docs(gaps): close GT-570 on registry evidence, carve the remainder into GT-624 - #229
Merged
Merged
Conversation
…to GT-624
1.2.0 is published. Verified against the REGISTRY rather than an exit code:
evolith-agent-runtime@1.2.0 (14:06:10), evolith-sdk@2.0.0 (14:06:24),
evolith-mcp@1.2.0 (14:06:39), evolith-cli@1.2.0 (14:06:58) — timestamps that also
confirm dependency order, since the last three consume the first. All four carry
`dist.attestations`, produced by GitHub Actions with id-token: write.
That last point is the substance. The audit's finding was "0 of 8 published
packages carry dist.attestations"; four now do, and they were not hand-published.
CLOSED WITHOUT OVER-CLAIMING
----------------------------
GT-570 had three acceptance criteria and shipping 1.2.0 meets one and a half.
Rather than tick them, the row is re-scoped explicitly and the remainder becomes
GT-624 (P1):
(a) The 1.1.0 versions are still not deprecated, so
`npm install @beyondnet/evolith-mcp@1.1.0` silently resolves the build that
predates the security wave. One command per package, but it needs npm
credentials — owner action.
(b) No release gate fails when a security-tagged commit is absent from the
published tag. That absence is exactly what let the wave sit unpublished
from 2026-07-23 to 2026-07-27 while SECURITY.md declared 1.1.x "actively
patched". Nothing detected it; an audit did.
Ticking those would be the pattern this board keeps catching in itself — GT-12,
GT-568, GT-254 and GT-424 all closed over live defects. The re-scope is recorded
in the catalog entry, not silent.
WHAT THE REHEARSALS BOUGHT
--------------------------
Three defects, all of which would have been permanent since npm forbids
unpublishing after 72 hours:
- run 30265298045: no LICENSE in any of the four tarballs, on an MIT project;
repository.url auto-corrected in all eight manifests
- run 30271837941: bin paths auto-corrected in two
And the scope itself was wrong until `git show --name-only` replaced `--stat`,
which truncates long paths: the wave touches mcp (15 files), cli (7) and
agent-runtime (1 — the CWE-78 shell runner), not mcp alone. The original plan
would have shipped one patch and left two packages vulnerable.
Board: 562/624 done, 9 in progress, 49 pending, 4 deferred.
Verified: 08-validate-tracking 624 gaps (ES 624), 600/600 EN/ES catalog sections,
544 closure records; ci-runner governance 17/17 exit 0; 01, 04 and
11-validate-product-docs exit 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Summary
1.2.0 is published. Verified against the registry, not an exit code:
dist.attestations@beyondnet/evolith-agent-runtime@beyondnet/evolith-sdk@beyondnet/evolith-mcp@beyondnet/evolith-cliThe timestamps also confirm dependency order — the last three consume the first.
That last column is the substance. The audit's finding was "0 of 8 published packages carry
dist.attestations". Four now do, produced by GitHub Actions withid-token: writerather than by a developer machine.Closed without over-claiming
GT-570 had three acceptance criteria and shipping 1.2.0 meets one and a half. Rather than tick them, the row is re-scoped explicitly and the remainder becomes GT-624 (P1):
npm install @beyondnet/evolith-mcp@1.1.0silently resolves the build that predates the security wave. One command per package, but it needs npm credentials — owner action.SECURITY.mddeclared 1.1.x "actively patched". Nothing detected it; an audit did.Ticking those would be the pattern this board keeps catching in itself — GT-12, GT-568, GT-254 and GT-424 all closed over live defects. The re-scope is recorded in the catalog entry, not silent.
What the rehearsals bought
Three defects, all permanent had they shipped (npm forbids unpublishing after 72 hours):
repository.urlauto-corrected in all eightbinpaths auto-corrected in twoAnd the scope itself was wrong until
git show --name-onlyreplaced--stat, which truncates long paths: the wave touches mcp (15 files), cli (7) and agent-runtime (1 — the CWE-78 shell runner), not mcp alone. The original plan would have shipped one patch and left two packages vulnerable.Board: 562/624 done · 9 in progress · 49 pending · 4 deferred.
Evolith Core Quality Gates
.mdand.es.mdfrom a single data structure.01-validate-docs.mjsgreen.04-check-bilingual-parity.mjsgreen.Verification
08-validate-tracking624 gaps (ES 624), 600/600 EN/ES catalog sections, 544 closure records ·ci-runner governance17/17 exit 0 ·01,04and11-validate-product-docsexit 0.Linked ADRs / Issues
Conventional Commits
🤖 Generated with Claude Code