[zoeyrose]

Summary

#99 removed atrinik/editor and atrinik/renderer from governance after their 2026-10-17 transfer to Seraphina Studios. It merged before three owner decisions about leftover state could be recorded, which left four review threads open. This PR records those decisions, all made on 2026-10-18:

1. App key: accepted and recorded. The transfer carried the editor's copy of the crate dependency App key (CRATE_DEPENDENCY_UPDATE_APP_PRIVATE_KEY) and App ID variable into seraphinastudios/tilewright-editor. Only the owner controls that repository and its organization, and the copy was deleted within hours. The owner accepts that window instead of rotating early, and rotate_by stays 2027-01-09. Review threads: key rotation and its repeat.
2. Selected-set evidence: re-verification pending. The client-only selected set (atrinik/client, ID 1327106844) is now recorded as pending re-verification, because the transfer changed the installation's repository set after the 2026-10-11 readback. Review thread: selected-set evidence.
3. Renderer Trusted Publishers: the owner is revoking them. The README records that the owner is revoking the atrinik/renderer Trusted Publisher from the renderer's seven crates.io crates. This is an owner action pending confirmation, not a completed one. Review thread: renderer Trusted Publishers.

Implementation / behavior

• config/manual-settings.json, crate_dependency_update_app:
  • New accepted_key_exposures list with one entry:
    • exposure repository-transfer-retained-copy;
    • exposed names CRATE_DEPENDENCY_UPDATE_APP_ID and CRATE_DEPENDENCY_UPDATE_APP_PRIVATE_KEY;
    • former repository atrinik/editor, now seraphinastudios/tilewright-editor, ID 1327106902;
    • exposure started 2026-10-17, removal observed 2026-10-18 (the names-only readback in the chore: drop editor and renderer after transfer to Seraphina Studios #99 thread);
    • accepted by Atrinik organization owners on 2026-10-18.
  • New repository_scope_reverification object: state pending-reverification, reason repository-transfer-after-readback, last_readback_on 2026-10-11, selection_changed_on 2026-10-17, and removed repository atrinik/editor (1327106902). repository_scope_verification, observed_on, the key dates and rotate_by are unchanged.
• bin/validate:

  • Both fields are required and must have exactly the expected keys.

  • A planned App must have no accepted exposures and no pending record.

  • Both records pin the exact editor transfer: atrinik/editor, now seraphinastudios/tilewright-editor, ID 1327106902, on 2026-10-17.

  • Re-verification: while observed_on is on or before 2026-10-17, the pending record is required. It must:

    • name that readback as last_readback_on;
    • name the 2026-10-17 change and the editor as the removed repository.

    After a later readback is recorded in observed_on, the record must be null. It can't be cleared without fresh evidence, and a readback dated on the transfer day itself is rejected.

  • Accepted exposure: while the current key was created on or before 2026-10-17, exactly one exposure is required. It must:

    • match the transfer tuple and start on 2026-10-17;
    • name exactly the App's secret and variable;
    • have an observed removal, with acceptance on or after it;
    • be accepted by Atrinik organization owners.

    After a rotation records a newer key_created_on, the list must be empty. All dates must be valid and not in the future.

• bin/verify-manual-settings: while re-verification is pending, it prints PENDING atrinik-crate-dependency-update selected repositories await re-verification: a 2026-10-17 repository transfer removed atrinik/editor after the 2026-10-11 readback; ... instead of the ordinary MANUAL reminder. Its live checks are unchanged.
• README.md:
  • The App section records the accepted exposure and the pending re-verification, plus the re-verification steps: confirm the exact set, then record the method and date and clear the pending record.
  • A new Renderer Trusted Publisher revocation subsection names the seven crates and records the owner's pending revocation. They are atrinik-render-api, atrinik-render-resources, atrinik-render-sdl3, atrinik-render-testkit, atrinik-render-ui, atrinik-render-wgpu and atrinik-scene.
  • The "fourteen renderer/toolkit names ... in the table above" wording (in the intro, activation step 3 and the onboarding evidence) now says which seven libraries are in the current table and names the seven renderer libraries directly. The recorded facts are unchanged.
  • Transferred repositories links all three decisions.
• AGENTS.md and CONTRIBUTING.md: one sentence each about the two new validated states.

Validation

• bin/validate passes on today's date. With ATRINIK_VALIDATION_TODAY=2026-10-17 it fails, because the acceptance date would be in the future.
• shellcheck bin/* tests/*.sh passes.
• Every tests/*.sh script passes.
• git diff --check is clean.
• New negative tests in tests/validate-crate-trusted-publishing.sh: 29 cases for accepted exposures and 25 for pending re-verification, plus planned-state cases. Positive cases cover a rotated key with the exposure removed, a completed re-verification and a planned App.
• I checked the negative tests by mutation: weakening each of the 21 new constraints, one at a time, still left the real config valid and made the test fail.
• tests/verify-manual-settings.sh asserts the new PENDING line and the absence of the MANUAL line for the real config. A fresh-readback fixture asserts the opposite.
• Pinned ATRINIK_VALIDATION_TODAY values move from 2026-10-12 to 2026-10-18 so the new observations are not in the future, as docs: record completed crate onboarding #92 did for its observations.

Limitations / follow-up

• This PR changes no live settings, credentials or crates.io state.
• Re-verification: the owner still needs to confirm, in the installation's organization-owner UI or through supported App-authenticated readback, that the selected set is exactly atrinik/client. A follow-up then records the method and date and clears repository_scope_reverification.
• Renderer revocation: after the owner confirms it on crates.io, a follow-up records the dated, sanitized observation for each crate. Until then, treat the seven registrations as live.
• Key rotation: at rotation (by 2027-01-09), the accepted exposure record has to be removed in the same change that records the new key's dates. Validation enforces this.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T07:12:54.908042Z	879a6dd	Manual request
🔒 Security Review	✅ Completed 2026-10-18T07:14:37.225238Z	879a6dd	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ea7bc2c51

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[zoeyrose]

Review round 1

The Codex code review of 0ea7bc2 raised four P2 findings, all valid. All four are fixed in 879a6dd, which pins both new evidence records to the exact 2026-10-17 editor transfer.

1. Require fresh evidence before clearing re-verification: fixed in 879a6dd. The pending record is required while observed_on is on or before 2026-10-17, and must be null after a later readback.
2. Preserve the exposure record until the key rotates: fixed in 879a6dd. The exposure is required while key_created_on is on or before the transfer, and must be empty after rotation.
3. Bind removed repositories to the prior selected set: fixed in 879a6dd. removed_repositories must be exactly atrinik/editor (1327106902), with the 2026-10-17 change date.
4. Bind the exposure to the transferred editor identity: fixed in 879a6dd. The exposure must match the editor's former name, current name, ID and transfer date, and name exactly both of the App's secret and variable names.

The Codex security review of 0ea7bc2 had no findings.

Validation for 879a6dd:

• bin/validate passes.
• shellcheck bin/* tests/*.sh passes.
• All 26 tests/*.sh scripts pass.
• git diff --check is clean.
• Weakening each of the 21 new constraints by mutation makes the schema test fail.

The PR body has been updated to match.

[zoeyrose]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 879a6dd1ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 879a6dd1ab

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[github-actions]

🎉 This PR is included in version 2.24.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀