Publish attested preview and stable Pylon Prime releases #29

Activity

1. rynfar

   added

   pkg:coding-agentAffects packages/coding-agentAffects packages/coding-agent

   on Aug 31, 2026
2. rynfar commented on Aug 31, 2026

   

   rynfar

   on Aug 31, 2026

   Author

   More actions

   Read-only implementation audit complete. No repository setting, file, tag, release, attestation, or publication was changed.

   One concrete blocker must be fixed in #29: protected pylon currently requires Check changelog fragment, but that workflow runs only on pull_request. A stable admission routine that honestly requires every branch-protection context on the exact merged source SHA would therefore always fail. The #29 PR should add a pylon push proof job that asserts the canonical repo/ref, resolves the associated merged PR, verifies its head check came from GitHub Actions app id 15368 and succeeded, then emits the required context on the merged SHA. It must not relabel a PR-head check as an exact merged-SHA check or silently omit a protected context.

   The smallest sound implementation is:

   • protected preview publication only after the canonical pylon push aggregate and Ubuntu/macOS/Windows deterministic-install gates succeed;
   • immutable prerelease pylon-build-g<sha12>-r<recipe> with the four tarballs, build manifest, deterministic preview manifest, and keyless build-provenance attestations for all six subjects;
   • manual pylon-ref stable promotion that downloads and verifies an existing immutable preview, checks every exact-SHA protected context and attestation, runs the same bytes through three-OS install gates, and publishes only a signed stable manifest under monotonic pylon-stable-NNNNNN-g<sha12>-r<recipe>;
   • no rebuild, clobber, mutable release edit, npm/R2 credentials, arbitrary refs, main, inherited v*, or repository-source execution in the publisher;
   • rollback/withdrawal as a higher signed stable sequence with an append-only revocation list, never release/tag deletion.

   Ordering remains strict: merge #32 first; create #29 from the resulting latest origin/pylon (not PR #32's current head); configure immutable releases plus guarded pylon-preview/pylon-stable environments and full-SHA action policy before #29 merges; then verify the first preview and dispatch stable sequence 000001 as explicit maintainer checkpoints. No repository secret is required.

   Admin prerequisites do not exist yet: the repository currently has zero environments/releases/deployments, and the release-immutability setting was not exposed by the read-only REST probe. The publisher must require immutable:true after publication and fail loudly otherwise. The first live preview remains a maintainer verification gate.
3. rynfar commented on Aug 31, 2026

   

   rynfar

   on Aug 31, 2026

   Author

   More actions

   Admin prerequisites advanced after #32 merged:

   • repository immutable releases are now enabled and read back as enabled: true (enforced_by_owner: false);
   • GitHub Actions remains enabled with the existing allowed_actions: all policy, but full-SHA pin enforcement is now enabled and read back as sha_pinning_required: true;
   • a pre-change scan found zero non-40-hex action references in current workflows.

   No environment, release, tag, deployment, attestation, or publication was created. pylon-preview and pylon-stable environment policies remain pending the final reviewed job boundaries.
4. rynfar commented on Aug 31, 2026

   

   rynfar

   on Aug 31, 2026

   Author

   More actions

   Maintainer approved the solo-maintainer environment model. Admin prerequisites are now complete:

   • pylon-preview: required reviewer rynfar, self-approval allowed, only custom deployment branch pylon;
   • pylon-stable: required reviewer rynfar, self-approval allowed, only custom deployment branch pylon.

   Both environment and branch-policy API responses were read back exactly. This is the deliberate single-maintainer exception: each deployment still requires explicit approval, but prevent_self_review cannot be enabled until a second maintainer exists. No deployment, release, tag, or attestation was created.
5. rynfar commented on Aug 31, 2026

   

   rynfar

   on Aug 31, 2026

   Author

   More actions

   Publication tag governance is now configured and read back:

   • repository ruleset 21950766, Pylon immutable publication tags;
   • active for refs/tags/pylon-build-* and refs/tags/pylon-stable-* (including sequence reservations);
   • blocks all tag updates and deletions;
   • no bypass actors; API read-back reports current_user_can_bypass: never;
   • new tag creation remains allowed so the protected publisher can atomically create the next reservation.

   I first attempted to restrict creation with GitHub Actions app 15368 as the sole bypass. GitHub rejected that configuration because its global Actions integration is not part of the repository or owner-organization ruleset source. I did not add a broad maintainer/owner bypass. This configuration instead preserves the key invariant: once any publication or sequence tag is created, neither the publisher nor a maintainer can update or delete it without an explicit governance change.

   No tag, release, deployment, or attestation was created.
6. rynfar

   added 12 commits that reference this issue on Aug 31, 2026

   fix(release): harden protected Pylon publication

   ...

   This issue will close once commit 6ca7f2b is merged into the 'pylon' branch.

   6ca7f2b

   fix(release): harden protected publication transactions

   ...

   This issue will close once commit 10cf840 is merged into the 'pylon' branch.

   10cf840

   fix(release): separate publication policy identity

   ...

   This issue will close once commit ca3dc1b is merged into the 'pylon' branch.

   ca3dc1b

   fix(release): enforce protected publication prerequisites

   ...

   This issue will close once commit fdb5940 is merged into the 'pylon' branch.

   fdb5940

   fix(release): fence consumer high-water transactions

   ...

   This issue will close once commit cebf74b is merged into the 'pylon' branch.

   cebf74b

   fix(release): close consumer journal hardening gaps

   ...

   This issue will close once commit 84a41c3 is merged into the 'pylon' branch.

   84a41c3

   fix(release): close remaining consumer journal gaps

   ...

   This issue will close once commit abe4969 is merged into the 'pylon' branch.

   abe4969

   fix(release): close final consumer journal forks

   ...

   This issue will close once commit efd17ca is merged into the 'pylon' branch.

   efd17ca

   fix(release): serialize consumer journal operations

   ...

   This issue will close once commit f857524 is merged into the 'pylon' branch.

   f857524

   fix(release): close final consumer journal races

   ...

   This issue will close once commit 8f57255 is merged into the 'pylon' branch.

   8f57255

   fix(release): require authoritative ruleset audits

   ...

   This issue will close once commit 9d2501d is merged into the 'pylon' branch.

   9d2501d

   fix(release): prove ruleset auditor App visibility

   ...

   This issue will close once commit f4d9ef0 is merged into the 'pylon' branch.

   f4d9ef0
7. rynfar

   closed this as completedin #42on Sep 1, 2026