From a97e849850e5699b308a8c9fd2867e26f8eb7cb6 Mon Sep 17 00:00:00 2001 From: Brett Kinny Date: Sat, 1 Aug 2026 02:20:19 +1000 Subject: [PATCH 1/3] Document v1.2.1 platform qualification waivers --- .../v1.2.1-external-platform-qualification.md | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .out-of-scope/v1.2.1-external-platform-qualification.md diff --git a/.out-of-scope/v1.2.1-external-platform-qualification.md b/.out-of-scope/v1.2.1-external-platform-qualification.md new file mode 100644 index 0000000..07ae209 --- /dev/null +++ b/.out-of-scope/v1.2.1-external-platform-qualification.md @@ -0,0 +1,32 @@ +# v1.2.1 external platform qualification + +Squarebox v1.2.1 is being released on a best-effort qualification basis without +manual Fedora SELinux/rootless Podman, macOS Docker Desktop, native Windows, or +physical arm64 runs. + +## Why this is out of scope + +The release has completed its automated multi-architecture Candidate suite, +artifact and signature verification, real Linux Docker lifecycle testing on +physical amd64, genuine non-1000 Linux testing in a KVM guest, Codespaces +create/rebuild testing, and retained-v1.1-home migration testing. The release +owner accepted the residual host-integration risk rather than delaying v1.2.1 +until every external operating system and physical architecture was available. + +This is a version-specific qualification waiver, not a statement that Fedora, +Podman, macOS, Windows, or arm64 support has been removed. Failures reported on +those supported paths remain valid bugs. Future Releases should create fresh +qualification issues and may reinstate any of these manual gates when suitable +hosts are available. + +Physical arm64 remains covered by the automated exact-Candidate arm64 build and +emulated smoke evidence, but v1.2.1 does not claim a native physical-arm64 UAT +pass. Final publication still requires exact-digest physical amd64 testing and +all automated Evidence. + +## Prior requests + +- #127 — Qualify v1.2 rootless Podman on Fedora SELinux +- #128 — Qualify v1.2 on macOS Docker Desktop +- #129 — Qualify v1.2 Windows PowerShell and Git Bash lifecycle +- #131 — Qualify the final v1.2 Candidate on physical amd64 and arm64 From 82b51d05e1a619b427cf7518576f80d5fcf2d77e Mon Sep 17 00:00:00 2001 From: Brett Kinny Date: Sat, 1 Aug 2026 02:24:14 +1000 Subject: [PATCH 2/3] Clarify v1.2.1 waiver boundaries --- .../v1.2.1-external-platform-qualification.md | 64 ++++++++++++------- 1 file changed, 41 insertions(+), 23 deletions(-) diff --git a/.out-of-scope/v1.2.1-external-platform-qualification.md b/.out-of-scope/v1.2.1-external-platform-qualification.md index 07ae209..9e2e866 100644 --- a/.out-of-scope/v1.2.1-external-platform-qualification.md +++ b/.out-of-scope/v1.2.1-external-platform-qualification.md @@ -1,32 +1,50 @@ -# v1.2.1 external platform qualification +# v1.2.1 external platform qualification waiver -Squarebox v1.2.1 is being released on a best-effort qualification basis without -manual Fedora SELinux/rootless Podman, macOS Docker Desktop, native Windows, or -physical arm64 runs. +Release owner Brett Kinny accepted on 2026-08-01 that the immutable v1.2.1 +Release may proceed without manual Fedora SELinux/rootless Podman, macOS Docker +Desktop, native Windows PowerShell 7 and Git Bash, or physical arm64 runs. These +criteria are waived, not passed. ## Why this is out of scope -The release has completed its automated multi-architecture Candidate suite, -artifact and signature verification, real Linux Docker lifecycle testing on -physical amd64, genuine non-1000 Linux testing in a KVM guest, Codespaces -create/rebuild testing, and retained-v1.1-home migration testing. The release -owner accepted the residual host-integration risk rather than delaying v1.2.1 -until every external operating system and physical architecture was available. +This is a permanent decision for the v1.2.1 Release identity once published, +not a reusable rejection of platform qualification. It is recorded here +because the version-specific enhancement-style UAT issues are being resolved +as `wontfix`. This record must never be used to deduplicate or reject +qualification work for a later Release. Each later Release must create fresh +qualification issues and reassess its manual gates. -This is a version-specific qualification waiver, not a statement that Fedora, -Podman, macOS, Windows, or arm64 support has been removed. Failures reported on -those supported paths remain valid bugs. Future Releases should create fresh -qualification issues and may reinstate any of these manual gates when suitable -hosts are available. +Prerelease qualification through `v1.2.1-rc5`, source +`8f56f759acdf735c50e1bd0464dd852c28618deb` and image digest +`sha256:861dd7c2ae0e69ae18641bb3817ed0647570c5527b3b3354bfc8f073817b55f5`, +completed the automated multi-architecture Candidate suite, artifact and +signature verification, real physical-amd64 Linux Docker lifecycle testing, +genuine UID/GID 2000 Linux testing in a KVM guest, and Codespaces +create/rebuild testing. A mechanical retained-v1.1-home migration also passed +with synthetic authentication, Selection, and Workspace markers; real +authentication and prompt behavior are not claimed by that evidence. -Physical arm64 remains covered by the automated exact-Candidate arm64 build and -emulated smoke evidence, but v1.2.1 does not claim a native physical-arm64 UAT -pass. Final publication still requires exact-digest physical amd64 testing and -all automated Evidence. +The final protected `v1.2.1` Candidate does not exist yet. It must repeat every +automated build, Evidence, artifact, signature, and emulated-arm64 gate. It also +still requires desktop VS Code Dev Containers UI evidence under #130, native +physical-amd64 exact-digest qualification, draft verification, protected +environment approval, immutable publication verification, alias checks, and +the non-rewind proof under #131. + +## Affected release criteria + +For v1.2.1 only, #125 no longer requires #127, #128, or #129 to produce a manual +pass, and no longer requires the physical-arm64 portion of #131. All other #125 +and #131 criteria remain required. + +This waiver does not remove or change existing platform support status. +Podman remains experimental. Failures reported on any documented path remain +valid bugs. ## Prior requests -- #127 — Qualify v1.2 rootless Podman on Fedora SELinux -- #128 — Qualify v1.2 on macOS Docker Desktop -- #129 — Qualify v1.2 Windows PowerShell and Git Bash lifecycle -- #131 — Qualify the final v1.2 Candidate on physical amd64 and arm64 +- #127 — Fedora SELinux/rootless Podman manual qualification +- #128 — macOS Docker Desktop manual qualification +- #129 — Windows PowerShell 7 and Git Bash manual qualification +- #131 — physical-arm64 criterion only; the issue remains open for every other + final-Candidate and publication criterion From b7ac61f9426406cb974674e9f1aca2f72fad1482 Mon Sep 17 00:00:00 2001 From: Brett Kinny Date: Sat, 1 Aug 2026 02:26:36 +1000 Subject: [PATCH 3/3] Name waived qualification issues precisely --- .out-of-scope/v1.2.1-external-platform-qualification.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.out-of-scope/v1.2.1-external-platform-qualification.md b/.out-of-scope/v1.2.1-external-platform-qualification.md index 9e2e866..485deab 100644 --- a/.out-of-scope/v1.2.1-external-platform-qualification.md +++ b/.out-of-scope/v1.2.1-external-platform-qualification.md @@ -9,10 +9,11 @@ criteria are waived, not passed. This is a permanent decision for the v1.2.1 Release identity once published, not a reusable rejection of platform qualification. It is recorded here -because the version-specific enhancement-style UAT issues are being resolved -as `wontfix`. This record must never be used to deduplicate or reject -qualification work for a later Release. Each later Release must create fresh -qualification issues and reassess its manual gates. +because #127, #128, and #129 will be resolved as `wontfix`. Only #131's +physical-arm64 criterion is waived; #131 remains open. This record must never +be used to deduplicate or reject qualification work for a later Release. Each +later Release must create fresh qualification issues and reassess its manual +gates. Prerelease qualification through `v1.2.1-rc5`, source `8f56f759acdf735c50e1bd0464dd852c28618deb` and image digest