feat(release): add fail-closed release-quorum certificate - #38
Merged
Conversation
Bind one exact release candidate to every 1.0.0 release gate at once through a content-addressed ReleaseQuorumCertificate. It proves the historical-tree replay resolved succeeded with temporary rollback, the attestation-campaign run and model-witness quorum was met, an independent reviewer quorum of unique trusted current pass signatures was reached, and the wheel, source, SBOM, signing, provenance, and documentation identities are bound. Construction refuses whenever any gate is unmet and never counts unsigned, untrusted, expired, or duplicate reviewer material. Keep the certificate schema internal to release governance via the schema discovery exclusion, so the frozen public compatibility contract and its independent review remain unchanged. Cover every fail-closed path at full statement and branch coverage on real Git replays and genuinely signed attestations. Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li) Seat: a7c1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a fail-closed, content-addressed
ReleaseQuorumCertificatethat binds oneexact release candidate to every 1.0.0 release gate at once: the historical-tree
replay resolution (must be
succeeded) with temporary-rollback proof, theattestation-campaign run and model-witness quorum, an independent reviewer
quorum counting only unique trusted current
passsignatures, the wheel,source, and SBOM digests, and the signing, provenance, and documentation
references. Construction refuses whenever any gate is unmet and never counts
unsigned, untrusted, expired, or duplicate reviewer material.
The certificate schema is kept internal to release governance via the schema
discovery exclusion, so the frozen public compatibility contract and its
independent review remain unchanged; no CLI surface is added.
src/rigor_foundry/release_quorum.py.tests/test_release_quorum.pyat 100% statement and branch coverage onreal Git replays and genuinely signed Ed25519 attestations; every fail-closed
path covered.
tests/test_stable_contract.pyregisters the internal schema exclusion.CHANGELOG.mdAdded entry.Exact object
f2038c686ed15e175ea9e86bc87e6b91182277f0(tree7817012b57c45103e6f8e0debdd2591fde28fef4, parente5a68bd). Independentexact-SHA second-eye review returned CLEAR with zero findings. Local gates:
strict MyPy (141 files), Ruff, Ruff-format, Bandit, REUSE, preflight
--fast,and the repository guard tests all pass. The production seal of a real
v1.0.0candidate remains a separate, owner-gated step and no release tag is created
here.