Skip to content

chore(main): release 0.3.7 - #760

Merged
jason931225 merged 1 commit into
mainfrom
release-please--branches--main--components--console
Aug 16, 2026
Merged

chore(main): release 0.3.7#760
jason931225 merged 1 commit into
mainfrom
release-please--branches--main--components--console

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 I have created a release beep boop

0.3.7 (2026-08-16)

Features

  • console: tracked lane-receipt validator wired into CI preflight (W1.0 pilot) (#770) (d29be0d)
  • db: 0218 employee_leave_balances schema (hee2 PR-1) (#783) (97a45cf)
  • hr: L5-HR UUID attributes + ReassignOrgUnit→hr.transfer (console-y0n) (#761) (681540d)
  • identity: role-set compare, no-op replay conflict, deactivated-region 409 (#776) (de8fc64)
  • p4: retarget Employment owner to the canonical adapter (#775) (86c35b1)
  • peas: employment port routing (#781) (fb9ae31)
  • wave-3 admit — 7sx L5-ORG + xxp L5-JOB (#756) (9e29b62)
  • wave4: ADR-0030 §7 backend — aggregate path + OpenAPI generator (#755) (84655ce)

Bug Fixes

  • bound release proof head polling (#787) (0e7cfc0)
  • cursor: ban cross-agent git process/lock races (#757) (111e65a)
  • employment: freeze gate + append-only backdating on the port (rte/r25) (#780) (6a7b27b)
  • gates: decouple G004 policy contract prose (#771) (dea1f91)
  • gates: prototype-chain lookup census (console-g14a) (#762) (ae699da)
  • hardening: fail closed on source/./timeout argv0 wrappers of real executors (#778) (f0f8c1d)
  • hr: B-EMP-A employment containment (31e/2kd/0hf) (#779) (0da6c2f)
  • hr: clear exit_date on reactivation (console-90h) (#766) (b2acd80)
  • hr: route employee-row creation through the Employment port (u6ih part-1) (#782) (7fc04e3)
  • identity: gate replace_user_branches on actor BranchScope (console-o498) (#759) (5770c04)
  • logistics: POD corpus from enforced scheme (console-5yn) (#767) (4417bb3)
  • orgchange: refuse CreateBranch/RenameBranch under deactivated region (console-k6wm) (#763) (950b3b1)
  • payroll: refuse changed provenance on PayRun conflict; recheck drain period gate (#777) (f9a88ed)
  • residual admit — kwm §60 pin, cvh UI sight (+clippy), gc9z LifecycleError, 0lj branch-removal (#754) (e07fffd)

This PR was generated with Release Please. See documentation.

@github-actions
github-actions Bot force-pushed the release-please--branches--main--components--console branch 11 times, most recently from 886dcf6 to 524a7fe Compare August 13, 2026 04:45
@jason931225
jason931225 enabled auto-merge (squash) August 14, 2026 15:01
@github-actions
github-actions Bot force-pushed the release-please--branches--main--components--console branch 9 times, most recently from 824b410 to dc2b1e8 Compare August 15, 2026 08:25
@jason931225
jason931225 force-pushed the release-please--branches--main--components--console branch from dc2b1e8 to b72002a Compare August 15, 2026 20:19
@jason931225 jason931225 mentioned this pull request Aug 16, 2026
Merged
@jason931225
jason931225 disabled auto-merge August 16, 2026 09:44
jason931225 added a commit that referenced this pull request Aug 16, 2026
@jason931225
ci: separate candidate validation from release authority (#785)
53925c3 
## Outcome

Separates candidate validation, protected release provenance, and
post-merge evidence. Ordinary PRs no longer require the historical
signed C/T authority train or authority-ledger tip commits. The stable
`authenticate-console-authority` context remains protected/read-only and
admits ordinary PRs from exact live GitHub coordinates plus ancestry,
without executing candidate bytes.

Release-like PRs cannot fall through to the ordinary route. They retain
exact path/content/graph classification and a native proof from the
protected Release Please workflow. Required CI gains an exact
release-metadata-only lane, semantic manifest/CHANGELOG checks, and
skip-aware aggregates so policy/preflight failures do not masquerade as
PostgreSQL or product failures.

## Risk and governance

- Ordinary commit signatures are no longer an authorization primitive.
Repository merge permissions and review governance are the authorization
boundary; current branch protection has zero required approvals, and
that accepted residual is documented rather than hidden.
- No candidate bytes execute in `pull_request_target`; no PR secrets,
write token, package, image, production, or deployment change is
introduced.
- `RELEASE_PLEASE_TOKEN` remains unprovisioned and is a post-merge
operational HOLD. PR #760 must remain auto-merge-disabled until its
release tip is regenerated through the protected workflow.

## Verification

- `env PATH="/tmp/console-ci-boundary-dotslash/bin:$PATH" npm run
verify` — passed, ending `verify(fast) passed`
- focused protected/release suite — 40/40 passed
- independent test-contract suite — 47/47 passed; documentation custody
453/453
- `git diff --cached --check` — clean before commit
- independent CI/Actions and test-contract reviews: READY; security
review: source READY, guarded transition required

## One-time cutover

The current protected-base authority workflow still requires the retired
signing key, so this PR cannot self-host its replacement. After
exact-head Required / CI and Required / Security pass: disable and
verify all auto-merge, snapshot protection, temporarily remove only
`authenticate-console-authority`, squash-merge this exact head by SHA,
and unconditionally restore all three strict app-pinned contexts with
readback. Then exercise the restored context on temporary one- and
two-commit canary heads. Any state drift or restoration failure is a
repository-wide HOLD.
@github-actions
github-actions Bot force-pushed the release-please--branches--main--components--console branch 2 times, most recently from 6658408 to 234a9ae Compare August 16, 2026 11:35
@jason931225
jason931225 force-pushed the release-please--branches--main--components--console branch from 234a9ae to b74970d Compare August 16, 2026 11:35
@jason931225 jason931225 mentioned this pull request Aug 16, 2026
Merged
jason931225 added a commit that referenced this pull request Aug 16, 2026
@jason931225 Jason Leee
fix: bound release proof head polling (#787)
0e7cfc0 
## Summary

- tolerate only the exact stale pre-push lease tip while the Pulls API
converges
- validate the full initial PR snapshot before any write-capable work,
then revalidate every stable field after transport
- bound head polling to 20 reads / 19 waits and the protected producer
job to 10 minutes
- fail closed on metadata drift, third SHAs, API errors, sleep errors,
or producer timeout
- add RED/GREEN regressions and custody-indexed design and rollout
records

## Evidence

- full `npm run verify` with pinned DotSlash 0.5.7: exit 0,
`verify(fast) passed`
- focused protected release authority suite: 49/49 passed, zero skipped
or failed
- independent security review: READY, no Critical or Important findings
- independent test/contract review: READY, no Critical or Important
findings
- reviewed HEAD: `4d07b6f1c8281eee5f35d255ff61e2bdb26a2959`
- reviewed tree: `992cb2ff0a5d4ade2c7952e14d6a74027febe91d`
- base-relative patch SHA-256:
`adea2726b692666d8b39ea7fdabef8cfb95bc5c1be4123d74e9683a642dfba0b`

## Review fixes

- pre-push snapshot validation now binds
draft/base/head/repository/ref/creator/title/body fields before worktree
creation, token acquisition, commit construction, or push; post-push
validation remains
- `release-please` producer now has `timeout-minutes: 10`, bounding a
stalled GitHub API call without changing triggers, permissions, secrets,
or proof identity

## Safety and rollout

This does not change branch protection, required context names,
packages, images, or production. After the exact amended head passes all
three app-bound required contexts, merge this repair, observe a fresh
protected Release Please run on that exact main SHA, and merge PR #760
only after its regenerated exact head has native authority proof plus
Required / CI and Required / Security. Image/package/production actions
remain HOLD.

Bead: `console-l23`.

---------

Co-authored-by: Jason Leee <jasonlee@Jasons-MacBook-Pro.local>
@github-actions
github-actions Bot force-pushed the release-please--branches--main--components--console branch from b74970d to fe2b3fa Compare August 16, 2026 17:46
@jason931225
jason931225 force-pushed the release-please--branches--main--components--console branch from fe2b3fa to e197b8e Compare August 16, 2026 17:46
@jason931225
jason931225 merged commit bf17db4 into main Aug 16, 2026
24 checks passed
@jason931225
jason931225 deleted the release-please--branches--main--components--console branch August 16, 2026 17:55
@github-actions

github-actions Bot commented Aug 16, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Created releases:

🌻

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

autorelease: tagged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jason931225