Summary

Release-prep bump for 1.7.4.post5 (PEP 440 post-release / ADR-0073). PyPI-only — operator runs build → TestPyPI → PyPI. No Git tag, no GitHub Release, no container.

maturity_build calculation (ADR-0073)

Boundary: merge of post4 release PR #1224 → 656fdc3d (chore(release): 1.7.4.post4).

git log 656fdc3d..HEAD --format='%h %s' | rg '^[0-9a-f]+ fix\('
# COUNT = 14
# maturity_build = 226 + 14 = 240

Full commit list + postN ↔ octet map: docs/releases/1.7.4.post5.md.

Not in N: feat(cli) #1246, docs #1234/#1235, chore #1240 (bundled in notes/CHANGELOG, not octet count).

Wave packaged (CHANGELOG / release notes)

• fix(archives): .7z BytesIOFactory ([P1][bug] Leitura de conteudo dentro de .7z sempre falha (AttributeError) - nao e questao de senha, e API do py7zr incompativel #1250 [bug] .7z sempre falha com AttributeError: 'SevenZipFile' object has no attribute 'read' mesmo com py7zr instalado #1248)
• fix(session): orphan reaper + interrupt ([P1][bug] Sessoes interrompidas ficam presas em status='running' com finished_at=NULL (nunca transicionam para estado terminal) #1251)
• feat(cli): validate-config optional driver WARN ([P1][enhancement] --validate-config poderia checar dependencia opcional do driver (ex: psycopg2), nao so nome/schema #1246)
• fix(security): CSRF / Dataverse SSRF / archive budgets / JWT GRACE / IEX ([P1][security][web] CSRF ausente no POST /{locale}/config com WebAuthn gate off (default) — config-tampering cross-origin #1231 [P2][security][connector] Dataverse: token_url/org_url sem validate_outbound_url — SSRF + client_secret exfil #1232 [P2][security][file_scan] archives: falta budget agregado de descompressão (member-count + total-bytes + ratio) — cap por-membro já existe #1233 [P1][security][verify] Positional secret->target binding — confirmar que credencial nao vai pro target errado #1210 [P2][licensing] JWT GRACE pode ser inalcancavel — verificar se a cadeia elif do guard chega a atribuir GRACE #1212 [P1][security][scripts] replace Invoke-Expression in external-review-pack.ps1 #1192)
• fix(integrity): build_digest_matched ([P1][integrity] integrity_anchor: semantica de signature_ok + fail-open em erro (nao pode parecer confiavel sem verificacao) #1211)
• docs/chore OPSEC + markdown-lint ([P2][security][opsec] LICENSING_SPEC.md:82 expõe que deploy-count não é enforced em runtime — reconnaissance de evasão no repo público #1234 [P2][security][opsec] LICENSING_SPEC.md:120 expõe janela de revocation (no hot-reload + lista local) — reconnaissance no repo público #1235 [P2][chore] markdown-lint local varre untracked de ferramenta (venv/jolli) → falso-positivo trava commit local do selo; gitignore + exclude/git-tracked no lint #1240 [P0][security][docs] split operator-specific Cursor skills into private templates #1191)

Test plan

• ./scripts/check-all.sh --enforced
• Operator: merge → publish-pypi workflow (TestPyPI → PyPI)

Does not close issues — bump-only release-prep.

Made with Cursor