From 05008c274352846f6661728a5f35042428305da4 Mon Sep 17 00:00:00 2001 From: Beyond <46542494+crypticpy@users.noreply.github.com> Date: Sat, 29 Aug 2026 03:21:12 -0500 Subject: [PATCH 1/4] Cut v1.9.0 Records-only promotion of the accepted v1.9.0-rc.7 candidate per work package 8: package and lock version, CHANGELOG stable section, and release records move from 1.9.0-rc.7 to 1.9.0 with no template behaviour change. Records the RR-H08 soak acceptance (rc.7 deployment clean for 29 half-hourly probes, no P0/P1 defect, release owner called the cut on 2026-08-29) and closes RR-H01's rc.7 leg. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014sAVayAT2tkQ7p9U2o9CsD --- CHANGELOG.md | 9 ++++++++- README.md | 2 +- docs/release-readiness-plan.md | 2 +- docs/release-readiness-status.md | 20 ++++++++++++-------- package-lock.json | 4 ++-- package.json | 2 +- 6 files changed, 25 insertions(+), 14 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ddaae2a..cfc27b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,12 @@ major version, and each entry says so when it happens. ## [Unreleased] +## [1.9.0] — 2026-08-29 + +Stable release. Records-only promotion of the accepted `v1.9.0-rc.7` +candidate: no template behaviour changes since rc.7 — the release line's +features and fixes are recorded in the rc.1–rc.7 sections below. + ## [1.9.0-rc.7] — 2026-08-28 ### Fixed @@ -1182,7 +1188,8 @@ fixed in this release, and the remaining P3s are listed in `docs/roadmap.md`. in-browser and CLI configurators, GitHub-issue submission flow, events / cohorts / resources modules, Lunr search, thumbnails workflow. -[Unreleased]: https://github.com/crypticpy/phct/compare/v1.9.0-rc.7...HEAD +[Unreleased]: https://github.com/crypticpy/phct/compare/v1.9.0...HEAD +[1.9.0]: https://github.com/crypticpy/phct/compare/v1.9.0-rc.7...v1.9.0 [1.9.0-rc.7]: https://github.com/crypticpy/phct/compare/v1.9.0-rc.6...v1.9.0-rc.7 [1.9.0-rc.6]: https://github.com/crypticpy/phct/compare/v1.9.0-rc.5...v1.9.0-rc.6 [1.9.0-rc.5]: https://github.com/crypticpy/phct/compare/v1.9.0-rc.4...v1.9.0-rc.5 diff --git a/README.md b/README.md index 3c64d3b..4439cd4 100644 --- a/README.md +++ b/README.md @@ -104,7 +104,7 @@ A fork is a copy, not a subscription: template releases do not reach you on thei ```bash git remote add template https://github.com/crypticpy/phct.git git fetch template --tags -npm run upgrade:check -- --to v1.9.0-rc.7 # read-only: what this exact release changes, in two lists +npm run upgrade:check -- --to v1.9.0 # read-only: what this exact release changes, in two lists ``` The whole protected-update and manual-recovery recipe: [`docs/upgrading.md`](docs/upgrading.md). diff --git a/docs/release-readiness-plan.md b/docs/release-readiness-plan.md index 0d8ad47..6ad641e 100644 --- a/docs/release-readiness-plan.md +++ b/docs/release-readiness-plan.md @@ -3,7 +3,7 @@ - Status: in execution; automated baseline implemented 2026-08-22 - Created: 2026-08-21 - Target: a release candidate suitable for the wider BCHC demo audience next week -- Candidate: `v1.9.0-rc.7` +- Release: `v1.9.0` (stable, promoted from `v1.9.0-rc.7`) - Parent repository: [`crypticpy/phct`](https://github.com/crypticpy/phct) - Downstream demo: [`crypticpy/bchc-ai-use-case-catalog`](https://github.com/crypticpy/bchc-ai-use-case-catalog) diff --git a/docs/release-readiness-status.md b/docs/release-readiness-status.md index 3f785c2..5f8da80 100644 --- a/docs/release-readiness-status.md +++ b/docs/release-readiness-status.md @@ -1,12 +1,16 @@ # PHCT and BCHC release-readiness status -- Evidence date: 2026-08-28 +- Evidence date: 2026-08-29 - PHCT starting baseline: `c9fcb223826f2fc8c945d894420c16a2b8ff5da0` -- PHCT candidate: `v1.9.0-rc.7`, cut from protected `main` at the merge of the two - rc.6 refresh-cycle robustness fixes found in downstream review +- PHCT release: stable `v1.9.0`, a records-only promotion of the accepted + [`v1.9.0-rc.7`](https://github.com/crypticpy/phct/releases/tag/v1.9.0-rc.7) + candidate cut by this release pull request; no template behaviour change + since rc.7. The candidate was cut from protected `main` at the merge of the + two rc.6 refresh-cycle robustness fixes found in downstream review ([PR #49](https://github.com/crypticpy/phct/pull/49), merged at - `af54f2810ed9d94fbfbb9b92ecf500ceaba18ddb`) and this release pull request. - It supersedes + `af54f2810ed9d94fbfbb9b92ecf500ceaba18ddb`), published at immutable commit + `b97432bc1d5298407046e599248bc62a6f09ce37`, and consumed and rollback-proven + live by BCHC. It supersedes [`v1.9.0-rc.6`](https://github.com/crypticpy/phct/releases/tag/v1.9.0-rc.6), published at immutable commit `c33e76b05fda6a9bdaa7beea7527414b13d74c1b` — cut at the merge of the searchable "Also deployed by" listings ([PR #46](https://github.com/crypticpy/phct/pull/46)), @@ -27,7 +31,7 @@ [rc.2 run](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/32599759546): immutable tag and full SHA resolved, protected paths preserved byte-for-byte, merged at `fd7206981c58107df626f50062f08ad6aee1a0e0`); the - published BCHC demo then consumed `v1.9.0-rc.5` via [PR #14](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/14) on 2026-08-26. On 2026-08-28 the ownership-contract migration merged ([BCHC PR #29](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/29)), the live updater consumed `v1.9.0-rc.6` with its fail-closed contract gate proven ([run 33134382533](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33134382533)) and the machine-verified update merged after human review ([BCHC PR #30](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/30), `c0826d9`), followed by the rc.6 feature adoption ([BCHC PR #31](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/31)). The post-rc.6 robustness fixes then merged to PHCT `main` ([PR #49](https://github.com/crypticpy/phct/pull/49), `af54f28`), the `v1.9.0-rc.7` candidate was cut ([PR #54](https://github.com/crypticpy/phct/pull/54), merged `b97432b`, immutable tag published) and the live updater consumed it the same day ([run 33144777338](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33144777338) → machine-verified [BCHC PR #34](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/34), merged after human review at `929b007`), after which the live rollback drill proved revert and byte-identical roll-forward of that update ([BCHC PR #35](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/35) / [PR #36](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/36)); the stable cut now requires only the records-only promotion and one stable-tag updater pass. + published BCHC demo then consumed `v1.9.0-rc.5` via [PR #14](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/14) on 2026-08-26. On 2026-08-28 the ownership-contract migration merged ([BCHC PR #29](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/29)), the live updater consumed `v1.9.0-rc.6` with its fail-closed contract gate proven ([run 33134382533](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33134382533)) and the machine-verified update merged after human review ([BCHC PR #30](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/30), `c0826d9`), followed by the rc.6 feature adoption ([BCHC PR #31](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/31)). The post-rc.6 robustness fixes then merged to PHCT `main` ([PR #49](https://github.com/crypticpy/phct/pull/49), `af54f28`), the `v1.9.0-rc.7` candidate was cut ([PR #54](https://github.com/crypticpy/phct/pull/54), merged `b97432b`, immutable tag published) and the live updater consumed it the same day ([run 33144777338](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33144777338) → machine-verified [BCHC PR #34](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/34), merged after human review at `929b007`), after which the live rollback drill proved revert and byte-identical roll-forward of that update ([BCHC PR #35](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/35) / [PR #36](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/36)); the records-only stable promotion `v1.9.0` is cut by this release pull request; after its human-reviewed merge, publish the immutable `v1.9.0` tag and run the one remaining stable-tag updater pass. - Automated code baseline: **green** - Wider-demo candidate: **no-go until parent interface polish and the remaining manual/live demo gates pass** - Stable release and BCHC handoff: **no-go until the human and live-repository gates below pass** @@ -136,14 +140,14 @@ No automated P0 or P1 defect is known at this checkpoint. | ID | Required evidence | Owner | Status | |---|---|---|---| -| RR-H01 | Review these changes and obtain green required CI plus independent human approval in PHCT and BCHC. | PHCT maintainer | In progress — rc.6's machine-verified update ([BCHC PR #30](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/30)) and the feature adoption ([BCHC PR #31](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/31)) merged 2026-08-28 with green required checks after human review of #30. The [PHCT PR #49](https://github.com/crypticpy/phct/pull/49) merge resets the line: the stable cut now requires an rc.7 candidate and one more human-reviewed BCHC update. | +| RR-H01 | Review these changes and obtain green required CI plus independent human approval in PHCT and BCHC. | PHCT maintainer | In progress — rc.6's machine-verified update ([BCHC PR #30](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/30)) and the feature adoption ([BCHC PR #31](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/31)) merged 2026-08-28 with green required checks after human review of #30. The [PHCT PR #49](https://github.com/crypticpy/phct/pull/49) merge reset the line; the rc.7 candidate ([PR #54](https://github.com/crypticpy/phct/pull/54), merged `b97432b`) and its human-reviewed BCHC update ([BCHC PR #34](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/34), merged `929b007`) closed it. Remaining: human review and merge of this stable release record and of the stable BCHC update pull request. | | RR-H02 | Tag an immutable PHCT release candidate, run the actual BCHC update workflow, review the checksum report and generated changes, then prove revert/rollback of the update pull request. | PHCT maintainer | Complete for rc.6 and rc.7 — immutable `v1.9.0-rc.6` consumed through the live updater with the fail-closed ownership-contract gate proven ([run 33134382533](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33134382533)) before [BCHC PR #30](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/30); immutable `v1.9.0-rc.7` consumed the same way ([run 33144777338](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33144777338) → [BCHC PR #34](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/34), maintainer-merged `929b007`); and the revert/rollback of an update pull request is now proven live under RR-H07 ([BCHC PR #35](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/35) rollback and [BCHC PR #36](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/36) byte-identical roll-forward, both through required checks, Pages redeploys and live verification on 2026-08-28). Repeat the update run for the stable tag. | | RR-H03 | Complete a real issue → pull request → media processing → review → merge → Pages deploy → notification rehearsal in both repositories. Use non-sensitive test content and remove it afterward. | Repository admins | In progress — the BCHC leg completed 2026-08-28: a real web-form submission became [BCHC PR #27](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/27) carrying real media (PDF deck plus generated AVIF/WebP derivatives), merged at `610c0fc`, deployed through Pages, and was verified live (entry page, media files, and `search.json`); the test entry was then removed end to end via [BCHC PR #32](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/32) and verified gone. The PHCT leg completed later the same day: form-contract issue [#51](https://github.com/crypticpy/phct/issues/51) was scaffolded into [PR #52](https://github.com/crypticpy/phct/pull/52), the content gates correctly rejected the link-less draft until the maintainer amendment `84dd8bf` (the exact remedies the admin guide prescribes), it merged at `3a3e717`, was verified live on the deployed showcase (entry page and search index), and was removed via [PR #53](https://github.com/crypticpy/phct/pull/53) with the removal verified live. Only the notification-delivery confirmation remains open. | | RR-H04 | Name a BCHC product owner and backup technical maintainer; grant least-privilege access; update `CODEOWNERS`, `MAINTAINERS.md`, and the private contact system. | BCHC sponsor | Deferred until organizational handoff; it is not a wider-demo prerequisite. | | RR-H05 | Correct and verify branch rules, required checks/approval, Pages environment protection, Actions permissions, secrets/variables, domain/DNS, security settings, labels, and notifications against `docs/bchc/operations-inventory.yml`. | Repository admins | In progress — a fresh read-only API audit on 2026-08-28 was synced into `docs/bchc/operations-inventory.yml` (BCHC PRs [#31](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/31) and [#33](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/33)); the intentionally-unset repository variables are documented as default-on. Four admin items remain manual: require a human approval, disable Actions PR approval, protect release tags, and confirm notification delivery. | | RR-H06 | Manually test current Firefox, Safari, Edge, iOS Safari, and Android Chrome plus VoiceOver and NVDA; verify 200%/400% zoom, keyboard-only use, visible focus, forced colors, reduced motion, and representative long/empty/error content. | Accessibility reviewer | Open | | RR-H07 | Perform the documented bad-deploy rollback, content takedown, credential-response, repository backup, and restore drills; record timestamps, participants, gaps, and corrections. | Primary and backup maintainers | In progress — template update (2026-08-26), repository backup/restore (2026-08-28, bundle-verified mirrors of both repositories restored and fsck-checked) and the bad-deploy rollback (2026-08-28, full on-GitHub drill: [BCHC PR #35](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/35) rolled the live deployment back to `v1.9.0-rc.6` through required checks, Pages redeploy and live smoke test, then [BCHC PR #36](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/36) rolled forward to `v1.9.0-rc.7` byte-identical to the maintainer-merged update — `git diff 929b007` empty) passed; content takedown is partial: [BCHC PR #32](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/32) rehearsed an ordinary unpublish while the protected-data history purge of `docs/incidents.md` remains unrehearsed. Credential-response and owner-transfer drills remain open. | -| RR-H08 | Run the approved candidate on the intended Pages configuration for one business day with no unresolved P0/P1 defect and review Actions/Pages behavior before the wider demo. | Release owner | In progress — rc.6 is live on the intended Pages configuration with a one-business-day monitor running since 2026-08-28T03:35Z; no P0/P1 defect observed so far. Re-scope the soak once rc.7 is consumed. | +| RR-H08 | Run the approved candidate on the intended Pages configuration for one business day with no unresolved P0/P1 defect and review Actions/Pages behavior before the wider demo. | Release owner | Pass, accepted by the release owner — the rc.6 deployment soaked clean for ~15 hours (30 half-hourly probes from 2026-08-28T03:35Z, superseded when rc.7 shipped), then the rc.7 deployment soaked clean on the intended Pages configuration from 2026-08-28T18:29Z to 2026-08-29T08:17Z: 29 half-hourly probes, each confirming a 200 homepage, a versioned search index and zero failed workflow runs on the default branch, across a window that also absorbed the live rollback drill. No P0/P1 defect was observed; the release owner accepted the soak and called the stable cut on 2026-08-29. | | RR-H09 | Check presentation-critical external links and contact destinations from the deployed candidate; record any intentionally unreachable or staging-only target. | BCHC content owner | Complete for rc.6 — 187 links checked from the deployed candidate on 2026-08-28. One live finding: the three "Ask in the open" links 404 until repository Discussions are enabled (or `contact.ask_in_open` is turned off). The sample entries' intentionally unreachable targets (`example.org`, `github.com/example`) are recorded as such. | The authenticated 2026-08-22 API audit confirmed that both repositories are public, use `main`, diff --git a/package-lock.json b/package-lock.json index 2ece4a3..a331b42 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "phct", - "version": "1.9.0-rc.7", + "version": "1.9.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "phct", - "version": "1.9.0-rc.7", + "version": "1.9.0", "devDependencies": { "@eslint/js": "^10.0.1", "@tailwindcss/forms": "^0.5.10", diff --git a/package.json b/package.json index 8dad5d4..047aaa1 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "phct", - "version": "1.9.0-rc.7", + "version": "1.9.0", "private": true, "packageManager": "npm@10.9.4", "engines": { From 1b60cbf8db866668e325def18b291b3802384890 Mon Sep 17 00:00:00 2001 From: Beyond <46542494+crypticpy@users.noreply.github.com> Date: Sat, 29 Aug 2026 03:39:57 -0500 Subject: [PATCH 2/4] docs: record the v1.9.0 verify run npm run verify passed under the exact-pinned toolchain at the cut commit 05008c2: 799 Node tests across 3 suites, 233 Ruby tests with 578 assertions, 109 build-matrix tests across 6 suites, plus every non-browser release gate. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014sAVayAT2tkQ7p9U2o9CsD --- docs/release-readiness-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-readiness-status.md b/docs/release-readiness-status.md index 5f8da80..62be464 100644 --- a/docs/release-readiness-status.md +++ b/docs/release-readiness-status.md @@ -58,7 +58,7 @@ that updater succeeds. |---|---|---| | Reproducible toolchain | Pass | Node 22.22.2, npm 10.9.4, Ruby 3.3.11, and Bundler 4.0.11 are exact-pinned and checked by `npm run doctor`. | | Live pull-request CI | Pass at reviewed heads | The rc.2 implementation retained the full Validate, coverage, preset matrix, scale/Chrome, supply-chain, CodeQL, workflow-lint, pa11y, assistive-flow, and desktop/mobile Lighthouse gates. PHCT PRs #17/#20 passed protected CI and review. The generated metrics head `9a486f6` then passed all seven ruleset-required contexts plus browser quality through trusted dispatches before PR #19 was intentionally closed unmerged. Every check on BCHC rc.2 update head `2017cda` is green. | -| PHCT release verification | Pass | `npm run verify` completed under the exact-pinned toolchain at release-record commit `f1e5699f147ce770137cc50d3d7c86c372c83a37`: 799 Node tests across 3 suites, 233 Ruby tests with 578 assertions, 109 build-matrix tests across 6 suites, plus lint, formatting, coverage, generated-file, data/front-matter, license, security-exception, SBOM, image-derivative, production CSS, Jekyll production build, and built-site link gates. The final release-record head differs from that commit only by this evidence sentence, and every protected CI context runs on the exact head in the release pull request. | +| PHCT release verification | Pass | `npm run verify` completed under the exact-pinned toolchain at release-record commit `05008c274352846f6661728a5f35042428305da4`: 799 Node tests across 3 suites, 233 Ruby tests with 578 assertions, 109 build-matrix tests across 6 suites, plus lint, formatting, coverage, generated-file, data/front-matter, license, security-exception, SBOM, image-derivative, production CSS, Jekyll production build, and built-site link gates. The final release-record head differs from that commit only by this evidence sentence, and every protected CI context runs on the exact head in the release pull request. | | Code coverage | Pass locally and in exact-head CI | Pinned runtime coverage passed reviewed regression floors: complete loaded Node production code 84.81% lines / 75.94% branches / 80.07% functions; focused security parsers 90.54% / 80.55% / 93.59%; updater and release-lock logic 72.79% / 77.39% / 87.76%; loaded Ruby production code 93.29% lines / 85.13% branches / 77.69% methods. Six Ruby CLI sources exercised by subprocess or integration gates are explicitly inventoried, and any new unrepresented Ruby source fails the gate. Validate retains JSON and raw TAP artifacts even when a floor fails. | | Exact BCHC update rehearsal | Pass for rc.6 and rc.7 | The real rc.4 updater run resolved `v1.9.0-rc.4` to full SHA `c41149eaacab353c82403477bf0c5b2f26a48650`, preserved the protected BCHC paths, regenerated BCHC-owned deployment output, and opened candidate [PR #7](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/7) at `c4ac0d5de1921f8047cabbe3264b6cda517c52b2`. The complete downstream required-check set was green, and the PR merged at `fd7206981c58107df626f50062f08ad6aee1a0e0`, locking the published BCHC demo to `v1.9.0-rc.4`. The rc.2 rehearsal ([PR #4](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/4) at `2017cda8b731ae52103c6b44232496d2c2fc8662`, 116 protected files byte-identical) remains the recorded checksum baseline. The rc.6 update repeated the rehearsal live on 2026-08-28: the updater first failed closed on the pending ownership-contract migration ([run 33134382533](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33134382533)), passed once [BCHC PR #29](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/29) merged, and opened the machine-verified [BCHC PR #30](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/30), which merged after human review at `c0826d9776747c2838daaba91991628e4301f7bf`, locking the published demo to `v1.9.0-rc.6`. The rc.7 update repeated the rehearsal live the same day: [run 33144777338](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33144777338) opened machine-verified [BCHC PR #34](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/34), which merged after human review at `929b007ce9cd75b14447b9e1a781d6a04b6dfb4`, locking the published demo to `v1.9.0-rc.7`; the live rollback drill then reverted and byte-identically re-applied that update ([BCHC PR #35](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/35) / [PR #36](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/36)). Repeat the same rehearsal and checksum gate for the stable update. | | Dependency vulnerabilities | Pass | The exact-head Supply chain job passed parsed npm and Bundler audits with zero active exceptions; critical or unidentified findings cannot be waived, and stale/expired/unused exceptions fail closed. | From 2cb4fca7f7c4aa276985ec428feabe5da054f0d2 Mon Sep 17 00:00:00 2001 From: Beyond <46542494+crypticpy@users.noreply.github.com> Date: Sat, 29 Aug 2026 03:50:06 -0500 Subject: [PATCH 3/4] docs: keep the RR-H08 stable soak leg open The candidate soak (rc.6/rc.7 windows, accepted by the release owner) does not discharge work package 8's requirement to observe the deployed stable update for one business day. Record the acceptance but keep the gate in progress until the stable deployment supplies that evidence. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014sAVayAT2tkQ7p9U2o9CsD --- docs/release-readiness-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-readiness-status.md b/docs/release-readiness-status.md index 62be464..6aefb2e 100644 --- a/docs/release-readiness-status.md +++ b/docs/release-readiness-status.md @@ -147,7 +147,7 @@ No automated P0 or P1 defect is known at this checkpoint. | RR-H05 | Correct and verify branch rules, required checks/approval, Pages environment protection, Actions permissions, secrets/variables, domain/DNS, security settings, labels, and notifications against `docs/bchc/operations-inventory.yml`. | Repository admins | In progress — a fresh read-only API audit on 2026-08-28 was synced into `docs/bchc/operations-inventory.yml` (BCHC PRs [#31](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/31) and [#33](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/33)); the intentionally-unset repository variables are documented as default-on. Four admin items remain manual: require a human approval, disable Actions PR approval, protect release tags, and confirm notification delivery. | | RR-H06 | Manually test current Firefox, Safari, Edge, iOS Safari, and Android Chrome plus VoiceOver and NVDA; verify 200%/400% zoom, keyboard-only use, visible focus, forced colors, reduced motion, and representative long/empty/error content. | Accessibility reviewer | Open | | RR-H07 | Perform the documented bad-deploy rollback, content takedown, credential-response, repository backup, and restore drills; record timestamps, participants, gaps, and corrections. | Primary and backup maintainers | In progress — template update (2026-08-26), repository backup/restore (2026-08-28, bundle-verified mirrors of both repositories restored and fsck-checked) and the bad-deploy rollback (2026-08-28, full on-GitHub drill: [BCHC PR #35](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/35) rolled the live deployment back to `v1.9.0-rc.6` through required checks, Pages redeploy and live smoke test, then [BCHC PR #36](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/36) rolled forward to `v1.9.0-rc.7` byte-identical to the maintainer-merged update — `git diff 929b007` empty) passed; content takedown is partial: [BCHC PR #32](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/32) rehearsed an ordinary unpublish while the protected-data history purge of `docs/incidents.md` remains unrehearsed. Credential-response and owner-transfer drills remain open. | -| RR-H08 | Run the approved candidate on the intended Pages configuration for one business day with no unresolved P0/P1 defect and review Actions/Pages behavior before the wider demo. | Release owner | Pass, accepted by the release owner — the rc.6 deployment soaked clean for ~15 hours (30 half-hourly probes from 2026-08-28T03:35Z, superseded when rc.7 shipped), then the rc.7 deployment soaked clean on the intended Pages configuration from 2026-08-28T18:29Z to 2026-08-29T08:17Z: 29 half-hourly probes, each confirming a 200 homepage, a versioned search index and zero failed workflow runs on the default branch, across a window that also absorbed the live rollback drill. No P0/P1 defect was observed; the release owner accepted the soak and called the stable cut on 2026-08-29. | +| RR-H08 | Run the approved candidate on the intended Pages configuration for one business day with no unresolved P0/P1 defect and review Actions/Pages behavior before the wider demo. | Release owner | In progress — candidate soak accepted by the release owner: the rc.6 deployment soaked clean for ~15 hours (30 half-hourly probes from 2026-08-28T03:35Z, superseded when rc.7 shipped), then the rc.7 deployment soaked clean on the intended Pages configuration from 2026-08-28T18:29Z to 2026-08-29T08:17Z: 29 half-hourly probes, each confirming a 200 homepage, a versioned search index and zero failed workflow runs on the default branch, across a window that also absorbed the live rollback drill. No P0/P1 defect was observed; the release owner accepted the candidate soak and called the stable cut on 2026-08-29. Remaining: deploy the stable `v1.9.0` BCHC update and observe it for one business day per work package 8 before closing this gate. | | RR-H09 | Check presentation-critical external links and contact destinations from the deployed candidate; record any intentionally unreachable or staging-only target. | BCHC content owner | Complete for rc.6 — 187 links checked from the deployed candidate on 2026-08-28. One live finding: the three "Ask in the open" links 404 until repository Discussions are enabled (or `contact.ask_in_open` is turned off). The sample entries' intentionally unreachable targets (`example.org`, `github.com/example`) are recorded as such. | The authenticated 2026-08-22 API audit confirmed that both repositories are public, use `main`, From 2a2006e8943051aca6e5def6e9f5fb979ef90f62 Mon Sep 17 00:00:00 2001 From: Beyond <46542494+crypticpy@users.noreply.github.com> Date: Sat, 29 Aug 2026 03:51:48 -0500 Subject: [PATCH 4/4] docs: re-record the verify run at the corrected head npm run verify passed again under the exact-pinned toolchain at 2cb4fca (the head carrying the RR-H08 correction), restoring the row's only-the-evidence-sentence invariant. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014sAVayAT2tkQ7p9U2o9CsD --- docs/release-readiness-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/release-readiness-status.md b/docs/release-readiness-status.md index 6aefb2e..5418ce1 100644 --- a/docs/release-readiness-status.md +++ b/docs/release-readiness-status.md @@ -58,7 +58,7 @@ that updater succeeds. |---|---|---| | Reproducible toolchain | Pass | Node 22.22.2, npm 10.9.4, Ruby 3.3.11, and Bundler 4.0.11 are exact-pinned and checked by `npm run doctor`. | | Live pull-request CI | Pass at reviewed heads | The rc.2 implementation retained the full Validate, coverage, preset matrix, scale/Chrome, supply-chain, CodeQL, workflow-lint, pa11y, assistive-flow, and desktop/mobile Lighthouse gates. PHCT PRs #17/#20 passed protected CI and review. The generated metrics head `9a486f6` then passed all seven ruleset-required contexts plus browser quality through trusted dispatches before PR #19 was intentionally closed unmerged. Every check on BCHC rc.2 update head `2017cda` is green. | -| PHCT release verification | Pass | `npm run verify` completed under the exact-pinned toolchain at release-record commit `05008c274352846f6661728a5f35042428305da4`: 799 Node tests across 3 suites, 233 Ruby tests with 578 assertions, 109 build-matrix tests across 6 suites, plus lint, formatting, coverage, generated-file, data/front-matter, license, security-exception, SBOM, image-derivative, production CSS, Jekyll production build, and built-site link gates. The final release-record head differs from that commit only by this evidence sentence, and every protected CI context runs on the exact head in the release pull request. | +| PHCT release verification | Pass | `npm run verify` completed under the exact-pinned toolchain at release-record commit `2cb4fca7f7c4aa276985ec428feabe5da054f0d2`: 799 Node tests across 3 suites, 233 Ruby tests with 578 assertions, 109 build-matrix tests across 6 suites, plus lint, formatting, coverage, generated-file, data/front-matter, license, security-exception, SBOM, image-derivative, production CSS, Jekyll production build, and built-site link gates. The final release-record head differs from that commit only by this evidence sentence, and every protected CI context runs on the exact head in the release pull request. | | Code coverage | Pass locally and in exact-head CI | Pinned runtime coverage passed reviewed regression floors: complete loaded Node production code 84.81% lines / 75.94% branches / 80.07% functions; focused security parsers 90.54% / 80.55% / 93.59%; updater and release-lock logic 72.79% / 77.39% / 87.76%; loaded Ruby production code 93.29% lines / 85.13% branches / 77.69% methods. Six Ruby CLI sources exercised by subprocess or integration gates are explicitly inventoried, and any new unrepresented Ruby source fails the gate. Validate retains JSON and raw TAP artifacts even when a floor fails. | | Exact BCHC update rehearsal | Pass for rc.6 and rc.7 | The real rc.4 updater run resolved `v1.9.0-rc.4` to full SHA `c41149eaacab353c82403477bf0c5b2f26a48650`, preserved the protected BCHC paths, regenerated BCHC-owned deployment output, and opened candidate [PR #7](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/7) at `c4ac0d5de1921f8047cabbe3264b6cda517c52b2`. The complete downstream required-check set was green, and the PR merged at `fd7206981c58107df626f50062f08ad6aee1a0e0`, locking the published BCHC demo to `v1.9.0-rc.4`. The rc.2 rehearsal ([PR #4](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/4) at `2017cda8b731ae52103c6b44232496d2c2fc8662`, 116 protected files byte-identical) remains the recorded checksum baseline. The rc.6 update repeated the rehearsal live on 2026-08-28: the updater first failed closed on the pending ownership-contract migration ([run 33134382533](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33134382533)), passed once [BCHC PR #29](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/29) merged, and opened the machine-verified [BCHC PR #30](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/30), which merged after human review at `c0826d9776747c2838daaba91991628e4301f7bf`, locking the published demo to `v1.9.0-rc.6`. The rc.7 update repeated the rehearsal live the same day: [run 33144777338](https://github.com/crypticpy/bchc-ai-use-case-catalog/actions/runs/33144777338) opened machine-verified [BCHC PR #34](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/34), which merged after human review at `929b007ce9cd75b14447b9e1a781d6a04b6dfb4`, locking the published demo to `v1.9.0-rc.7`; the live rollback drill then reverted and byte-identically re-applied that update ([BCHC PR #35](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/35) / [PR #36](https://github.com/crypticpy/bchc-ai-use-case-catalog/pull/36)). Repeat the same rehearsal and checksum gate for the stable update. | | Dependency vulnerabilities | Pass | The exact-head Supply chain job passed parsed npm and Bundler audits with zero active exceptions; critical or unidentified findings cannot be waived, and stale/expired/unused exceptions fail closed. |