[Supply Chain] Establish CI, review, and software-supply-chain gates #15

Activity

1. gnanirahulnutakki

   added this to the M0 — Foundation milestone on Sep 1, 2026
2. gnanirahulnutakki

   added

   priority:p0Critical prerequisite or correctness boundaryCritical prerequisite or correctness boundary

   area:supply-chainBuild security, dependencies, artifacts, and provenanceBuild security, dependencies, artifacts, and provenance

   on Sep 1, 2026
3. gnanirahulnutakki

   marked this as blocked on Sep 1, 2026

   • [Security] Publish the formal threat model and data classification #14
4. gnanirahulnutakki

   added a parent issue on Sep 1, 2026

   • [Epic] Establish the engineering and governance foundation #2
5. gnanirahulnutakki

   marked this as blocked by 2 issues on Sep 1, 2026

   • [Foundation] Select the open-source license and contribution model #10
   • [Developer Experience] Create reproducible bootstrap and local quality commands #13
6. gnanirahulnutakki

   added the

   Task

   issue type on Sep 1, 2026
7. gnanirahulnutakki

   marked this as blocking 7 issues on Sep 1, 2026

   • [API] Build the in-memory reference server and contract harness #21
   • [Security Testing] Build the security-invariant and untrusted-input regression suite #28
   • [Recovery] Prove reconciliation recovery objectives through failure injection #37
   • [Kubernetes] Qualify the full lifecycle in an ephemeral cluster #50
   • [AWS] Qualify rate limits, quotas, cost, drift, recovery, and full sandbox teardown #57
   • [Deployment] Publish hardened packaging, capacity controls, and upgrade-safe defaults #65
   • [Release] Implement versioning, migrations, upgrades, rollback, signed artifacts, SBOMs, and provenance #66
8. gnanirahulnutakki

   marked this as blocked by 4 issues on Sep 6, 2026

   • [Corrective] Make alpha network, probe, and recovery budgets enforceable #83
   • [Corrective] Bound versioned evidence and archive lifecycle accounting #84
   • [Corrective] Isolate reproducible bootstrap and source discovery #85
   • [Corrective] Bound archive metadata processing during bootstrap #86
9. gnanirahulnutakki commented on Sep 6, 2026

   

   gnanirahulnutakki

   on Sep 6, 2026

   MemberAuthor

   More actions

   Dependency graph reconciled on behalf of @ArdurAI after PR #82 merged. Four still-applicable review-debt lanes now block closure: #83 operational budgets, #84 versioned archive accounting, #85 bootstrap/source isolation, and #86 bounded tar metadata. Their bodies link every originating unresolved discussion from PRs #68 and #70. Issue #15 must not close until those corrective issues merge and their source discussions are resolved.
10. gnanirahulnutakki

    marked this as blocked on Sep 8, 2026

    • [Corrective] Bound required rejection-audit capacity independently of generator mix #94
11. gnanirahulnutakki

    closed this as completedin #97on Sep 9, 2026
12. gnanirahulnutakki

    reopened this on Sep 9, 2026
13. gnanirahulnutakki commented on Sep 9, 2026

    

    gnanirahulnutakki

    on Sep 9, 2026

    MemberAuthor

    More actions

    Reopened after post-merge live validation found an acceptance blocker: GitHub rejected the merged branch-protection payload with HTTP 422 because required_status_checks.contexts and required_status_checks.checks cannot be supplied together. No protection rule was applied. A focused corrective issue and PR will omit the legacy field, preserve the ten app-bound checks, verify the live PUT/readback, and only then close #15.

    Submitted on behalf of @ArdurAI. Contact: info@ardur.ai.
14. gnanirahulnutakki

    marked this as blocked by 3 issues on Sep 12, 2026

    • [Corrective] Make app-bound branch protection API-valid #115
    • [Corrective] Model unlocked-branch fork syncing as API-effective false #117
    • [Corrective] Remove mandatory second-person merge approval #119
15. gnanirahulnutakki commented on Sep 12, 2026

    

    gnanirahulnutakki

    on Sep 12, 2026

    MemberAuthor

    More actions

    Owner policy update on 2026-09-12: mandatory second-person pull-request approval has been explicitly removed. The live main rule already reads back with required_pull_request_reviews: null; all ten app-bound checks, strict mode, administrator enforcement, conversation resolution, and force-push/deletion bans remain.

    Issue #119 and PR #120 reconcile the canonical policy, verifier, tests, and documentation with that decision. Issue #15 remains open until the exact PR head is merged, exact-main CI succeeds, and live protection is reapplied from merged main and read back without a required-review object.

    Submitted on behalf of @ArdurAI. Contact: info@ardur.ai.
16. gnanirahulnutakki commented on Sep 12, 2026

    

    gnanirahulnutakki

    on Sep 12, 2026

    MemberAuthor

    More actions

    Acceptance evidence is complete on immutable main commit 1bfc42eed0706c1af38ff3bea6da988fde75d7fd.

    • PR fix: remove mandatory second-person approval #120 merged exact validated head ee5a74d737f2e75ba5375cb970ddecffa6abacbf; merge parents and tree were verified, and corrective issue [Corrective] Remove mandatory second-person merge approval #119 closed.
    • Exact-main Foundation bootstrap run 34683748509 and Supply-chain security run 34683748505 completed successfully. The PR head also passed all ten required app-bound checks, fresh Codex review found no major issues, and all review threads are resolved.
    • ./hack/dev check, ./hack/dev race, and ./hack/dev coverage passed locally; coverage is 81.4% against the 80.0% floor, with 69 supply-chain and 139 threat-model negative fixtures.
    • Live branch protection was reapplied from merged main and canonically matches the repository file: the pull-request gate remains present, approving-review count is 0, last-push approval is false, strict mode and ten checks are app-bound to 15368, admins and conversation resolution are enforced, and force pushes/deletions remain disabled.
    • The earlier comment describing required_pull_request_reviews: null is superseded: null was rejected because it removes the PR gate. The merged and live policy requires zero approvals while preserving pull requests.
    • Actions are limited to selected SHA-pinned actions; default token permission is read and workflows cannot approve reviews. Secret scanning, push protection, non-provider patterns, validity checks, Dependabot security updates, and automated security fixes are enabled; open secret and Dependabot alerts are zero.
    • Active gosec suppressions have explicit IDs, owners, expiries, and reasons. Exact-main SBOM artifact veer-source-sbom-1bfc42eed0706c1af38ff3bea6da988fde75d7fd exists and expires after 30 days; exact-source provenance succeeded.
    • All eleven recorded blockers are closed.

    The owner-selected zero-approval policy intentionally accepts the documented TM-016 single-maintainer compromise/error residual risk; automated checks are compensating controls, not an independent-person substitute.

    Submitted on behalf of @ArdurAI. Contact: info@ardur.ai.
17. gnanirahulnutakki

    closed this as completedon Sep 12, 2026