diff --git a/.github/scripts/test_patch_0_1_2_package_tag_approval_request.py b/.github/scripts/test_patch_0_1_2_package_tag_approval_request.py new file mode 100644 index 0000000..b477770 --- /dev/null +++ b/.github/scripts/test_patch_0_1_2_package_tag_approval_request.py @@ -0,0 +1,157 @@ +#!/usr/bin/env python3 +# +# Copyright 2026 The Ethos maintainers +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# + +from __future__ import annotations + +import re +import subprocess +import unittest +from pathlib import Path + +from makefile_guard import target_block + + +ROOT = Path(__file__).resolve().parents[2] +RECORD = ROOT / "docs/validation/patch-0-1-2-package-tag-approval-request-validation-2026-06-25.md" +CRATES_REQUEST = ( + ROOT + / "docs/validation/patch-0-1-2-crates-publication-approval-request-validation-2026-06-25.md" +) +CRATES_DECISION = ( + ROOT + / "docs/validation/patch-0-1-2-crates-publication-approval-decision-validation-2026-06-25.md" +) +CRATES_CLOSEOUT = ( + ROOT / "docs/validation/patch-0-1-2-crates-publication-closeout-validation-2026-06-25.md" +) +VALIDATION_README = ROOT / "docs/validation/README.md" +EXECUTION_STATUS = ROOT / "docs/execution-status.md" +PUBLIC_RELEASE_CHECKLIST = ROOT / "docs/public-release-checklist.md" +MAKEFILE = ROOT / "Makefile" + +SOURCE_SHORT = "bc14f36" +SOURCE_COMMIT = "bc14f36931ae7453c35fc4ecd1a2a9159f2127d4" +SOURCE_TREE = "2b597508e020e8c1090508d5a60fa66af4aa7951" +PACKAGE_SOURCE_COMMIT = "3bc3564e38c1168b2db72f38863d324b6b57bd4d" +PACKAGE_SOURCE_TREE = "eda8c7a605a4eb29c155ae3b9e6e9f0c35798f8c" +TAGS = ( + "ethos-package-ethos-doc-core-0.1.2", + "ethos-package-ethos-verify-0.1.2", + "ethos-package-ethos-pdf-0.1.2", +) +TAG_COMMANDS = ( + f"git tag -a {TAGS[0]} {PACKAGE_SOURCE_COMMIT}", + f"git tag -a {TAGS[1]} {PACKAGE_SOURCE_COMMIT}", + f"git tag -a {TAGS[2]} {PACKAGE_SOURCE_COMMIT}", +) +FORBIDDEN = ( + "package tags are created", + "tag creation approved", + "hosted surfaces approved", + "production-ready", + "windows packaged artifacts approved", + "bundled pdfium approved", + "ethos-doc approved", + "ethos-rag approved", + "public benchmark claims approved", +) + + +def read(path: Path) -> str: + return path.read_text(encoding="utf-8") + + +def normalized(path: Path) -> str: + return re.sub(r"\s+", " ", read(path)) + + +def git(*args: str) -> str: + return subprocess.check_output( + ["git", *args], + cwd=ROOT, + encoding="utf-8", + stderr=subprocess.DEVNULL, + ).strip() + + +class Patch012PackageTagApprovalRequestTests(unittest.TestCase): + def test_record_is_source_bound_and_indexed(self) -> None: + record = normalized(RECORD) + readme = normalized(VALIDATION_README) + + self.assertIn(RECORD.name, readme) + self.assertIn("patch 0.1.2 package tag approval request", readme.lower()) + self.assertIn(f"Validated source HEAD before this record: `{SOURCE_SHORT}`", read(RECORD)) + self.assertIn(f"Patch 0.1.2 package tag approval request source commit: `{SOURCE_COMMIT}`", record) + self.assertIn(f"Patch 0.1.2 package tag approval request source tree: `{SOURCE_TREE}`", record) + self.assertEqual(SOURCE_COMMIT, git("rev-parse", SOURCE_SHORT)) + self.assertEqual(SOURCE_TREE, git("rev-parse", f"{SOURCE_SHORT}^{{tree}}")) + + def test_request_binds_exact_published_package_tag_set(self) -> None: + record = normalized(RECORD) + + self.assertIn(CRATES_REQUEST.name, record) + self.assertIn(CRATES_DECISION.name, record) + self.assertIn(CRATES_CLOSEOUT.name, record) + self.assertIn(f"Package tag source commit requested: `{PACKAGE_SOURCE_COMMIT}`", record) + self.assertIn(f"Package tag source tree requested: `{PACKAGE_SOURCE_TREE}`", record) + self.assertEqual(PACKAGE_SOURCE_TREE, git("rev-parse", f"{PACKAGE_SOURCE_COMMIT}^{{tree}}")) + for tag in TAGS: + self.assertIn(tag, record) + for command in TAG_COMMANDS: + self.assertIn(command, record) + + def test_request_remains_non_executing_and_retains_boundaries(self) -> None: + raw = read(RECORD) + record = normalized(RECORD) + lower = record.lower() + + for expected in ( + "This request record does not create package tags.", + "This request record does not approve package tag creation.", + "Tag creation remains blocked until a separate explicit approval decision is recorded.", + "Public beta evaluation surfaces remain unchanged.", + "Hosted surfaces remain blocked.", + "Production positioning remains blocked.", + "Windows packaged artifacts remain blocked.", + "Bundled project-maintained PDFium builds remain blocked.", + "`ethos-doc` remains blocked.", + "`ethos-rag` remains blocked.", + "Public benchmark claims remain blocked.", + ): + self.assertIn(expected, record) + for forbidden in FORBIDDEN: + self.assertNotIn(forbidden, lower) + self.assertNotIn("/Users/", raw) + self.assertNotIn("/private/tmp", raw) + self.assertNotIn("/private/var", raw) + self.assertNotIn("/var/folders", raw) + self.assertNotIn("saumildiwaker", raw) + + def test_status_docs_reference_request_and_keep_tag_creation_blocked(self) -> None: + for path in (EXECUTION_STATUS, PUBLIC_RELEASE_CHECKLIST): + text = normalized(path) + self.assertIn(RECORD.name, text, str(path)) + self.assertIn("Package tag creation remains blocked", text, str(path)) + self.assertIn("hosted", text.lower(), str(path)) + self.assertIn("production", text.lower(), str(path)) + + def test_release_candidate_prep_runs_after_python_wording_before_artifact_checks(self) -> None: + makefile = read(MAKEFILE) + python_wording_guard = "$(PYTHON) .github/scripts/test_patch_0_1_2_python_public_install_wording_closeout.py" + tag_request_guard = "$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_request.py" + first_public_guard = "$(PYTHON) .github/scripts/test_first_public_release_artifact_evidence.py" + block = target_block("release-candidate-prep") + + self.assertIn(tag_request_guard, block) + self.assertEqual(1, makefile.count(tag_request_guard)) + self.assertLess(block.index(python_wording_guard), block.index(tag_request_guard)) + self.assertLess(block.index(tag_request_guard), block.index(first_public_guard)) + + +if __name__ == "__main__": + unittest.main() diff --git a/.github/scripts/test_release_candidate_prep.py b/.github/scripts/test_release_candidate_prep.py index aed28c2..8353938 100644 --- a/.github/scripts/test_release_candidate_prep.py +++ b/.github/scripts/test_release_candidate_prep.py @@ -77,6 +77,7 @@ "$(PYTHON) .github/scripts/test_patch_0_1_2_python_publication_approval_decision.py", "$(PYTHON) .github/scripts/test_patch_0_1_2_python_publication_closeout.py", "$(PYTHON) .github/scripts/test_patch_0_1_2_python_public_install_wording_closeout.py", + "$(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_request.py", "$(PYTHON) .github/scripts/test_first_public_release_artifact_evidence.py", "$(PYTHON) .github/scripts/test_first_public_release_final_decider.py", "$(PYTHON) .github/scripts/test_first_public_release_linux_x64_artifact_evidence.py", diff --git a/CHANGELOG.md b/CHANGELOG.md index c6956a8..3c12d4f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +- boundary-exception: request decider review for exact patch `0.1.2` package tag creation while keeping tag creation, hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces blocked pending a separate approval decision. - boundary-exception: close patch `0.1.2` Python public install wording for published PyPI wheel `ethos-pdf==0.1.2` while keeping package tag creation, hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces blocked. - boundary-exception: close patch `0.1.2` Python PyPI publication with exact registry evidence for `ethos-pdf==0.1.2` while keeping Python public install wording, package tag creation, hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces blocked. - boundary-exception: record decider approval for bounded later deterministic patch `0.1.2` Python PyPI wheel publication while keeping actual upload, Python public install wording, package tag creation, hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces blocked. diff --git a/Makefile b/Makefile index b5d2549..8378808 100644 --- a/Makefile +++ b/Makefile @@ -328,6 +328,7 @@ release-candidate-prep: $(PYTHON) .github/scripts/test_patch_0_1_2_python_publication_approval_decision.py $(PYTHON) .github/scripts/test_patch_0_1_2_python_publication_closeout.py $(PYTHON) .github/scripts/test_patch_0_1_2_python_public_install_wording_closeout.py + $(PYTHON) .github/scripts/test_patch_0_1_2_package_tag_approval_request.py $(PYTHON) .github/scripts/test_first_public_release_artifact_evidence.py $(PYTHON) .github/scripts/test_first_public_release_final_decider.py $(PYTHON) .github/scripts/test_first_public_release_linux_x64_artifact_evidence.py diff --git a/docs/execution-status.md b/docs/execution-status.md index 0dd801a..4cba1f6 100644 --- a/docs/execution-status.md +++ b/docs/execution-status.md @@ -104,6 +104,14 @@ to `ethos-pdf==0.1.2`. Package tag creation remains blocked, and hosted surfaces positioning, Windows packaged artifacts, bundled project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, and public benchmark claims remain blocked. +Patch `0.1.2` package tag approval request is recorded in +`docs/validation/patch-0-1-2-package-tag-approval-request-validation-2026-06-25.md`. It records the +exact package tag names, source commit, source tree, and requested later operator commands for +decider review only. Package tag creation remains blocked until a separate explicit approval +decision is recorded, and hosted surfaces, production positioning, Windows packaged artifacts, +bundled project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, and public benchmark claims +remain blocked. + Public approval lane blocker prep is recorded in `docs/milestone-e-public-approval-lane-blockers.json` and schema-bound by `schemas/ethos-milestone-e-public-approval-lane-blockers.schema.json`. This public approval lane diff --git a/docs/public-release-checklist.md b/docs/public-release-checklist.md index b3adbb4..a1f7cd2 100644 --- a/docs/public-release-checklist.md +++ b/docs/public-release-checklist.md @@ -185,6 +185,14 @@ production positioning remains blocked, Windows packaged artifacts remain blocke project-maintained PDFium builds remain blocked, `ethos-doc` remains blocked, `ethos-rag` remains blocked, and public benchmark claims remain blocked. +Patch `0.1.2` package tag approval request is recorded in +`docs/validation/patch-0-1-2-package-tag-approval-request-validation-2026-06-25.md`. It records the +exact package tag names, source commit, source tree, and requested later operator commands for +decider review only. Package tag creation remains blocked until a separate explicit approval +decision is recorded; hosted surfaces, production positioning, Windows packaged artifacts, bundled +project-maintained PDFium builds, `ethos-doc`, `ethos-rag`, and public benchmark claims remain +blocked. + ## Required Before Public Push - Package-name and trademark decision is closed by accepted ADR-0006 in diff --git a/docs/validation/README.md b/docs/validation/README.md index d3938cf..6f23fd6 100644 --- a/docs/validation/README.md +++ b/docs/validation/README.md @@ -760,6 +760,11 @@ recording the exact current-main source candidate and required follow-up evidenc public claim-inventory wording for `ethos-pdf==0.1.2`; package tag creation, hosted, production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces remain blocked until separate closeout or approval records pass. +- `patch-0-1-2-package-tag-approval-request-validation-2026-06-25.md` - patch 0.1.2 + package tag approval request validation records exact package tag names, source commit, source + tree, and requested later operator commands for decider review; package tag creation, hosted, + production, Windows, bundled PDFium, benchmark, `ethos-doc`, and `ethos-rag` surfaces remain + blocked until a separate approval decision passes. - `milestone-e-validation-command-index-validation-2026-06-20.md` - internal Milestone E validation-command index validation passed through command-alignment checks, schema enum checks, row-record checks, public-surface posture checks, `make milestone-e-prep`, and diff hygiene; the diff --git a/docs/validation/patch-0-1-2-package-tag-approval-request-validation-2026-06-25.md b/docs/validation/patch-0-1-2-package-tag-approval-request-validation-2026-06-25.md new file mode 100644 index 0000000..3608a46 --- /dev/null +++ b/docs/validation/patch-0-1-2-package-tag-approval-request-validation-2026-06-25.md @@ -0,0 +1,114 @@ +# Patch 0.1.2 Package Tag Approval Request Validation - 2026-06-25 + +Validated source HEAD before this record: `bc14f36`. + +Patch 0.1.2 package tag approval request source commit: `bc14f36931ae7453c35fc4ecd1a2a9159f2127d4`. + +Patch 0.1.2 package tag approval request source tree: `2b597508e020e8c1090508d5a60fa66af4aa7951`. + +Status: **patch 0.1.2 package tag approval request recorded; tag creation remains blocked** + +This record requests decider review for creating the exact patch `0.1.2` package tags that were +named in the crates.io publication request and accepted by the crates.io publication decision. It +does not create package tags, approve package tag creation, move any existing tag, change package +contents, change public wording, approve hosted surfaces, approve production positioning, approve +Windows packaged artifacts, approve bundled project-maintained PDFium builds, approve `ethos-doc`, +approve `ethos-rag`, or approve public benchmark reports or claims. + +## Subject + +- Repository: `docushell/ethos` +- Lane: patch `0.1.2` package tag creation approval request +- Source request record: + `docs/validation/patch-0-1-2-crates-publication-approval-request-validation-2026-06-25.md` +- Source decision record: + `docs/validation/patch-0-1-2-crates-publication-approval-decision-validation-2026-06-25.md` +- Source publication closeout record: + `docs/validation/patch-0-1-2-crates-publication-closeout-validation-2026-06-25.md` +- Package tag source commit requested: `3bc3564e38c1168b2db72f38863d324b6b57bd4d` +- Package tag source tree requested: `eda8c7a605a4eb29c155ae3b9e6e9f0c35798f8c` + +## Exact Request Fields + +- Decision requested: approve exact patch `0.1.2` package tag creation for later operator + execution. +- Approver requested: `docushell-admin` acting as decider. +- Date requested: 2026-06-25. +- Exact package tag name set requested: + - `ethos-package-ethos-doc-core-0.1.2` + - `ethos-package-ethos-verify-0.1.2` + - `ethos-package-ethos-pdf-0.1.2` +- Exact package tag source commit requested: `3bc3564e38c1168b2db72f38863d324b6b57bd4d`. +- Exact package tag source tree requested: `eda8c7a605a4eb29c155ae3b9e6e9f0c35798f8c`. +- Exact later operator commands requested: + +```sh +git tag -a ethos-package-ethos-doc-core-0.1.2 3bc3564e38c1168b2db72f38863d324b6b57bd4d +git tag -a ethos-package-ethos-verify-0.1.2 3bc3564e38c1168b2db72f38863d324b6b57bd4d +git tag -a ethos-package-ethos-pdf-0.1.2 3bc3564e38c1168b2db72f38863d324b6b57bd4d +git push origin refs/tags/ethos-package-ethos-doc-core-0.1.2 +git push origin refs/tags/ethos-package-ethos-verify-0.1.2 +git push origin refs/tags/ethos-package-ethos-pdf-0.1.2 +``` + +The operator must use annotated tags and must stop if any requested tag already exists locally or on +`origin`, if the requested source commit or tree does not match this record, or if any retained +blocker is softened. + +## Evidence Bound To This Request + +- The crates.io publication approval request recorded the exact package tag name set and source + binding. +- The crates.io publication approval decision accepted that exact tag name set and source binding. +- The crates.io publication closeout records `ethos-doc-core`, `ethos-verify`, and `ethos-pdf` + published at `0.1.2`. +- The current public README and public package installation wording already point all approved + evaluation install surfaces to `0.1.2`. +- Public beta evaluation surfaces remain unchanged. + +## Non-Actions + +- This request record does not create package tags. +- This request record does not approve package tag creation. +- This request record does not move or delete any tag. +- This request record does not change package contents. +- This request record does not change public installation wording. +- This request record does not approve hosted surfaces. +- This request record does not approve production positioning. +- This request record does not approve Windows packaged artifacts. +- This request record does not approve bundled project-maintained PDFium builds. +- This request record does not approve public benchmark reports. +- This request record does not approve public benchmark claims. +- This request record does not approve `ethos-doc`. +- This request record does not approve `ethos-rag`. + +## Retained Blockers + +- Tag creation remains blocked until a separate explicit approval decision is recorded. +- Hosted surfaces remain blocked. +- Production positioning remains blocked. +- Windows packaged artifacts remain blocked. +- Bundled project-maintained PDFium builds remain blocked. +- Public benchmark reports remain blocked. +- Public benchmark claims remain blocked. +- `ethos-doc` remains blocked. +- `ethos-rag` remains blocked. +- PDFium remains caller-provided through `ETHOS_PDFIUM_LIBRARY_PATH`. + +## Commands + +```sh +python3 .github/scripts/test_patch_0_1_2_package_tag_approval_request.py +python3 .github/scripts/test_patch_0_1_2_crates_publication_closeout.py +python3 .github/scripts/test_patch_0_1_2_python_public_install_wording_closeout.py +make release-candidate-prep PYTHON=python3 +git diff --check +``` + +## Result + +```text +patch 0.1.2 package tag approval request recorded +Exact package tag names and source binding were recorded for decider review +Package tag creation remains blocked pending a separate explicit approval decision +```