Repository navigation
chore: drop editor and renderer after transfer to Seraphina Studios - #99
Conversation
Dependency Review✅ No vulnerabilities or license issues found.Scanned FilesNone |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01a755d0d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
## Summary Updates the organization profile's closing paragraph to match the project's current content guidelines. Atrinik's creators shape the game world with whatever tools serve the work, including AI tools, and every asset keeps its exact credit and license. ## Implementation / behavior This is a one-paragraph change in `community-health/profile/README.md`, the authoritative source for the generated `atrinik/.github` profile. The required phrase "Direct human contributions are welcome." is kept. ## Validation - `bin/validate` passes. - `tests/validate-community-health.sh` and `tests/publish-community-health.sh` pass. - `git diff --check` is clean. ## Limitations / follow-up - After merge, an authorized `bin/publish-community-health --apply` publishes the profile. - #99 removes the renderer row from the same file; the two changes touch different lines. - The website, the component READMEs and atrinik/atrinik#331 are updated in companion changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: cf855bba1e
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
The editor and renderer repositories were transferred on 2026-10-17 to seraphinastudios/tilewright-editor and seraphinastudios/tilewright-renderer. Remove them from every desired-state inventory, validator identity map and test fixture, and record the transfer in the README. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The crate dependency update App's only remaining consumer is the client, whose recorded run skipped the PR-writing job. The owned-PR proof came from the transferred editor, so workflow_activation goes back to pending-reviewed-workflows until a client-owned PR is observed. verify-manual-settings now reports the activation as PENDING. The README keeps the editor observation as history, outside the client's evidence. The maintenance-branch publication test no longer serves renderer identities, workflows or API routes, so a query against the transferred repository fails as an unexpected endpoint. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
verify_crate_workflow.py kept a renderer-only package job name, release guard and artifact name. With the renderer transferred, every remaining crate repository uses the standard package job, so the verifier accepts only that shape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cf855bb to
73d2805
Compare
|
@codex review |
|
Review round summary for head 73d2805 This push rebases the branch onto Findings so far:
The Codex code review of |
|
Review round 1, Codex on
|
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 73d2805e07
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The rotation, verification and retirement instructions still described two consumer workflows and two secret slots after the editor's transfer. Point them at the client's single workflow and credential slots, and keep the editor run as historical evidence that does not prove the client writer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review round summary for head 574b377
Earlier findings (activation proof and renderer fixtures) were fixed in |
|
@codex review |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 574b3776f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The package Actions-access text still described client and editor grants as the current inventory and rolled back "these two" grants. Describe only the client's grant and rollback, and keep the editor's 2026-10-11 grant observation as history tied to its transfer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review round summary for head b75f403
Every earlier finding is fixed, and its thread is resolved: activation proof and renderer fixtures in |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b75f4035a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…nbook The metaserver activation text still preserved renderer, the source-release inventory still added it, and the readback loop still queried atrinik/renderer. Remove renderer from those operational parts and keep the completed activation's rollout and payload as a historical record, with a note to derive later payloads from config/immutable-releases.json. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review round summary for head c8b0d5f
Every other finding is fixed and resolved: |
|
@codex review |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8b0d5fb73
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
🎉 This PR is included in version 2.23.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Summary
On 2026-10-17
atrinik/editorandatrinik/rendererwere transferred to Seraphina Studios asseraphinastudios/tilewright-editorandseraphinastudios/tilewright-renderer. This PR removes them from Atrinik's governance so the hourly audit, the publisher and the validators stop expecting repositories that no longer exist in the organization.Implementation / behavior
repositories.json(pull-request gate, required CI, release tags),repository-properties.json,security-merge-protection.json,immutable-releases.json, and frommanual-settings.json(Codecov App access, renderer crates.io Trusted Publishing, the editor'slinux-buildpackage grant, and the crate dependency App's consumers and selected repositories).bin/validate,bin/publishandbin/verify-manual-settingsdrop the hard-coded editor and renderer identities. The crate dependency App is now client-only, and Trusted Publishing covers protocol and content-toolkit.workflow_activationis reset topending-reviewed-workflows, because the owned-PR proof came from the transferred editor and the client hasn't run its writer yet.lib/verify_crate_workflow.pydrops its renderer-only workflow variant.README.mdnow names only the client's workflow and credential slots. The editor's owned-PR run is kept as historical evidence.linux-buildpackage runbook now describes and rolls back only the client's read grant. The editor's grant observation is kept as history.AGENTS.mdandCONTRIBUTING.mdare updated.README.mdgains a Transferred repositories section. The renderer row is removed from the generated org profile.CRATE_DEPENDENCY_UPDATE_APP_PRIVATE_KEYandCRATE_DEPENDENCY_UPDATE_APP_IDwas deleted from the transferred repository, and itsreleased-dependencies.ymlworkflow was disabled.atrinik/client.Validation
bin/validatepasses.tests/*.shscript passes locally, includingpublish-maintenance-branch.sh,audit.sh,verify-manual-settings.sh,validate-immutable-releases.shandvalidate-manual-package-access.sh.shellcheck bin/* tests/*.shpasses with ShellCheck 0.11.0.git diff --checkis clean.Limitations / follow-up
bin/publish --applyremoves the now-unmatched03 - Required CI - editorand03 - Required CI - rendererrulesets, andbin/publish-community-health --applyrepublishes the org profile.atrinik-render-*crates on crates.io keep their existing Trusted Publisher registration foratrinik/renderer. The new owners publish under new names.README.md. This PR doesn't touch the key.atrinik-render-*crates.io registrations still trustatrinik/renderer. A recreated repository with that name could match them. The owner either revokes them on crates.io, after which this PR records it, or chooses to keep a validated pending-revocation record.🤖 Generated with Claude Code