Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
e87c41e
Add v1 release readiness gate
Bryforge Jun 12, 2026
7dc8070
Make release toolchain availability observed
Bryforge Jun 12, 2026
bc8020a
Allow signing preflight success with valid inputs
Bryforge Jun 12, 2026
dd86e92
Tighten v1 artifact preflight gating
Bryforge Jun 12, 2026
439fe54
Read v1 evidence blockers from status
Bryforge Jun 12, 2026
fb70f0b
Read v1 product blockers from status
Bryforge Jun 12, 2026
414a77d
Decompose v1 product blockers
Bryforge Jun 12, 2026
850b946
Decompose v1 evidence blockers
Bryforge Jun 12, 2026
ef76660
Add Latticra Netplane intake
chasebryan Jun 20, 2026
7a75276
chore: merge main quality fixes (panel path coverage + netplane licen…
Jun 20, 2026
b02d15c
fix(ci): cherry seal hybrid unavailable tolerance for smoke pass
Jun 20, 2026
b532faa
Merge origin/main into codex/v1-release-readiness-gate
Bryforge Jun 20, 2026
5275f1f
fix(installer): keep release artifact preflight passed=0 until promot…
Bryforge Jun 20, 2026
0334aec
fix(quality-safety-guards): path-scope pull_request triggers in latti…
Jun 20, 2026
23daf48
chore(ci): force re-run of quality after scoping fix for latticra-v1-…
Jun 20, 2026
c8abdd4
feat(portability): add shared portable-paths lib and normalize candid…
Jun 20, 2026
202825a
refactor(receipts): finish switch of remaining tools to central recei…
Jun 20, 2026
da04a5d
Merge remote-tracking branch 'origin/main' into codex/v1-release-read…
Jun 20, 2026
14c8aee
Sync portable paths lib
Jun 20, 2026
3132db1
Sync portable paths lib fix
Jun 20, 2026
15f6308
fix(model1): portable lib and syntax
Jun 20, 2026
af1260c
Merge main into v1 (resolve model1/verify conflicts)
Jun 20, 2026
c435046
fix(panel): manifest fixture path
Jun 20, 2026
82e15c6
Merge main into v1 (resolve docs and panel conflicts)
Jun 20, 2026
8681fd0
fix(panel)
Jun 20, 2026
b371376
Merge main (resolve for mergeable)
Jun 20, 2026
46a92c5
fix(panel)
Jun 20, 2026
0d14902
fix(v1): restore release readiness status notes dropped during panel …
Bryforge Jun 20, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions .github/workflows/latticra-v1-release-readiness-gate.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Latticra v1 Release Readiness Gate

on:
push:
paths:
- 'docs/LATTICRA_V1_0_0_RELEASE_READINESS_GATE_CONTRACT.md'
- 'docs/status/LATTICRA_V1_0_0_RELEASE_READINESS_GATE_STATUS.md'
- 'docs/LATTICRA_V1_0_0_EVIDENCE_BLOCKER_AUDIT_CONTRACT.md'
- 'docs/status/LATTICRA_V1_0_0_EVIDENCE_BLOCKER_AUDIT_STATUS.md'
- 'docs/LATTICRA_V1_0_0_PRODUCT_COMPLETION_BLOCKER_AUDIT_CONTRACT.md'
- 'docs/status/LATTICRA_V1_0_0_PRODUCT_COMPLETION_BLOCKER_AUDIT_STATUS.md'
- 'scripts/latticra-v1-release-readiness-gate.sh'
- 'scripts/test-latticra-v1-release-readiness-gate-contract.sh'
- 'scripts/latticra-v1-evidence-blocker-audit.sh'
- 'scripts/test-latticra-v1-evidence-blocker-audit-contract.sh'
- 'scripts/latticra-v1-product-completion-blocker-audit.sh'
- 'scripts/test-latticra-v1-product-completion-blocker-audit-contract.sh'
- '.github/workflows/latticra-v1-release-readiness-gate.yml'
pull_request:
paths:
- 'docs/LATTICRA_V1_0_0_RELEASE_READINESS_GATE_CONTRACT.md'
- 'docs/status/LATTICRA_V1_0_0_RELEASE_READINESS_GATE_STATUS.md'
- 'docs/LATTICRA_V1_0_0_EVIDENCE_BLOCKER_AUDIT_CONTRACT.md'
- 'docs/status/LATTICRA_V1_0_0_EVIDENCE_BLOCKER_AUDIT_STATUS.md'
- 'docs/LATTICRA_V1_0_0_PRODUCT_COMPLETION_BLOCKER_AUDIT_CONTRACT.md'
- 'docs/status/LATTICRA_V1_0_0_PRODUCT_COMPLETION_BLOCKER_AUDIT_STATUS.md'
- 'scripts/latticra-v1-release-readiness-gate.sh'
- 'scripts/test-latticra-v1-release-readiness-gate-contract.sh'
- 'scripts/latticra-v1-evidence-blocker-audit.sh'
- 'scripts/test-latticra-v1-evidence-blocker-audit-contract.sh'
- 'scripts/latticra-v1-product-completion-blocker-audit.sh'
- 'scripts/test-latticra-v1-product-completion-blocker-audit-contract.sh'
- '.github/workflows/latticra-v1-release-readiness-gate.yml'

permissions:
contents: read

jobs:
latticra-v1-release-readiness-gate:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
persist-credentials: false
- name: Run Latticra v1 release readiness gate guard
run: |
sh scripts/test-latticra-v1-evidence-blocker-audit-contract.sh
sh scripts/test-latticra-v1-product-completion-blocker-audit-contract.sh
sh scripts/test-latticra-v1-release-readiness-gate-contract.sh
21 changes: 20 additions & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,9 @@
.PHONY: production-installer-recovery-evidence-intake-validator-contract
.PHONY: production-installer-multi-vm-validation-status-contract
.PHONY: production-installer-multi-vm-evidence-intake-validator-contract
.PHONY: latticra-v1-evidence-blocker-audit
.PHONY: latticra-v1-product-completion-blocker-audit
.PHONY: latticra-v1-release-readiness-gate

OS_IMAGE_VERSION ?= local-candidate
OS_IMAGE_ISO ?= artifacts/os-images/$(OS_IMAGE_VERSION)/latticra-x86_64.iso
Expand Down Expand Up @@ -440,6 +443,9 @@ quality-installer-readiness:
sh ./scripts/test-production-installer-recovery-evidence-intake-validator-contract.sh
sh ./scripts/test-production-installer-multi-vm-validation-status-contract.sh
sh ./scripts/test-production-installer-multi-vm-evidence-intake-validator-contract.sh
sh ./scripts/test-latticra-v1-evidence-blocker-audit-contract.sh
sh ./scripts/test-latticra-v1-product-completion-blocker-audit-contract.sh
sh ./scripts/test-latticra-v1-release-readiness-gate-contract.sh
sh ./scripts/test-seabios-grub-compatibility-contract.sh
sh ./scripts/test-seabios-grub-boot-preview-evidence-contract.sh
sh ./scripts/test-seabios-grub-boot-preview-preflight.sh
Expand Down Expand Up @@ -807,6 +813,9 @@ quality-status:
sh ./scripts/test-latticra-higgs-chain-verifier.sh
sh ./scripts/test-latticra-effect-substrate-transition-intake.sh
sh ./scripts/test-production-quality-blocker-ledger.sh
sh ./scripts/test-latticra-v1-evidence-blocker-audit-contract.sh
sh ./scripts/test-latticra-v1-product-completion-blocker-audit-contract.sh
sh ./scripts/test-latticra-v1-release-readiness-gate-contract.sh

latticra-effect-status-surface:
sh ./scripts/test-latticra-effect-status-surface.sh
Expand Down Expand Up @@ -852,7 +861,6 @@ latticra-guarded-model1-effect-demonstration-operator-non-claim-review-receipt:

latticra-guarded-model1-effect-demonstration-evidence-acceptance-preflight-denial-gate:
sh ./scripts/test-latticra-guarded-model1-effect-demonstration-evidence-acceptance-preflight-denial-gate.sh

latticra-netplane-central-hub-intake:
sh ./scripts/test-latticra-netplane-central-hub-intake.sh

Expand Down Expand Up @@ -1009,6 +1017,17 @@ production-installer-multi-vm-validation-status-contract:
production-installer-multi-vm-evidence-intake-validator-contract:
sh ./scripts/test-production-installer-multi-vm-evidence-intake-validator-contract.sh

latticra-v1-evidence-blocker-audit:
sh ./scripts/test-latticra-v1-evidence-blocker-audit-contract.sh

latticra-v1-product-completion-blocker-audit:
sh ./scripts/test-latticra-v1-product-completion-blocker-audit-contract.sh

latticra-v1-release-readiness-gate:
sh ./scripts/test-latticra-v1-evidence-blocker-audit-contract.sh
sh ./scripts/test-latticra-v1-product-completion-blocker-audit-contract.sh
sh ./scripts/test-latticra-v1-release-readiness-gate-contract.sh

boot-compatibility:
sh ./scripts/test-seabios-grub-compatibility-contract.sh
sh ./scripts/test-seabios-grub-boot-preview-evidence-contract.sh
Expand Down
14 changes: 7 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ Latticra Guard is a planned simplification route, not a finished app or protecti

## Current status at a glance

The current public posture is tracked in [STATUS.md](STATUS.md), [docs/status/CURRENT_STATUS.md](docs/status/CURRENT_STATUS.md), and [docs/status/ANNOUNCEMENTS.md](docs/status/ANNOUNCEMENTS.md). The [Production quality blocker ledger](docs/status/PRODUCTION_QUALITY_BLOCKER_LEDGER.md) keeps the green local quality signal separate from production readiness claims. The production-installer release artifact staging directory, release worktree cleanliness audit with stdout-only dirty inventory, release toolchain availability audit, release signing identity reference, release artifact candidate preflight, release artifact evidence template, and release artifact, SBOM, transcript, lifecycle, recovery, and multi-VM evidence intake validators are present. The SBOM and transcript evidence templates are also present for future reviewed SBOM and dry-run transcript bundles. They can check future tagged artifact evidence bundles, but they do not create or sign release artifacts, clean or revert tracked files, write dirty-inventory evidence, install release tools, generate or attach an SBOM, accept evidence, pass promotion, record transcripts, validate lifecycle, recovery, or multi-VM behavior, or claim production readiness. Strategy and near-term direction live in [docs/strategy/README.md](docs/strategy/README.md), [docs/project_notes/README.md](docs/project_notes/README.md), [docs/project_notes/CURRENT_DIRECTION.md](docs/project_notes/CURRENT_DIRECTION.md), and [docs/project_notes/UPCOMING_WORK.md](docs/project_notes/UPCOMING_WORK.md).
The current public posture is tracked in [STATUS.md](STATUS.md), [docs/status/CURRENT_STATUS.md](docs/status/CURRENT_STATUS.md), and [docs/status/ANNOUNCEMENTS.md](docs/status/ANNOUNCEMENTS.md). The [Production quality blocker ledger](docs/status/PRODUCTION_QUALITY_BLOCKER_LEDGER.md) keeps the green local quality signal separate from production readiness claims. The [v1.0.0 release readiness gate contract](docs/LATTICRA_V1_0_0_RELEASE_READINESS_GATE_CONTRACT.md) and [status record](docs/status/LATTICRA_V1_0_0_RELEASE_READINESS_GATE_STATUS.md) aggregate the current release blockers with `v1_release_readiness_gate_passed=0`, `v1_release_readiness_blocked=1`, dynamic blocker classification counts, a v1 tag-specific release artifact candidate preflight report, dynamic evidence-status aggregation, an evidence-blocker detail audit, a product-completion detail blocker audit, and `production_release_ready=0`. The production-installer release artifact staging directory, release worktree cleanliness audit with stdout-only dirty inventory, release toolchain availability audit, release signing identity reference, release artifact candidate preflight, release artifact evidence template, and release artifact, SBOM, transcript, lifecycle, recovery, and multi-VM evidence intake validators are present. The SBOM and transcript evidence templates are also present for future reviewed SBOM and dry-run transcript bundles. They can check future tagged artifact evidence bundles, but they do not create or sign release artifacts, clean or revert tracked files, write dirty-inventory evidence, install release tools, generate or attach an SBOM, accept evidence, pass promotion, record transcripts, validate lifecycle, recovery, or multi-VM behavior, or claim production readiness. Strategy and near-term direction live in [docs/strategy/README.md](docs/strategy/README.md), [docs/project_notes/README.md](docs/project_notes/README.md), [docs/project_notes/CURRENT_DIRECTION.md](docs/project_notes/CURRENT_DIRECTION.md), and [docs/project_notes/UPCOMING_WORK.md](docs/project_notes/UPCOMING_WORK.md).

The [effect substrate transition intake](docs/LATTICRA_EFFECT_SUBSTRATE_TRANSITION_INTAKE.md) records the review order for future effect-runner, build-profile, and Model-1 bridge work before any capability promotion.

Expand Down Expand Up @@ -144,12 +144,12 @@ release_artifact_candidate_tracked_worktree_clean=0
release_artifact_candidate_tracked_dirty_count=<observed>
release_toolchain_availability_audit_present=1
release_toolchain_availability_audit_mode=no-effect-command-visibility-report
release_toolchain_availability_audit_passed=0
release_toolchain_ready=0
rpmbuild_available=0
rpm_available=0
release_artifact_build_tool_available=0
release_artifact_query_tool_available=0
release_toolchain_availability_audit_passed=<observed>
release_toolchain_ready=<observed>
rpmbuild_available=<observed>
rpm_available=<observed>
release_artifact_build_tool_available=<observed>
release_artifact_query_tool_available=<observed>
release_signing_identity_reference_validator_present=1
release_signing_identity_reference_valid=0
release_signing_identity_reference_fingerprint_format_valid=0
Expand Down
3 changes: 3 additions & 0 deletions STATUS.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,9 @@ Latest Latticra guarded Model-1 effect demonstration evidence acceptance preflig
Latest Latticra Netplane central hub intake note: 2026-06-19 CDT
Latest Latticra Netplane Kaiju static adapter evidence intake note: 2026-06-19 CDT
Latest Latticra product organization simplification note: 2026-06-19 CDT
Latest Latticra v1.0.0 release readiness gate note: 2026-06-12 CDT
Latest Latticra v1.0.0 evidence blocker audit note: 2026-06-12 CDT
Latest Latticra v1.0.0 product blocker audit note: 2026-06-12 CDT
Latest Latticra computational proof foundation note: 2026-05-29 CDT
Latest Latticra computational math and physics evaluation note: 2026-05-29 CDT
Latest Latticra Speculum premise note: 2026-05-29 CDT
Expand Down
111 changes: 111 additions & 0 deletions docs/LATTICRA_V1_0_0_EVIDENCE_BLOCKER_AUDIT_CONTRACT.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,111 @@
# Latticra v1.0.0 Evidence Blocker Audit Contract

Status: no-effect v1.0.0 evidence blocker audit contract
Evidence level: evidence-blocker decomposition only
Scope: decompose the evidence blockers that keep the v1.0.0 release readiness gate closed across release artifact, SBOM, transcript, lifecycle, recovery, and multi-VM evidence intake records.

## Purpose

The v1.0.0 release readiness gate reports a compact `v1_release_evidence_blocker_count`. That keeps the top-level release decision readable, but it can hide which concrete evidence inputs are still missing before a release can be considered.

This audit gives those evidence blockers one executable no-effect decomposition. It reads existing status records and reports the missing artifact, checksum, signature, SBOM, transcript, lifecycle, recovery, and multi-VM evidence fields that keep the evidence portion of the v1.0.0 gate blocked.

It does not create release artifacts, generate SBOMs, run VMs, invoke package managers, write evidence, accept evidence, pass promotion, install packages, publish releases, or mutate the host.

## Command

```sh
sh scripts/latticra-v1-evidence-blocker-audit.sh
```

## Current classification

```text
v1_evidence_blocker_audit_present=1
v1_evidence_blocker_audit_mode=no-effect-evidence-blocker-decomposition
v1_evidence_blocker_audit_passed=0
v1_evidence_detail_blocker_count=<observed>
v1_evidence_detail_blockers=<observed>
release_artifact_promotion_gate_passed=<observed>
release_artifact_present=<observed>
release_artifact_built_from_tag=<observed>
release_artifact_reproducible=<observed>
release_artifact_sha256_recorded=<observed>
release_artifact_signature_present=<observed>
release_artifact_signature_verified=<observed>
release_artifact_evidence_accepted_by_intake_validator=<observed>
sbom_artifact_file_present=<observed>
sbom_dependency_review_present=<observed>
sbom_vulnerability_review_present=<observed>
sbom_license_review_present=<observed>
sbom_evidence_accepted_by_intake_validator=<observed>
install_transcript_file_present=<observed>
uninstall_transcript_file_present=<observed>
post_removal_absence_transcript_file_present=<observed>
transcript_evidence_accepted_by_intake_validator=<observed>
upgrade_transcript_file_present=<observed>
rollback_transcript_file_present=<observed>
reinstall_transcript_file_present=<observed>
lifecycle_evidence_accepted_by_intake_validator=<observed>
recovery_runbook_file_present=<observed>
failure_mode_register_file_present=<observed>
recovery_drill_transcript_file_present=<observed>
rollback_drill_transcript_file_present=<observed>
operator_recovery_receipt_file_present=<observed>
recovery_evidence_accepted_by_intake_validator=<observed>
fresh_vm_validation_file_present=<observed>
repeat_vm_validation_file_present=<observed>
existing_install_validation_file_present=<observed>
remove_reinstall_validation_file_present=<observed>
unsupported_target_validation_file_present=<observed>
non_root_cli_validation_file_present=<observed>
root_boundary_validation_file_present=<observed>
checksum_verification_file_present=<observed>
package_signature_verification_file_present=<observed>
multi_vm_evidence_accepted_by_intake_validator=<observed>
```

The current detail blocker vocabulary includes `release_artifact_missing`, `release_artifact_signature_not_verified`, `release_artifact_evidence_not_accepted`, `sbom_artifact_file_missing`, `sbom_evidence_not_accepted`, `install_transcript_file_missing`, `transcript_evidence_not_accepted`, `upgrade_transcript_file_missing`, `lifecycle_evidence_not_accepted`, `recovery_runbook_file_missing`, `recovery_evidence_not_accepted`, `fresh_vm_validation_file_missing`, and `multi_vm_evidence_not_accepted`.

## Required Source Records

```text
docs/status/PRODUCTION_INSTALLER_RELEASE_ARTIFACT_CANDIDATE_PREFLIGHT_STATUS.md
docs/status/PRODUCTION_INSTALLER_RELEASE_ARTIFACT_EVIDENCE_INTAKE_VALIDATOR_STATUS.md
docs/status/PRODUCTION_INSTALLER_SBOM_EVIDENCE_INTAKE_VALIDATOR_STATUS.md
docs/status/PRODUCTION_INSTALLER_TRANSCRIPT_EVIDENCE_INTAKE_VALIDATOR_STATUS.md
docs/status/PRODUCTION_INSTALLER_LIFECYCLE_EVIDENCE_INTAKE_VALIDATOR_STATUS.md
docs/status/PRODUCTION_INSTALLER_RECOVERY_EVIDENCE_INTAKE_VALIDATOR_STATUS.md
docs/status/PRODUCTION_INSTALLER_MULTI_VM_EVIDENCE_INTAKE_VALIDATOR_STATUS.md
```

## Pass Requirements

This audit may report `v1_evidence_blocker_audit_passed=1` only after future reviewed records close all evidence detail blockers. In particular:

```text
release_artifact_promotion_gate_passed=1
release_artifact_present=1
release_artifact_built_from_tag=1
release_artifact_reproducible=1
release_artifact_sha256_recorded=1
release_artifact_signature_verified=1
release_artifact_evidence_accepted_by_intake_validator=1
sbom_evidence_accepted_by_intake_validator=1
transcript_evidence_accepted_by_intake_validator=1
lifecycle_evidence_accepted_by_intake_validator=1
recovery_evidence_accepted_by_intake_validator=1
multi_vm_evidence_accepted_by_intake_validator=1
```

The audit must not infer evidence acceptance from templates, placeholders, fixture records, or validator presence alone.

## Validation

```sh
sh scripts/test-latticra-v1-evidence-blocker-audit-contract.sh
```

## Non-Claims

This contract is not evidence acceptance, not a v1.0.0 release candidate, not release artifact promotion, not production installer readiness, not Fedora distribution readiness, not Nadia production readiness, not production cryptography, not runtime authority, and not permission to publish a release.
Loading
Loading