Repository navigation
fix: drain managed-policy fixture input and correct contributor guidance - #12
EraPartner wants to merge 1 commit into
Conversation
|
Final publication verification for signed head 3ff01e0: CI Complete and every CI job passed, including both-image builds and booted functional egress smoke tests, fixture regressions, integrity/parity, index secret audits, and linters (run 37113938712). Explicit staged-content audit and whitespace checks passed before signing. Exact published source SHA-256 values matching the preserved prepared files:
The CodeQL workflow path filter also omits this fixture/documentation PR, while main requires CodeQL code-scanning results. No CodeQL analysis ran on this PR. That workflow/protection mismatch needs a reviewed repair in an editing environment. The changelog records dependency work reviewed separately in #9 and #11. Main is governed by active ruleset Protect main (18505263), including Restrict updates with an administrator bypass actor. The user explicitly prohibited protection bypass, so no administrator merge or ruleset relaxation was attempted. Required approvals are currently zero and there is no blocking review. All three live PRs remain BLOCKED even after their checks completed. Host image doctor/native Apple Container launcher results were requested but have not been supplied; this publication container has no runtime. The working tree remains unchanged and hooks remain disabled. |
|
Closed at the user’s explicit request to keep only main and no open PRs. All changed blobs from verified PR head 3ff01e0 are preserved exactly in focused signed local-main commits 5cb4cfe and 9c1d4d4. Local main is 9c1d4d4; the user will push it separately. This is a closure, not a merge, and remote main has not been updated. Repository protections remain unchanged. |
The managed-policy launcher test fixture exited without reading the JSON that the real validator consumes, allowing its producer to race the closed pipe and intermittently fail. Drain piped input in the fixture. Correct README guidance for the zero-day cooldown default, editing/publication boundary, index-only audit, runtime smoke coverage, and branch cleanup, and record the prepared maintenance work in the changelog.
Validation supplied by the editing session: full make check passed (123 Python regressions, integrity/parity checks, nine managed copies and Dockerfile pins); actionlint, Bash syntax, CI-warning-level ShellCheck, and git diff --check passed. The three explicitly staged publication paths passed a fresh full-index secret audit and staged whitespace checks. The source worktree and local main were preserved. No release or tool-version bump.
Dependency updates are reviewed separately in #9 and #11. Host rebuild/doctor/native launcher results have not been supplied; this publication environment has no container runtime. Required CI must build/boot both images before merging. Repository hooks remain disabled.