Land v1.3.0-rc.1 adoption-surface program (OVK-PR1–PR9) - #18
Open
fraware wants to merge 19 commits into
Open
Conversation
Record a machine-checkable reproducibility baseline so release candidates can prove adapter and control-plane behavior across platforms before attributable publication.
Tighten the capability schema and publish a template registry so stable backends declare enforceable limits, versions, and eligibility instead of prose-only claims.
Replace ad-hoc merge recommendations with a normative decision lattice, wire aggregation and CLI exit codes through decision_state, and lock behavior with exhaustive truth-table tests.
Define a typed integrity envelope for evidence artifacts so digests, assumptions, and provenance cannot drift between execution, bundle assembly, and attestation checks.
Require every stable adapter to ship machine-readable conformance claims so registry stability implies tested timeout, unavailable, and malformed behavior.
Publish capability and conformance packages for authorization, CI-secrets, deployment, infrastructure, and self-protection lanes so deterministic runners share the same failure taxonomy as native backends.
Add timeout, unavailable, and malformed example payloads so local demos and conformance generators share the same edge-case corpus.
…R5). Version the benchmark manifest with attributable provenance, mutation partitions, adversarial cases, and held-out variants so leaderboard claims stay reproducible.
Wire provenance generation, holdout runners, and scoring updates so benchmark publications validate against the versioned manifest rather than ad-hoc file lists.
Pin third-party Action dependencies by SHA and add adversarial scenario coverage for fork PRs, malicious paths, and workflow-dispatch edges before consumers widen adoption.
Introduce a signature-verified webhook service with isolation, replay protection, redaction, and check-run emission so App installs stay narrower than the composite Action surface.
Land express-actions, fastapi-terraform, and infra-terraform-k8s pilot reports with check-case evidence so adoption guidance is backed by attributable advisory runs.
Advance release metadata and preflight report shape so install pins and consumer checklists target the in-repo release candidate explicitly.
Document the trusted computing base and add machine-checkable RC definition-of-done plus install verification so attributable publication cannot proceed on incomplete gates.
Match verification-policy changes against the canonical repository path as well as absolute test roots so policy-touching PRs are not silently treated as trusted.
Treat a zero or negative budget as a configuration error rather than a timed-out process so isolation tests and control-plane fallbacks observe the correct failure cause.
Extend cache binding and MCP regression tests so decision-state-aware control-plane replay cannot cross regime boundaries after the lattice landing.
Share digest and manifest helpers used by provenance generation so scoring and holdout tooling stay aligned with the versioned corpus.
Update roadmap, schema index, and root docs for v1.3.0-rc.1, and extend CI so conformance and RC gates run with the rest of the suite.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v1.3.0-rc.1adoption-surface program into reviewable commits covering OVK-PR1 through OVK-PR9: normative capability/template registry and multi-OS repro baseline, DecisionState lattice, evidence integrity envelope, adapter conformance (including lane adapters), FormalPR-Bench provenance/partitions/holdout, Action SHA pinning and hardening scenarios, private-alpha GitHub App, three advisory pilot reports, and RC prep (TCB, install/DoD gates, attributable publication docs).main.Test plan
scripts/verify_rc_dod.py/scripts/verify_rc_install.pyand capability/conformance validatorsv1.3.0-rc.1tag/Sigstore only after gates pass