Make the CHANGELOG describe the release that is actually shipping - #5
Merged
Conversation
The v1.0.0 tag is being moved to the current head, so everything sitting under [Unreleased] is part of 1.0.0 and no longer a delta against it. Folded in, and reworded: a first release has nothing to have "changed" or "fixed" against, so entries that read as repairs to an intermediate state now simply describe what the release contains. Two corrections while rewriting. The per-run workspace-isolation attestation was listed inside "a fail-closed control-data boundary", which reads as though it gates a write. It does not: `ControlBoundary.begin()` calls `_require_evidence` for the access review only, and `_isolation_state` records attested/unknown either way. It now sits outside that sentence and says optional in as many words. The documentation sweep that closed fourteen of these missed this one because CHANGELOG.md was not in its scope. Three things the release genuinely ships had no entry at all: grant provenance reported at both ends, the worked example notebooks, and the diagrams with their generator. Every claim added here was checked against the tree — 33 code cells in the cookbook, 27 in the master workflow, ten SVGs, one generator, one roadmap entry naming the authoring tool.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
v1.0.0tag is being moved to the current head, so everything under[Unreleased]is part of 1.0.0 rather than a delta against it. This folds it in and rewords it: a first release has nothing to have "changed" or "fixed" against, so entries that read as repairs to an intermediate state now simply describe what the release contains.Two corrections found while rewriting
The attestation was listed as a gate. It sat inside "A fail-closed control-data boundary: reserved paths, bounded ETag-bearing DAR snapshots, per-run workspace isolation attestation, and a PII-free incident sentinel" — which reads as though it blocks a write. It does not:
ControlBoundary.begin()calls_require_evidencefor the access review only, and_isolation_staterecordsattested/unknowneither way.The documentation sweep that closed fourteen instances of exactly this claim missed it because
CHANGELOG.mdwas never in that sweep's scope.Three shipped things had no entry at all — grant provenance reported at both ends, the worked example notebooks, and the diagrams with their generator.
Verified against the tree, not from memory
first_granted_by/last_granted_bynotebooks/olaf.ipynbolaf_runnershipsscripts/gen-olaf-diagrams.pypresentGates: lint clean, 1,657 tests, release gate 0 findings.