From 2f95753d9ccccb9b1344d45dcc77ea086665a46e Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Mon, 2 Nov 2026 03:41:01 +0000 Subject: [PATCH] Verify the audit remediation changes --- docs/cli.md | 6 +++--- docs/consumers/build.md | 4 +++- docs/internal/overview.md | 4 ++-- docs/internal/validation.md | 19 +++++++++++-------- docs/roadmap/audit/08-testing.md | 3 ++- docs/roadmap/implementation.md | 26 +++++++++++++++++++++++++- 6 files changed, 46 insertions(+), 16 deletions(-) diff --git a/docs/cli.md b/docs/cli.md index 79ac0ee..b85249c 100644 --- a/docs/cli.md +++ b/docs/cli.md @@ -209,9 +209,9 @@ first and then run `deliver --assets DIR` with the token available. The ordinary `deliver` command does not download application dependencies or change the checkout. -The command returns 0 for complete delivery, 1 for an unavailable preflight, -a known delivery failure, conflict, partial delivery, or local cleanup failure -after hosted completion, and 2 for usage, +The command returns 0 for complete delivery without a local error, 1 for an +unavailable preflight, a known delivery failure, conflict, partial delivery, or +local cleanup failure after hosted completion, and 2 for usage, profile, forge-selection, local credential-loading, or classified preflight configuration/access errors. A remote write whose outcome remains uncertain returns 3, including when cancellation prevents reconciliation. Cancellation diff --git a/docs/consumers/build.md b/docs/consumers/build.md index 3d893da..e99a69a 100644 --- a/docs/consumers/build.md +++ b/docs/consumers/build.md @@ -53,7 +53,9 @@ module. The default output directory is `/dist`; a relative `OutputDir` is resolved from the module, while an absolute path is used as supplied. Selected artifact filenames are regenerated. Other files in the output directory are left in place. A failed later build or native version check -returns the binaries already generated in `BuildResult.Artifacts`. +returns completed, hashed binaries in `BuildResult.Artifacts`. If hashing a +newly built file fails, the error identifies its path and earlier completed +artifacts remain in the result. Builds use the available compatible Go toolchain selected locally; ReleaseKit does not download a different toolchain automatically. It disables workspace diff --git a/docs/internal/overview.md b/docs/internal/overview.md index ab20713..8cf63df 100644 --- a/docs/internal/overview.md +++ b/docs/internal/overview.md @@ -94,9 +94,9 @@ not a separate release matrix: | Capability | Implementation owner | Existing evidence | | --- | --- | --- | | Runtime version lookup and injected application version | `buildinfo`, `internal/runtimeinfo`, `internal/versioncontract`, `internal/build` | `TestVersionInConsumerExecutable`, `TestVersion` | -| Candidate capture, shared validation, public diagnostics, additional checks, and rechecks | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestRunUsesOneSuiteWithSelectedRaceSetting`, `TestRunReportsRacePrerequisiteFailureWithoutFallback`, `TestRunExecutesRaceEnabledSuiteOnHost`, `TestRunCompilesTargetsAfterTestAndVetInSelectionOrder`, `TestRunAttributesTargetCompileFailureAndStops`, `TestRunCompilesSourceOnlyAndExecutablePackagesWithoutArtifacts`, `TestCandidateRequestMapsGoValidation`, `TestCandidateRequestPreservesMarkdownObjectSelection`, `TestLoadSettingsReadsGoValidation`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestCheckUsesSelectedRaceSuiteBeforeAdditionalChecks`, `TestCheckCapturesCandidateAndCallsAdditionalChecksOnce`, `TestCheckReturnsPublicValidationError`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestCheckStopsBeforeProductAndBuildCallbacksWhenMarkdownBoundaryFails`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate`, `TestPublishCommandPublishesConfiguredCandidate`, `TestCandidateCommandsPresentValidationDiagnosticsOnce`, `TestDeliverPageOnlyCreatesAndReusesRelease` | +| Candidate capture, shared validation, public diagnostics, additional checks, and rechecks | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestRunUsesOneSuiteWithGoValidationSettings`, `TestRunReportsRacePrerequisiteFailureWithoutFallback`, `TestRunExecutesRaceEnabledSuiteOnHost`, `TestRunCompilesTargetsAfterTestAndVetInSelectionOrder`, `TestRunAttributesTargetCompileFailureAndStops`, `TestRunCompilesSourceOnlyAndExecutablePackagesWithoutArtifacts`, `TestCandidateRequestMapsGoValidation`, `TestCandidateRequestPreservesMarkdownObjectSelection`, `TestLoadSettingsReadsGoValidation`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestCheckUsesSelectedRaceSuiteBeforeAdditionalChecks`, `TestCheckCapturesCandidateAndCallsAdditionalChecksOnce`, `TestCheckReturnsPublicValidationError`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestCheckStopsBeforeProductAndBuildCallbacksWhenMarkdownBoundaryFails`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate`, `TestPublishCommandPublishesConfiguredCandidate`, `TestCandidateCommandsPresentValidationDiagnosticsOnce`, `TestDeliverPageOnlyCreatesAndReusesRelease` | | Committed-file validation: formatting, workspace files, local replacements, and file size | `internal/validation`, `internal/candidate`, `releasekit.Check`, `releasekit.Publish`, CLI profile conversion | `TestCheckGoFormatUsesCapturedRegularGoBlobs`, `TestCheckWorkspaceFilesReportsCommittedBlobNames`, `TestCheckLocalReplacementsParsesCommittedModuleDeclarations`, `TestCheckLocalReplacementsFollowsCommittedModuleSymlinks`, `TestCheckFileSizeUsesStrictLimitsAndDefault`, `TestCheckFileSizeAppliesLiteralPathExclusions`, `TestCheckFileSizeUsesCommittedBlobSizes`, `TestCheckFileSizeUsesOnlyCandidateFilesIndividually` | -| Internal Markdown parsing, committed destinations, fragments, boundary observations, and public selection | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestParseMarkdownLinksAndSourceLocations`, `TestParseMarkdownDecodesEntitiesInDestinations`, `TestParseMarkdownHeadingAnchors`, `TestMarkdownCacheKeepsParsedDocumentsPerCandidatePath`, `TestCheckMarkdownLinksResolvesCommittedDestinationsAndFragments`, `TestCheckMarkdownLinksReportsMissingPathsAnchorsAndCycles`, `TestCheckMarkdownLinksUsesResolvedMarkdownIdentity`, `TestCheckMarkdownLinksReportsBoundaryAndSubmoduleObservations`, `TestCheckMarkdownLinksPreservesResolverCauseAndCancellation`, `TestCheckMarkdownLinksPreservesAnchorReadCause`, `TestRunSelectsMarkdownWithCombinedGoChecksAndReportsOutOfScopeLinks`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestValidationSpecPreservesMarkdownObjectSelection` | +| Internal Markdown parsing, committed destinations, fragments, boundary observations, and public selection | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestParseMarkdownLinksAndSourceLocations`, `TestParseMarkdownDecodesEntitiesInDestinations`, `TestParseMarkdownHeadingAnchors`, `TestMarkdownDocumentsParseIdenticalAndDistinctBlobs`, `TestCheckMarkdownLinksResolvesCommittedDestinationsAndFragments`, `TestCheckMarkdownLinksReportsMissingPathsAnchorsAndCycles`, `TestCheckMarkdownLinksUsesResolvedMarkdownIdentity`, `TestCheckMarkdownLinksReportsBoundaryAndSubmoduleObservations`, `TestCheckMarkdownLinksPreservesResolverCauseAndCancellation`, `TestCheckMarkdownLinksPreservesAnchorReadCause`, `TestRunSelectsMarkdownWithCombinedGoChecksAndReportsOutOfScopeLinks`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestValidationSpecPreservesMarkdownObjectSelection` | | Shared Go settings for validation and builds | `internal/gotool`, `internal/process`, `internal/candidate`, `internal/build` | `TestDefaultValidationDoesNotInheritGOFLAGSRunFilter`, `TestNativeAndStaticCommandsUseOwnedBaseline`, `TestPersistentSettingsPreserveCachesAndNativeCTools`, `TestOwnerReusesSettingsUntilInheritedEnvironmentChanges`, `TestOwnerRefreshesWhenPersistentSettingsChange`, `TestCheckSharesGoDiscoveryWithAfterValidateCallback`, `TestCheckBuildsAfterValidationAndKeepsOutputOutsideWorktree`, `TestRunValidatesOnlyTheSelectedModule`, `TestBuildIgnoresAmbientAndPersistentArchitectureTuning` | | Batched local Git blob reads | `internal/git`, `internal/process` | `TestBlobReaderReadsLooseAndPackedObjects`, `TestBlobReaderMissingObjectKeepsBatchSessionUsable`, `TestCandidateObjectReadsStayLocalInPartialClones` | | Piped child-process exchanges and cancellation cleanup | `internal/process` | `TestStartPipedExchangesBeforeInputEOFAndPreservesSettings`, `TestStartPipedCancellationAfterReadinessReapsChild`, `TestStartPipedPreservesNonzeroExit` | diff --git a/docs/internal/validation.md b/docs/internal/validation.md index 4e3703e..13d663b 100644 --- a/docs/internal/validation.md +++ b/docs/internal/validation.md @@ -19,11 +19,12 @@ artifact or executing a target binary. Test, vet, and package-compilation failures retain their `go-test`, `go-vet`, and `package-compile` identities, selected target where applicable, and underlying causes. Its request carries the captured repository directory and commit, output writer, -and internal settings. When selected, the Go-format check loads the candidate -tree once, reads regular Go blobs from the captured commit, and compares them -with go/format output. It uses the selected inputs, including vendor and explicit -shared files, and skips -symlink blobs, reports all unformatted paths, and stops with a contextual cause +and internal settings. The Go commands run before the committed-tree sequence, +which owns its reader's lifetime and close-error attribution. When selected, +the Go-format check loads the candidate tree once, reads regular Go blobs from +the captured commit, and compares them with go/format output. It uses the +selected inputs, including vendor and explicit shared files, skips symlink +blobs, reports all unformatted paths, and stops with a contextual cause on parse or inspection errors. It runs before product checks and build callbacks. `Request.ReadCandidateTree` lets selected file checks request candidate contents; the Go-only path does not enumerate the tree. @@ -109,9 +110,11 @@ observations remain out of scope under either setting. Observations go to the provided writer; a nil writer keeps library use quiet. Public selection is defined in the [configuration reference](../config.md) and GoDoc. -Committed-tree metadata and blob reads disable lazy fetching and Git transports -for those child commands. Missing local objects produce inspection errors; -source preparation retains its separate network-capable operations. See Git's +ReleaseKit-owned Git commands inspect original objects even when replacement +refs exist. Committed-tree metadata and blob reads also disable lazy fetching +and Git transports for those child commands. Missing local objects produce +inspection errors; source preparation retains its separate network-capable +operations. See Git's [lazy-fetch controls](https://git-scm.com/docs/git) for the command mechanism. Candidate and delivery release-note reads use the same local object boundary. diff --git a/docs/roadmap/audit/08-testing.md b/docs/roadmap/audit/08-testing.md index 6da7fa7..a184b90 100644 --- a/docs/roadmap/audit/08-testing.md +++ b/docs/roadmap/audit/08-testing.md @@ -79,7 +79,8 @@ already checks that identical content resolves relative to each source path. Consider removing the pointer-identity assertions or the cache-specific test after retaining any unique parsing checks at the behavior boundary. -[TestDeliverReadsLocalBinaryOnceForVerificationAndOnceForUpload](../../../delivery_reads_linux_test.go) +`TestDeliverReadsLocalBinaryOnceForVerificationAndOnceForUpload` in +`delivery_reads_linux_test.go` at audit baseline `3d7a691` requires exactly two filesystem opens using Linux inotify. Verification before hosted writes and correct uploaded bytes matter; the exact number of opens is an implementation choice, and a harmless extra metadata open or a different diff --git a/docs/roadmap/implementation.md b/docs/roadmap/implementation.md index 88f6914..5d2da08 100644 --- a/docs/roadmap/implementation.md +++ b/docs/roadmap/implementation.md @@ -54,7 +54,7 @@ the agent policy; an intermediate compilation dependency is recorded accurately. | 16 | A15 | Complete — the full CLI command suite passed after workflow extraction. | | 17 | Remaining A19, A20 | Complete — Git, identity, and Markdown tests passed; delivery benchmark ran for fresh uploads and matching retries. | | 18 | A11, A17: assessment only | Assessment complete; production JSON limits and exclusion indexing remain deferred. Evidence follows below. | -| 19 | Integrated verification and current documentation | Pending | +| 19 | Integrated verification and current documentation | Complete — full offline tests, race tests, API/dependency checks, formatting, and documentation link checks passed. | ## Stage 1: Correct the owned tag push @@ -622,3 +622,27 @@ Completion means the selected repairs and maintenance are implemented, their behavioral evidence passes, current contracts are documented, and the two accepted deferrals have assessment records. Intermediate stages introduce no extra compilation, review, or deployment gates. + +### Integrated verification + +Reviewed the combined A01–A20 outcomes and their cross-package interactions. +The selected repairs and maintenance are implemented; A11 JSON caps and A17 +production exclusion indexing remain deferred with the assessment evidence above. +The public facade shape and receipt schema remain unchanged. Current consumer, +CLI, integration, internal, and Go documentation reflects the selected +contracts and the source audit reports remain available. + +On Linux/amd64 with Go 1.26.8, the following root commands passed with +`GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off` and a temporary build +cache. The test commands used `/var/tmp` for fixtures because the restricted +environment's `/tmp/.git` marker interfered with standalone Git discovery: + +- `go test ./...` +- `go test -race ./...` +- `go run ./internal/apicheck` + +All tracked Go files passed `gofmt` inspection. Local links and Markdown +fragments across 50 documentation files resolved; the policy's literal +`COMMIT_URL` template placeholder was intentionally excluded. Markdown and +combined changes passed `git diff --check`, and the internal guide's referenced +tests were checked against current test declarations.