Skip to content

Correct draft visibility and prepare fresh 0.4.2 packages #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JasonStys merged 1 commit into from
Nov 10, 2026
Merged

Correct draft visibility and prepare fresh 0.4.2 packages #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/release-native.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,10 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: read
# GitHub exposes draft metadata only to push-capable credentials.
# https://docs.github.com/en/rest/releases/releases#list-releases
# The guarded verify command performs reads only and never promotes a draft.
contents: write
actions: read
security-events: read
steps:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ jobs:
with:
python-version: '3.12'
- run: pip install -e '.[dev]'
- run: docker build -t code-flow-worker:0.4.1 runner
- run: docker build -t code-flow-worker:0.4.2 runner
- run: python -m scripts.worker_checks
- run: python -m scripts.private_worker_checks
- run: python -m scripts.push_analysis
Expand Down
11 changes: 8 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

An independently written successor to a group AI-in-SDLC capstone: a local-first development workbench for isolated polyglot checks, configurable AI proposals, and replayable revision evidence.

**Version 0.4.1: bounded worker reports and verified source review.** Create an account, unlock your encrypted source/history workspace, and use the same interface in the desktop app or your browser. Filter diagnostics by file or unused-code category, select an exact line, inspect its read-only evidence snapshot, and open the editable draft only when its SHA-256 still matches. No public backend, shared login, analytics, ads or cloud AI calls are enabled by default. By [Jason Stys](https://github.com/JasonStys); [contact via LinkedIn](https://www.linkedin.com/in/jason-stys-31b30b351/).
**Version 0.4.2: bounded reports, safe shutdown and corrected draft verification.** Create an account, unlock your encrypted source/history workspace, and use the same interface in the desktop app or your browser. Filter diagnostics by file or unused-code category, select an exact line, inspect its read-only evidence snapshot, and open the editable draft only when its SHA-256 still matches. No public backend, shared login, analytics, ads or cloud AI calls are enabled by default. By [Jason Stys](https://github.com/JasonStys); [contact via LinkedIn](https://www.linkedin.com/in/jason-stys-31b30b351/).

Download OS-specific installers/portable packages from [Releases](https://github.com/JasonStys/code-flow-studio/releases). Read [private-account operation](docs/private-accounts.md), [current validation](docs/validation-polyglot.md), [historical Python-location validation](docs/validation-locations.md) and [security boundaries](docs/security.md). Packages are unsigned. This is a local development tool, not a public hostile-code SaaS sandbox or an autonomous correctness oracle.

Expand Down Expand Up @@ -38,10 +38,15 @@ The [source inspection workflow](docs/source-navigation.md) explains stale/legac

## Run and install

Version 0.4.1 includes bounded worker-report reads and verified source review. Its [release notes](docs/releases/v0.4.1.md)
Version 0.4.2 retains bounded worker-report reads, verified source review and safe
local shutdown, and corrects the final draft-verification job's required metadata
visibility. Its [release notes](docs/releases/v0.4.2.md)
and [full-main finding/validation report](docs/reports/codeql-main-fixes-2026-11-09.md)
describe the bounded worker reader and the fresh native/download checks required
before release promotion. Check Releases for the currently published downloads; a source version alone does not replace one.
before release promotion. The 0.4.1 draft passed native builds but its final
metadata check lacked GitHub's required draft visibility; that draft and all its
assets are preserved. See the [observed CI fault and narrow correction](docs/reports/draft-release-visibility-2026-11-10.md).
Check Releases for the currently published downloads; a source version alone does not replace one.

For end users, use the checksummed OS-specific packages in Releases. The UI runtime is bundled. Open the app's **Code Flow → Open local website** menu for browser use; no login token appears in the URL. Compiler jobs require an isolated local Unix/named-pipe Docker engine and the trusted worker image. Missing isolation is blocked, never passed; there is no host-execution fallback. Save/edit/static review/history/help remain usable without Docker.

Expand Down
5 changes: 3 additions & 2 deletions docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,9 @@

- [Verified source inspection and draft navigation](source-navigation.md), with [observed practical-workflow validation](reports/practical-workflows-2026-11-09.md).
- [Worker sanitizer compatibility and separate analyzer audit](worker-toolchain.md).
- [0.4.1 hotfix preparation](releases/v0.4.1.md): descriptor-bound worker JSON reads; full-main CodeQL fixes and pending native acceptance.
- [0.4.2 delivery correction](releases/v0.4.2.md): required draft visibility for the read-only final verifier; coherent new product/worker metadata and preserved prior assets.
- [Draft-verification CI report](reports/draft-release-visibility-2026-11-10.md): actual failed final job, official visibility rule, narrow permission/policy regression and separate pending delivery gates.
- [0.4.1 historical hotfix](releases/v0.4.1.md): descriptor-bound worker reads and safe shutdown; native builds passed but final draft metadata visibility failed.
- [0.4.1 finding and release-guard validation](reports/codeql-main-fixes-2026-11-09.md): exact original alerts, independent negative cases, local compiled package provenance and required hosted acceptance.
- [0.4.0 release notes](releases/v0.4.0.md): exact-source publication gate, unchanged data formats and matching worker-image update.

Expand All @@ -26,4 +28,3 @@
- [Research and provenance](research.md): source review and primary technical references.
- [Remaining scope](remaining-scope.md): implemented contracts, missing integrations and acceptance milestones.
- [Evidence files](evidence/worker-evidence.json): genuine isolated worker reports; training and inference reports are in the same directory and linked from the validation report.

Loading
Loading