Release v5.0.0 vor-tag: version_pin re-baseline + docs - #154
Merged
Conversation
added 2 commits
August 27, 2026 14:08
…ATIBILITY + record Owner release prompt Phase A.2 (2026-08-27), at the merged main head. No src touched; the security ceremony (scripts/pre_tag_*.py) stays byte-identical to the 2b8a16e WITHSTANDS. P3-3 — audit_candidate_matrix version_pin 3.6.0 -> 5.0.0, matrix freshly measured: - VERSION_UNDER_TEST -> "5.0.0" (+ the C10.2 message/title now read VERSION_UNDER_TEST, not a literal). The L6-01 BINDING (version_pin_binding, unchanged) is in place, so pulling the literal to the shipping version is the correct release step, not the recreated defect (the warning was against bumping WITHOUT the binding). Matrix now BOUND; the drift the binding catches is exercised synthetically (test_drift_withholds_readiness / test_the_human_output_leads_with_the_drift monkeypatch an older pin), the anti-parity half unchanged. - docs/readiness_pack/index.json: a 5.0.0 release_evidence_slot (grounded in docs/release_scope/5.0.0.md); MANIFEST.sha256 + advisory self-receipt regenerated to match. - C12.1 (the signed pre-tag receipt) stays FAIL until the Mac key-custody handshake at tag time — expected, reported, not a defect (audit_candidate_ready is honestly withheld on it, never false-green). Docs to 5.0.0: COMPATIBILITY worked-example (exit 2->1; PROOFBUNDLE_THRESHOLD now required — the two MAJOR triggers); release_scope version_pin paragraph corrected; DEEP_RUN_RECORD refreshed to match HEAD (the reverted version_pin bump + the evalclaim assert + the OTS guards; the ac1d005 adversarial re-gate). CHANGELOG already carries [5.0.0]; README is version-agnostic. Inspect-Nachtrag I1-I3 (20260826T213824Z) VERIFIED CLOSED (makellose-500): fresh-env inspect eval against inspect_ai 0.3.260 — entry-point discovery + on_task_end receipt + verify_bundle/decode_eval_claim + no-EMIT-no-receipt all pass; I2 PROOFBUNDLE_RELEASE_LANE makes the skip a failure; I3 fixture provenance records inspect_ai 0.3.217. Battery at the merged head: harness 32/32; full suite green; ruff/mypy/claims-hygiene/doc-links clean; type-confusion 57/57. Not the tag. Owner-GO Phase A.2 (QITEM-RELEASE-V5-ABSCHLUSS-01).
…pre-tag receipt Pins the ed25519 PUBLIC half of the v5.0.0 release signing key (base64, raw 32-byte) in audit_artifacts/pre_tag_trusted_pubkeys.txt. The PRIVATE half stays on the Mac under Cowork key custody (release_ed25519_public.pem, generated 2026-08-27) and never reaches the build host / runner; the runner VERIFIES the pre-tag receipt signature against this pinned key, it does not sign — the F6 key-custody separation the release gate requires. The gate reads the COMMITTED file (git show HEAD:audit_artifacts/pre_tag_trusted_pubkeys.txt), so an uncommitted working-tree pubkey grants no trust; this owner-approved commit is the trust anchor. Was empty (fail-closed); now one key. Owner-GO Phase A.4 (QITEM-RELEASE-V5-ABSCHLUSS-01).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase A.2 vor-tag at the merged head. version_pin 3.6.0→5.0.0 (matrix + 5.0.0 readiness slot + regenerated manifest + synthetic-drift tests), COMPATIBILITY 5.0.0 note, DEEP_RUN_RECORD refresh, scope-doc paragraph. No src touched; ceremony byte-identical to 2b8a16e. Battery green (2557 passed/0 failed). Owner-GO. Not the tag.