fix: autorelease unattended hardening - #56

Merged

loadinglucian merged 48 commits into

mainfrom

fix/autorelease-unattended-hardening

Aug 3, 2026

Commits on Aug 3, 2026

docs: add autorelease unattended hardening plan
loadinglucian
committed
8427c3c
fix: accept any maintained branch in stage-4 module comparison
loadinglucian
committed
fba2b25
fix: validate version shape only in build and package gates
loadinglucian
committed
145211a
fix: protect gate harness scripts and tests from admitted patches
loadinglucian
committed
a1375a1
fix: protect toolchain pins and the shared shell library from admitted patches
loadinglucian
committed
12fa3f4
refactor: unify merge admission check assertions in one script
loadinglucian
committed
368dbee
fix: correct admission assert rationale and cover check-name path
loadinglucian
committed
9a899ea
refactor: assert workflow structure instead of source text in verifier
loadinglucian
committed
eb91008
fix: assert the whole release workflow is free of the OpenAI credential
loadinglucian
committed
b907f5d
feat: decide to recover a published release with no event record
loadinglucian
committed
7c9c0c0
feat: recover missing event records from the watcher
loadinglucian
committed
d174ea8
fix: stop a blocked record recovery from starving the watcher
loadinglucian
committed
0f641aa
fix: bind a recovered record to an attested release on main
loadinglucian
committed
e78e2f9
fix: keep record recovery out of the shared checkout and branch name
loadinglucian
committed
8b0c869
fix: keep the recovery merge from deleting a branch in use
loadinglucian
committed
243329f
refactor: route watch actions through deterministic control table
loadinglucian
committed
78cbe67
fix: route the recovery action and assert the hard operator gates
loadinglucian
committed
9c632b8
chore: delete unreferenced schemas
loadinglucian
committed
9e82fd1
refactor: align the completion assessment schema with admission
loadinglucian
committed
ae0454a
refactor: dedupe digest and sha validation helpers
loadinglucian
committed
952ed15
chore: enforce bash defaults and least privilege in workflows
loadinglucian
committed
47f1123
fix: bind trusted automation exemptions to single-file records
loadinglucian
committed
4075fbf
test: fold line continuations before checking gh calls name the repo
loadinglucian
committed
b104cf6
docs: record why the recovery withdraw path traps only EXIT
loadinglucian
committed
d3df414
chore: scope the public-language check to tracked files
loadinglucian
committed
3cf020c
chore: keep the packaging test artifacts out of the working tree
loadinglucian
committed
bec6c5e
refactor: reuse canonical digest helpers in the admin snapshot
loadinglucian
committed
8dc474b
fix: shut the release fixture server down cleanly
loadinglucian
committed
abd64cc
chore: narrow the shellcheck suppression and cover every bash script
loadinglucian
committed
723dc81
test: assert both repositories name event records identically
loadinglucian
committed
ea543de
fix: shield the recovery withdraw from cancellation escalation
loadinglucian
committed
8f5baf6
fix: fail the public-language check when it lists no files
loadinglucian
committed
9ef9071
refactor: split control module behind stable facade
loadinglucian
committed
49092ac
refactor: split plan admission into its three gates
loadinglucian
committed
192074a
docs: state the watcher routing invariant the workflow depends on
loadinglucian
committed
6f7b221
test: scan the whole control package for classifier markers
loadinglucian
committed
06cb37d
docs: correct autorelease references and document unattended lifecycle
loadinglucian
committed
2958457
fix: set the validate output only after its artifact uploads
loadinglucian
committed
0964951
test: scan nested control modules for classifier markers
loadinglucian
committed
c8589aa
docs: make the automation the subject of the rebuild revision
loadinglucian
committed
09a03af
fix(autorelease): defer the no-change evidence record after a recovery merge
loadinglucian
committed
e34872c
refactor(autorelease): read the missing record after the health guards
loadinglucian
committed
2b7d9be
fix(autorelease): protect the shared dependabot configuration in php-bin
loadinglucian
committed
b32afa0
docs: drop the committed hardening plan from the release repository
loadinglucian
committed
bb27c0d
docs(autorelease): bind an in-flight action key across watcher runs
loadinglucian
committed
6f59ab3
test(autorelease): validate the jq-built recovery record as a completed event
loadinglucian
committed
ca9cd9b
fix: group the grep tolerance so the listing failure stays fatal
loadinglucian
committed
5e5d99f
test: anchor codeowners pairing on the repo root and tolerate tabs
loadinglucian
committed
2b22061