diff --git a/README.md b/README.md index 9c938b6..e3c008c 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,8 @@ For the high-level relationship between `flow`, `bootstrap`, `.github`, individu - [`scripts/flow/inspect_repo_flow.py`](scripts/flow/inspect_repo_flow.py) - read-only-by-default inspector for repo flow metadata; see the [operator guide](docs/flow-inspector.md). - [`docs/autonomous-flow-platform.md`](docs/autonomous-flow-platform.md) - design rationale and rollout plan. - [`docs/omt-global-operating-map.md`](docs/omt-global-operating-map.md) - org-level ownership map. +- [`docs/policy-index.md`](docs/policy-index.md) - current policy authority, release, and implementation evidence. +- [`docs/public-repository-standard-gap-analysis.md`](docs/public-repository-standard-gap-analysis.md) - historical discovery record and links to remaining migration work. ## Controller Loop @@ -81,7 +83,9 @@ paths. Review the proposed writes in the default report before following the ## Release Standard -This repository uses release maturity level `simple`. Level 1 `simple` keeps immutable exact SemVer tags such as `v1.2.3`, then automatically advances the floating compatibility tags `v1.2` and `v1` to the same commit. Level 2 `governed` adds preflight, full validation, explicit publish approval, postpublish verification, and release evidence. +The current immutable policy release is [`v1.0.1`](https://github.com/OMT-Global/flow/releases/tag/v1.0.1). Production consumers must pin an exact SemVer release or immutable commit SHA; `main` and floating compatibility aliases are discovery aids only and are never valid production policy references. + +This repository uses release maturity level `simple`. Level 1 `simple` publishes immutable exact SemVer tags such as `v1.2.3` and may advance floating discovery aliases such as `v1.2` and `v1`. Level 2 `governed` adds preflight, full validation, explicit publish approval, postpublish verification, and release evidence. Cut patch releases from `release/X.Y` branches when you maintain an older minor line. Cut new minor and major releases from `main`. diff --git a/docs/decisions/ADR-0001-public-repository-standard-v1.md b/docs/decisions/ADR-0001-public-repository-standard-v1.md index bd7a7c1..a904bbc 100644 --- a/docs/decisions/ADR-0001-public-repository-standard-v1.md +++ b/docs/decisions/ADR-0001-public-repository-standard-v1.md @@ -1,7 +1,8 @@ # ADR-0001: Make Flow the authority for Public Repository Standard v1 -- Status: Proposed +- Status: Accepted - Date: 2026-07-11 +- Accepted: 2026-07-15 - Decision owners: Flow maintainers - Material notification: [Flow issue #8](https://github.com/OMT-Global/flow/issues/8) and the discovery pull request @@ -64,6 +65,18 @@ Rejected because `project.bootstrap.yaml` must remain the sole editable reposito Implementation is tracked by [#8](https://github.com/OMT-Global/flow/issues/8), [#9](https://github.com/OMT-Global/flow/issues/9), [#10](https://github.com/OMT-Global/flow/issues/10), [#11](https://github.com/OMT-Global/flow/issues/11), [#12](https://github.com/OMT-Global/flow/issues/12), and [#13](https://github.com/OMT-Global/flow/issues/13). +## Implementation evidence + +The decision is implemented and released: + +- [PR #15](https://github.com/OMT-Global/flow/pull/15) established the publisher-neutral policy bundle and schema. +- [PR #16](https://github.com/OMT-Global/flow/pull/16) made work and release transitions executable. +- [PR #17](https://github.com/OMT-Global/flow/pull/17) added contribution-lifecycle, review, and immutable-release contracts. +- [PR #18](https://github.com/OMT-Global/flow/pull/18) defined security response and provenance semantics. +- The immutable [v1.0.1 policy release](https://github.com/OMT-Global/flow/releases/tag/v1.0.1) was published and independently verified under [issue #23](https://github.com/OMT-Global/flow/issues/23). + +Acceptance records the policy decision; it does not claim that every consumer has migrated. Flow's plan-first Bootstrap dogfood remains tracked by [issue #13](https://github.com/OMT-Global/flow/issues/13), and generated governance reconciliation remains tracked by [issue #25](https://github.com/OMT-Global/flow/issues/25). + ## Security and privacy The public policy bundle contains no secrets or private provenance. It defines redaction, hard-stop, and provenance-failure behavior. Physical private-sink details and credentials remain outside repository configuration. diff --git a/docs/policy-index.md b/docs/policy-index.md index 44fa538..58974d3 100644 --- a/docs/policy-index.md +++ b/docs/policy-index.md @@ -2,6 +2,14 @@ Flow publishes the authoritative repository policy vocabulary and work-state semantics. Bootstrap consumes released policy and projects it into managed repositories. +## Current authority + +- Current immutable release: [`v1.0.1`](https://github.com/OMT-Global/flow/releases/tag/v1.0.1) +- Accepted decision: [`ADR-0001`](decisions/ADR-0001-public-repository-standard-v1.md) +- Historical discovery record: [`Public Repository Standard v1 gap analysis`](public-repository-standard-gap-analysis.md) + +The files below are the canonical source for policy semantics on the repository's development branch. Production consumers must resolve the immutable release rather than this branch. + ## Public Repository Standard v1 - Canonical bundle: [`policies/public-repository-standard-v1.json`](../policies/public-repository-standard-v1.json) diff --git a/docs/public-repository-standard-gap-analysis.md b/docs/public-repository-standard-gap-analysis.md index 5c092a5..af2dad3 100644 --- a/docs/public-repository-standard-gap-analysis.md +++ b/docs/public-repository-standard-gap-analysis.md @@ -1,5 +1,21 @@ # Public Repository Standard v1 gap analysis: Flow +> **Historical analysis — superseded for current status.** This document records the repository state reviewed on 2026-07-11. The implemented policy bundle, its immutable release, and the linked follow-up issues are the current evidence; the original findings below are preserved rather than rewritten. + +## Implementation outcome + +As of 2026-07-15, the policy-definition lanes identified here have landed: + +| Lane | Current evidence | +|---|---| +| Vocabulary and policy bundle | [Issue #8](https://github.com/OMT-Global/flow/issues/8), merged by [PR #15](https://github.com/OMT-Global/flow/pull/15) | +| Executable transitions | [Issue #9](https://github.com/OMT-Global/flow/issues/9), merged by [PR #16](https://github.com/OMT-Global/flow/pull/16) | +| Contribution lifecycle and release contract | [Issues #10](https://github.com/OMT-Global/flow/issues/10) and [#12](https://github.com/OMT-Global/flow/issues/12), merged by [PR #17](https://github.com/OMT-Global/flow/pull/17) | +| Security and provenance | [Issue #11](https://github.com/OMT-Global/flow/issues/11), merged by [PR #18](https://github.com/OMT-Global/flow/pull/18) | +| Immutable policy publication | [v1.0.1](https://github.com/OMT-Global/flow/releases/tag/v1.0.1), verified under [issue #23](https://github.com/OMT-Global/flow/issues/23) | + +The current source of truth is the [policy index](policy-index.md), which points to the canonical policy data, schemas, compatibility guidance, and accepted architecture decision. Remaining migration work is intentionally tracked outside this historical snapshot: [#13](https://github.com/OMT-Global/flow/issues/13) for Flow dogfooding, [#25](https://github.com/OMT-Global/flow/issues/25) for generated governance and operator guidance, and [#26](https://github.com/OMT-Global/flow/issues/26) for human-approved stewardship surfaces. This document's retirement is tracked by [#27](https://github.com/OMT-Global/flow/issues/27). + ## Outcome Flow has solid fragments for agent roles, autonomy, issue/PR work states, merge gates, and a governed release train. It does not yet provide the single versioned, publisher-neutral, machine-readable policy model required by Public Repository Standard v1. The safe migration is additive: establish vocabulary and schemas first, test them, publish an immutable policy release, then let Bootstrap consume it.