AC-038: add release-readiness verification record - #9
Merged
Merged
Conversation
Records the Gates A-G verification results for main db1c745, the release and supply-integrity state, and the disposition of findings U1, U5, U6, U7, U8 plus five new findings (U9-U13). Gate F was re-executed independently in a fresh clone rather than relying on docs/AGENT-USABILITY.md: CLI surface, success path, refusal path, receipt verification, unsupported-module imports, the documented wrapper-to-verify-receipt negative case, refusal-as-return-value, workflow-vs-enforcement, licensing boundary, claim ceiling, and reason-code semantics with no cross-version stability claim. Records rather than repairs U11 (no explicit workflow permissions block), U12 (actions pinned to mutable major tags) and U13 (unpinned dependency floors, no lockfile): the first is repository configuration outside this work order's authorization, and the last would alter a protected device-under-test path and invalidate the existing benchmark verification without a fresh measurement run. No test, guard, or benchmark threshold was weakened. Behavioral surfaces (authcontract/, tests/, fixtures/, .github/, pyproject.toml, benchmarks/) are byte-identical to main. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Emwzah7sNdUGzJGDwbSCam
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/RELEASE-READINESS.mdand links it from the README's "Where to go next" table.What this records
Verification results for
mainatdb1c745686285b229361d83f663dac2b5e8924a5, gathered from two independent fresh clones plus GitHub API state. It records observations — it does not certify release and does not describe the repository as production-ready.Gates A–G. Engineering correctness (342 passed; ALLOW, both refusal paths, receipt verification), evidence sufficiency (DUT-verified benchmark, 7/7 E2E, 38/38 adversarial, observed sustained throughput), independent-adjudication boundary, git integrity, human usability from a fresh clone (first meaningful success at 21 s against a 5-minute budget), agent usability, adoption readiness.
Gate F was re-executed independently rather than read off
docs/AGENT-USABILITY.md: CLI surface (exactly six subcommands), success path, refusal path, receipt verification via the documented extraction step, unsupported-module imports (server/api/http/registry/db→ModuleNotFoundError), the documented wrapper-to-verify-receiptnegative case, refusal-as-return-value, workflow-vs-enforcement, licensing boundary, claim ceiling, and reason-code semantics carrying no cross-version stability claim.Release and supply integrity. No tags, no releases, not published — so release-artifact clauses are marked NOT APPLICABLE rather than passed. Tracked-file secret scan clean across 82 files. Branch protection is recorded as not verified (no read access from this session) rather than asserted either way.
Findings
README.md— deliberately not worked around), U8 (agent-usability record is self-authored).SECURITY.md/CONTRIBUTING.md), U11 (no explicit workflowpermissions:block), U12 (actions pinned to mutable major tags), U13 (unpinned dependency floors, no lockfile — in tension with roadmap X4).U11 is repository configuration outside this work order's authorization. U13 would alter a protected device-under-test path and invalidate the existing benchmark verification without a fresh measurement run. Both are recorded rather than repaired.
Scope
Documentation only. No test, guard, or benchmark threshold was weakened.
authcontract/,tests/,fixtures/,.github/,pyproject.tomlandbenchmarks/are byte-identical tomain.Generated by Claude Code