From 41b2021d8cd90b8dc15483f63fb1979642acad3a Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Thu, 8 Oct 2026 13:36:01 +0000 Subject: [PATCH] Resolve the ReleaseKit adoption decisions --- docs/roadmap/releasekit.md | 52 ++++++++------------------------------ 1 file changed, 11 insertions(+), 41 deletions(-) diff --git a/docs/roadmap/releasekit.md b/docs/roadmap/releasekit.md index daab809..a4f34d1 100644 --- a/docs/roadmap/releasekit.md +++ b/docs/roadmap/releasekit.md @@ -1,6 +1,6 @@ # ReleaseKit Adoption Roadmap -Status: Adoption scope for review; implementation has not started. +Status: Adoption scope agreed; implementation has not started. A companion staged implementation plan will define the implementation steps. ## Purpose @@ -153,8 +153,10 @@ the upstream recovery contract. Published tags and historical notes retain their contents. CI, hosted delivery, and module availability are separate from successful source publication. -Hosted note-page delivery remains the decision described at the end of this -roadmap. +This adoption covers source publication. Hosted note-page delivery is left +for a separately selected expansion; PromptKit currently has no hosted CI, +and delivery would add workflow and credential provisioning beyond the +immediate standardization scope. ## Changes Needed From The Current Baseline @@ -187,9 +189,11 @@ workspace/local-replacement selections for the established The current blanket rejection of all replacement directives gives way to that more precise upstream check. -The recommended target also retires the mandatory credential regex, -subject to Open Decision 2. Ordinary credential-aware change review remains -part of development. No replacement scanner is required for adoption. +Retire the mandatory credential regex. Its limited formats and possible +matches against synthetic fixtures do not justify keeping a separate local +release gate. Ordinary credential-aware change review remains part of +development, including the obligation to keep actual credentials out of +source. No replacement scanner is required for adoption. ### Align Policy And Documentation @@ -232,42 +236,8 @@ Adoption is complete when the implemented release path uses ReleaseKit, the selected shared validators replace local equivalents, the retained example check is integrated, and policies and runbooks describe the actual workflow. Source-publication testing requires no provider credentials or -live inference. If hosted delivery is selected, its integration has its own -verification and delivery status. +live inference. The desired reduction is in owned machinery and routine decisions, not a fixed deletion count. The companion implementation plan will divide this migration into appropriately scoped stages. - -## Open Decisions - -### 1. Include Hosted Gitea Release Notes In This Adoption? - -**Recommendation:** Adopt source publication first and leave hosted delivery -for a separately selected expansion. This achieves the immediate -standardization and maintenance goals. PromptKit currently has no hosted CI; -introducing a runner workflow and delivery credentials adds operational -scope rather than enabling the shared validation features. - -**Alternative:** Include asynchronous page-only delivery using ReleaseKit's -maintained module-selected Woodpecker integration. This follows upstream's -broader consumer direction and improves release discoverability with little -bespoke implementation. It requires a delivery profile, CI configuration, -credentials, and documented delivery retries. The released tag selects the -tool for retries, and successful source publication still completes the -release independently of page delivery. - -### 2. Retire Or Retain The Credential-Pattern Gate? - -**Recommendation:** Retire the mandatory regex scan and retain ordinary -credential-aware change review. Its limited formats and possible matches -against synthetic fixtures do not justify preserving a separate local gate -merely because ReleaseKit has no equivalent. This simplifies publication -without changing the obligation to keep actual credentials out of source. - -**Alternative:** Retain the small existing scan as a focused additional -check if its independent automated signal is considered worth its cost and -false positives. This catches some recognizable accidentally committed -formats but leaves a local validation fragment to maintain and is not -comprehensive detection. It does not require a new upstream security -subsystem.