feat(release): add turnkey release-quorum seal driver - #39
Merged
Conversation
Add tools/seal_release_quorum.py, a release-engineering entry point in the same family as tools/check_release_tag.py. Its seal command reads a release-evidence manifest, runs the representative campaign live through the historical-tree executor, loads the attestation campaign, reviewer attestations, and trust store from their files, and writes one sealed ReleaseQuorumCertificate; it exits non-zero and writes nothing when any release gate is unmet. Its verify command reloads a sealed certificate and reports its bound identity. The historical execution record is produced live because it has no reload path, which matches how a real release event scans and replays the representative repositories at seal time. The driver adds no frozen public command or schema. Tests cover the seal, verify, and every manifest-error path on real Git replays and genuinely signed attestations. Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li) Seat: a7c1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
tools/seal_release_quorum.py, a turnkey release-engineering entry point inthe same family as
tools/check_release_tag.py, so the eventualv1.0.0releaseevent is a single command rather than a hand-assembled certificate.
seal --manifest <m.json> --output <c.json>reads a release-evidence manifest,runs the representative campaign live through the historical-tree executor
(each repository scanned at its head, captured, replayed in isolation), loads
the attestation campaign, reviewer attestations, and trust store from their
files, and writes one sealed
ReleaseQuorumCertificate. It exits non-zero andwrites nothing when any release gate is unmet.
verify --certificate <c.json>reloads a sealed certificate throughfrom_dictand reports its bound identity.The historical execution record is produced live because it has no reload path,
matching how a real release event scans and replays the representative
repositories at seal time. No frozen
rigorcommand or wire schema is added.New
tools/seal_release_quorum.pyandtests/test_seal_release_quorum.py(seal, verify, and every manifest-error path on real Git replays and genuinely
signed attestations);
CHANGELOG.mdentry.Exact object
8afa62739e1ecd661a070ac2c389c004beea62a7(tree1753be48..., parentf2038c6). Independent exact-SHA second-eye reviewreturned CLEAR with zero findings. Local gates: strict MyPy over
srcandtools, Ruff, Ruff-format, Bandit, REUSE, preflight--fast, and the guardtests all pass. No release tag is created here.