diff --git a/conductor/github-mapping.json b/conductor/github-mapping.json index 3851590..df2fe9d 100644 --- a/conductor/github-mapping.json +++ b/conductor/github-mapping.json @@ -11,8 +11,8 @@ "tracks": 31, "phases": 128, "repository_issues": 168, - "open_tracks": 1, - "historical_tracks": 30 + "open_tracks": 0, + "historical_tracks": 31 }, "verification": { "verified_at": "2026-08-01", @@ -26,10 +26,10 @@ { "track_id": "post-release-security-quality-frontier_20260801", "title": "Post-Release Security and Quality Frontier", - "path": "conductor/tracks/post-release-security-quality-frontier_20260801", + "path": "conductor/tracks/archive/post-release-security-quality-frontier_20260801", "priority": "P0", - "historical": false, - "metadata_status": "in_progress", + "historical": true, + "metadata_status": "archived", "parent_issue": { "number": 224, "node_id": "I_kwDORAMgA88AAAABLCLcjQ", @@ -41,59 +41,59 @@ "phase_id": "post-release-security-quality-frontier_20260801.phase1", "number": 1, "title": "Dependency and runtime consolidation", - "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "source": "conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md", "reconstructed": false, "issue": { "number": 225, "node_id": "I_kwDORAMgA88AAAABLCLc0w", "url": "https://github.com/edithatogo/authentext/issues/225", - "state": "open" + "state": "closed" } }, { "phase_id": "post-release-security-quality-frontier_20260801.phase2", "number": 2, "title": "Measured quality frontier", - "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "source": "conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md", "reconstructed": false, "issue": { "number": 226, "node_id": "I_kwDORAMgA88AAAABLCLdJg", "url": "https://github.com/edithatogo/authentext/issues/226", - "state": "open" + "state": "closed" } }, { "phase_id": "post-release-security-quality-frontier_20260801.phase3", "number": 3, "title": "Solo-maintainer security controls", - "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "source": "conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md", "reconstructed": false, "issue": { "number": 227, "node_id": "I_kwDORAMgA88AAAABLCLdeQ", "url": "https://github.com/edithatogo/authentext/issues/227", - "state": "open" + "state": "closed" } }, { "phase_id": "post-release-security-quality-frontier_20260801.phase4", "number": 4, "title": "Backlog, roadmap, and GitHub reconciliation", - "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "source": "conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md", "reconstructed": false, "issue": { "number": 228, "node_id": "I_kwDORAMgA88AAAABLCLdug", "url": "https://github.com/edithatogo/authentext/issues/228", - "state": "open" + "state": "closed" } }, { "phase_id": "post-release-security-quality-frontier_20260801.phase5", "number": 5, "title": "Final verification and governed handoff", - "source": "conductor/tracks/post-release-security-quality-frontier_20260801/plan.md", + "source": "conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md", "reconstructed": false, "issue": { "number": 229, diff --git a/conductor/index.md b/conductor/index.md index 93b0074..cf3b661 100644 --- a/conductor/index.md +++ b/conductor/index.md @@ -19,7 +19,7 @@ than guessing paths. - [Roadmap](./roadmap.md) - [Tracks Registry](./tracks.md) -- [Active Security and Quality Track](./tracks/post-release-security-quality-frontier_20260801/index.md) +- [Archived Security and Quality Track](./tracks/archive/post-release-security-quality-frontier_20260801/index.md) - [Released Bleeding-Edge Track](./tracks/archive/bleeding-edge-agent-skills-conductor_20260731/index.md) - [GitHub Issue Mapping](./github-mapping.json) diff --git a/conductor/roadmap.md b/conductor/roadmap.md index 7fa1287..ff3be1d 100644 --- a/conductor/roadmap.md +++ b/conductor/roadmap.md @@ -7,7 +7,7 @@ Local Conductor files define scope and evidence. GitHub issues, subissues, and Project fields mirror that state; they do not establish implementation, publication, or release. -## Now: post-release security and quality frontier +## Completed: post-release security and quality frontier - Move maintained automation from EOL Node 20 to Node 24 LTS. - Consolidate PR #219 with overlapping dependency and audit work. @@ -17,7 +17,7 @@ publication, or release. - Reconcile stale issues and hosted Project state. Primary track: -[`post-release-security-quality-frontier_20260801`](./tracks/post-release-security-quality-frontier_20260801/index.md), +[`post-release-security-quality-frontier_20260801`](./tracks/archive/post-release-security-quality-frontier_20260801/index.md), coordinated under [GitHub issue #65](https://github.com/edithatogo/authentext/issues/65). ## Completed: standards-compliant portable core diff --git a/conductor/tracks.md b/conductor/tracks.md index 2bff397..a3f1830 100644 --- a/conductor/tracks.md +++ b/conductor/tracks.md @@ -8,11 +8,7 @@ This file tracks all major tracks for the project. Each track has its own detail ## Active Tracks -- [~] **post-release-security-quality-frontier_20260801** (P0) - Consolidate - dependencies and Node 24, add measured quality evidence, strengthen - solo-maintainer controls, and reconcile the post-3.2.0 backlog. See - [`tracks/post-release-security-quality-frontier_20260801/`](./tracks/post-release-security-quality-frontier_20260801/index.md) - and portfolio [GitHub #65](https://github.com/edithatogo/authentext/issues/65). +No active tracks. --- @@ -26,10 +22,16 @@ This file tracks all major tracks for the project. Each track has its own detail ## Archived Tracks -**Total archived track directories:** 26 +**Total archived track directories:** 27 **Latest archives:** +- [x] **post-release-security-quality-frontier_20260801** - Node 24 and audited + dependencies, native coverage evidence, solo-maintainer safeguards, and + reconciled hosted/backlog state. See + [`tracks/archive/post-release-security-quality-frontier_20260801/`](./tracks/archive/post-release-security-quality-frontier_20260801/index.md) + and GitHub [#224](https://github.com/edithatogo/authentext/issues/224). + - [x] **bleeding-edge-agent-skills-conductor_20260731** - Portable Agent Skills conformance, behavioral evaluation, current Conductor/GitHub control plane, governed experimental layers, and release `v3.2.0`. See diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/backlog-evidence.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/backlog-evidence.md similarity index 100% rename from conductor/tracks/post-release-security-quality-frontier_20260801/backlog-evidence.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/backlog-evidence.md diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/design.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/design.md similarity index 100% rename from conductor/tracks/post-release-security-quality-frontier_20260801/design.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/design.md diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/index.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/index.md similarity index 100% rename from conductor/tracks/post-release-security-quality-frontier_20260801/index.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/index.md diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/metadata.json similarity index 80% rename from conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/metadata.json index 0c38099..d104c0b 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/metadata.json +++ b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/metadata.json @@ -4,13 +4,11 @@ "description": "Consolidate dependency updates, retire the Node 20 maintenance baseline, strengthen evidence-based tests and solo-maintainer controls, and reconcile the post-3.2.0 backlog.", "type": "maintenance", "priority": "P0", - "status": "in_progress", + "status": "archived", "created_at": "2026-08-01", "updated_at": "2026-08-01", - "current_phase": "Phase 1: Dependency and runtime consolidation", - "depends_on": [ - "bleeding-edge-agent-skills-conductor_20260731" - ], + "current_phase": "Complete", + "depends_on": ["bleeding-edge-agent-skills-conductor_20260731"], "parallel_safe": false, "portfolio_issue": 65, "github": { diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md similarity index 68% rename from conductor/tracks/post-release-security-quality-frontier_20260801/plan.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md index 8f4c4a1..afbab23 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/plan.md +++ b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/plan.md @@ -8,7 +8,7 @@ Tasks move from `[ ]` to `[~]` to `[x]` only with repository and hosted evidence. Each phase is mirrored by a native GitHub subissue. -## Phase 1: Dependency and runtime consolidation +## Phase 1: Dependency and runtime consolidation [checkpoint: 4417398] - [x] Add failing guardrails for Node 24 and dependency-engine compatibility. (M-001, M-008) @@ -18,12 +18,12 @@ evidence. Each phase is mirrored by a native GitHub subissue. (M-002, M-003) - [x] Run audit, sync, validation, lint, type, tests, and host/portable checks. (M-003–M-006, S-001) -- [~] Verify the exact revision on Linux, macOS, Windows, and CodeQL. -- [ ] Close or supersede overlapping PRs #50, #53, and #62 with evidence. +- [x] Verify the exact revision on Linux, macOS, Windows, and CodeQL. +- [x] Close or supersede overlapping PRs #50, #53, and #62 with evidence. (M-002) -- [ ] Phase verification and checkpoint per `conductor/workflow.md`. +- [x] Phase verification and checkpoint per `conductor/workflow.md`. -## Phase 2: Measured quality frontier +## Phase 2: Measured quality frontier [checkpoint: 4417398] - [x] Inventory existing property, contract, behavioral, and integration tests. (M-007, S-002, S-003, C-003) @@ -35,9 +35,9 @@ evidence. Each phase is mirrored by a native GitHub subissue. bounded adopt/exclude decision. (S-002, C-004) - [x] Upload a quality summary artifact; add Codecov OIDC only if hosted setup is verified. (S-005, C-002) -- [ ] Phase verification and checkpoint per `conductor/workflow.md`. +- [x] Phase verification and checkpoint per `conductor/workflow.md`. -## Phase 3: Solo-maintainer security controls +## Phase 3: Solo-maintainer security controls [checkpoint: 4417398] - [x] Inventory current rulesets, automation actors, templates, and security context. (M-009, S-004) @@ -49,26 +49,26 @@ evidence. Each phase is mirrored by a native GitHub subissue. - [x] Verify hosted ruleset behavior and owner recovery. - [x] Verify Renovate access before any Dependabot removal; otherwise retain Dependabot and record the external gate. (M-011, S-006) -- [ ] Phase verification and checkpoint per `conductor/workflow.md`. +- [x] Phase verification and checkpoint per `conductor/workflow.md`. -## Phase 4: Backlog, roadmap, and GitHub reconciliation +## Phase 4: Backlog, roadmap, and GitHub reconciliation [checkpoint: 4417398] -- [~] Reconcile issue #54 against the final audit and install-surface contract. +- [x] Reconcile issue #54 against the final audit and install-surface contract. - [x] Reconcile issues #57–#59 against merged files, tests, and hosted runs. (M-012) - [x] Keep or route issue #61 based on its product-scope evidence. - [x] Rewrite `conductor/roadmap.md` for the post-3.2.0 frontier. (S-007) - [x] Verify native issue/subissue hierarchy and Project 36 fields. (M-013) - [x] Refresh the deterministic GitHub mapping receipt. -- [ ] Phase verification and checkpoint per `conductor/workflow.md`. +- [x] Phase verification and checkpoint per `conductor/workflow.md`. -## Phase 5: Final verification and governed handoff +## Phase 5: Final verification and governed handoff [checkpoint: 4417398] -- [ ] Run full local, official Agent Skills, audit, coverage, and Conductor +- [x] Run full local, official Agent Skills, audit, coverage, and Conductor gates. -- [ ] Run formal Conductor review and resolve findings. -- [ ] Verify hosted CI on the exact final revision. -- [ ] Record external gates for Renovate, Codecov, publication, or credentials. +- [x] Run formal Conductor review and resolve findings. +- [x] Verify hosted CI on the exact final revision. +- [x] Record external gates for Renovate, Codecov, publication, or credentials. (M-014) -- [ ] Archive the track only after repository and hosted evidence agree. -- [ ] Phase verification and checkpoint per `conductor/workflow.md`. +- [x] Archive the track only after repository and hosted evidence agree. +- [x] Phase verification and checkpoint per `conductor/workflow.md`. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/quality-evidence.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/quality-evidence.md similarity index 100% rename from conductor/tracks/post-release-security-quality-frontier_20260801/quality-evidence.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/quality-evidence.md diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/requirements.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/requirements.md similarity index 100% rename from conductor/tracks/post-release-security-quality-frontier_20260801/requirements.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/requirements.md diff --git a/conductor/tracks/archive/post-release-security-quality-frontier_20260801/review-report.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/review-report.md new file mode 100644 index 0000000..9d8608b --- /dev/null +++ b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/review-report.md @@ -0,0 +1,34 @@ +# Review Report: Post-Release Security and Quality Frontier + +Date: 2026-08-01 +Reviewed range: `c26146a..4417398` + +## Summary + +Ready to archive: the implementation matches the plan, preserves the portable +skill boundary, and has no unresolved correctness, security, portability, or +style finding. + +## Verification checks + +- **Plan compliance:** Yes. Node 24, consolidated dependencies, native coverage, + repository context, hosted safeguards, backlog reconciliation, and explicit + external gates are implemented. +- **Style compliance:** Pass against both Conductor code style guides. +- **New tests:** Yes. Workflow/runtime/context guards and the deterministic LCOV + summary contract were added. +- **Test coverage:** Yes. Node-native thresholds pass at 77.66% lines, 83.33% + functions, and 65.42% branches. +- **Test results:** Passed. Sync, portable and host validation, lint, typecheck, + formatting, 76 aggregate Node tests, integration tests, audit, and live + Conductor reconciliation passed on updated `main`. +- **Hosted evidence:** Passed on merge revision `4417398` across CI, workflow + lint, skill distribution (Linux/macOS/Windows), and CodeQL. + +## Findings + +The archival PR demonstrated that the initially required `actionlint` context is +path-filtered and absent for Conductor-only changes. Ruleset `20171596` was +corrected to require only the universal `test` and `portable-spec` contexts; +`actionlint` remains enforced whenever workflow paths change. No finding remains +open. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/security-evidence.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/security-evidence.md similarity index 83% rename from conductor/tracks/post-release-security-quality-frontier_20260801/security-evidence.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/security-evidence.md index e8adffb..ec540f4 100644 --- a/conductor/tracks/post-release-security-quality-frontier_20260801/security-evidence.md +++ b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/security-evidence.md @@ -20,7 +20,10 @@ warranted permissions. Active ruleset `20171596` (`Authentext main safeguards`) targets the default branch and blocks branch deletion and non-fast-forward pushes. It requires -up-to-date `test`, `actionlint`, and `portable-spec` checks. Repository +up-to-date `test` and `portable-spec` checks, which run on every pull request. +`actionlint` remains enforced by its path-filtered workflow when workflow files +change, but is not a global required context because it does not run on +Conductor-only changes. Repository administrators retain an explicit recovery bypass; no review count, team, CODEOWNERS, or human approval is required. diff --git a/conductor/tracks/post-release-security-quality-frontier_20260801/spec.md b/conductor/tracks/archive/post-release-security-quality-frontier_20260801/spec.md similarity index 100% rename from conductor/tracks/post-release-security-quality-frontier_20260801/spec.md rename to conductor/tracks/archive/post-release-security-quality-frontier_20260801/spec.md