Repository navigation
Release health - unreleased work or an incomplete publish #1621
Description
Automated release-health check. This issue is rewritten in place on every run and closed automatically once every gap below is closed; it is never duplicated.
Last evaluated: 2026-10-30T01:20:20.725189+00:00 (run)
unreleased-work — 66 releasable commit(s) unpublished for 5d 1h
main has been carrying 66 releasable commit(s) for 5d 1h past v1.18.0. main CI is green and no release run is in flight, so nothing is going to publish these on its own.
Next version would be a minor bump.
| commit | bump | age | subject |
|---|---|---|---|
3379dd67 |
minor | 5d 1h | feat(flow): re-arm signed by a key that never leaves its keychain (rearm_to_sign, rearm_evidence) |
760d6b67 |
minor | 5d 1h | feat(desktop): compare each possible match field by field; measure stops |
45e2b946 |
minor | 5d 1h | feat(desktop): phone shows matches field by field; close stops while a run waits |
440f7029 |
minor | 5d 1h | feat(desktop): re-arm "only ask about problems" from a stop card |
99e99810 |
patch | 5d 1h | fix(desktop): a locked Mac isn't a Mac without a Secure Enclave |
a8f7ab40 |
minor | 5d 0h | feat(flow): the gate trusts re-arms signed by registered approver keys by default |
2bfeb155 |
patch | 5d 0h | fix(flow): compare AX elements with CFEqual in the row census |
21fa218a |
patch | 4d 23h | fix(desktop): presence before re-registering; no file-key fallback on Touch ID Macs |
6b52dd32 |
patch | 4d 23h | fix(flow): review fixes for the switch policy |
4512c91a |
patch | 4d 23h | fix(desktop): re-check stop cards after Touch ID; no file-key fallback |
06bb5200 |
patch | 4d 23h | fix(flow): close the census fail-opens found in review |
f42e51a8 |
patch | 4d 23h | fix(flow): accept the record channel's exact and close decisions as duplicate candidates |
a08534d6 |
patch | 4d 21h | fix(flow): keep real record ids; signing out a patient is a write |
881e3e68 |
patch | 4d 21h | fix(tray): address the independent review of local recording |
934bf6fb |
patch | 4d 21h | fix(tray): stop a tray-started recorder within a deadline |
8123c975 |
patch | 4d 21h | fix(flow): approvers are a signed roster with a root each run pins |
2eac02d8 |
patch | 4d 21h | fix(flow): re-arm keys come from #1486's signed approver roster under the pinned root |
56d0e4a8 |
patch | 4d 20h | fix(flow): config-only pin on governed runs; chained roster; no rollback |
95b3e93f |
patch | 4d 20h | fix(desktop): the Keychain pin wins; each run's config carries it; no rollback |
ab8a9bae |
patch | 4d 19h | fix(flow): nothing agent-writable anchors approver trust |
719c0c7f |
patch | 4d 19h | fix(desktop): pass the Keychain head to Flow; stage configs outside run dirs |
7fd46996 |
patch | 4d 19h | fix(flow): config-only pins on the guard server and governed resumes |
eced3b1d |
patch | 4d 18h | fix(desktop): config digest, head on answers, no env root, no symlinked dirs |
a6f2e00a |
patch | 4d 18h | fix(flow): pin the config by the path given; no symlinks; pin approvers now |
70184d3e |
patch | 4d 18h | fix(desktop): only the Keychain names this Mac's approver root |
beb1d2f1 |
patch | 4d 18h | fix(desktop): no Keychain pin means no root reaches Flow |
79cfa54a |
patch | 4d 18h | fix(desktop): with no Keychain pin, hand Flow no approvers section |
39daa43e |
patch | 4d 16h | fix(flow): the census follows the target's teach-time role on every rung |
f911e85a |
patch | 4d 16h | fix(flow): a control role never skips a census that can count |
fa2e653f |
patch | 4d 15h | fix(tray): make local-recorder stop and owner checks portable |
152d69a3 |
patch | 4d 14h | fix(flow): sibling tabs that share chrome are told apart by their label |
ee707b80 |
patch | 4d 12h | fix(flow): a featureless identifier crop cannot count rows |
68e79e73 |
patch | 4d 11h | fix(flow): an OCR misread never tells identical rows apart |
5c1b05e6 |
patch | 4d 11h | fix(flow): repeated div rows, grid rows and cards are worklist rows |
d94ccc93 |
patch | 4d 10h | fix(desktop): bundle the Flow that knows Desktop's flags; check every command line against it |
ca2ef9c4 |
patch | 4d 10h | fix(flow): count look-alike rows loosely; read sections by their heading |
a1c3f975 |
minor | 4d 10h | feat: arm a create-new form's save by the form the run typed into (parked) |
dcd07a03 |
patch | 4d 10h | fix(flow): count every row in the container; headings only in headers |
332c74eb |
patch | 4d 9h | fix(flow): count look-alike rows page-wide; remember a teach-time twin |
5f1b547e |
patch | 4d 9h | fix(flow): a teach-time twin halt says teach time saw the twin |
51a19e45 |
patch | 4d 9h | fix(desktop): freeze the benchmark module Flow 2.4.0 imports; prove Playwright's own browser download |
21d8233a |
patch | 1d 6h | fix(flow): the config pin reads the file's exact bytes on Windows |
ded2cc2e |
patch | 1d 6h | fix: close #1581's re-review holes: query, what is sent, late submits, token scope |
95980721 |
patch | 1d 5h | fix: hold a create-form save at the network until it matches the checked form |
50fa271a |
minor | 1d 5h | feat: one wire check for checked saves, replacing the page-level guard |
bc5791c3 |
patch | 1d 4h | fix: keep pre-form-identity sealed bundles valid |
5a4a25f9 |
patch | 1d 2h | fix: wire check covers popups, service workers and WebSockets |
52a7048b |
patch | 1d 1h | fix(flow): product code no longer imports the benchmark package (#1594) |
40f227ab |
minor | 1d 0h | feat(flow): local grounding model rung for pixel surfaces (off by default) (#1596) |
b7827ed1 |
patch | 23h 41m | fix: only an aborted request is reported as cancelled; WebSocket and service-worker notes stand alone |
4b216029 |
patch | 22h 46m | fix: main red — Python 3.10 locks, and a held save recorded before it lands (#1622) |
d5b7a421 |
patch | 22h 29m | fix(ci): import tomllib only where release_plan reads a pyproject (#1629) |
7700c499 |
patch | 22h 12m | fix(ci): set the commit release-package's plan step decides for (#1630) |
b6041993 |
patch | 21h 38m | fix(flow): print the skill bind and qualify hints through command(); guards back on the PR lane (#1632) |
94adb725 |
patch | 20h 11m | fix(flow): refuse a held save's WebSockets in the page, at construction |
f94c0d8c |
minor | 19h 53m | feat(desktop): an administrator pins the approver root (Desktop 0.25.0) (#1573) |
b2af951f |
patch | 19h 39m | fix(flow): close the review's WebSocket and worker routes around a held save |
9b1240d5 |
minor | 18h 39m | feat: verified writes for any agent, and taught browser writes with receipts (#1589) |
ac4dc7ec |
patch | 18h 3m | fix(flow): the guard reports what its recording has kept; the test agent waits for it (#1645) |
f9734348 |
patch | 17h 37m | fix(flow): guard WebSockets from every page's first load; stop routing them (#1644) |
fb8392df |
minor | 17h 29m | feat(flow): one verifier API (CONFIRMED/REFUTED/UNCERTAIN) and a durable uncertain-write ledger (#1628) |
9dcbbf11 |
minor | 16h 40m | feat(flow): verified write tools for agent frameworks (#1609) |
df6aedd6 |
patch | 16h 23m | fix(flow): keep the WebSocket guard's state out of the page's reach (#1647) |
5a9c8043 |
minor | 13h 9m | feat(flow): recheck a verified write for writes that land after the verdict (#1639) |
5aa13f58 |
minor | 8h 30m | feat(flow): skill cache for framework agents, measured on MockMed (#1613) |
09b0d791 |
patch | 7h 49m | fix(flow): keep a click's label when it only shares a word with a later value; plain wording for the reconcile choices (#1654) |
Most recent release run: 39493543378 — completed/failure.
Publish with:
# First merge the reviewed version, changelog, lockfile, and candidate state. Then create the tag from exact main.
gh workflow run release-and-publish.yml --repo OpenAdaptAI/OpenAdapt --ref main -f version=<reviewed-version>
# If that exact tag run partially failed, rerun it. Do not create a recovery tag.
gh run rerun --repo OpenAdaptAI/OpenAdapt <tag-run-id>tag-without-release — 1 tag(s) published no release
1 tag(s) in the desktop lane exist with no GitHub release object. The tag is immutable and public; the artifacts it promises were never published.
| tag | age | release run | outcome |
|---|---|---|---|
openadapt-desktop-v0.21.1 |
9d 22h | — | workflow never started |
cancelled and skipped are the outcomes no if: failure() step can see. A run cancelled while waiting on an environment approval gate lands here.
Re-run the publish with:
# A half-published version resumes by re-running the failed jobs of its run:
gh run rerun --failed --repo OpenAdaptAI/OpenAdapt <desktop-release run id>
# A merged version that never started releases with:
gh workflow run desktop-release.yml --repo OpenAdaptAI/OpenAdapt --ref mainEverything the check considered and cleared
- [launcher] tag v0.36.1 has no release object; acknowledged: 2024-07-06 legacy monorepo tag. No release object was ever created and 0.36.1 was never published to PyPI (the index jumps 0.35.x -> 0.39.1). Permanently historical: acknowledged here rather than left to alert forever, because a guard that is always red is a guard nobody reads.
- [launcher] openadapt 1.18.0 is on PyPI.
- [desktop] openadapt-desktop 0.25.0 is on PyPI.
Reproduce locally with python scripts/check_release_health.py.
Activity