecycle_governance` +- `no_tag_no_seal_no_github_release` +- `no_branch_cleanup` + +SOT layer classification: + +- `L1 Projection Source` +- `L3 Verification Evidence` +- `L4 Publication Surface` +- `L6 Codex Execution Governance` + +Prompt assertions were used only as the owner request and were checked against +local repository governance. + +## Release Projection Router Result + +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` was applied because this is a +release-like public projection merge workflow. + +Selected public repo baseline: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` +- `governance/release/MPLP-RELEASE-SOP.md` +- `GOVERNANCE.md` +- `CONTRIBUTING.md` +- `release-config.yaml` +- prior public projection plan, execution, review, branch/release/proposal + baseline, and protected merge decision records + +Selected Dev comparison baseline: + +- Dev repo `AGENTS.md` +- Dev protected merge and release evidence closure records, read-only +- Dev release-set, pypi-set, package publish verification, and Devtools publish + verification records, read-only + +## Agents / Reviewers Selected + +The local router selected these reviewer perspectives: + +- `governance_secretariat` +- `release_governance_reviewer` +- `projection_boundary_reviewer` +- `security_no_secret_reviewer` +- `package_surface_auditor` +- `branch_lifecycle_reviewer` +- `proposal_candidate_governance_reviewer` +- `website_boundary_reviewer` +- `validation_lab_boundary_reviewer` + +Actual subagent invocation was attempted but blocked by the active thread's +agent limit. The reviewer lanes were therefore applied locally. + +## Local Baseline Evidence Table Summary + +No mutation-affecting decision depended on missing, conflicting, or low +confidence local evidence. The detailed baseline table is recorded in +`local-baseline-evidence-table.json`. + +## Owner Merge Authorization + +Owner authorization named the exact repository, source branch, source commit, +target branch, and mutation category. The allowed mutation was public `main` +merge execution only. + +## Pre-Merge Branch Lineage Check + +Pre-merge lineage gates passed: + +- source branch remote HEAD matched + `0741c5915ebc330013fbb4f85cbcb6878fc38d35` +- source branch contained public `origin/main` +- source branch was ahead of public `origin/main` and not behind it +- source branch contained the projection execution branch, branch review + record, branch/release/proposal baseline, and protected merge decision record +- source branch had not already been merged into `origin/main` + +## Pre-Merge Projection Review Check + +Prior local evidence recorded: + +- projection plan compliance: `PASS_PROJECTION_PLAN_COMPLIANCE` +- leakage safety review: `PASS_LEAKAGE_SAFETY_REVIEW` +- projection branch review verdict: + `COMPLETE_PUBLIC_OSS_PROJECTION_BRANCH_REVIEW_READY_FOR_PROTECTED_MERGE_DECISION` +- protected merge decision verdict: + `COMPLETE_PUBLIC_OSS_PROJECTION_MERGE_DECISION_READY_FOR_OWNER_MERGE_EXECUTION` + +## Pre-Merge Evidence Hygiene Check + +Evidence hygiene passed with no credential values, no `.npmrc` / `.pypirc` +contents, no raw Dev evidence copy, no internal harness projection, no +`node_modules`, no venv, no wheels, no sdists, no tarballs, no package +`dist/**` mutation, and no Website/Lab/downstream/Dev/V1 mutation. + +## Merge Execution Summary + +The public repo local merge succeeded with: + +- command class: `git merge --no-ff` +- merge commit: + `abc8010df1e793320f3e7d3e4760fd71debc35c3` +- conflict status: none +- worktree state after local merge: clean + +## Post-Merge Main Verification + +Local post-merge verification before evidence commit passed: + +- local `main` contains the expected source commit +- local merge commit parents match expected pre-merge public `origin/main` and + source commit +- public `origin/main` was fetched again and remained + `574d13d20b829c0c8768bc7916186f01dcf5ff46` before the evidence commit +- final push verification is performed after this evidence commit is created + because a commit cannot self-record its own final SHA + +## Website / Lab Follow-Up Boundary + +Website and Validation Lab were not mutated. Follow-up pointer sync remains a +separate goal and is not authorized by this merge execution record. + +## Branch Cleanup Still Blocked + +No source branch deletion or cleanup occurred. Branch cleanup remains blocked +without a separate owner-authorized branch cleanup goal. + +## Files Changed + +This execution goal changed only: + +- public `main` via the merge commit +- this governance record +- lightweight evidence files in this goal's evidence directory + +## Evidence Created + +Evidence bundle: + +- `artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/` + +Required evidence files are present in that directory. + +## Gates Run + +Required gates include repo-truth-first, task governance router, release +projection router, branch lineage checks, projection review evidence checks, +public manifest validation, `npm test`, `npm run lint`, skill mirror diff, JSON +parse, frontmatter check, no-secret scan, protected surface scan, and final +worktree/upstream verification. + +## Forbidden Action Compliance + +No branch deletion, branch cleanup, tag, seal, GitHub release, npm publish, +PyPI upload, registry mutation, website deploy, Validation Lab publication, +downstream sync, Dev mutation, V1 mutation, or out-of-scope +package/source/schema/docs mutation was performed. + +## Commit / Push + +This record is committed after local merge gates pass, then public `main` is +pushed to `origin` if `origin/main` has not drifted. If the push is rejected, +the required outcome is `BLOCKED_MAIN_PUSH_REJECTED`; no force push is +authorized. + +## Remaining Blockers + +None at local merge execution record creation time. + +## Recommended Next Goal + +`WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01` + +## Final Verdict + +`COMPLETE_PUBLIC_OSS_PROJECTION_MERGED_TO_MAIN` From d8d85801633370bfde1056e03188adc901057e3c Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 9 Jun 2026 00:30:08 +0800 Subject: [PATCH 20/24] governance: record public OSS main push rejection --- .../final-verdict.json | 11 +++++-- .../main-push-rejection.json | 22 ++++++++++++++ .../no-forbidden-action-compliance.json | 7 +++++ .../post-merge-main-verification.json | 17 +++++++++-- ...UBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md | 29 +++++++++++++++---- 5 files changed, 76 insertions(+), 10 deletions(-) create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/main-push-rejection.json diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json index 7c5e26ef..c0ae2d36 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json @@ -1,12 +1,19 @@ { "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", "local_merge_commit": "abc8010df1e793320f3e7d3e4760fd71debc35c3", + "local_evidence_commit_before_push_attempt": "100d3c33bcb73cf23cc077e11b4bd0ef4d4a2457", "expected_source_commit": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", "target_branch": "main", "remaining_blockers_before_push": [], "push_required": true, + "push_attempted": true, + "push_result": "REJECTED_BY_PROTECTED_BRANCH_POLICY", "push_rejection_stop_condition": "BLOCKED_MAIN_PUSH_REJECTED", + "origin_main_after_rejection": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "remote_main_contains_local_merge": false, + "force_push_attempted": false, + "retry_attempted": false, "recommended_next_goal": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", - "final_verdict": "COMPLETE_PUBLIC_OSS_PROJECTION_MERGED_TO_MAIN", - "verification_note": "final origin/main SHA is verified after this evidence commit is pushed and reported in the final execution report" + "final_verdict": "BLOCKED_MAIN_PUSH_REJECTED", + "verification_note": "local merge and evidence are present on local main; remote origin/main rejected the push and remains at the pre-merge protected branch SHA" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/main-push-rejection.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/main-push-rejection.json new file mode 100644 index 00000000..3129c1d4 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/main-push-rejection.json @@ -0,0 +1,22 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "push_attempted": true, + "push_target": "origin main", + "origin_main_before_push": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "local_main_head_attempted": "100d3c33bcb73cf23cc077e11b4bd0ef4d4a2457", + "push_result": "REJECTED_BY_PROTECTED_BRANCH_POLICY", + "remote_error_summary": [ + "GH006 Protected branch update failed for refs/heads/main", + "Changes must be made through a pull request", + "Required status check Build Docusaurus is expected" + ], + "origin_main_after_rejection": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "remote_source_branch_after_rejection": "0741c5915ebc330013fbb4f85cbcb6878fc38d35", + "force_push_attempted": false, + "push_retry_attempted": false, + "protected_branch_bypass_attempted": false, + "branch_cleanup_attempted": false, + "tag_or_release_attempted": false, + "registry_mutation_attempted": false, + "required_stop_verdict": "BLOCKED_MAIN_PUSH_REJECTED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json index 966b854c..e0bd182b 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/no-forbidden-action-compliance.json @@ -19,6 +19,13 @@ "out_of_scope_package_source_schema_docs_mutation": "NOT_PERFORMED", "credential_value_access_or_output": "NOT_PERFORMED" }, + "after_push_rejection": { + "force_push": "NOT_PERFORMED", + "push_retry": "NOT_PERFORMED", + "protected_branch_bypass": "NOT_PERFORMED", + "pull_request_created": "NOT_PERFORMED", + "branch_created_for_bypass": "NOT_PERFORMED" + }, "tags_observed_after_local_merge_before_push": [ "protocol-v1.0.0", "v1.0.0" diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json index 0c5e1e65..1e020619 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/post-merge-main-verification.json @@ -28,7 +28,20 @@ "remote_source_branch_present": "PASS", "origin_main_drift_check": "PASS_NO_DRIFT" }, - "remote_push_verification": "performed_after_evidence_commit_push_and_reported_in_final_execution_report", + "remote_push_verification": { + "attempted": true, + "push_command_class": "git push origin main", + "result": "REJECTED_BY_PROTECTED_BRANCH_POLICY", + "remote_error_summary": [ + "GH006 Protected branch update failed for refs/heads/main", + "Changes must be made through a pull request", + "Required status check Build Docusaurus is expected" + ], + "force_push_attempted": false, + "retry_attempted": false, + "origin_main_after_rejection": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "remote_main_contains_local_merge": false + }, "self_referential_commit_sha_note": "the evidence commit cannot record its own final SHA without changing that SHA", - "verdict": "PASS_POST_MERGE_LOCAL_VERIFICATION_READY_FOR_GATES_AND_PUSH" + "verdict": "PARTIAL_POST_MERGE_LOCAL_VERIFICATION_BLOCKED_BY_MAIN_PUSH_REJECTION" } diff --git a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md index 55867d0d..497b40c8 100644 --- a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md +++ b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md @@ -240,14 +240,31 @@ package/source/schema/docs mutation was performed. ## Commit / Push -This record is committed after local merge gates pass, then public `main` is -pushed to `origin` if `origin/main` has not drifted. If the push is rejected, -the required outcome is `BLOCKED_MAIN_PUSH_REJECTED`; no force push is -authorized. +The local merge and evidence commits were created after local gates passed. +Before push, public `origin/main` still matched the expected pre-merge SHA: + +- `574d13d20b829c0c8768bc7916186f01dcf5ff46` + +The ordinary `git push origin main` attempt was rejected by GitHub protected +branch policy: + +- protected branch update failed for `refs/heads/main` +- changes must be made through a pull request +- required status check `Build Docusaurus` is expected + +No force push, bypass, retry, branch deletion, branch cleanup, tag, seal, +GitHub release, registry mutation, Website/Lab sync, or downstream mutation was +performed after the rejection. ## Remaining Blockers -None at local merge execution record creation time. +Remote `main` push is blocked by protected branch policy. Public `origin/main` +therefore remains: + +- `574d13d20b829c0c8768bc7916186f01dcf5ff46` + +Local `main` contains the authorized merge and local evidence commits, but the +merge is not on remote `origin/main`. ## Recommended Next Goal @@ -255,4 +272,4 @@ None at local merge execution record creation time. ## Final Verdict -`COMPLETE_PUBLIC_OSS_PROJECTION_MERGED_TO_MAIN` +`BLOCKED_MAIN_PUSH_REJECTED` From 8e61175940f4bf4868da41c11093d2e6955c69f8 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 9 Jun 2026 00:32:11 +0800 Subject: [PATCH 21/24] governance: align blocked public merge next goal --- .../final-verdict.json | 3 ++- .../website-lab-followup-boundary.json | 2 +- ...OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json index c0ae2d36..c2c16020 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/final-verdict.json @@ -13,7 +13,8 @@ "remote_main_contains_local_merge": false, "force_push_attempted": false, "retry_attempted": false, - "recommended_next_goal": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "deferred_after_remote_main_merge_goal": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", "final_verdict": "BLOCKED_MAIN_PUSH_REJECTED", "verification_note": "local merge and evidence are present on local main; remote origin/main rejected the push and remains at the pre-merge protected branch SHA" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json index d260f221..5d32656a 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01/website-lab-followup-boundary.json @@ -5,7 +5,7 @@ "downstream_repos_mutated": false, "website_followup_status": "separate_goal_required", "validation_lab_followup_status": "separate_goal_required", - "recommended_next_goal": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "recommended_next_goal_after_remote_main_merge": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", "validation_lab_goal_remains_followup": "VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01", "verdict": "PASS_WEBSITE_LAB_FOLLOWUP_BOUNDARY_PRESERVED" } diff --git a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md index 497b40c8..68e6a93a 100644 --- a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md +++ b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md @@ -268,7 +268,7 @@ merge is not on remote `origin/main`. ## Recommended Next Goal -`WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01` +`OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01` ## Final Verdict From 45f7a4d721df71b748f297256ce0ff82d618baeb Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 9 Jun 2026 00:55:49 +0800 Subject: [PATCH 22/24] governance: record public OSS projection PR path --- .../agent-reviewer-selection.json | 25 +++ .../blocked-main-push-carryforward.json | 14 ++ .../branch-cleanup-still-blocked.json | 9 + .../final-verdict.json | 12 ++ .../local-baseline-evidence-table.json | 52 ++++++ .../local-main-realignment-decision.json | 8 + .../no-forbidden-action-compliance.json | 22 +++ .../post-pr-main-verification.json | 8 + .../pr-creation-summary.json | 12 ++ .../pr-merge-execution-summary.json | 8 + .../pr-source-branch-creation.json | 13 ++ .../release-projection-router-result.json | 35 ++++ .../repo-truth-before.json | 29 +++ .../required-check-status.json | 12 ++ .../task-governance-router-result.json | 61 ++++++ .../website-lab-followup-boundary.json | 9 + ...IC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md | 175 ++++++++++++++++++ 17 files changed, 504 insertions(+) create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/agent-reviewer-selection.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/blocked-main-push-carryforward.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-baseline-evidence-table.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-main-realignment-decision.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/release-projection-router-result.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/repo-truth-before.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/task-governance-router-result.json create mode 100644 artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/website-lab-followup-boundary.json create mode 100644 governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/agent-reviewer-selection.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/agent-reviewer-selection.json new file mode 100644 index 00000000..f2ab83b4 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/agent-reviewer-selection.json @@ -0,0 +1,25 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "actual_subagent_invocation": { + "attempted": false, + "reason": "prior thread agent limit was reached; local reviewer lanes applied" + }, + "local_agent_files": [ + ".codex/agents/package_surface_auditor.toml", + ".codex/agents/product_boundary_reviewer.toml", + ".codex/agents/protocol_schema_reviewer.toml", + ".codex/agents/publication_claim_reviewer.toml", + ".codex/agents/release_governance_reviewer.toml", + ".codex/agents/runtime_binding_reviewer.toml" + ], + "selected_review_perspectives": [ + "governance_secretariat", + "release_governance_reviewer", + "projection_boundary_reviewer", + "security_no_secret_reviewer", + "branch_lifecycle_reviewer", + "website_boundary_reviewer", + "validation_lab_boundary_reviewer" + ], + "verdict": "PASS_REVIEWER_LANES_SELECTED_AND_APPLIED_LOCALLY" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/blocked-main-push-carryforward.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/blocked-main-push-carryforward.json new file mode 100644 index 00000000..255f8e74 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/blocked-main-push-carryforward.json @@ -0,0 +1,14 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "prior_goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01", + "prior_final_verdict": "BLOCKED_MAIN_PUSH_REJECTED", + "prior_local_merge_commit": "abc8010df1e793320f3e7d3e4760fd71debc35c3", + "prior_local_evidence_head": "8e61175940f4bf4868da41c11093d2e6955c69f8", + "prior_origin_main_after_rejection": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "protected_branch_rejection_summary": [ + "changes must be made through a pull request", + "required status check Build Docusaurus is expected" + ], + "carryforward_chain_verified": true, + "verdict": "PASS_BLOCKED_MAIN_PUSH_CARRYFORWARD" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json new file mode 100644 index 00000000..3ed70784 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/branch-cleanup-still-blocked.json @@ -0,0 +1,9 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "branch_cleanup_authorized": false, + "branch_deletion_authorized": false, + "source_branch_deleted": false, + "pr_branch_deleted": false, + "required_future_authorization": "explicit owner-authorized branch cleanup goal", + "verdict": "PASS_BRANCH_CLEANUP_STILL_BLOCKED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json new file mode 100644 index 00000000..bffd475d --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json @@ -0,0 +1,12 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "pr_source_branch": "codex/owner-authorize-public-oss-projection-pr-merge-execution-01", + "pr_branch_head_before_initial_evidence_commit": "8e61175940f4bf4868da41c11093d2e6955c69f8", + "pr_number": null, + "pr_url": null, + "required_check": "Build Docusaurus", + "required_check_status": "pending_pr_creation", + "merge_attempted": false, + "recommended_next_goal": "pending_check_state", + "final_verdict": "PENDING_PR_CREATION_AND_CHECK_INSPECTION" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-baseline-evidence-table.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-baseline-evidence-table.json new file mode 100644 index 00000000..d17d2b5a --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-baseline-evidence-table.json @@ -0,0 +1,52 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "rows": [ + { + "decision_area": "public repo authority", + "local_evidence_file": "AGENTS.md", + "evidence_signal": "MPLP-Protocol is clean public OSS projection and Dev is package/release truth", + "derived_rule": "perform PR path only in public repo; keep Dev read-only", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "protected branch PR path", + "local_evidence_file": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md; main-push-rejection.json", + "evidence_signal": "direct main push rejected; changes must be made through PR and Build Docusaurus is required", + "derived_rule": "create PR source branch and PR; do not retry direct main push", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "branch cleanup boundary", + "local_evidence_file": "PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "evidence_signal": "branch existence is evidence only and cleanup requires explicit authorization", + "derived_rule": "do not delete source or PR branch in this goal", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "release/tag/registry boundary", + "local_evidence_file": ".agents/skills/release-projection-governance-router/SKILL.md; owner authorization", + "evidence_signal": "tag, seal, GitHub release, publish/upload, dist-tag, deprecate, and registry mutation are forbidden without exact owner authorization", + "derived_rule": "do not perform any release or registry mutation", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + }, + { + "decision_area": "Website and Validation Lab boundary", + "local_evidence_file": "website-lab-followup-boundary.json", + "evidence_signal": "Website/Lab pointer sync follows only after remote main merge", + "derived_rule": "do not mutate Website or Validation Lab in this goal", + "confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false, + "action": "apply" + } + ], + "overall_confidence": "HIGH_LOCAL_BASELINE_EXPLICIT", + "conflict": false +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-main-realignment-decision.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-main-realignment-decision.json new file mode 100644 index 00000000..1977baf8 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/local-main-realignment-decision.json @@ -0,0 +1,8 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "local_main_realigned_to_origin_main": false, + "decision": "LOCAL_MAIN_AHEAD_PENDING_PR_MERGE", + "reason": "preserve blocked merge result locally until PR branch is pushed and the PR path outcome is known", + "destructive_reset_performed": false, + "verdict": "PASS_LOCAL_MAIN_REALIGNMENT_DEFERRED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json new file mode 100644 index 00000000..c682b0ca --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json @@ -0,0 +1,22 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "direct_origin_main_push": "NOT_PERFORMED", + "force_push": "NOT_PERFORMED", + "branch_protection_bypass": "NOT_PERFORMED", + "required_check_disabled": "NOT_PERFORMED", + "branch_deletion": "NOT_PERFORMED", + "branch_cleanup": "NOT_PERFORMED", + "tag": "NOT_PERFORMED", + "seal": "NOT_PERFORMED", + "github_release": "NOT_PERFORMED", + "npm_publish": "NOT_PERFORMED", + "pypi_upload": "NOT_PERFORMED", + "registry_mutation": "NOT_PERFORMED", + "website_deploy": "NOT_PERFORMED", + "validation_lab_publication": "NOT_PERFORMED", + "dev_repo_mutation": "NOT_PERFORMED", + "v1_mutation": "NOT_PERFORMED", + "downstream_sync": "NOT_PERFORMED", + "credential_value_access_or_output": "NOT_PERFORMED", + "verdict": "PASS_NO_FORBIDDEN_ACTION_COMPLIANCE_PRE_PR_PUSH" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json new file mode 100644 index 00000000..14f72563 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json @@ -0,0 +1,8 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "origin_main_before_pr_path": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "origin_main_after_pr_path": "pending", + "origin_main_contains_pr_head": false, + "public_manifest_validation_after_merge": "not_run_before_merge", + "verdict": "PENDING_PR_MERGE_OR_STOP" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json new file mode 100644 index 00000000..cf43e264 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json @@ -0,0 +1,12 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "gh_cli_available": true, + "gh_cli_version": "2.90.0", + "gh_auth_visible_without_token_value": true, + "existing_pr_before_creation": null, + "pr_creation": "pending", + "pr_number": null, + "pr_url": null, + "merge_performed_during_creation_step": false, + "verdict": "PENDING_PR_CREATION" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json new file mode 100644 index 00000000..9e8245fb --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json @@ -0,0 +1,8 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "merge_attempted": false, + "merge_permitted_only_if_required_checks_pass": true, + "merge_method": "pending", + "merge_commit": null, + "verdict": "PENDING_REQUIRED_CHECKS" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json new file mode 100644 index 00000000..4b12aefd --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json @@ -0,0 +1,13 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "branch_name": "codex/owner-authorize-public-oss-projection-pr-merge-execution-01", + "created_from": "main", + "created_from_head": "8e61175940f4bf4868da41c11093d2e6955c69f8", + "remote_branch_existed_before_push": false, + "contains_blocked_merge_commit": true, + "contains_blocked_evidence_commit": true, + "contains_authorized_source_commit": true, + "remote_push": "pending", + "remote_head_after_push": "pending", + "verdict": "PASS_LOCAL_PR_SOURCE_BRANCH_CREATED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/release-projection-router-result.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/release-projection-router-result.json new file mode 100644 index 00000000..53e867de --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/release-projection-router-result.json @@ -0,0 +1,35 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "router_id": "RELEASE-PROJECTION-GOVERNANCE-ROUTER-01", + "executed": true, + "workflow_type": [ + "public_oss_projection", + "protected_branch_pr_path", + "protected_check_aware_merge_execution", + "no_direct_main_push", + "no_registry_mutation" + ], + "required_check_source": "prior GitHub protected branch rejection", + "required_check_name": "Build Docusaurus", + "allowed_mutations": [ + "create PR source branch from blocked merge result", + "push PR source branch", + "create GitHub PR if permitted", + "inspect required checks", + "merge PR only if checks pass and governance permits", + "create lightweight PR-path governance evidence" + ], + "forbidden_actions": [ + "direct main push", + "force push", + "branch protection bypass", + "check disabling", + "branch deletion", + "tag", + "seal", + "GitHub release", + "npm/PyPI/registry mutation", + "Website/Lab/downstream/Dev/V1 mutation" + ], + "verdict": "PASS_RELEASE_PROJECTION_ROUTER_APPLIED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/repo-truth-before.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/repo-truth-before.json new file mode 100644 index 00000000..9dac08e1 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/repo-truth-before.json @@ -0,0 +1,29 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "captured_at_local": "2026-06-09T00:51:50+0800", + "captured_at_utc": "2026-06-08T16:51:50Z", + "canonical_workspace_root": "/Users/jasonwang/Documents/AI_Dev/Coregentis", + "public_repo": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol", + "role": "clean_public_oss_projection", + "starting_branch": "main", + "pr_source_branch": "codex/owner-authorize-public-oss-projection-pr-merge-execution-01", + "local_main_head_before_pr_branch": "8e61175940f4bf4868da41c11093d2e6955c69f8", + "origin_main_head": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "ahead_behind_against_origin_main": { + "behind": 0, + "ahead": 22 + }, + "status_before_new_pr_evidence": "clean", + "remote_origin": "https://github.com/Coregentis/MPLP-Protocol.git" + }, + "dev_repo_read_only": { + "path": "/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev", + "role": "protocol_package_release_dev_truth", + "branch": "codex/release-projection-governance-harness-codification-01", + "local_head": "93bcc881cc45e13d12dcc4d0ba26b8f11d996b23", + "origin_main_head": "00f57406005fe0a23f27c2e3e82a8c27e99dba6d", + "status": "clean_read_only" + }, + "goal_tooling_note": "thread goal tool still contains the prior blocked goal and did not allow creating a second goal; this governance record carries the new owner-authorized PR path goal" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json new file mode 100644 index 00000000..f8572fa3 --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json @@ -0,0 +1,12 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "required_check_name": "Build Docusaurus", + "check_inspection": "pending", + "check_status": "pending_pr_creation", + "check_conclusion": null, + "required_checks_passed": false, + "required_checks_pending": false, + "required_checks_failed": false, + "required_checks_unavailable": false, + "verdict": "PENDING_CHECK_INSPECTION" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/task-governance-router-result.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/task-governance-router-result.json new file mode 100644 index 00000000..e5f56c2f --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/task-governance-router-result.json @@ -0,0 +1,61 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "router_id": "TASK-GOVERNANCE-ROUTER-01", + "executed": true, + "task_type_classification": [ + "owner_authorized_public_oss_projection_pr_path_execution", + "protected_branch_pr_creation", + "protected_check_aware_merge_execution", + "no_direct_main_push", + "no_tag_no_seal_no_github_release" + ], + "sot_layer_classification": [ + "L1 Projection Source", + "L3 Verification Evidence", + "L4 Publication Surface", + "L6 Codex Execution Governance" + ], + "selected_local_governance_baseline": [ + "AGENTS.md", + ".codex/config.toml", + ".agents/skills/task-governance-router/SKILL.md", + ".agents/skills/release-projection-governance-router/SKILL.md", + "governance/codex-goals/CODEX-GOAL-TEMPLATE.md", + "governance/release/MPLP-RELEASE-SOP.md", + "GOVERNANCE.md", + "CONTRIBUTING.md", + "release-config.yaml", + "governance/04-records/PUBLIC-OSS-BRANCH-RELEASE-PROPOSAL-GOVERNANCE-BASELINE-01.md", + "governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-MERGE-EXECUTION-01.md" + ], + "forbidden_actions": [ + "direct_origin_main_push", + "force_push", + "branch_protection_bypass", + "disable_required_checks", + "branch_deletion", + "branch_cleanup", + "tag", + "seal", + "GitHub release", + "npm publish", + "PyPI upload", + "registry mutation", + "website deploy", + "Validation Lab publication", + "Dev mutation", + "V1 mutation", + "downstream sync", + "credential exposure" + ], + "stop_conditions": [ + "BLOCKED_LOCAL_MAIN_MERGE_RESULT_MISSING", + "BLOCKED_LOCAL_MAIN_HAS_UNEXPLAINED_COMMITS", + "BLOCKED_PR_SOURCE_BRANCH_PUSH_FAILED", + "PARTIAL_PR_CREATED_CHECKS_PENDING_NO_MERGE", + "PARTIAL_PR_CREATED_CHECKS_FAILED_NO_MERGE", + "PARTIAL_PR_CREATED_CHECKS_UNAVAILABLE_NO_MERGE", + "PARTIAL_PR_CREATED_MERGE_BLOCKED_BY_BRANCH_PROTECTION" + ], + "verdict": "PASS_TASK_GOVERNANCE_ROUTER_APPLIED" +} diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/website-lab-followup-boundary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/website-lab-followup-boundary.json new file mode 100644 index 00000000..072ae5cd --- /dev/null +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/website-lab-followup-boundary.json @@ -0,0 +1,9 @@ +{ + "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", + "website_mutated": false, + "validation_lab_mutated": false, + "downstream_repos_mutated": false, + "website_followup_after_remote_main_merge": "WEBSITE-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "validation_lab_followup_after_remote_main_merge": "VALIDATION-LAB-PROTOCOL-MANIFEST-POINTER-SYNC-01", + "verdict": "PASS_WEBSITE_LAB_FOLLOWUP_BOUNDARY_PRESERVED" +} diff --git a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md new file mode 100644 index 00000000..cc756ab6 --- /dev/null +++ b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md @@ -0,0 +1,175 @@ +--- +entry_surface: repository +doc_type: governance-execution-record +status: active +authority: MPLP public OSS projection protected PR merge execution governance +protocol_version: "1.0.0" +doc_id: "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01" +title: "Owner Authorized Public OSS Projection PR Merge Execution 01" +created_at: "2026-06-09" +goal_id: "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01" +--- + +# Owner Authorized Public OSS Projection PR Merge Execution 01 + +## Scope + +This record moves the previously blocked direct public `main` push into the +GitHub protected-branch PR path. + +Authorized actions: + +- preserve the local blocked merge result +- create and push PR source branch + `codex/owner-authorize-public-oss-projection-pr-merge-execution-01` +- create a GitHub PR into `main` if permitted by local governance and tooling +- inspect required checks read-only +- merge only if all required checks pass and local governance permits merge in + this goal + +Forbidden actions: + +- direct push to `origin/main` +- force push +- branch protection bypass +- disabling required checks +- branch deletion or cleanup +- tag, seal, or GitHub release +- npm/PyPI/registry mutation +- Website, Validation Lab, Cognitive_OS, SoloCrew, Dev, V1, downstream, or + deployment mutation +- credential value reading, printing, copying, committing, or exposure + +## Repo Truth + +Canonical workspace root: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis` + +Primary target repository: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol` + +Authority source repository, read-only: + +- `/Users/jasonwang/Documents/AI_Dev/Coregentis/MPLP-Protocol-Dev` + +Starting local public repo state: + +- starting branch: `main` +- local blocked merge result HEAD: + `8e61175940f4bf4868da41c11093d2e6955c69f8` +- public `origin/main`: + `574d13d20b829c0c8768bc7916186f01dcf5ff46` +- ahead/behind from `origin/main` to local `main`: `+22 / -0` +- local `main` contains merge commit: + `abc8010df1e793320f3e7d3e4760fd71debc35c3` +- local `main` contains prior evidence commit: + `8e61175940f4bf4868da41c11093d2e6955c69f8` +- local `main` contains source commit: + `0741c5915ebc330013fbb4f85cbcb6878fc38d35` + +## Task Governance Router Result + +`TASK-GOVERNANCE-ROUTER-01` was applied before PR source branch evidence and PR +operations. + +Task classification: + +- `owner_authorized_public_oss_projection_pr_path_execution` +- `protected_branch_pr_creation` +- `protected_check_aware_merge_execution` +- `no_direct_main_push` +- `no_tag_no_seal_no_github_release` + +## Release Projection Router Result + +`RELEASE-PROJECTION-GOVERNANCE-ROUTER-01` was applied because this is a +release-like public projection PR/merge workflow. + +Selected public repo baseline: + +- `AGENTS.md` +- `.codex/config.toml` +- `.agents/skills/task-governance-router/SKILL.md` +- `.agents/skills/release-projection-governance-router/SKILL.md` +- `governance/codex-goals/CODEX-GOAL-TEMPLATE.md` +- `governance/release/MPLP-RELEASE-SOP.md` +- `GOVERNANCE.md` +- `CONTRIBUTING.md` +- `release-config.yaml` +- prior public projection, branch/release/proposal, blocked direct push, and + merge execution evidence + +Selected Dev comparison baseline: + +- Dev `AGENTS.md` +- Dev release/projection governance records, read-only + +## Starting-State Inspection + +Starting-state inspection passed: + +- local `main` contains the blocked merge result +- local `main` contains the prior blocked push evidence +- source commit is contained in local `main` +- previous final verdict was `BLOCKED_MAIN_PUSH_REJECTED` +- no unexplained commits beyond the known carryforward chain were found + +## Blocked Main Push Carryforward + +The prior direct `git push origin main` was rejected by GitHub protected branch +policy: + +- changes must be made through a pull request +- required check `Build Docusaurus` was expected + +This goal therefore uses the protected PR path and does not retry direct +`main` push. + +## PR Source Branch Creation + +PR source branch: + +- `codex/owner-authorize-public-oss-projection-pr-merge-execution-01` + +The branch was created from local blocked merge result HEAD and preserves the +full carried-forward merge and evidence chain. + +## PR Creation Summary + +PR creation and check state are recorded in evidence JSON after local gates and +remote branch push. + +## Required Check Status + +Required check from protected branch rejection: + +- `Build Docusaurus` + +If required checks are pending, failing, missing, or unavailable, this goal +stops without merge. + +## PR Merge Execution Summary + +PR merge is permitted only if the PR exists, source branch HEAD is verified, +`Build Docusaurus` passes, and local governance still permits merge in this +goal. + +## Local Main Realignment Decision + +Local `main` is left ahead as `LOCAL_MAIN_AHEAD_PENDING_PR_MERGE` until the PR +is actually merged. The blocked merge result is not discarded. + +## Website / Lab Follow-Up Boundary + +Website and Validation Lab remain follow-up only. No Website or Validation Lab +mutation occurs in this goal. + +## Branch Cleanup Still Blocked + +No branch deletion or cleanup is authorized. + +## Final Verdict + +Pending PR creation and check inspection. From d7847ab37b57ac738eb1f1211bbb99600831667f Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 9 Jun 2026 00:58:38 +0800 Subject: [PATCH 23/24] governance: record public OSS PR check pending --- .../final-verdict.json | 13 +++++---- .../no-forbidden-action-compliance.json | 4 ++- .../post-pr-main-verification.json | 4 +-- .../pr-creation-summary.json | 14 +++++++--- .../pr-merge-execution-summary.json | 5 ++-- .../pr-source-branch-creation.json | 7 +++-- .../required-check-status.json | 15 +++++++--- ...IC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md | 28 +++++++++++++++---- 8 files changed, 64 insertions(+), 26 deletions(-) diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json index bffd475d..cb08b87c 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json @@ -2,11 +2,14 @@ "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", "pr_source_branch": "codex/owner-authorize-public-oss-projection-pr-merge-execution-01", "pr_branch_head_before_initial_evidence_commit": "8e61175940f4bf4868da41c11093d2e6955c69f8", - "pr_number": null, - "pr_url": null, + "initial_pr_branch_head": "45f7a4d721df71b748f297256ce0ff82d618baeb", + "pr_number": 10, + "pr_url": "https://github.com/Coregentis/MPLP-Protocol/pull/10", "required_check": "Build Docusaurus", - "required_check_status": "pending_pr_creation", + "required_check_status": "IN_PROGRESS", + "required_check_bucket": "pending", "merge_attempted": false, - "recommended_next_goal": "pending_check_state", - "final_verdict": "PENDING_PR_CREATION_AND_CHECK_INSPECTION" + "origin_main_after_pr_creation": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-CHECK-CLOSURE-01", + "final_verdict": "PARTIAL_PR_CREATED_CHECKS_PENDING_NO_MERGE" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json index c682b0ca..187145fc 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/no-forbidden-action-compliance.json @@ -18,5 +18,7 @@ "v1_mutation": "NOT_PERFORMED", "downstream_sync": "NOT_PERFORMED", "credential_value_access_or_output": "NOT_PERFORMED", - "verdict": "PASS_NO_FORBIDDEN_ACTION_COMPLIANCE_PRE_PR_PUSH" + "pr_created": "PERFORMED_AUTHORIZED", + "pr_merge": "NOT_PERFORMED_REQUIRED_CHECK_PENDING", + "verdict": "PASS_NO_FORBIDDEN_ACTION_COMPLIANCE_PR_CREATED_NO_MERGE" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json index 14f72563..0462970b 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/post-pr-main-verification.json @@ -1,8 +1,8 @@ { "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", "origin_main_before_pr_path": "574d13d20b829c0c8768bc7916186f01dcf5ff46", - "origin_main_after_pr_path": "pending", + "origin_main_after_pr_path": "574d13d20b829c0c8768bc7916186f01dcf5ff46", "origin_main_contains_pr_head": false, "public_manifest_validation_after_merge": "not_run_before_merge", - "verdict": "PENDING_PR_MERGE_OR_STOP" + "verdict": "PASS_ORIGIN_MAIN_UNCHANGED_NO_MERGE_ATTEMPTED" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json index cf43e264..2470046a 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json @@ -4,9 +4,15 @@ "gh_cli_version": "2.90.0", "gh_auth_visible_without_token_value": true, "existing_pr_before_creation": null, - "pr_creation": "pending", - "pr_number": null, - "pr_url": null, + "pr_creation": "PASS", + "pr_number": 10, + "pr_url": "https://github.com/Coregentis/MPLP-Protocol/pull/10", + "pr_state": "OPEN", + "pr_head_ref": "codex/owner-authorize-public-oss-projection-pr-merge-execution-01", + "pr_head_oid": "45f7a4d721df71b748f297256ce0ff82d618baeb", + "pr_base_ref": "main", + "pr_base_oid": "574d13d20b829c0c8768bc7916186f01dcf5ff46", + "mergeable": "MERGEABLE", "merge_performed_during_creation_step": false, - "verdict": "PENDING_PR_CREATION" + "verdict": "PASS_PR_CREATED" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json index 9e8245fb..4f1e2705 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-merge-execution-summary.json @@ -2,7 +2,8 @@ "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", "merge_attempted": false, "merge_permitted_only_if_required_checks_pass": true, - "merge_method": "pending", + "merge_blocked_reason": "required check Build Docusaurus is pending", + "merge_method": null, "merge_commit": null, - "verdict": "PENDING_REQUIRED_CHECKS" + "verdict": "PARTIAL_PR_CREATED_CHECKS_PENDING_NO_MERGE" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json index 4b12aefd..27a33392 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-source-branch-creation.json @@ -7,7 +7,8 @@ "contains_blocked_merge_commit": true, "contains_blocked_evidence_commit": true, "contains_authorized_source_commit": true, - "remote_push": "pending", - "remote_head_after_push": "pending", - "verdict": "PASS_LOCAL_PR_SOURCE_BRANCH_CREATED" + "initial_evidence_commit": "45f7a4d721df71b748f297256ce0ff82d618baeb", + "remote_push": "PASS", + "remote_head_after_initial_push": "45f7a4d721df71b748f297256ce0ff82d618baeb", + "verdict": "PASS_PR_SOURCE_BRANCH_PUSHED_AND_VERIFIED" } diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json index f8572fa3..4c410ec9 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json @@ -1,12 +1,19 @@ { "goal_id": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01", "required_check_name": "Build Docusaurus", - "check_inspection": "pending", - "check_status": "pending_pr_creation", + "check_inspection": "PASS_READ_ONLY_INSPECTION", + "pr_number": 10, + "pr_url": "https://github.com/Coregentis/MPLP-Protocol/pull/10", + "check_status": "IN_PROGRESS", "check_conclusion": null, + "workflow": "Deploy Docusaurus to GitHub Pages", + "bucket": "pending", + "started_at": "2026-06-08T16:56:45Z", + "completed_at": null, + "details_url": "https://github.com/Coregentis/MPLP-Protocol/actions/runs/27153463021/job/80150152866", "required_checks_passed": false, - "required_checks_pending": false, + "required_checks_pending": true, "required_checks_failed": false, "required_checks_unavailable": false, - "verdict": "PENDING_CHECK_INSPECTION" + "verdict": "PARTIAL_PR_CREATED_CHECKS_PENDING_NO_MERGE" } diff --git a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md index cc756ab6..90c2cdab 100644 --- a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md +++ b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md @@ -138,8 +138,17 @@ full carried-forward merge and evidence chain. ## PR Creation Summary -PR creation and check state are recorded in evidence JSON after local gates and -remote branch push. +PR was created: + +- PR: `#10` +- URL: `https://github.com/Coregentis/MPLP-Protocol/pull/10` +- head branch: + `codex/owner-authorize-public-oss-projection-pr-merge-execution-01` +- head SHA: + `45f7a4d721df71b748f297256ce0ff82d618baeb` +- base branch: `main` +- base SHA: + `574d13d20b829c0c8768bc7916186f01dcf5ff46` ## Required Check Status @@ -147,8 +156,15 @@ Required check from protected branch rejection: - `Build Docusaurus` -If required checks are pending, failing, missing, or unavailable, this goal -stops without merge. +Observed status: + +- workflow: `Deploy Docusaurus to GitHub Pages` +- check: `Build Docusaurus` +- state: `IN_PROGRESS` +- bucket: `pending` +- started at: `2026-06-08T16:56:45Z` + +Because the required check is pending, this goal stops without merge. ## PR Merge Execution Summary @@ -156,6 +172,8 @@ PR merge is permitted only if the PR exists, source branch HEAD is verified, `Build Docusaurus` passes, and local governance still permits merge in this goal. +Merge was not attempted because the required check was pending. + ## Local Main Realignment Decision Local `main` is left ahead as `LOCAL_MAIN_AHEAD_PENDING_PR_MERGE` until the PR @@ -172,4 +190,4 @@ No branch deletion or cleanup is authorized. ## Final Verdict -Pending PR creation and check inspection. +`PARTIAL_PR_CREATED_CHECKS_PENDING_NO_MERGE` From f4381a801d24c069e08af7ba8616780d71137510 Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 9 Jun 2026 01:00:27 +0800 Subject: [PATCH 24/24] governance: stabilize PR check evidence boundary --- .../final-verdict.json | 4 +++- .../pr-creation-summary.json | 3 ++- .../required-check-status.json | 6 ++++-- ...RIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md | 10 ++++++++-- 4 files changed, 17 insertions(+), 6 deletions(-) diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json index cb08b87c..ac00ef3d 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/final-verdict.json @@ -3,11 +3,13 @@ "pr_source_branch": "codex/owner-authorize-public-oss-projection-pr-merge-execution-01", "pr_branch_head_before_initial_evidence_commit": "8e61175940f4bf4868da41c11093d2e6955c69f8", "initial_pr_branch_head": "45f7a4d721df71b748f297256ce0ff82d618baeb", + "final_pr_branch_head_after_final_evidence_push": "reported_in_final_execution_report", "pr_number": 10, "pr_url": "https://github.com/Coregentis/MPLP-Protocol/pull/10", "required_check": "Build Docusaurus", - "required_check_status": "IN_PROGRESS", + "required_check_status": "PENDING_AT_LAST_COMMITTED_CHECK_INSPECTION", "required_check_bucket": "pending", + "self_reference_boundary": "final check state after this evidence branch is pushed is reported in the final execution report", "merge_attempted": false, "origin_main_after_pr_creation": "574d13d20b829c0c8768bc7916186f01dcf5ff46", "recommended_next_goal": "OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-CHECK-CLOSURE-01", diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json index 2470046a..75ab96d4 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/pr-creation-summary.json @@ -9,7 +9,8 @@ "pr_url": "https://github.com/Coregentis/MPLP-Protocol/pull/10", "pr_state": "OPEN", "pr_head_ref": "codex/owner-authorize-public-oss-projection-pr-merge-execution-01", - "pr_head_oid": "45f7a4d721df71b748f297256ce0ff82d618baeb", + "pr_head_oid_at_creation": "45f7a4d721df71b748f297256ce0ff82d618baeb", + "final_pr_head_after_evidence_push": "reported_in_final_execution_report", "pr_base_ref": "main", "pr_base_oid": "574d13d20b829c0c8768bc7916186f01dcf5ff46", "mergeable": "MERGEABLE", diff --git a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json index 4c410ec9..0f1a1a20 100644 --- a/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json +++ b/artifacts/governance/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01/required-check-status.json @@ -8,9 +8,11 @@ "check_conclusion": null, "workflow": "Deploy Docusaurus to GitHub Pages", "bucket": "pending", - "started_at": "2026-06-08T16:56:45Z", + "observed_before_final_evidence_push": true, + "self_reference_boundary": "each evidence push retriggers Build Docusaurus; final post-push check state is verified read-only and reported in the final execution report", + "started_at": "superseded_by_later_evidence_push", "completed_at": null, - "details_url": "https://github.com/Coregentis/MPLP-Protocol/actions/runs/27153463021/job/80150152866", + "details_url": "superseded_by_later_evidence_push", "required_checks_passed": false, "required_checks_pending": true, "required_checks_failed": false, diff --git a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md index 90c2cdab..ef683365 100644 --- a/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md +++ b/governance/04-records/OWNER-AUTHORIZE-PUBLIC-OSS-PROJECTION-PR-MERGE-EXECUTION-01.md @@ -144,12 +144,17 @@ PR was created: - URL: `https://github.com/Coregentis/MPLP-Protocol/pull/10` - head branch: `codex/owner-authorize-public-oss-projection-pr-merge-execution-01` -- head SHA: +- head SHA after initial PR creation: `45f7a4d721df71b748f297256ce0ff82d618baeb` - base branch: `main` - base SHA: `574d13d20b829c0c8768bc7916186f01dcf5ff46` +This record includes a self-reference boundary: each additional evidence commit +to the PR branch retriggers the required GitHub check. Therefore the final +post-push check state is verified read-only after the final evidence push and +reported in the execution report, not recursively committed again. + ## Required Check Status Required check from protected branch rejection: @@ -162,7 +167,8 @@ Observed status: - check: `Build Docusaurus` - state: `IN_PROGRESS` - bucket: `pending` -- started at: `2026-06-08T16:56:45Z` +- latest committed-evidence observation before the final evidence push: + `IN_PROGRESS` Because the required check is pending, this goal stops without merge.