Repository navigation
Add production readiness gates (kernel → RC) - #110
Merged
Merged
Conversation
Automates the waterproofing stack with tiered shell gates, Makefile targets, GitHub workflows, and production-readiness docs so release evidence can run locally and in CI before tagging. Co-authored-by: Cursor <cursoragent@cursor.com>
2 tasks
9.0.0 SDK installers are no longer on the CDN; pin 9.0.100 with latestFeature roll-forward so gate workflows and dotnet CLI resolve. Co-authored-by: Cursor <cursoragent@cursor.com>
IanFrelinger
pushed a commit
that referenced
this pull request
Sep 30, 2026
…r it The Readiness-v1 sheets (dated 2026-05-19) and ReleaseSignOff-v1 (bec2a6e, 2026-05-22) mark tiers PASS. An audit claimed several of those PASSes rested on nothing. This change checks each one against its OWN date and SHA, not against today. A filter that broke in June does not falsify a PASS recorded in May. Each PASS row, and each tick in the release sign-off, now carries a dated "[corrected 2026-09-30: ...]" note in place, with one of four labels: SUPPORTED (with the run id), UNSUPPORTED-AT-THE-TIME, LATER-DECAYED (with date and cause), or UNEVIDENCED (a local run nobody can now inspect, not disproven). Nothing is removed or re-ticked: a word diff against 876cc52 shows only insertions in all 9 files. The production-readiness README and each corrected sheet state the rule from now on. A PASS names a run on the header SHA; otherwise the row reads NOT RUN or CARRIED FORWARD with both SHAs. A readiness PASS cites a Readiness summary run whose verdict is `verified`. The labels follow that rule. A run on any commit other than the sheet's is "carried forward tested -> sheet", even when the trees are identical (a PR head and its merge), and the note names the tree hash or says what differs. A run that finished after the release sign-off says "after sign-off". What the evidence shows: - No commit held these gates on 2026-05-19. The scripts first appear in 43d5fca (authored 2026-05-22 00:45 UTC), and 7457e6c's Makefile has none of the targets. The sheets were committed in 0ecb5bf, whose tree f1e22df equals PR #110's head ee8befa. - SUPPORTED on 0ecb5bf itself: kernel A (26262716833). Carried forward ee8befa -> 0ecb5bf (identical tree f1e22df): application A (26262666898), composition A-C (26262666838; static counts reproduce the sheet's 44/6/18 exactly), security A-B (26262666843), and the portal and agent-server dry runs (26262666791). Carried forward 7457e6c -> 0ecb5bf (2026-05-19): kernel B and ship A (26129468793), mesh-lab-e2e and composition D (26129468841), and kernel C's gRPC leg and D's pack-list check. - UNSUPPORTED-AT-THE-TIME: security C's unit step and 3 of the 4 suites named by application B are UnitTestBase suites that FullyQualifiedName~ cannot select. CI run 31982500018 prints "No test matches ... TrustCommandTests" and then PASS. ReleaseSignOff's "all automated gates green for target SHA": 8 of the 19 runs on bec2a6e failed, including Full Platform Readiness Gate and its Readiness summary. When the box was ticked, none had succeeded and 4 had already shown a failure (mapbox-tile-helpers-ci 26262737725 and onboarding-quickstart-gate 26262737929 at creation, then Cross-Platform Tests and Persistence Tests jobs at 01:36). - LATER-DECAYED: security B since e6b5579 (2026-08-17); application C since 9579c81 and e6b5579; compat A's migration step since 678d071 (2026-06-08). CI logs and a container run at 876cc52 show each one printing "No test matches" and then PASS. - Release sign-off, all after the 01:38:36 sign-off commit: security Tiers A-B carried forward 2a1b4d1 -> bec2a6e (PR #114 head, identical tree b2996d4, run 26262735412, done 01:57:29); compat 26262738367 (01:56:14); DR Tiers A-B 26262738375 (01:50:21). waterproofing-gate.yml has never run (API total_count 0). dr-gate's own tier C took its placeholder path in CI, but "mesh director persistence verified" is SUPPORTED after sign-off by Mesh virtual lab gate run 26262738372 on bec2a6e, which runs the same persistence script with the key and LiteDb provider it needs. - The Operations tick ("rollback drill recorded"): the drill record exists, filled in by the sign-off commit fb54476. Its checks passed CI only after sign-off. It records a restore in place ("To version: N/A"), not a rollback to an earlier version, and its reports went to gitignored .nexo/. The mesh task id it cites (20260522001559314-...) is NOT a timestamp of the drill: the persistence script always posts idempotency key mesh-lab-persist-idem, POST /api/mesh/tasks returns the existing task for a known key, and the task lives on a named volume that mesh-lab-up and dr-gate-tier-c never remove. The id dates the first seeding of that task (00:15:59 UTC, before bec2a6e existed), so it cannot show which tree the local drill ran on. What this does NOT fix: the gates themselves. Security B, application C and compat A still print PASS on zero tests, because nothing in those scripts rejects a filter that matches nothing. The new evidence rule is prose only: no check reads these tables, so a wrong run id in a note stays green, and scripts/rc-gate-tier-e.sh (run by waterproofing-gate) still reports "sign-off: checked items found" from the ticked lines, including the Engineering tick now annotated UNSUPPORTED-AT-THE-TIME; the README says so. RollbackDrill-v1.md's own "Result PASS" is not annotated; the note sits on the sign-off tick that links to it. May test counts cannot be recovered (logs return HTTP 410); counts given are static counts at the historical SHA, checked against 2026-08-17 CI logs. CompatReadiness, DRReadiness and PerfReadiness have no PASS rows and are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nexo-ready-gate, and kernel phase resolution testsTest plan
make rc-gate-fullwithRC_GATE_GH_ADVISORY_ONLY=1locallymake nexo-ready-gatewithNEXO_READY_SKIP_DOCKER=1rc-gateworkflow runs on pushStacked: PR #2 targets this branch for waterproofing gates.
Made with Cursor