GraphKit 0.3.1 stable dependency bridge for TenantPulse - #5
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
There was a problem hiding this comment.
🟡 Changes recommended
The PSGallery publisher currently suppresses Find-PSResource errors, which can allow publication to proceed without a definitive “version not already published” check.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR establishes GraphKit 0.3.1 as an unpublished stable-line maintenance bridge for TenantPulse by adding the two missing beta read descriptors and introducing a stricter “tested-release proof” mechanism that binds packaged bytes to the exact passing test result and source revision before any publication path can proceed.
Changes:
- Add the beta descriptors
AppleEnrollmentProfile.ListByTokenandManagedDevice.GetBeta, plus deterministic contract/routing tests. - Bump module identity to
0.3.1and update release-truth documentation to preserve immutable0.3.0publication evidence. - Introduce “tested-release proof” creation/verification scripts, enforce proof-gating in publishers, and ratchet CI’s minimum test floor to
791.
File summaries
| File | Description |
|---|---|
| tests/Unit/Operations/TenantPulseDescriptorContracts.Tests.ps1 | Adds catalog + public routing contract tests for the two new TenantPulse-required operations. |
| tests/QA/ReleaseTruth.tests.ps1 | Ensures 0.3.0 publication evidence remains intact while 0.3.1 is explicitly described as unpublished maintenance. |
| tests/QA/ReleaseProof.tests.ps1 | Adds mutation-style QA tests for the new tested-release proof verifier/creator behavior. |
| tests/QA/PublishChannel.tests.ps1 | Updates QA assertions to require proof-gated, report-only-by-default publisher behavior. |
| tests/QA/PackageIdentity.tests.ps1 | Updates package identity expectations to 0.3.1 and checks shipped metadata avoids internal names. |
| tests/QA/MinimumTestsRatchetSync.tests.ps1 | Synchronizes the MinimumTests floor across CI, proof creator, verifier, and fixture. |
| tests/QA/InstallPinnedDependencies.tests.ps1 | Updates “next-release” dependency selection tests to target 0.3.1. |
| source/GraphKit.psd1 | Bumps module version to 0.3.1 and adds explicit maintenance/unpublished release notes and boundary language. |
| source/Data/Operations/ManagedDevice.GetBeta.psd1 | Adds the beta singleton descriptor with a fixed $select projection for TenantPulse detail needs. |
| source/Data/Operations/AppleEnrollmentProfile.ListByToken.psd1 | Adds the beta child-collection descriptor for DEP token-scoped Apple enrollment profiles. |
| scripts/Test-GraphKitReleaseProof.ps1 | Adds independent verification of proof/package/built-tree/test-result/source-revision integrity (and optional snapshots). |
| scripts/New-GraphKitTestedReleaseProof.ps1 | Adds proof creation that seals the tested package + built outputs + NUnit result + exact clean source revision. |
| scripts/Publish-GraphKitPackage.ps1 | Refactors channel publication to require proof verification and to publish only verifier-owned snapshots (report-only unless -Publish). |
| scripts/Publish-GraphKitToGallery.ps1 | Refactors PSGallery publication to require proof verification and to publish only verifier-owned snapshots (report-only unless -Publish). |
| README.md | Documents 0.3.1 as an unpublished TenantPulse bridge and clarifies optional SecretManagement behavior for 0.3.0+. |
| docs/superpowers/specs/2026-09-06-graphkit-0.3.1-iha-bridge-design.md | Adds the approved design/spec narrative for the 0.3.1 maintenance bridge and proof model. |
| docs/superpowers/plans/2026-09-06-graphkit-0.3.1-iha-bridge.md | Adds the implementation plan and gates distinguishing deterministic proof vs live verification/publication. |
| CHANGELOG.md | Adds an unreleased 0.3.1 section describing the bridge scope and deterministic verification boundary. |
| AGENTS.md | Updates operator guidance to describe 0.3.1 as an unpublished bridge and ratchets the deterministic test floor to 791. |
| .github/workflows/ci.yml | Updates CI’s whole-result gate minimum tests from 777 to 791. |
Review details
- Files reviewed: 20/20 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| $existing = Find-PSResource -Name GraphKit -Repository PSGallery -ErrorAction SilentlyContinue | ||
| $versions = @($existing | ForEach-Object { $_.Version.ToString() }) | ||
| if ($version -in $versions) { throw "GraphKit $version is already published to PSGallery." } |
Summary
-Publishis explicitly namedVerification
8b2546be366e00ff5b7adf13c3a86780679a3c4219ec54a58f93f661f3f74b5a24a116b0c6a42bbcf8f4fa6e47e406dd885944caEvidence boundary
The new routes have deterministic catalog, routing, and shape proof. No live-service verification is claimed. This PR does not publish to PSGallery and does not promote the broader R8 line.