[altmn]

{
  "schema_version": 1,
  "pr": 3,
  "head": "3818765b348b7ddce258e78b6f847b96b23bcb17",
  "base": "master",
  "gate": {
    "tests": {
      "pass": 52,
      "fail": 0,
      "skip": 0
    },
    "pregate_repository": {
      "pass": 3,
      "fail": 0,
      "skip": 0
    }
  },
  "session_kind": "interactive",
  "pregate": "warn @d674b1fdb630 (5 checks, current for 3818765b348b)",
  "issues": {
    "fixes": [],
    "refs": [],
    "flakes": []
  }
}

Summary

Routine GitHub Action updates now wait seven days. The release guide requires reviewed-commit CodeQL analyses and alert disposition, preparation of all draft release assets, and verification of the immutable release and downloaded ZIP.

Live repository settings enable CodeQL default setup for Python and Actions with the extended suite, Dependabot alerts/security fixes, immutable releases, and an active no-bypass v* tag update/deletion ruleset. Existing master protections and read-only, SHA-pinned Actions permissions are preserved. Fork PRs require an analysis path before adding a required CodeQL merge rule.

The new .gstack/pregate.json maps these documentation/configuration files to existing repository tests so the ship preflight can execute them. No test exemptions, warning downgrades, product instruction changes, version bump, or release publication are included.

Test Coverage

CONFIGURATION / DOCUMENTATION              VERIFICATION
Dependabot: seven-day routine cooldown --> GitHub config review
Release guide: draft, assets, verify ----> Maintainer release checks
Pregate: select repository tests --------> 3 tests passed
Application code paths added: 0

No new application code paths to audit. Tests: 3 -> 3 (+0 new). Local documentation checks do not enforce GitHub security settings; remote settings and release operations require separate verification.

Coverage percentage is not applicable. Test value: 0 tests written, 0 rejected, 0 extended, 0 weak paths. Tests ran: unit suite count unavailable in the evidence parser; the unittest log reports 52 tests passed. Pregate selected 3 repository tests, all passed.

Pre-Landing Review

Parent checklist and native adversarial review completed with no issues, on the same final source tree.

Gate edits: none detected (0 listed, 0 read; patterns: RH-1,RH-3,RH-4,RH-12,RH-13,RH-14,RH-15,RH-16; unlisted idioms: none). Four paths were unmatched by the mechanical gate inventory and reviewed manually, including the new lane mapping.

Outside review: Claude Code unavailable because authentication failed; this is missing optional coverage, not a passing review.

Exploratory QA

Four smoke checks passed: repository documentation/fixture invariants; active refs/tags/v* update/deletion rules with no bypass actors; CodeQL Python/Actions extended weekly setup; immutable releases enabled. Evidence checkpoints are retained locally. The GitHub checks inspect configuration; they do not reproduce rejected tag mutations or publish a release.

Design Review

No frontend files changed; design review skipped.

Eval Results

No prompt-related files changed; evals skipped.

Greptile Review

PR inline comments, issue comments, and reviews fetched successfully; no Greptile comments.

Scope Drift

Scope Check: CLEAN. Security documentation/configuration and the required existing-test mapping only.

Plan Completion

Plan completion audit: not run (no plan is bound to this branch and no docs/designs/ file matches). Fix: add "Plan: " to the PR body, or run /autoplan.

Acceptance edits: baseline unavailable (no bound plan).

Verification Results

Four smoke checks PASS; no plan-specific obligations. Package validation, build, and diff checks pass. No plugin installation, directory publication, tag, release, or merge is performed by this PR.

Documentation

Status: current — reviewed documentation matches this PR's repository and release changes; no corrections applied.

Audited scope: two commits changing Dependabot configuration and release guidance, plus the staged pregate configuration. Product behavior and package contents are unchanged.

Documentation health:

• README.md — Current (build, installation, support, and linked guides remain accurate for this change).
• AGENTS.md — Current (branch, package, and verification instructions remain applicable).
• CONTRIBUTING.md — Current (standard-library tests and protected-branch workflow remain applicable).
• SECURITY.md — Current (private reporting and repository-code scope remain consistent).
• docs/architecture.md — Current (skills-only runtime and six-file package boundaries remain unchanged).
• docs/chatgpt-submission.md — Current for this PR's scope (existing readiness-count debt noted below).
• docs/open-source-readiness.md — Current (cooldown, CodeQL, tag protections, and immutable releases are described).
• docs/releasing.md — Current (reviewed commit, draft assets, immutable publication, and verification procedure are consistent).
• tests/README.md — Current (package tests and model/host acceptance remain distinct).

Coverage: Dependabot policy has reference and explanation coverage; CodeQL and immutable-release safeguards have reference, how-to, and explanation coverage. Existing build/install tutorials remain applicable.

Documentation debt:

• Optional contributor reference/how-to for .gstack/pregate.json is not yet documented in CONTRIBUTING.md; the standard unittest/build workflow remains documented.
• The unchanged submission-readiness snapshot uses older test and skill-character counts; refresh those when updating that handoff snapshot.

Discoverability: all nine audited docs are reachable from README.md or AGENTS.md. Diagram drift: none; no affected architecture diagrams were found.

Test plan

• python3 -m unittest discover -s tests -p 'test_*.py' -v: 52 passed.
• python3 scripts/release.py validate: six runtime files validated.
• python3 scripts/release.py build: allowlisted ZIP and local staging built and verified.
• git diff --check: passed.
• Ship preflight with the proposed new policy: selected repository tests passed; new .gstack/ directory warning reviewed as intentional. No test-lane exemptions.

Generated with Codex.