From c23d77c8c4bb053ebfee4693b1cde0139ff010e3 Mon Sep 17 00:00:00 2001 From: arpan Date: Wed, 16 Sep 2026 03:52:34 +0530 Subject: [PATCH 1/2] Regenerate the readiness block for kernel 0.12.2 Pairs with `CTRLRun/ctrlrun#223`, which cuts 0.12.2, and carries the same branch name so that repository's `docs` job checks this branch instead of `main`. Version 0.12.1 to 0.12.2 and 6,223 tests to 6,248, in the four generated files and in the two pages that embed the block, `docs.mdx` and `docs/production/index.mdx`. The generator writes `generated/` and the state; the embedded copies are pasted from its own `render()` so they cannot drift from it. Every audit step green: capabilities, cli, schemas, api, cookbook, probe, soak, readiness, badges, lint and links. Signed-off-by: arpan --- docs.mdx | 4 ++-- docs/production/index.mdx | 4 ++-- generated/readiness.full.mdx | 4 ++-- generated/readiness.json | 6 +++--- generated/readiness.mdx | 4 ++-- generated/readiness.readme.md | 4 ++-- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/docs.mdx b/docs.mdx index c826321..ed0736e 100644 --- a/docs.mdx +++ b/docs.mdx @@ -218,8 +218,8 @@ the framework's own interrupt, and a framework with no such primitive does not n ## Where it stands {/* generated from the suite, pyproject and the soak (mdx) — run the generator */} -- **Version 0.12.1**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. -- **6,223 tests**, every version specified before it was written and every requirement mutation-tested. +- **Version 0.12.2**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. +- **6,248 tests**, every version specified before it was written and every requirement mutation-tested. - **32 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak). diff --git a/docs/production/index.mdx b/docs/production/index.mdx index 12add29..7752db3 100644 --- a/docs/production/index.mdx +++ b/docs/production/index.mdx @@ -27,8 +27,8 @@ need. `test_the_first_line_of_the_section_says_which_store_and_why` asserts the ## Where it stands {/* generated from the suite, pyproject and the soak (full) — run the generator */} -- **Version 0.12.1**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. -- **6,223 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built). +- **Version 0.12.2**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. +- **6,248 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built). - **32 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees). - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres). - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak). diff --git a/generated/readiness.full.mdx b/generated/readiness.full.mdx index 1981ca3..a88a743 100644 --- a/generated/readiness.full.mdx +++ b/generated/readiness.full.mdx @@ -1,6 +1,6 @@ {/* generated from the suite, pyproject and the soak (full) — run the generator */} -- **Version 0.12.1**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. -- **6,223 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built). +- **Version 0.12.2**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. +- **6,248 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built). - **32 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees). - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres). - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak). diff --git a/generated/readiness.json b/generated/readiness.json index bd05f35..b4266c3 100644 --- a/generated/readiness.json +++ b/generated/readiness.json @@ -9,7 +9,7 @@ "3.14" ] }, - "released": "0.12.1", + "released": "0.12.2", "soak": { "actions": 889735, "backend": "postgres", @@ -18,6 +18,6 @@ "positive_control": true, "unexplained": 0 }, - "tests": 6223, - "version": "0.12.1" + "tests": 6248, + "version": "0.12.2" } diff --git a/generated/readiness.mdx b/generated/readiness.mdx index f9013a1..52a019e 100644 --- a/generated/readiness.mdx +++ b/generated/readiness.mdx @@ -1,6 +1,6 @@ {/* generated from the suite, pyproject and the soak (mdx) — run the generator */} -- **Version 0.12.1**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. -- **6,223 tests**, every version specified before it was written and every requirement mutation-tested. +- **Version 0.12.2**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. +- **6,248 tests**, every version specified before it was written and every requirement mutation-tested. - **32 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak). diff --git a/generated/readiness.readme.md b/generated/readiness.readme.md index d4b0ee7..51bceea 100644 --- a/generated/readiness.readme.md +++ b/generated/readiness.readme.md @@ -1,6 +1,6 @@ -- **Version 0.12.1**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. -- **6,223 tests**, every version specified before it was written and every requirement mutation-tested. +- **Version 0.12.2**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later, tested on 3.11 to 3.14. +- **6,248 tests**, every version specified before it was written and every requirement mutation-tested. - **32 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak). From ec5ecc9ccb44732bd1638d837c6c951e907e2eb1 Mon Sep 17 00:00:00 2001 From: arpan Date: Wed, 16 Sep 2026 03:55:59 +0530 Subject: [PATCH 2/2] Move the pages that name the kernel version to 0.12.2 Three pages quote a `ctrlrun verify` transcript whose first line carries the version, and `test_every_quoted_verify_transcript_is_one_verify_actually_prints` runs verify and compares: `docs/verify.md`, `docs/guides/verify-in-ci.mdx` and `docs/cookbook/verify-in-github-actions.mdx`. The kernel branch's own CI printed the real line, `ctrlrun 0.12.2, catalogue ctrlrun.guarantees/v7`, which is what they now say. The OWASP landscape page is pinned to the newest released version by `test_the_version_the_page_is_written_against_is_released`, so its five version references move too. Nothing else on it changes and nothing should: 0.12.2 touches no enforcement path, the catalogue is still `ctrlrun.guarantees/v7`, and the guarantees are still G1 to G32, so every tick on the page stands exactly as it was reviewed. Signed-off-by: arpan --- docs/OWASP-SOLUTIONS-LANDSCAPE.md | 10 +++++----- docs/cookbook/verify-in-github-actions.mdx | 2 +- docs/guides/verify-in-ci.mdx | 2 +- docs/verify.md | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/OWASP-SOLUTIONS-LANDSCAPE.md b/docs/OWASP-SOLUTIONS-LANDSCAPE.md index 3352963..b1dd268 100644 --- a/docs/OWASP-SOLUTIONS-LANDSCAPE.md +++ b/docs/OWASP-SOLUTIONS-LANDSCAPE.md @@ -1,6 +1,6 @@ --- title: "OWASP Agentic Solutions Landscape" -description: "A reading of the OWASP Agentic Solutions Landscape checklist against what CTRLRun 0.12.1 ships, with the boxes it does not tick named." +description: "A reading of the OWASP Agentic Solutions Landscape checklist against what CTRLRun 0.12.2 ships, with the boxes it does not tick named." sidebarTitle: "OWASP Solutions Landscape" --- @@ -26,11 +26,11 @@ credible. | **Publisher** | OWASP GenAI Security Project, OWASP Foundation | | **Form** | [https://genai.owasp.org/solution-submission-agentic/](https://genai.owasp.org/solution-submission-agentic/) | | **Read on** | 2026-09-10 | -| **Written against** | CTRLRun **0.12.1**, guarantees `G1`–`G32`, catalogue `ctrlrun.guarantees/v7` | +| **Written against** | CTRLRun **0.12.2**, guarantees `G1`–`G32`, catalogue `ctrlrun.guarantees/v7` | **Written against what is tagged, and the version is printed on every row that needs one.** Every guarantee cited below is in the catalogue `ctrlrun verify` runs today, `G1` through -`G32`, and every one of them is in the 0.12.1 wheel. **There are no design rows.** A *Since* +`G32`, and every one of them is in the 0.12.2 wheel. **There are no design rows.** A *Since* column names the milestone that added the row rather than a separate download: 0.3.0 was published to TestPyPI alone, and what it added reached PyPI inside 0.4.0. This page was first written against an unreleased 1.0 and marked the rows that waited on it; none of them waits any longer, and the hedge came out rather than being left to read @@ -168,7 +168,7 @@ example is theirs and is not a claim that CTRLRun uses it. The form asks for `ASI01:26` through `ASI10:26` as ten checkboxes. The [Agentic Top 10 reading](/docs/OWASP-AGENTIC-TOP10) carries the row-by-row mapping and the -sentence for each entry saying what is *not* covered; this table is the summary at 0.12.1, +sentence for each entry saying what is *not* covered; this table is the summary at 0.12.2, with the version that moved each entry. Each row's guarantees are exactly what that reading maps to the entry, which is a test and not an intention. @@ -202,7 +202,7 @@ that every guarantee cited here exists in the registry, that the catalogue named `ctrlrun verify` reports, that no *Since* column names a version the changelog has not released, and that each `ASI` row's guarantees are exactly what the [Agentic Top 10 reading](/docs/OWASP-AGENTIC-TOP10) maps to that entry. It was written against -`ctrlrun.guarantees/v7`, the catalogue 0.12.1 ships, and the form as read on 2026-09-10. +`ctrlrun.guarantees/v7`, the catalogue 0.12.2 ships, and the form as read on 2026-09-10. ## Next diff --git a/docs/cookbook/verify-in-github-actions.mdx b/docs/cookbook/verify-in-github-actions.mdx index 6d878ec..f7e0612 100644 --- a/docs/cookbook/verify-in-github-actions.mdx +++ b/docs/cookbook/verify-in-github-actions.mdx @@ -62,7 +62,7 @@ by tag where you want a ref nobody can move. The agent sees nothing; this is the operator's check. The build sees: ```text -CTRLRun verify — ctrlrun 0.12.1, catalogue ctrlrun.guarantees/v7 +CTRLRun verify — ctrlrun 0.12.2, catalogue ctrlrun.guarantees/v7 policy /Users/arpanghoshal/ctrlrun-project/wt/v11-i3/examples/cookbook/verify-in-github-actions/ctrlrun.yaml (ctrlrun.policy/v2, mode: enforce) authority none store sqlite, scratch (created and destroyed for this run) diff --git a/docs/guides/verify-in-ci.mdx b/docs/guides/verify-in-ci.mdx index 7421a8e..37c2df0 100644 --- a/docs/guides/verify-in-ci.mdx +++ b/docs/guides/verify-in-ci.mdx @@ -32,7 +32,7 @@ guarantees pass. ``` ```text - CTRLRun verify — ctrlrun 0.12.1, catalogue ctrlrun.guarantees/v7 + CTRLRun verify — ctrlrun 0.12.2, catalogue ctrlrun.guarantees/v7 policy /Users/arpanghoshal/ctrlrun-project/wt/v11-i3/examples/cookbook/verify-in-github-actions/ctrlrun.yaml (ctrlrun.policy/v2, mode: enforce) authority none store sqlite, scratch (created and destroyed for this run) diff --git a/docs/verify.md b/docs/verify.md index f02def5..6013a20 100644 --- a/docs/verify.md +++ b/docs/verify.md @@ -14,7 +14,7 @@ what could not be tested at all. ```console $ ctrlrun verify -CTRLRun verify — ctrlrun 0.12.1, catalogue ctrlrun.guarantees/v7 +CTRLRun verify — ctrlrun 0.12.2, catalogue ctrlrun.guarantees/v7 policy examples/authority/payments.yaml (ctrlrun.policy/v7, mode: enforce) authority same document, 3 grants store sqlite, scratch (created and destroyed for this run)