Repository navigation
docs(ASSURANCE): bind canonical b4 and offline release claims to active source - #73
Conversation
…s with code Add source-derived status contract comparing LC0 selection, J3 resource catalog and shipped hybrid options. Gate the always-present merge check against stale claims and unauthorized release/licensing flags; preserve historical milestones.
HMarcusWH
left a comment
HMarcusWH
left a comment
There was a problem hiding this comment.
Independent source/status consistency review
Reviewed source: f059d365d074471056d9f952599cf131b0f881ba.
The active engine-opt-v2-selection.json, J3 resource-profile-catalog-v1.json and actual allfather.online-hybrid-v2.validation.json agree on canonical BLAS LC0 b4-p0-c256k-cold with MinibatchSize=4, NNCacheSize=262144 and MaxPrefetch=0. The new check-current-status.py reconstructs those invariants, verifies closed release and license flags, and requires the top-level current-status header to match. Older dated sections remain historical evidence rather than being erased.
The always-present Merge gate passed the new independent source-status and mutation tests. Additional scope-triggered CI workflows were still running at review time.
Governance non-grant: Source-level checking does not protect GitHub main: issues #26/#27 still require repository-administrator branch protection with required Merge gate / validate. No public release/license/network/host/strength claim was promoted.
Keep draft until exact-head triggered CI completes and review remains current.
…-2A mainline Preserve PR #72's independent installed wheel/version observer intact. Apply only the five source-status and always-present merge-gate paths on the new base. Do not change OS/wheel lock approval, license/publication/network/deployment/strength authority.
HMarcusWH
left a comment
HMarcusWH
left a comment
There was a problem hiding this comment.
Final combined-source review: PR #73 rebased onto merged RELEASE-2A
Exact reviewed head: cc1d98ae034dca32d5af02db623d659c91e928b8. Base: 8a2585156dbea01392f870533dac9740e6514b46 (PR #72 code merged).
I verified the Git merge parentage and compared full source trees with the new base. Exactly five approved source-status files differ: merge-gate.yml, CURRENT_STATUS.md, current-status-v1.json, check-current-status.py, and test_current_status_contract.py. All eight original RELEASE-2A file changes are inherited unchanged. No overlapping edits, no force-push, no semantic change to signed APT, PyPI wheel source lock, OCI/SLSA, bridge transport or engine move authority.
The new exact-head merge gate passed the canonical b4/J3/runtime consistency contract and adversarial status mutation tests, plus RELEASE-1 fast tests (201/201). No unapproved authority flag was raised. Historical milestone text remains explicitly historical.
Source assessment: ready for code merge once exact-head CI completes. This review does not substitute old-head CI for combined-tree qualification. Hold draft if any of the eight workflows fail or are skipped outside declared conditional jobs. Confirm current main still equals 8a2585156dbea01392f870533dac9740e6514b46, PR head equals cc1d98ae034dca32d5af02db623d659c91e928b8, GitHub reports clean mergeability, and all 8 workflow conclusions are successful before marking ready and merging.
No live-play/distribution grant: combined license, corresponding source, approved OS/wheel reproducibility, deployment host, real network transport, public bot and operator authority remain closed. Protecting GitHub main against direct pushes remains an administrative action, issues #26/#27.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
COMBINED-SOURCE BOARDING — new main synchronized (draft)
Current exact head:
cc1d98ae034dca32d5af02db623d659c91e928b8with parent main8a2585156dbea01392f870533dac9740e6514b46(merged PR #72). The merge commit on this PR branch combines the complete RELEASE-2A dependency-witness tree with these five non-overlapping current-status files:.github/workflows/merge-gate.ymldocs/CURRENT_STATUS.mdqualification/current-status-v1.jsonscripts/check-current-status.pytests/ci/test_current_status_contract.pyThis is a fast-forward reconciliation (original PR #73 head retained in history; no force-push). A comparison with the new base shows exactly those five files. The original source review applied to the source-status changes; the combined tree is now being validated on its new exact head, with 8 new CI workflow groups triggered. No earlier head's CI result is borrowed for this merge.
No authority promotion: GitHub main protection remains an admin action (issues #26/#27). Publication, combined license, source availability, destination host, public bot, network and OS/wheel lock approval remain explicitly blocked.
Boarding requirements: [ ] 8/8 current-head workflows passed; [ ] refreshed source/CI review; [ ] final mergeability check. Do not merge until complete.
Current status sync and always-present source-derived claim gate
Base: merged
main952a2c5. Head:f059d365d074471056d9f952599cf131b0f881ba.The merged engine-opt selection, J3 resource catalog and
allfather.online-hybrid-v2.validation.jsonagree that the canonical LC0 profile is b4-p0-c256k-cold. The top-leveldocs/CURRENT_STATUS.mdstill carried older dated b7/current-milestone language. PR #71 also merged the offline OCI + guarded recovery release assurance, but did not authorize public/Lichess deployment.This independent PR (does not depend on draft #72) fixes that drift without rewriting historical project records.
Changes
docs/CURRENT_STATUS.md, identifying PR feat(M14-J): promote b4 into canonical J3-J12 substrate #64's b4 canonical migration and PR fix: close post-merge Codex provenance, recovery and OCI review debt #71's offline RELEASE-1 assurance. Older dated material remains visibly historical.qualification/current-status-v1.jsonas a source-based, non-authority status contract, with explicit false flags for online release, strength, distribution, host and network recovery.scripts/check-current-status.py, which fails closed unless b4 selected engine parameters match the J3 resource catalog and actual hybrid runtime options, the top-level status reflects them, and all release/licensing prohibitions stay closed.Merge gate / validateworkflow. This improves claims/document synchronization but does not implement GitHub main branch protection.Required gates
Separate repository administration: issue #26 and #27 still require an administrator to enable active
mainprotection with requiredMerge gate / validate, pull requests and no force pushes. GitHub connector does not have administrative write scope.