Skip to content

docs(ci-coverage): define evidence contract; implementation unpublished - #70

Merged
rldyourmnd merged 1 commit into
mainfrom
docs/ci-coverage-evidence-20260907
Sep 10, 2026
Merged

docs(ci-coverage): define evidence contract; implementation unpublished#70
rldyourmnd merged 1 commit into
mainfrom
docs/ci-coverage-evidence-20260907

Conversation

@rldyourmnd

Copy link
Copy Markdown
Contributor

Documentation-only draft

This PR records the design and acceptance contract for read-only CI execution coverage. It does not implement or ship an evaluator, CLI, collector or repository enrollment.

A reusable evaluator and standalone inspector were implemented and tested locally, but the GitHub tool blocked the source publication. That write was not retried via another method. The local prototype is retained for independent review in the operator's handoff bundle; it is not code in this PR.

Contract

  • Distinguish repository discovery, effective runner/workflow/cache eligibility and actual successful execution.
  • Bind observations to immutable repository IDs, declared profiles, exact revisions, estate/engine commits and module-lock digest.
  • Preserve missing, stale, future, incomplete and denied evidence rather than claiming all-private-repository coverage.
  • Verify exact run/job/attempt/head relationships through authenticated collection; provenance locators alone are not attestations.
  • Keep the inspector read-only and outside per-job scheduling. Do not broaden observer permissions or create a new mandatory CI gate.
  • Reject empty-scope acceptance, identity ambiguity and duplicate/concatenated JSON.

Verification status

The unpublished local prototype passed six top-level stdlib-only Go tests with 36 named table subcases, plus decoder cases, under Go 1.23.2 with race detection; focused go vet passed. Those are local prototype results, not evidence that the source exists in this branch. Repository toolchain pins are unchanged.

Completion

Independently review the proposed contract and prototype, implement reviewed changes through an authorized development workflow, run pinned-toolchain CI against the actual committed code, and integrate complete paginated policy observations through the existing application/control-plane boundaries. Real private-repository job evidence remains required for every profile. No live coverage or fleet speed improvement is claimed here.

@rldyourmnd
rldyourmnd marked this pull request as ready for review September 10, 2026 04:49
Record source binding, effective eligibility and exact execution evidence as
separate facts. Documentation only: the locally tested prototype could not be
published by the tool. No collector, CLI or enrollment behavior is installed.

Recommitted with a signature: main requires signed commits and the original
commit was unsigned, so the pull request could not merge.

Claude-Session: https://claude.ai/code/session_01Dhii8pMkUcUEWKjhDwxzAX
@rldyourmnd
rldyourmnd force-pushed the docs/ci-coverage-evidence-20260907 branch from 246e062 to 16a7c17 Compare September 10, 2026 04:50
@rldyourmnd
rldyourmnd merged commit 85bcddf into main Sep 10, 2026
6 checks passed
@rldyourmnd
rldyourmnd deleted the docs/ci-coverage-evidence-20260907 branch September 10, 2026 04:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant