Record two of the answers the plan's decision issue took - #186
Merged
Conversation
Issue #46 collected the questions this plan does not decide by engineering judgement, and all eight were answered on 2026-08-24. Record 0000 says a decision that exists only in an issue is not yet recorded, so an answer sitting in a tracker comment is what this change ends for two of the eight. 0021 records that this board publishes downloadable release artefacts, that they are signed rather than carrying a bare checksum, and that the release notes say they exist for checking this board rather than as something the organisation ships to users. It names the tension with the scope this board opened with instead of resolving it by silence, says the separating sentence depends on being read, and names what publishing costs: signing, checksums, a bill of materials, a vulnerability surface and an expectation of continuity. That is issue #182. 0023 records that a commit on the default branch carries a verified signature, effective as the keys operations#1609 sets up land. It names the costs that arrive after the decision - a key held and rotated, a repair that rebuilds a branch at the end of the work rather than adding a commit at the start, and what is left of the web interface and of automation - and it says plainly that earlier history does not become signed, because a property that holds from a date read as a property of the whole is worse than no property at all. That is issue #184. The two are one change rather than two because they are one key-custody story. Signing a release artefact and signing a commit both need a key held somewhere and rotated eventually, and each record names operations#1609 as where that story lives rather than restating it, so the failure this prevents is two custody stories with two different answers. Both carry the four sections record 0000 fixes, and both name in sections three and four every option the entry rejected with what taking it would have cost. Neither record claims a mechanism: 0023 says the requirement is a branch setting rather than anything in this tree and hands the reader the command that reads the live state, and 0021 says it decides that artefacts are signed and not what checks a signature or what a reader does when the check fails. The gate at this head: go build, go vet and gofmt are silent, every package passes, and the runner reads 20 decision records over its own tree and refuses nothing. Refs #182, #184 Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #182. Closes #184.
What this does
#46 collected the questions this plan does not decide by engineering judgement,
and all eight were answered on 2026-08-24. Record
0000says a decision thatexists only in an issue is not yet recorded:
This lands two of the eight. The other six are #179, #180, #181, #183, #185 and,
for entry five, #35.
0021-what-this-board-publishes.md, entry four, issue #182. This boardpublishes downloadable release artefacts, they are signed rather than carrying a
bare checksum, and the release notes say they exist for checking this board
rather than as something the organisation ships to users. The record names the
tension with the scope this board opened with instead of resolving it by
silence, says plainly that the separating sentence depends on being read, and
names what publishing costs: signing, checksums, a bill of materials, a
vulnerability surface and an expectation of continuity.
0023-signed-commits-on-the-default-branch.md, entry seven, issue #184. Acommit on the default branch carries a verified signature, effective as the keys
operations#1609 sets up for the working accounts land. The record names the
costs that arrive after the decision - a key held and rotated, a repair that
rebuilds a branch at the end of the work rather than adding a commit at the
start, and what is left of the web interface and of automation - and it says
that earlier history does not become signed, because a property that holds from
a date and is read as a property of the whole is worse than no property at all.
Why the two are one change
They are one key-custody story. Signing a release artefact and signing a commit
both need a key held somewhere and rotated eventually, which is why the two
entries were answered together, and each record names operations#1609 as where
that story lives rather than restating it. The failure this prevents is two
custody stories with two different answers, one per record, discovered later.
What neither record claims
Neither claims a mechanism.
0023says the requirement is a setting on thebranch protection rather than anything in this tree, so nothing here refuses an
unsigned commit, and it hands the reader the command that reads the live state
instead of a sentence they would have to trust.
0021decides that artefactsare signed and does not decide what checks a signature, by whom, or what a
reader does when the check fails - a published signature nobody verifies is a
file beside a file, and the record says so.
Both carry the four sections record
0000fixes and both name in sections threeand four every option the entry rejected with what taking it would have cost.
The gate
Run at this head, in the order
CONTRIBUTING.mdnames:This change adds no code, so it adds no refusal site and owes no fixture. What
holds it is the record checks that already run over this tree: the section rule
that refuses a record missing any of the four headings, and the numbering rule
that refuses two records under one number. The run above is those checks reading
twenty records where they previously read eighteen.
The integration-hardware harness was not asked for and produced nothing here.
The means
Markdown under
docs/decisions/, because record0000fixes that decisions livethere one per file in that shape, and the checks that read a decision record
already read that directory. No language, runtime or dependency is added.
What is left
The answers are decided; six of the eight records are not yet written, and each
has its own issue. Until a record exists, that decision lives in a tracker
comment, which is the state record
0000refuses to treat as recorded.No second person has read this change. The gate output above stands in place of
one.