Release: qualify and publish basic supervised Slack ingress in v1.5.0

[jeffhuber]

Canonical basic-Slack v1.5.0 release gate — owner-approved, reconciled 2026-09-17

This section supersedes older dependency and acceptance text below where it conflicts.

• v1.4.2 Board published and qualified
• Lineage: attest issue-to-PR creation and local audit publication #1020/Lineage: publish local audits through a verified GitHub workflow #1022 provenance foundations merged through Lineage: attest initial issue-to-PR creation #1021/Publish local audit verdicts through a verified GitHub workflow #1023
• Audit publication: verify repository-dispatch workflow identity correctly #1025 repository-dispatch publication bootstrap correction
• Slack: minimal opt-in setup, doctor, and runbook for v1.5.0 #922/Slack: explicit private-workspace setup, readiness doctor and runbook #1024 minimal opt-in setup, redacted doctor and runbook
• CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding #918 private isolated-workspace admin lifecycle, privacy-log, rollout and rollback exercise
• Build and rehearse one immutable v1.5 candidate: default Slack-free install, explicit Slack opt-in, v1.4.2 upgrade, disable/uninstall and rollback; include Fix Graphify inventory limits and frontend test discovery #1007 in package/release notes
• Slack: Devin dispatch, clarification, completion, and cancellation bridge #920 completion and confirmed-cancellation canaries against that immutable candidate, after explicit numeric cap authorization
• Replay/dedupe/restart/revocation/privacy evidence, exact-head release audit, green CI and authoritative gate
• Publish v1.5.0 tag/package, independently reinstall, reconcile evidence and close Slack: Devin dispatch, clarification, completion, and cancellation bridge #920/CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding #918/Epic: Basic supervised Slack ingress for v1.5.0 #903/Roadmap through v1.5.0: bounded builders, Graphify, Board, and supervised Slack #900

Final publication follows candidate canaries; the final published package is not a canary prerequisite. #921/#978, rich Slack UX, Slack Connect, public channels, broad provider selection and optional #951 are v1.5.1.

Part of #903 and roadmap #900.

v1.5.0 release and qualification

Dependencies

• v1.4.2 Board package published and locally qualified through Release: publish and qualify Board clarity v1.4.2 #952
• Board: integrate head-bound evidence and qualify local and hosted session visibility #951 hosted Board observation canary, if retained as a final release criterion
• CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding #918 OAuth/policy binding
• Slack: connect authorized tasks to a qualified Code Mower supervisor #977 qualified supervisor adapter
• Slack: durable inbox/outbox and start/status/cancel interaction #919 durable interactions
• Slack: Devin dispatch, clarification, completion, and cancellation bridge #920 supervised hosted bridge
• v1.5.1: Slack telemetry contract and OSS Board/cloud emitters #921 OSS telemetry contract and emitters
• v1.5.1: CodeMower.com Slack telemetry, aggregation, and fresh views #978 hosted telemetry ingest and fresh views
• Slack: minimal opt-in setup, doctor, and runbook for v1.5.0 #922 setup, doctor and operating guidance
• Campaign: support isolated Codex authentication on headless Linux #983 isolated headless Codex campaign authentication
• Board: manage persistent services and reject stale keepalive bindings during release restart #1001 persistent Board service lifecycle merged for inclusion in the next package
• Release integrity: reject transient publication text in final tags #1014 final-tag release-state integrity gate
• Adoption polish: explain drift direction and stabilize Board startup evidence #1015 adoption evidence polish for drift, Board startup, and provider-specific prompts
• Lineage: attest issue-to-PR creation and local audit publication #1020 attested issue-to-PR creation lineage and local audit publication

Final acceptance

• Complete and cancel bounded work through the qualified Slack-to-supervisor path.
• Verify signature/replay handling, durable receipt-before-ack, deduplication, retries, clarification answers and uncertain-create reconciliation.
• Verify privacy, tenant isolation, retention/deletion, restart recovery, rate limiting and least-privilege scopes.
• Verify local Board, stored metadata receipt and freshly observed hosted aggregate views independently.
• Verify hosted deployment and rollback evidence.
• Pass source/package builds, fresh install, upgrade and default/no-optional-provider rehearsals.
• Include PR Fix Graphify inventory limits and frontend test discovery #1007's post-v1.4.2 Graphify compatibility fixes in the published release notes; rebuild only generations those gaps left affected/partial.
• Obtain an independent exact-head release audit with zero P0/P1/P2 findings, green CI and authoritative gate.
• Publish and verify v1.5.0 artifacts, then update Epic: Basic supervised Slack ingress for v1.5.0 #903/Roadmap through v1.5.0: bounded builders, Graphify, Board, and supervised Slack #900 with final evidence.

Paid completion/cancellation canaries require explicit campaign-wide caps. Provider exit, implementation completion, reviewed head, authorized/settled spend, stored receipt and fresh aggregate visibility remain separate evidence.

---

Owner-approved basic Slack release gate (2026-09-17)

Required dependencies

• Lineage: publish local audits through a verified GitHub workflow #1022 verified audit publication
• CodeMower.com: single-workspace Slack OAuth installation and explicit policy binding #918 private setup/rotation/disable/deletion exercise
• Slack: connect authorized tasks to a qualified Code Mower supervisor #977 qualified supervisor adapter
• Slack: durable inbox/outbox and start/status/cancel interaction #919 durable interactions
• Slack: Devin dispatch, clarification, completion, and cancellation bridge #920 two capped bridge canaries
• Slack: minimal opt-in setup, doctor, and runbook for v1.5.0 #922 minimal setup, doctor, and runbook
• Campaign: support isolated Codex authentication on headless Linux #983 headless Codex authentication
• Board: manage persistent services and reject stale keepalive bindings during release restart #1001 Board service lifecycle
• Release integrity: reject transient publication text in final tags #1014 release-integrity gate
• Adoption polish: explain drift direction and stabilize Board startup evidence #1015 adoption polish
• PR Fix Graphify inventory limits and frontend test discovery #1007 compatibility changes included in release notes/package

#951, #921, and #978 are v1.5.1 work and do not block v1.5.0.

Final acceptance

• One private workspace and explicit immutable user/channel/repository policy pass.
• Private start, status, answer, completion, and cancellation work through one qualified supervisor/hosted-builder path.
• One capped completion canary reaches verified PR/head completion.
• One capped cancellation canary records acknowledgement and observed provider exit.
• Replay, deduplication, restart recovery, revocation, uncertain mutation handling, least privilege, and privacy pass.
• Fresh default install remains Slack-free; opt-in fresh install and upgrade rehearsals pass.
• Hosted rollout, rollback, disable, and uninstall evidence pass.
• Source/package checks, independent exact-head release audit, CI, and authoritative gate pass.
• v1.5.0 artifacts are published and independently reinstalled.
• Roadmap through v1.5.0: bounded builders, Graphify, Board, and supervised Slack #900 and Epic: Basic supervised Slack ingress for v1.5.0 #903 receive final immutable evidence.

[jeffhuber]

v1.4.1 independent adoption feedback incorporated

The upgrade rehearsal confirmed the core install path, PyPI/tag/version alignment, doctor, lane status, session-lease guidance, and fresh Board startup. Follow-up is now mapped as follows:

• Board: manage persistent services and reject stale keepalive bindings during release restart #1001 (from Board: manage persistent services and reject stale keepalive bindings during release restart #961) already completed the observed Board process-loss problem with a managed persistent service lifecycle.
• Adoption polish: report effective review authority and superseded Devin bridge drift #955 already completed posture-scoped concise doctor output; warning count remains evidence, not a release target.
• Release integrity: reject transient publication text in final tags #1014 is the v1.5 release blocker that prevents final tags from retaining transient candidate/publication-pending text and removes the hard-coded prior release identity from publication.
• Adoption polish: explain drift direction and stabilize Board startup evidence #1015 owns the remaining adoption polish: explicit setup-drift operands/classification meaning, a bounded Board-startup visibility grace, concise install verification guidance, and extraction of detailed optional Devin setup from the universal prompt.

The published v1.4.1 tag remains immutable. Current main has corrected prose; #1014 prevents recurrence for v1.5.0 rather than rewriting history.

[jeffhuber]

Provenance convergence update: stage 1 of #1020 merged through #1021 at 1888cd4740da76cd03f7e062ef23c62f74f3a41e with green CI, exact-head Codex PASS and the authoritative gate. Stage 2 is now #1022 and is active in the Code Mower Codex builder lane. #1020 remains open until same-owner local audits publish through the trusted workflow without a routine override.

[jeffhuber]

Roadmap update: provenance stage 2 is complete. PR #1023 merged as a6b2e32804dcd16153fdcf4efe70c35e4fbe592e after exact-head Claude PASS, separate trust review PASS, green CI, and the one-time bootstrap owner override. The next #922 implementation PR is the live acceptance proof for workflow-attested local audits without routine owner identity override.

The narrowed v1.5.0 critical path is now: minimal #922 in parallel with #918 private admin readiness; immutable candidate artifacts; install/upgrade/rollback rehearsal; the two explicitly capped #920 canaries; exact-head release audit; publication; and independent reinstall verification.

[jeffhuber]

Roadmap mapping update: #1027 is the single release-prep PR boundary for the immutable 1.5.0 candidate and its fresh-install, explicit Slack opt-in, v1.4.2 upgrade, disable/uninstall, rollback, package-inventory, and release-text rehearsals. It follows #1025/#1024, feeds #918 private acceptance and #920 capped canaries, and leaves tag/package publication to #923 after those gates pass.

[jeffhuber]

Release dependency update: #1029 is required in the v1.5.0 candidate before the #1027 package/rehearsal PR freezes. It consumes the already-merged #1007 reader changes, adds readiness/query parity and actionable compatibility diagnostics, and must preserve usable bounded-partial query semantics. No private graph data or adoption evidence enters public artifacts.

[jeffhuber]

v1.5.0 candidate and release-path reconciliation:

• Audit publication: verify repository-dispatch workflow identity correctly #1025 is complete and Slack: explicit private-workspace setup, readiness doctor and runbook #1024 merged; the provenance publication path and minimal opt-in Slack setup/readiness guidance are in the candidate.
• Release: build and rehearse the immutable v1.5.0 candidate #1027 completed through PR Release: prepare and rehearse the immutable v1.5.0 candidate #1033 at d66e01db952e2528f0b5693508808cd068fbf718. Candidate workflow run 35317161869 produced immutable 1.5.0 artifacts; the wheel SHA-256 is 08c8b44cdb4795e1bae939d190b2058b0c73084a856169734111898b9c868001 and the sdist SHA-256 is 91ab9b1407f6c482122338323f94ea7c66335e3dedded10b583bd44d33685313.
• All ten offline candidate rehearsals passed, including default Slack-free install, explicit opt-in, v1.4.2 upgrade, disable/uninstall, rollback, package inventory, release-state integrity, and installed-wheel Graphify compatibility. The Fix Graphify inventory limits and frontend test discovery #1007/Graphify: validate query-reader compatibility before reporting search available #1029 doc_ref query-reader correction is therefore included in this candidate; it remains unreleased until v1.5.0 publication.
• The authorized private OAuth relay correction is merged, the production application is deployed at its exact merge, and the relay is deployed in its disabled state. Exact-head CI and an independent Claude audit passed with zero P0/P1/P2/P3 findings.

The remaining serialized path is now: finish fresh provider telemetry inventory and synthetic OAuth preflight; run #918's isolated private admin lifecycle plus rollback; obtain the explicit 1-ACU-per-canary / 2-ACU-total / zero-recovery authorization and run #920's completion and confirmed-cancellation canaries; perform the final exact-head release audit; publish; independently reinstall; then close #918/#920/#923/#903/#900. No live Slack qualification or paid provider result is claimed by this update.

[jeffhuber]

Candidate invalidated before live Slack mutation

Live #918 preflight found a contract mismatch in the retained candidate: its generated Slack manifest sends OAuth directly to the application callback, while the reviewed privacy boundary requires the dedicated query-scrubbing relay as Slack's sole redirect. The current candidate therefore cannot pass both manifest matching and the OAuth telemetry privacy gate.

Candidate run 35317161869 and its wheel/sdist remain immutable evidence, but they are invalid for publication and must not be tagged, uploaded, or used for #918/#920. No Slack app was created and no paid provider work was spent before this stop.

Corrective PR: #1035

The PR pins the relay redirect and separately pins the application command/interactivity routes in unit and installed-wheel rehearsal checks. After exact-head independent review, green CI, and the authoritative gate, merge it and build one new immutable candidate from that merge SHA. Resume #918 and the authorized two-canary campaign only against those replacement bytes.

[jeffhuber]

Replacement immutable v1.5.0 candidate verified after the Slack OAuth relay correction.

• Source merge: 027a249115d77ba7ce576a854cc1e817b119d0f6 (PR Slack: route OAuth through the privacy relay #1035)
• Candidate run: 35330007032, first attempt, success
• Wheel SHA-256: b76519639391cd2a8cac9828d08401f92c785b75334bd665f8ef73d1dcf871db
• Sdist SHA-256: 0ed172c1950133bbca19c9a990dc3dc96933ca05de576d08f09818e3294d01fa
• Manifest kind/version: candidate / 1.5.0, release PR 1035
• Rehearsal: PASS for fresh install, explicit private Slack setup, offline disabled state, the three required Graphify checks, 1.4.2 upgrade, disposable rollback, and uninstall; synthetic state preserved.

The earlier candidate from d66e01db remains invalid and must not be published or installed. Private acceptance, live Slack lifecycle, paid canaries, and publication remain pending against this replacement candidate.

[jeffhuber]

Candidate run 35330007032 is now invalidated and must not be published or installed for live acceptance.

The replacement candidate correctly fixed the Slack OAuth redirect, but release convergence exposed a separate release-critical defect: the trusted local-audit publication workflow cannot write its reservation/verdict comment on pull requests with its current read-only Pull requests permission. PR #1036 carries the narrow permission correction and a generated-workflow regression.

After #1036 passes an independent exact-head audit, CI and the authoritative gate, one new immutable candidate must be built from its merge SHA. No paid canary has run and no provider spend has occurred.

[jeffhuber]

Replacement v1.5.0 immutable candidate verified

The prior candidate invalidations are superseded by a new immutable candidate built from merged PR #1036.

• Source commit: 59fe054498ec2db5a43b782b75f5070f44a51320
• Candidate run: https://github.com/codemower-ai/code-mower/actions/runs/35331968778
• Wheel SHA-256: b8c1c0cec1fe33996df985beae53235f652ad069cc123f289d42ca148eb5888e
• sdist SHA-256: 953ae03884d421e5dca3e315fcca4d69444b69a86162ebee61401be6554e2d65
• Rehearsal: PASS; 10/10 fresh install, setup, Graphify, upgrade, rollback, and uninstall checks passed with synthetic state preserved.
• Independent local verification: artifact manifest and digests match; hash-locked Python 3.12 installation from the canonically named retained wheel passed; the exact installed package passed the hosted-worker no-provider qualification with zero provider and GitHub calls.

This is the candidate to use for the remaining private-host qualification, Slack lifecycle, paid completion/cancellation canaries, and release audit. The earlier candidates remain invalidated.