docs: record deployed trusted-gates evidence - #180
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The planned trusted-dco green run and ADR-0035 action-item updates have not yet landed.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Documents the deployed trusted-gates configuration and its live validation evidence.
Changes:
- Records the 10 required status contexts.
- Links three verified
gate-integrityred-to-green exercises. - Notes that
trusted-dcovalidation remains in progress.
File summaries
| File | Description |
|---|---|
docs/repository-trust-operations.md |
Records deployed ruleset state and workflow evidence. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom <m@beacom.dev>
mbeacom
force-pushed
the
mbeacom-trusted-gates-evidence
branch
from
August 27, 2026 01:33
91a1184 to
4cda89c
Compare
Decisions governing this change
|
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Mark Beacom <m@beacom.dev>
Merged
mbeacom
added a commit
that referenced
this pull request
Aug 27, 2026
release: prepare v0.12.0 Cut the unreleased changelog into `## [0.12.0] - 2026-08-27` and move every lockstep version-bearing surface from 0.11.0 to 0.12.0. `@adrkit/spec-kit` stays at 0.1.3 and the agent plugin at 0.2.0: both are independently versioned under ADR-0007 and neither moves with the repository release. Two changelog corrections rather than a mechanical rename. The trusted-gates trio was authored under `### Added` in #179, but #177 later inserted a `### Fixed` heading above it and silently swallowed all three entries into the wrong section; they are restored to `### Added`, and `### Fixed` now follows `### Changed` as in every prior release section. The `docs/repository-trust-operations.md` entry said those controls "cannot be applied until this lands" — no longer true once #180 recorded the deployed state, so it now states what is actually deployed: `trusted-dco` and `gate-integrity` are among the ten required contexts, the pull-request- controlled `dco` context was removed from that set only after the trusted one reported green on real pull requests, and both gates were observed red then green on real pull requests rather than in a fixture (ADR-0016). `bun.lock`'s diff is exactly the four workspace `version` lines, edited directly rather than by regenerating the lockfile, so no transitive drift rides along in the release commit. Validation: 2790 tests pass; typecheck, lint, `adr lint` (35 records, 0 errors), actionlint, and every `check:*` gate green; schema, MANIFEST, and committed Action bundle no-diff gates clean. The committed `packages/ci/dist` bundles were confirmed byte-identical to a canonical Linux Bun 1.3.14 rebuild and were restored after `release:pack`'s non-frozen build rewrote them under local Bun 1.4.0. `release:pack --tag v0.12.0` produced five artifacts (four lockstep at 0.12.0 plus spec-kit at 0.1.3); installed-tarball smoke passed on Node 22.22.2 and 24.16.0; `release:publish --dry-run` exited 0 and skipped `@adrkit/spec-kit@0.1.3` as registry-identical, confirmed independently against the registry shasum; `npm audit` over the packed consumer tree found 0 vulnerabilities against an empty `KNOWN_CONSUMER_ADVISORY_ACCEPTANCES`; and both OCI targets built and smoked, with the MCP image serving both protocol eras read-only and networkless. Signed-off-by: Mark Beacom <m@beacom.dev> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainruleset after addingtrusted-dcoandgate-integrityand retiring the old requireddcocontextgate-integrityred/acknowledge/green runs from PRs feat(release): add guarded Action tag recovery #175, feat: generate the MANIFEST inventory and gate it against the corpus #177, and Surface marker scan health and dangling claims in CI comments #178trusted-dconegative and positive exerciseDeployed evidence
Base:
e9169e7e6d6a8519ebafff06f5217a98a632c21f91a1184376b00bf394712377933e1c07a0558f00intentionally retained the Copilot co-author trailer and omittedSigned-off-by.trusted-dcofailed: run 33030349682, job 98381187821.4cda89cf299799ba1758cf2475ca6f384ecc7667and force-pushed only with an explicit lease against the recorded91a1184...remote tip.trusted-dcopassed: run 33030491642, job 98381634309.516b7bb2892859d46c8242a2db6ecd24e1c0c33b.Final checks
All 10 required contexts are green on the final head: trusted gates, CI, and CodeQL. Local DCO reports
2 signed, 0 exempt, 0 unsigned; ADR lint reports 35 records with no findings; MANIFEST regeneration is clean; targeted trust, manifest, ordering, and site grammar checks pass.Only
docs/adr/0035-...mdanddocs/repository-trust-operations.mdchanged. No gate-path acknowledgment label was applied because no gate-defining path changed. The PR remains open and unmerged.