[P1] Release signing: prove an authorized signed tag and integrate doctor verification

Review baseline and scope

Reviewed source: c9d32008e98d0e1711f47cb739f61c42376b884e on main, 22 September 2026.
Classification: OPERATOR DECISION + HOSTED EVIDENCE.
Predecessors: #168.
This replaces their remaining work; closing a predecessor during backlog migration is not a claim that its original scope was completed.

Already delivered — do not rebuild

Offline Sigstore bundle binding, explicit verifier capability, bounded signature claims and exact archive-attestation verification have been implemented. d9ed6cb additionally checks held archive/bundle pairs before aggregate publication. These local checks do not constitute an actually signed, hosted release.

Remaining implementation / execution

Have the responsible maintainer record the accepted signing identity and rotation/revocation policy; do not self-approve these decisions.
Use an explicitly authorized release/tag to execute the real hosted signing/attestation path and retain verifiable artifact/commit/tag/workflow bindings.
Integrate the existing offline verification capability into the intended doctor route and test valid, swapped, stale, tampered and revoked/untrusted material.

Acceptance evidence

A real authorized tag/release has exact signed/attested bytes and an independently reproducible verification record.
Doctor distinguishes cryptographic verification from digest-only checks and handles identity/rotation failure as specified.
Documentation states the demonstrated platform and trust scope without promoting local fixtures to hosted assurance.

Boundaries

The backlog-migration script must not create a tag, publish a release, access a signing secret or change trust policy. A task description is not an authorization for provider spend, signing, publication, remote deployment or a change to support policy. Preserve existing stable identities, explicit profile limits, source authority and non-vacuous acceptance gates.

Evidence and implementation entry points

Issue #168 update

Test results described above are retained repository evidence, not a fresh full test run performed by this backlog review. Re-run the owning gates for the implementation being accepted.

Coordinator update (2026-09-23)

Status: blocked on release identity and trust-policy authority.

The repository has bounded built-in Sigstore verification and a held-file CLI route, but there is no authorized signed release, named identity/issuer/workflow, or agreed rotation/revocation owner. The relationship between release verification and doctor integration also remains a product decision.

Next step: authorize an exact tag/workflow/release and immutable assets, name the signer policy and rotation/revocation owner, then run the signed-release proof. No signing or release mutation was performed. The issue remains open.

Coordinator update (2026-09-23): Main at 304bc10 now includes a doctor verify-release route that requires an independently obtained --trusted-root-sha256 commitment before reading other release material or invoking verification. Seven focused checks passed in the isolated implementation worktree, including a functional root-substitution negative control; independent re-review found no doctor-path bypass. Existing release verify behavior is unchanged. No signer identity, rotation/revocation policy, authorized tag, hosted signing, or public release was supplied or executed; acceptance remains blocked and this issue stays open.

Coordinator update (2026-09-24): Main 1cf2557 adds the missing test-only sigstore-verify dependency for the full-toolchain doctor root-substitution regression; that exact test passed locally (1/1) with the lockfile updated. This repairs a CI compile blocker, not release-signing acceptance. The independently committed-root doctor semantics remain as previously reported; signer policy, authorized tag, and hosted proof are still absent.

R10 local trust-policy increment is on main at 28fd199. Following the maintainer’s instruction to choose best-practice Wavect GmbH policy, the verifier now pins GitHub’s configured immutable owner/repository OIDC subject and checks the original-token subject plus owner/repository ID extensions in the cryptographically verified Fulcio leaf. It rejects missing, duplicate, legacy, and wrong-ID material. Focused local checks: 8 Sigstore and 6 structural signature-claim tests passed; Python claim CLI syntax/help checked. The existing doctor verify-release route was already present and was not rebuilt. The maintainer authorized v0.6.0 and one tag-triggered release gate, but no tag or hosted signed release exists yet. Release evidence and final rotation/revocation operations remain open; this comment makes no hosted assurance claim.

v0.6.0 release attempt: the immutable annotated tag points to 8f57ff8. The workflow lacked a tag-push trigger, so the one authorized hosted gate was manually dispatched on that exact tag/SHA: https://github.com/wavect/semaprax/actions/runs/36024489803 . It failed in Windows Rust build at cargo fmt --all --check because src/package_registry.rs had registry_v2 before leaf_manifest_v1; publication cannot run. Cancellation was requested for remaining jobs to conserve runner time. There is NO signed v0.6.0 release or hosted success claim. Main now has the exact formatting fix and a future tag trigger at 4b55128; cargo fmt --all --check and workflow YAML parsing passed locally. The published v0.6.0 tag was not moved or recreated. Issue remains open pending a separately authorized next release version/tag and hosted verification.

Update (2026-09-24): Maintainer authorized moving v0.6.0 and its required hosted release gate. The annotated tag now points to 32d45f3. The first tag-push run (36025664828) exposed Windows Clippy and ignored-test inventory failures; both fixes are on main. That run was stopped after several jobs were cancelled and could no longer establish a green gate. A clean gate for the corrected tag is running at https://github.com/wavect/semaprax/actions/runs/36028102754 . Local Python harness self-tests (137), release reconciliation, full workspace Clippy on macOS, warnings-as-errors Rust docs, and workspace doc tests passed. This is NOT yet a signed/published release; keep the issue open pending hosted gate, artifacts, and independent verification.

v0.6.0 release-gate update (2026-09-24): Main ae0fb99 contains the frozen Component-v7 WIT identity correction and repinned 0.6.0 version-bound Component known answers; the exact local Component contract selector passed 4/4 and independent review found no P1/P2. It also repairs the hosted STD-08 documentation catalog failure by restoring missing SUMMARY entries and first-page audience metadata; the integrated exact documentation catalog selector passed 1/1. The current annotated v0.6.0 tag still points to 32d45f3, so its hosted run https://github.com/wavect/semaprax/actions/runs/36028102754 has those two known failures and cannot certify this main SHA. Remaining jobs are still running to expose any additional failures. A redundant main-push full CI run was canceled to conserve runner capacity; the tag gate is undisturbed. There is still no signed or published v0.6.0 release; issue remains open pending a corrected exact tag gate, immutable artifacts, and independent verification.

v0.6.0 release-gate update (2026-09-24): Main 14500f1 now also fixes the two integration-2 semantic-cache failures exposed by the old-tag run. The root cause was a 16-authored-source snapshot bound applied to the task-service Project with 19 total bundled modules; the full bounded inventory is now checked on encode/decode. The exact formerly failing persistence/restart selector passed locally (1/1), formatting passed, and independent read-only review found no P1/P2. The GEN-05B job also hit its 90-minute job timeout after earlier steps passed; its limit is now 240 minutes with every test command retained. YAML parsed locally, but this is not hosted pass evidence. The annotated tag still points to old 32d45f3 while its run reveals remaining failures. No signed/published v0.6.0 assets exist; keep #289 open pending a corrected tag gate and independent artifact verification.

Partial hosted evidence update (2026-09-24): Main ac2ce08 records a timestamped status page at docs/RELEASE-0.6.0-STATUS.md with direct job links. At 19:12 UTC, 35 jobs had succeeded on the old v0.6.0 tag commit 32d45f3, including three-runner public generic ownership, owned-data SDK, Project Manifest and Project Product Acceptance jobs. Four jobs had failed, GEN-05B had timed out, and the aggregate gate was unfinished. These are exact-job hosted observations for the old commit only; they do not certify current main, signing, release assets or publication. Keep the issue open pending a corrected tag gate and independent artifact verification.

v0.6.0 gate update (2026-09-24): With explicit maintainer authorization, the annotated v0.6.0 tag was moved from old 32d45f3 to exact current-main ac2ce08 after focused fixes and release reconciliation. The new tag-push CI run is https://github.com/wavect/semaprax/actions/runs/36047757697 . Cancellation was requested for the stale old-head run 36028102754 to free hosted runners. The old run retains narrow historical job evidence in docs/RELEASE-0.6.0-STATUS.md but cannot certify this new commit. No aggregate green gate, signed artifact or published release is claimed yet; keep #289 open.

Current v0.6.0 hosted evidence snapshot, 2026-09-24 20:18 UTC: the authorized tag-push run https://github.com/wavect/semaprax/actions/runs/36047757697 is bound to tagged commit ac2ce08 and has 24 completed successful jobs, 20 running, 19 queued, and no reported failures yet. Examples of exact successes include Release claim reconciliation (job 107796106767), AGENT-06 Windows (job 107796106675), Rust build ubuntu-latest (job 107796106540), and Project Product Acceptance Ubuntu (job 107796106561); these are partial job-level hosted facts only. AGENT-06 macOS/Ubuntu and GEN-05B are still running, not timed out. The run has not completed; no signed artifact, GitHub release publication, full green gate, or production-support claim is made. The historical old-head evidence document remains separately bound to its prior SHA.

v0.6.0 status update (2026-09-24): the existing annotated tag remains at ac2ce08, and its hosted release run 36047757697 has a Rust 1.88 source-locked coverage failure in integration-2 (job 107796106524); the release is not certified or published. Main head 6430cac now contains 35db4c6, which restores real source-text coverage for newly split HIR, scaffold, graph, and workspace-graph submodules without weakening the gate. The exact failed contract test passed locally (1/1), as did the focused quality-routing test (1/1) and cargo fmt. These local checks do not retroactively turn the tag run green. I am continuing implementation/docs work; no new tag gate has been started.

v0.6.0 correction (2026-09-24): the unpublished annotated tag now points to main commit ceaba82. The new hosted tag run is https://github.com/wavect/semaprax/actions/runs/36063889395 and is pending; no green release gate, signed artifacts, or published release is claimed yet. The previous tag run 36047757697 had two integration-2 source-lock failures (same contract), repaired on main by 35db4c6 with focused local checks, and its Lean differential job hit its exact 120-minute timeout after two cross-backend tests passed. The new workflow retains all selectors and samples with a 240-minute bounded Lean job. I will update this issue from the new exact-commit outcome, not from partial job successes.

v0.6.0 hosted-gate update (2026-09-25): The completed tag run https://github.com/wavect/semaprax/actions/runs/36063889395 at ceaba82 failed. Observed blockers included one Rust test format-string compile error affecting multiple shards, two documentation source-lock checks, Linux held-Clang lacking an explicit linker path, a stale standalone example lockfile and Windows offline cache misses, plus CPU-heavy jobs canceled at the four-hour limit. Main now contains the focused repair batch 5193077. The unpublished annotated v0.6.0 tag was moved to that exact commit; its new release-gate run is https://github.com/wavect/semaprax/actions/runs/36110361560 . A duplicate main CI run was canceled to conserve hosted resources. Focused local checks passed for the affected workspace, doctor, lockfile, release-workflow and documentation contracts; no full local gate was run. The new hosted gate is pending. No signed assets, published release, aggregate green result, or production assurance is claimed. Keep this issue open until the exact-tag gate and independent artifact verification succeed.

v0.6.0 CI repair (2026-09-25): main now contains de7bd79, and the unpublished annotated v0.6.0 tag was moved to that exact commit. The new exact-tag CI run is https://github.com/wavect/semaprax/actions/runs/36131139700 (pending at this update). Prior tag run 36110361560 showed four failures: three integration-2 shards shared stale catalog/network/task-service assertions and a catalog graph-cap regression; Windows integration-1 had two stale browser budget-counter hash pins. The patch keeps the 64 MiB cap and simplifies the catalog escape helper so the full graph fits; it updates the affected source-lock assertions and pins while retaining the actual calculator revision and graph-digest checks. Focused local checks passed for the network boundary, maximal catalog output, two task-service cases, 256-record catalog oracle, and browser known answers; the longer escape cross-backend case was stopped locally after five minutes and remains for hosted CI. Formatting and diff checks passed. The old partial tag run and duplicate main CI run were canceled to avoid overlapping gates. No aggregate green release gate, signed assets, published release, or hosted verification is claimed; keep this issue open pending the exact-tag result and artifact verification.

2026-09-25 release-gate update: Wavect GmbH authorized v0.6.0 and delegated the signer-policy choice to the maintainer implementing this work. CI-regression fixes are now on main at e40a944; the v0.6.0 tag was moved to that exact commit. The new hosted release gate is https://github.com/wavect/semaprax/actions/runs/36178834413 (queued at posting). Focused local checks passed, including the pinned-digest regression, module-size contract, release-verification tests, workflow contracts, formatting, and native-host compile. This is not yet hosted signing/attestation evidence; leave the issue open until the tagged run succeeds and its artifacts and doctor verification are checked. The duplicate main-branch CI run was cancelled to avoid repeating the full matrix.

Follow-up 2026-09-25: the first retagged run found one Clippy-only regression in a one-element CI contract loop. Fixed and verified with focused cargo clippy --locked --test offline_package -- -D warnings; commit 4b39225 is on main and v0.6.0. Current hosted release gate: https://github.com/wavect/semaprax/actions/runs/36179804998. The superseded tag run and duplicate main CI run were cancelled. Hosted signing/attestation remains pending; issue stays open.

2026-09-25 follow-up: the prior v0.6.0 run found a quickstart install-guide contract failure on Windows integration-1: the documentation named Rust 1.88 and Node.js 22 but did not present versions in the table cells checked against the CLI and CI. The docs table is corrected in main commit 2a31657; the exact failing test passed locally. v0.6.0 now points to that commit. Current hosted gate: https://github.com/wavect/semaprax/actions/runs/36186582187. The superseded tag run and duplicate main CI run were cancelled. Hosted release evidence remains pending, so this issue stays open.

2026-09-25 CI update: the v0.6.0 run at 2a31657 found a Windows integration-0 help-surface test with a stale expected build target list. Production help correctly includes oci|rust; the test expected rust without oci. The exact test passes after updating its expectation, and fix f5e8531 is on main. The tag has not yet moved because the current hosted run still has many active/queued jobs; I am retaining its remaining evidence to batch any further failures into one retag. The duplicate main CI was cancelled. Release signing evidence remains pending, so the issue stays open.

2026-09-25 retag update: the help-surface expectation fix f5e8531 is on main and v0.6.0 now points to that exact commit. The focused full_help_is_exact_capability_aware_and_inert test passed locally. New hosted release gate: https://github.com/wavect/semaprax/actions/runs/36191514266 (pending at posting). Cancellation was requested for superseded tag run 36186582187 and duplicate main CI run 36191192777; GitHub may take time to reflect their final cancelled status. Hosted signing evidence remains pending, so this issue stays open.

The authorized v0.6.0 tag now targets ebce848, and the tag-triggered hosted gate is pending at https://github.com/wavect/semaprax/actions/runs/36230378360 . This tag move is not itself evidence that hosted signing, doctor verification, rotation, or revocation are complete. Keep open pending successful signed-artifact and installed-verifier evidence.

The earlier ebce848 tag gate was canceled after Clippy failed. The current authorized v0.6.0 tag targets dcb7544; hosted signing and installed doctor verification remain unproven until the replacement tag run completes: https://github.com/wavect/semaprax/actions/runs/36230752732 . Keep open.

v0.6.0 now targets e38e499 after the catalog source-suite fuel repair. The prior tag gate was superseded; the current hosted signing/doctor evidence must come from https://github.com/wavect/semaprax/actions/runs/36239572776 . Keep open pending proof.

v0.6.0 now targets 40ca5bb after the catalog UTF-8 regression fix. The current hosted signing/doctor evidence must come from https://github.com/wavect/semaprax/actions/runs/36251816182 ; the earlier tag run was superseded. Keep open pending hosted proof.

v0.6.0 now targets 02c6c33. Current hosted signing/doctor evidence must come from https://github.com/wavect/semaprax/actions/runs/36267391724 ; the prior tag run was superseded. Keep open pending hosted proof.

Completed for the scoped implementation at 1ae35afe83f62f405b979f57ac90772cfec9daca on wavect/v070 (PR #314), applying the maintainer's rule that hosted-evidence-only gaps count as complete. No replacement issue is needed.

The trusted-identity policy, immutable repository/owner checks, signing workflow path, structural/cryptographic verification, doctor verify-release route and independent trusted-root commitment are implemented. Rotation/revocation ownership and procedures are documented.

The remaining signed hosted tag/immutable asset execution is waived for backlog closure under the requested rule. This is not evidence that a signed release exists, and does not publish, sign or authorize a release.

This review did not rerun the repository's test suite, and closure does not merge the branch or authorize a release.

Navigation Menu

Repository navigation

[P1] Release signing: prove an authorized signed tag and integrate doctor verification #289

[P1] Release signing: prove an authorized signed tag and integrate doctor verification

Review baseline and scope

Already delivered — do not rebuild

Remaining implementation / execution

Acceptance evidence

Boundaries

Evidence and implementation entry points

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[P1] Release signing: prove an authorized signed tag and integrate doctor verification #289

Description

[P1] Release signing: prove an authorized signed tag and integrate doctor verification

Review baseline and scope

Already delivered — do not rebuild

Remaining implementation / execution

Acceptance evidence

Boundaries

Evidence and implementation entry points

Activity

wsdt commented on Sep 23, 2026

wsdt commented on Sep 23, 2026

wsdt commented on Sep 23, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 24, 2026

wsdt commented on Sep 25, 2026

wsdt commented on Sep 25, 2026

wsdt commented on Sep 25, 2026

wsdt commented on Sep 25, 2026

wsdt commented on Sep 25, 2026

wsdt commented on Sep 25, 2026

wsdt commented on Sep 25, 2026

wsdt commented on Sep 26, 2026

wsdt commented on Sep 26, 2026

wsdt commented on Sep 26, 2026

wsdt commented on Sep 26, 2026

wsdt commented on Sep 26, 2026

wsdt commented on Sep 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions