[ADHD] v0.6.0 — release verification and documentation #57

Activity

1. uniskela commented on Oct 22, 2026

   

   uniskela

   on Oct 22, 2026

   OwnerAuthor

   More actions

   Done

   Independent release audit of main at 8333dd88d87834890dfcd58e7745e4c8d9994f20. Result: CONDITIONAL GO. Full report: docs/internal/releases/v0.6.0-readiness.md on hardening PR #67.

   Category	Result	Evidence
   Git synchronization	PASS	pnpm check 656/656 on main; scheduler/per-repo/browser tests; new multi-repo isolation and disabled-worker tests (#67). #52 verified and closed.
   Inbound webhooks	PASS (automated)	Raw-byte HMAC before parsing, native headers only, SHA-1 rejected, identity/branch fences in the ledger transaction, single allowlisted public route; cross-workspace test (#67).
   Deployment bindings	PASS (automated)	Encryption/masking, CAS, lease-fenced begin/finish, unknown on interruption, pinned DNS, TLS verification, no redirects, deadlines; rotation/disable of queued work rejects without sending (#67).
   Selective routing	PASS (automated)	Scenario table re-run through real Git/SQLite/worker in tests/integration/release-audit-routing.test.ts, incl. Unicode/space/parenthesis paths and a root-prefix trap.
   Recovery/idempotency	PASS + risk R1	Restarts, lease expiry, rollback, rotation between accept and route. A push whose fetch exhausts retries is never routed (fail-closed) → #68.
   Database migration	PASS	Database seeded by the v0.5.0 code, upgraded: every existing row byte-identical, token decrypts and fetches, pending job runs, schema equals fresh, no drift.
   Backup/restore	PASS (disposable)	WAL-safe backups; volume round trip byte-identical; pre-upgrade backup runs under v0.5.0; wrong key refused at decryption; missing key refuses to start.
   Security	PASS	Gitleaks over main history clean; pnpm audit --prod clean; 20 Sonar alerts already dispositioned (manual status change pending); 2 open Kody threads fixed in #67.
   Accessibility	PASS	Playwright + axe on the audited build: 43 passed / 13 intentional skips; server-disabled scenario and new dashboard keyboard check passed.
   Container and CI	PASS (CI)	CI on main, container security on main, secret scan. Local image build not run (host disk ~450 MB free).
   Live operator acceptance	UNVERIFIED	Checklist: docs/public/UPGRADING_0_6.md (#67).

   Hardening PR #67 (head 75c9a38): all checks green (667 tests, Playwright/axe 43/13, Docker, CodeQL, Gitleaks, Sonar gate). Kody code review: one finding, fixed and resolved. Kody business validation: its MUST_FIX items are this gate's remaining operator steps (dispositions).

   Fixed in #67: raw deployment.* ids in Dashboard/Activity (now labelled); two Kody test findings; stale backup/rollback, release and roadmap docs. New: upgrade page with a 14-step operator checklist. #52 and #56 closed after verification; #51 checklist updated.

   Next

   1. Review and merge fix: harden v0.6.0 release audit labels, tests and upgrade docs #67 (it needs your approval; nothing was merged).
   2. After Release Please refreshes chore(main): release 0.6.0 #41, approve its action_required workflow runs and confirm they pass on its head.
   3. Run the acceptance checklist in UPGRADING_0_6.md on a disposable stack with the real forge, proxy and receiver, and record the results here. Steps 2, 3, 6, 9–12 and 14 are the minimum. Then sign off and merge chore(main): release 0.6.0 #41.

   Resume

   Start from the readiness report on #67 and the checklist table. Do not close #57 until the live checklist passes. No merge, tag, release, image publication or production deployment has been performed.
2. uniskela commented on Oct 22, 2026

   

   uniskela

   on Oct 22, 2026 – with Cursor

   OwnerAuthor

   More actions

   Drift update: hardening PR #67 and release PR #41 are merged and v0.6.0 was published on 2026-10-22, so Next and Resume now point only at the live operator checklist in docs/public/UPGRADING_0_6.md and sign-off. Leaving open until the live checklist results are recorded.