Skip to content

✨ feat: extensionrepo: prove releases with a receipt - #400

Merged
pascalandy merged 3 commits into
mainfrom
cor-103-t10-release-receipt
Oct 30, 2026
Merged

pascalandy merged 3 commits into
mainfrom
cor-103-t10-release-receipt

Conversation

@pascalandy

@pascalandy pascalandy commented Oct 30, 2026 •

Copy link
Copy Markdown
Owner

An extension release could pass after its README installed the previous tag. The release also lacked evidence tied to its signed SHA.

Implement COR-103-T10 through just release vX.Y.Z [fixture]. Require the signed, pushed SHA and acceptance before publication. Replay the README against the published remote, compare its clone SHA, measure Economy, and prove uninstall with NOT_FOUND. Store evidence in the cache and the signoff receipt in the annotated tag.

Proved by: uv run --no-project --python 3.12 just check (exit 0), plus D095 and Economy red/green controls

  • 1. Spec: the sections that the card reads cover every command, flag, JSON key, and error code you add or change
  • 2. Scenario: each scenario that the card proves fails for the missing behavior
  • 3. Code: those scenarios pass
  • 4. Text: each new user-facing string is a catalog entry with a description
  • 5. Checks: just check passes
  • 6. Verify: an agent that did not write the change runs verify-nicely on each feature that the card affects, and the pull request quotes its evidence. n/a: just release is a repository task, and no verify-nicely feature drives it. Independent proof instead: Sol reran uv run --no-project --python 3.12 just template at 86e473f2, with local bare remotes and a stub gh ("Both layouts pass all four default Economy calls; the differently named fixture replaces the example input correctly"). The first real use is the video-convert release of COR-103-T14
  • 7. Docs: the card is done in its backlog item, README.md shows any change a user sees, and a skill teaches any command you add: the extension's, or nicely for core
  • 8. Sign off: pending: root. just signoff passes, or just signoff-layers for a stack

Step 4 is n/a for catalog entries. Repository-task diagnostics follow the existing signoff program.
For step 7, the template AGENTS release section teaches the recipe. The README install block already uses TAG, and no ncly command changes.
All test releases use local bare remotes and stub gh. Independent verification and signoff belong to the root.

Review fixes: Economy gives each example its input files from the tagged clone's testdata/examples.txtar, and a supplied fixture replaces the example's input file, so the default release measures a real dry run and run instead of a missing-input error (Sol S1). The default release test now requires exit 0 for those rows.

Root review: Opus 5.5 read the full diff and the fix.

Reviewed with sol-loop: 2 rounds with gpt-6.1-sol on xhigh. Sol verdict: approved

by GPT-6.1-Sol via Codex

Require the pushed SHA and its successful signoff receipt before tagging

Replay the published README install, compare its SHA, measure Economy, and prove uninstall in scratch folders

Keep release evidence in the cache and test publication through local bare remotes
@coderabbitai

coderabbitai Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 6e382810-2636-4bde-abd4-f75876c12f78

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

- Purpose: keep the release proof within the repository file limit
- Impact: move shared calls and receipt fixtures without behavior changes
- Purpose: measure extension examples with their tagged input files
- Impact: extract archive files for each call and replace the named input with a supplied fixture
- Proof: reproduce missing-input rows and fixture name mismatches before the fix
@pascalandy
pascalandy merged commit 86e473f into main Oct 30, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant