TAB-29: prepare Tabellio v0.7.0 release candidate - #56
hudsonaikins wants to merge 19 commits into
Conversation
Entire-Checkpoint: 29c1c7c761ec
Entire-Checkpoint: 29c1c7c761ec
Entire-Checkpoint: 1a7858ccb0d6 Entire-Checkpoint: 29c1c7c761ec
Entire-Checkpoint: d123a88b9899 Entire-Checkpoint: 29c1c7c761ec
Entire-Checkpoint: 80c483965edd Entire-Checkpoint: 29c1c7c761ec
Entire-Checkpoint: 8648bed8c3f0 Entire-Checkpoint: 29c1c7c761ec
Entire-Checkpoint: 5f2b26ae1e15
Entire-Checkpoint: 79aed0fa931c
Entire-Checkpoint: a91d97f163c9
Entire-Checkpoint: 4370fb5a4f45
Entire-Checkpoint: d43fbf86bed8
Entire-Checkpoint: 7044872f4085
Entire-Checkpoint: 0c3674f381c8
Entire-Checkpoint: 00cd873c5d9a
Entire-Checkpoint: 0bdb97273214
ci: run Tabellio gates on macOS M4
Merge the published v0.6.0 runner identity contract with the TAB-18 through TAB-29 provenance rebuild, then add aligned release, install, validation, and GTM launch contracts. Plane-Work-Item: TAB-29 Entire-Checkpoint: e9c20a23247c
|
Linked to Plane Work Item(s) References This comment was auto-generated by Plane |
Write generated analytics evidence and symlink fixtures only in temporary directories so concurrent tests cannot change the runner fingerprint. Plane-Work-Item: TAB-29 Entire-Checkpoint: 1d61908f1ad0
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 34f6bff8ad
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| const status = await readGit(path, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]); | ||
| const fingerprint = revision === null | ||
| ? await fingerprintPaths(path, "unborn", status.stdout, "") | ||
| : await worktreeFingerprint(path, revision.stdout.trim(), status.stdout); |
There was a problem hiding this comment.
When an untracked nested Git repository uses assume-unchanged or skip-worktree, this path fingerprints only its HEAD, status, and diff. Those flags suppress modified tracked files from both status and diff, while the outer repository continues to report the same ?? nested/ entry; consequently, changing such a file produces an identical fingerprint and the ValidationRunner before/after check can publish evidence even though nested runner source changed. Read and pass the nested repository's unsafe index paths here, as is done for the top-level repository.
Useful? React with 👍 / 👎.
| ```bash | ||
| npm install --save-dev @intelip/tabellio@0.7.0 | ||
| npx tabellio-version --expect-version 0.7.0 | ||
| npm run tabellio:provenance:demo |
There was a problem hiding this comment.
After following the install step in a clean consumer project, this command exits with Missing script: "tabellio:provenance:demo" because npm run resolves scripts from the consumer's package.json, not from dependencies. This matches npm run --help (“Run arbitrary package scripts”): the demo entry exists only in Tabellio's own scripts map, and package.json exports no demo binary. As a result, the release's advertised “First useful workflow” cannot be completed after installation; expose the demo as a bin or document a directly runnable packaged command.
Useful? React with 👍 / 👎.
| "tabellio.platform.json", | ||
| "tabellio.validation.json", | ||
| "tabellio.*.validation.json", | ||
| ".tabellio", |
There was a problem hiding this comment.
When a release is packed from a checkout containing ignored local .tabellio state, this directory-wide files entry includes that state despite .gitignore. I verified this with npm pack --dry-run --json: an ignored .tabellio/review-temp-secret-do-not-keep.json appeared in the tarball alongside the two validators. Since docs/agent-run-lifecycle.md defines .tabellio/runs and .tabellio/artifacts as mutable local control and evidence state, publishing from a repository that has run Tabellio can leak those files to npm; list the two committed validator JSON paths explicitly or add an npm-specific exclusion.
Useful? React with 👍 / 👎.
1 participant
Summary
Customer outcome
GitHub-centered teams can install one package, identify the exact Tabellio runner, produce candidate-bound provenance evidence, and see missing, stale, conflicting, or moved-candidate evidence block instead of becoming a pass.
Validation
npm test— 438 tests, 430 passed, 8 skipped, 0 failed.34f6bff8ad404f8fe71ee0f8d2f781e5f5273b6c.@intelip/tabellio@0.7.0, 265 files; clean external install and packagedtabellio-version --expect-version 0.7.0passed.tabellio-pr-evidence-34f6bff.json.refs/tabellio/validations:commits/34f6bff8ad404f8fe71ee0f8d2f781e5f5273b6c/validation-0f4fe38e-5f7f-44c3-a0dc-ab0f51581de4.json.refs/tabellio/validations:commits/34f6bff8ad404f8fe71ee0f8d2f781e5f5273b6c/validation-2454bd1b-c695-4841-af06-740b29852ce5.json.External-action boundary
No merge, deployment, database or infrastructure mutation, GitHub release, npm publication, paid action, credentialed provider read, or customer contact was performed.
Deferred checks
Review note
This branch includes and supersedes the v0.6.0 code carried by open PR #44. Reconcile #44 rather than merging both independently.
Plane-Work-Item: TAB-29