docs(gaps): align main — GT-570 closed on registry evidence, GT-624 opened - #230
Merged
Conversation
…to GT-624
1.2.0 is published. Verified against the REGISTRY rather than an exit code:
evolith-agent-runtime@1.2.0 (14:06:10), evolith-sdk@2.0.0 (14:06:24),
evolith-mcp@1.2.0 (14:06:39), evolith-cli@1.2.0 (14:06:58) — timestamps that also
confirm dependency order, since the last three consume the first. All four carry
`dist.attestations`, produced by GitHub Actions with id-token: write.
That last point is the substance. The audit's finding was "0 of 8 published
packages carry dist.attestations"; four now do, and they were not hand-published.
CLOSED WITHOUT OVER-CLAIMING
----------------------------
GT-570 had three acceptance criteria and shipping 1.2.0 meets one and a half.
Rather than tick them, the row is re-scoped explicitly and the remainder becomes
GT-624 (P1):
(a) The 1.1.0 versions are still not deprecated, so
`npm install @beyondnet/evolith-mcp@1.1.0` silently resolves the build that
predates the security wave. One command per package, but it needs npm
credentials — owner action.
(b) No release gate fails when a security-tagged commit is absent from the
published tag. That absence is exactly what let the wave sit unpublished
from 2026-07-23 to 2026-07-27 while SECURITY.md declared 1.1.x "actively
patched". Nothing detected it; an audit did.
Ticking those would be the pattern this board keeps catching in itself — GT-12,
GT-568, GT-254 and GT-424 all closed over live defects. The re-scope is recorded
in the catalog entry, not silent.
WHAT THE REHEARSALS BOUGHT
--------------------------
Three defects, all of which would have been permanent since npm forbids
unpublishing after 72 hours:
- run 30265298045: no LICENSE in any of the four tarballs, on an MIT project;
repository.url auto-corrected in all eight manifests
- run 30271837941: bin paths auto-corrected in two
And the scope itself was wrong until `git show --name-only` replaced `--stat`,
which truncates long paths: the wave touches mcp (15 files), cli (7) and
agent-runtime (1 — the CWE-78 shell runner), not mcp alone. The original plan
would have shipped one patch and left two packages vulnerable.
Board: 562/624 done, 9 in progress, 49 pending, 4 deferred.
Verified: 08-validate-tracking 624 gaps (ES 624), 600/600 EN/ES catalog sections,
544 closure records; ci-runner governance 17/17 exit 0; 01, 04 and
11-validate-product-docs exit 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ment docs(gaps): close GT-570 on registry evidence, carve the remainder into GT-624
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns
mainwithdevelop. 1.2.0 published with provenance on all four packages, verified against the registry; GT-570 closed on what it covered and its two unmet criteria carved into GT-624 rather than ticked.🤖 Generated with Claude Code