chore(main): release 0.6.2 - #465
Open
github-actions[bot] wants to merge 1 commit into
Open
Conversation
This was referenced Aug 26, 2026
forkwright
added a commit
that referenced
this pull request
Aug 26, 2026
…ests (#471) ## Finding `gate / full-gate-build` fails on `main`, which blocks release PR #465 (`chore(main): release 0.6.2`, open 8 days). `gate / gate` reports failure too, but it is a downstream reporter of the same result — one cause, not two. ## Evidence `gate / full-gate-build` step `check`, verbatim: ``` error: unused import: `tracing::Instrument` --> crates/kerykeion/src/collector_tests.rs:4:5 | 4 | use tracing::Instrument as _; | ^^^^^^^^^^^^^^^^^^^ = note: `-D unused-imports` implied by `-D warnings` error: could not compile `kerykeion` (lib test) due to 1 previous error ``` `gate / gate` (job 98205969995) then reports: ``` BUILD_RESULT: failure ERROR: no Gate-Passed trailer, not a docs-only changeset, and full-gate-build did not succeed ``` **This is not the release commit's doing.** `gh pr diff 465` touches only `.release-please-manifest.json`, `CHANGELOG.md`, `Cargo.lock`, `Cargo.toml`. `crates/kerykeion/src/collector_tests.rs` is byte-identical between `origin/main` and the release head, so the fix belongs here on `main`. ## Why this matters `collector.rs:688-690` declares the test file as a **child module**: ```rust #[cfg(test)] #[path = "collector_tests.rs"] mod tests; ``` `collector.rs:15` already carries `use tracing::{Instrument as _, instrument};`, and `collector_tests.rs:6` opens with `use super::*;`. A non-`pub` item is visible to its defining module *and its descendants*, so that glob already brings `Instrument` into scope — the file's own line 4 binds a name it would have either way. ## Desired correction Delete line 4 and its trailing blank. The two `.instrument()` call sites (lines 258, 332) keep resolving through `use super::*;`, and `collector.rs` keeps its own import — it uses both the trait and the `#[instrument(...)]` attribute macro directly. **Done when:** `full-gate-build` passes on `main` and #465's `gate / gate` goes green. ## WARNING — the detection is non-deterministic, the defect is not The same `check` command over these byte-identical files **passed** on a main-push run 15 hours earlier (run 32907547269, job 97994832002, same pinned toolchain `1.97.1`) and **failed** here. `Swatinem/rust-cache` shares one key (`gate-attestation`) across the `push` and `pull_request` triggers, so an incremental cache hit can let rustc skip re-linting this compilation unit. The import is unconditionally redundant and removing it is correct regardless of cache state — but treat a green run on this workspace as *not* evidence that a `-D warnings` lint is absent. That shared cache key is worth a separate look. Co-authored-by: forkwright <cody@forkwright.com>
github-actions
Bot
force-pushed
the
release-please--branches--main
branch
from
August 26, 2026 14:45
add3df2 to
b75af1a
Compare
forkwright
added a commit
that referenced
this pull request
Aug 26, 2026
## Finding Release PRs here arrive with their required contexts **absent rather than red**, because release-please creates them with `GITHUB_TOKEN` and GitHub raises no workflow-triggering events for that token. Branch protection holds a PR with a missing context forever. ## Evidence #465 (`chore(main): release 0.6.2`) sat **8 days** at `mergeStateStatus: BLOCKED` with an **empty** `statusCheckRollup` while five workflow runs waited at `action_required`. `gh api repos/forkwright/akroasis/actions/runs?status=action_required` currently returns **51** held runs. ## Why this matters A missing check is worse than a failing one — a red check advertises itself; an absent one looks exactly like a PR still waiting on CI. Releases stop, and nothing surfaces the cause. ## Desired correction Adopt the reusable healer merged as `forkwright/.github#56`. This file asks for it and declares nothing about how it works, so it cannot drift from the other 17 repos that will carry it. **Done when:** a subsequent release PR here reaches a non-empty `statusCheckRollup` without a human approving runs by hand. ## The permissions block is load-bearing It is not the usual boilerplate. For `workflow_call`, the caller's `permissions` is a **cap** — a called workflow can only *downgrade* the token, never upgrade it. A caller declaring the customary `contents: read` alone would leave the healer unable to approve a single run, and the only symptom would be a release that stayed stuck. `actions: write` approves the held runs; `pull-requests: read` finds the release PR and its head SHA. Nothing here writes to a PR. ## Note This is the first adopter, deliberately — akroasis is the only repo with an open stuck release PR right now, so it is where the end-to-end path can actually be observed rather than assumed. The remaining 17 follow once a run here is read. Independent of this, #465 is also blocked by a real compile failure that #471 fixes; the two are unrelated causes on the same PR. Co-authored-by: forkwright <cody@forkwright.com>
forkwright
added a commit
that referenced
this pull request
Aug 26, 2026
## Summary - reserve Pinax for the standalone fleet relational engine and keep Akroasis's reference-library application name neutral pending a distinct Gnomon-approved identity - remove the unused staged Sphragis dependency, its exact dead-dependency baseline row, and the obsolete workflow token rationale; `Cargo.lock` never contained Sphragis - define the authority split: Pinax owns transactions, typed schemas, and page-at-rest encryption; Akroasis owns the application/domain-envelope policy; Sphragis owns recipient key distribution - replace the obsolete local-fjall reference-store premise while preserving the historical #132 document path for durable links - make the README, architecture, project index, lexicon, reference-layout note, docs manifest, and `akroasis know` placeholder agree; explicitly forbid a local `crates/pinax` identity ## Tracker reconciliation - References #395: retitled and rewritten around the standalone Pinax dependency, async-native multi-record transaction and typed-schema producer gates, a default-off Akroasis preview feature, exact reviewed Sphragis handoff, and a permanent `hazmat` prohibition. - References #261: this change removes only the exact `ARCH/substrate-dead-dep` row, moving the measured baseline from 24 entries to 23; it does not weaken or complete that issue. - References #132: re-triaged without closing so Pinax owns page-at-rest encryption and Akroasis owns only typed domain-envelope policy. The original write/read/migration/adversarial acceptance remains represented. ## Verification - `cargo fmt --all` - `cargo fmt --all -- --check` - `git diff --check` - `git diff --exit-code -- Cargo.lock` - confirmed `crates/pinax` does not exist - confirmed `.kanon-lint-baseline.toml` contains 23 entries - no compile, test, or gate command was run on Metis, per operator direction ## Collision and residual gates - Open release PR #465 also changes `Cargo.toml`; it was inspected and left untouched. This branch is based on live `main` at `d4ac3c5f24121ac3aeef0aca5b6baabf82f51f03`. - Durable implementation still waits for standalone Pinax's Tokio-native API, atomic multi-record transactions, and typed schemas. - Preview fixtures may remain default-off before Sphragis #43 completes. Any reviewed/default promotion waits for #43's favorable disposition and exact consumer-handoff tag. - The remaining 23 baseline entries stay owned by #261 and their recorded producer/review gates. Co-authored-by: forkwright <cody@forkwright.com>
github-actions
Bot
force-pushed
the
release-please--branches--main
branch
from
August 26, 2026 20:50
b75af1a to
3a75328
Compare
forkwright
added a commit
that referenced
this pull request
Aug 26, 2026
## Summary - follow up merged #476 with the exact-head review corrections for its remaining Sphragis boundary drift - state that Akroasis has no adopted Sphragis dependency; any preview use stays default-off and pins an immutable producer revision - limit KAT evidence to conformance, keep `hazmat` prohibited, and assign qualified review/release promotion to `forkwright/sphragis#43` while #395 owns the exact consumer handoff - move the preview test command into an exact-revision Sphragis checkout or its matching CI context - replace false “reviewed profile” claims with accurate versioned, unaudited, default-inert wording - classify both maintained boundary documents as authored SSOTs instead of false frozen decision records ## Tracker disposition - References #395 without closing it. - `forkwright/sphragis#43` remains open and owns qualified cryptographic review and reviewed release promotion. - #131 remains closed historical design context, not a live promotion owner. - This PR neither implies nor records a favorable cryptographic review. ## Verification - `cargo fmt --all -- --check` - `git diff --check origin/main..HEAD` - Kanon deterministic lint and writing checks over the changed documentation - no build, test, or full gate command was run, per operator direction ## Base and collision check - based on live `main` at `0a6cc2316fede4fff1a19662ebeda00c43743920`, the merge commit for #476 - release PR #465 head `3a75328aeda6a8d0fe44af722068995953a0d8de` changes only `.release-please-manifest.json`, `CHANGELOG.md`, `Cargo.lock`, and `Cargo.toml`; it does not overlap this four-doc patch Co-authored-by: forkwright <cody@forkwright.com>
forkwright
added a commit
that referenced
this pull request
Aug 26, 2026
## Summary - use the producer-side preview-pq,hazmat profile so the exact Sphragis checkout executes its full known-answer and conformance targets - state explicitly that producer test reachability does not permit Akroasis consumers to enable or call hazmat - classify the two living reference-encryption boundary documents as non-evergreen while preserving authored ownership ## Tracker disposition Refs #395. Refs forkwright/sphragis#43. Both trackers remain open; this documentation correction does not claim a reviewed consumer handoff. ## Verification - git diff --check - docs/MANIFEST.toml parsed successfully with Python tomllib - exact-value inspection of the changed command and manifest entries - no local build, test, or gate command was run, per operator direction ## Base and collision check - based on live main at 1451b4c - release PR #465 changes only .release-please-manifest.json, CHANGELOG.md, Cargo.lock, and Cargo.toml; it remains path-disjoint from this two-document patch Co-authored-by: forkwright <cody@forkwright.com>
github-actions
Bot
force-pushed
the
release-please--branches--main
branch
from
August 27, 2026 18:34
3a75328 to
9999884
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 I have created a release beep boop
0.6.2 (2026-08-27)
Bug Fixes
This PR was generated with Release Please. See documentation.