Repository navigation
release: release-pair fan-out to the app and compute targets (CR-194) - #83
Draft
luisleo526 wants to merge 5 commits into
Draft
luisleo526 wants to merge 5 commits into
luisleo526 wants to merge 5 commits into
Conversation
…-194) The hub's consumer fan-out gains a per-role event type and one new delivery-only role, with no new credential and nothing enabled by default. - scripts/release_contract.py: ROLES gains `compute`; EVENT_TYPES maps application and compute to `release-pair` and every other role to `pineforge-release` (unchanged bytes); DELIVERY_ONLY / RECEIPT_ROLES split the roles that report consumer receipts from the one that does not; pair_payload() builds the eight neutral top-level keys (pair_id, engine_tag, codegen_tag, hpo_tag, receipt_url, receipt_sha256, source_sets, build) from the same immutable manifest and candidate bytes, refusing a disagreeing pair. - scripts/release_pipeline.py: dispatch sends the table's event type; a `release-pair` target gets the eight-key payload; compute is never refused as superseded; aggregate gives compute pending -> delivered (complete) and never skipped_by_policy; compute is planned only when it is in RELEASE_READY_CONSUMERS and RELEASE_COMPUTE_FIRST_PAIR is non-empty and the pair is at or above it (empty = off, no backfill). The delivery reservation path (plan_delivery, finalize_all order, the deliveries output) is untouched. - scripts/release_receipts.py, release-receipts.yml: compute has no receipt policy and a consumer receipt for it is refused. - .github/workflows/release-finalize.yml: TARGET_REPOSITORY reads the private target name of compute from the release-automation secret RELEASE_COMPUTE_REPOSITORY; the token mint (action pin, one target, contents: write) is unchanged. - docs/release-chain.md: roles, event types, payload, the delivery-only role, the new variable and secret NAMES (no values). - tests: role-enumerating tests iterate the six receipt roles with every assertion kept, plus new tests for the event table, the payload, dispatch, aggregation, planning and the compute receipt refusal. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ts (CR-194) With compute off, the release incident text is again byte-identical to the base. A malformed RELEASE_COMPUTE_FIRST_PAIR is validated once before the row loop: compute is off for that run, every other role is planned, delivered and reported as without it, and the run then ends non-zero with one message naming the variable and its value. The pair builder now reuses the producer's source-tag pattern instead of a stricter copy. The release-chain document states that the existing App must be installed on the private compute repository, how the application receipt derives event_id and where facts come from, and restores a policy phrase an earlier edit removed. The workflow step name and the six-role receipt tuple in the tests are back to the base. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…iling finalize (CR-194) A malformed RELEASE_COMPUTE_FIRST_PAIR used to make the finalize script exit non-zero after it had reserved delivery attempts for the other roles. The workflow step stops on a non-zero exit before it writes the deliveries output, so those attempts were never sent and were used up by the 15-minute schedule. The script now exits 0 for that case, turns compute off for the run, delivers every other role as without compute, and writes a fixed compute_configuration_error output (it never prints the value). A final job that needs finalize and notify-consumers runs with always() when that output is set, prints one error naming the variable and exits 1. The release-chain document now says that the existing App's full permission set applies to the compute repository, gives the exact source-tag pattern, and describes the new path. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Brings in the application post_merge receipt policy (#85), the pull-request tier on hosted runners (#84), the CR-150 harness-list-free main and the v1.6.2-rc.1 release commit. Two conflicts, both resolved by keeping both sides: scripts/release_receipts.py (the receipt key set keeps the RECEIPT_ROLES check of this branch and adds the post_merge field from main) and docs/release-chain.md (the RELEASE_COMPUTE_REPOSITORY row of this branch next to the corrected RELEASE_RECEIPT_POLICY row of main, with the sentence that compute needs no entry). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Resolves the docs/release-chain.md conflict as a union: main's expanded supervisor-configuration text (canonical authz job, release/ready as a required status, the literal pf-ci-x64 runner array, the fork-approval and merge_group rules) plus this branch's receipt-role / compute first-pair gating and the receipt-role inventory wording. No code change; workflow YAML auto-merged.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CR-194 (CR-173 follow-up; L6 ruling 18:0x). The hub's consumer fan-out gains two targets for event release-pair, from the EXISTING hub App token (no new credential):
NOTHING IS ENABLED by this PR (RELEASE_READY_CONSUMERS = hosted today).
Proof: spot box on 7df7e8e: release_rules 368 OK, facts 47+24 OK, dry_run OK, controls OK. Independent Claude reads: round 1-3 REQUEST-CHANGES (all taken, incl. a P1: a non-zero exit before the deliveries output would have burned reserved attempts, the CR-187 path), read 4 APPROVE (P0/P1/P2 none).
DO NOT MERGE before: (1) COMPUTE's receiver (release-pair.yml) exists; (2) the owner's step O-1 (install the existing hub App on the private compute repository, with its full permission set) and L6's secret/policy/dry mint; (3) O-2 (L6 gate S-179): application stays out of RELEASE_READY_CONSUMERS until APP's receiver accepts release-pair.
🤖 Generated with Claude Code