From 2b87e00e9c33e50f2e5763c8d3b6cee928dc3b08 Mon Sep 17 00:00:00 2001 From: Lan_zhijiang Date: Sun, 6 Sep 2026 23:01:04 +0800 Subject: [PATCH 1/2] =?UTF-8?q?docs(governance):=20=E5=AF=B9=E9=BD=90=20Re?= =?UTF-8?q?gistry=20Worker=20=E9=A2=84=E8=A7=88=E4=BA=A4=E4=BB=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- GOVERNANCE.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 4ff8d4c..1c2ed82 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -75,7 +75,7 @@ of the tool or merge method. ### Pull-request validation A pull-request validation workflow proves a candidate change but does not -produce a Pages preview delivery input. A Pages preview workflow may run after +produce a preview delivery input. A preview workflow may run after successful validation, but it must check out the exact pull-request head and own its preview build and upload. Preview delivery requires all of these controls: @@ -161,7 +161,12 @@ required context. | `client-web` | `Workspace contract`, `Dependency review`, `client-web E2E`, and `client-webext E2E`; isolated Pages preview | Focused web release build and same-run production Pages delivery | | `ui` | `ui-web checks`; isolated runner-pushed Histoire preview | Changesets package publication and runner-pushed Histoire deployment | | `docs` | Website contract | Website release build and production Pages delivery | -| `ext-reg` | `ext-reg checks`; CI-orchestrated trusted-controller static Pages preview built from the exact head for same-repository PRs | Exact-current-main native Registry verification and deployment through the protected production environment | +| `ext-reg` | `ext-reg checks`; CI-orchestrated trusted-controller Python Worker preview built from the exact head, with per-PR D1/R2 for same-repository PRs | Exact-current-main native Registry verification and deployment through the protected production environment | + +For `ext-reg`, the preview workflow owns its build and transfers only built +Python modules and SQL to a separate trusted delivery runner. The controller +owns resource bindings and credentials; the candidate Worker receives only its +own D1/R2. Closing the PR retires the Worker and deletes those resources. Check names and commands remain repository-local implementation truth. The profiles standardize authority and evidence semantics, not identical jobs. From dafd33c2016e986ace56f7ad07026ef6fa3ab10a Mon Sep 17 00:00:00 2001 From: Lan_zhijiang Date: Sun, 13 Sep 2026 11:29:51 +0800 Subject: [PATCH 2/2] =?UTF-8?q?docs(governance):=20=E5=AF=B9=E9=BD=90=20Re?= =?UTF-8?q?gistry=20=E5=AE=B9=E5=99=A8=E4=B8=8E=20Neon=20=E9=A2=84?= =?UTF-8?q?=E8=A7=88=E4=BA=A4=E4=BB=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- GOVERNANCE.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 1c2ed82..5cb4498 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -161,12 +161,12 @@ required context. | `client-web` | `Workspace contract`, `Dependency review`, `client-web E2E`, and `client-webext E2E`; isolated Pages preview | Focused web release build and same-run production Pages delivery | | `ui` | `ui-web checks`; isolated runner-pushed Histoire preview | Changesets package publication and runner-pushed Histoire deployment | | `docs` | Website contract | Website release build and production Pages delivery | -| `ext-reg` | `ext-reg checks`; CI-orchestrated trusted-controller Python Worker preview built from the exact head, with per-PR D1/R2 for same-repository PRs | Exact-current-main native Registry verification and deployment through the protected production environment | +| `ext-reg` | `ext-reg checks`; CI-orchestrated trusted-controller CPython image preview built from the exact head, with per-PR Neon branches and R2 buckets for same-repository PRs | Exact-current-main native Registry verification and deployment through the protected production environment | For `ext-reg`, the preview workflow owns its build and transfers only built -Python modules and SQL to a separate trusted delivery runner. The controller -owns resource bindings and credentials; the candidate Worker receives only its -own D1/R2. Closing the PR retires the Worker and deletes those resources. +OCI images to a separate trusted delivery runner. The controller owns provider +credentials; the candidate service receives only its own PostgreSQL branch and +R2 bucket credentials. Closing the PR retires its app and deletes those resources. Check names and commands remain repository-local implementation truth. The profiles standardize authority and evidence semantics, not identical jobs.