Repository navigation
North Star execution: independent value, durable guarantees, and 90-day gates #216
Description
North Star and mandate
Objective: turn OVK from a technically sophisticated verification research system into a product that external engineering teams repeatedly use to maintain important machine-checked commitments across AI-authored changes, with honest uncertainty and measured reduction in review/revalidation work.
The long-term product answers: What claim is established, by which evidence and assumptions? Which changes preserve that justification? Which invalidate it? What is the least costly sound work that restores it?
Near-term buyer hypothesis (not validated): security-conscious Python/FastAPI teams adopting AI coding agents. First product claim-family hypothesis: bounded route/Protected Effect authorization integrity. Start advisory only with the existing executable profile; unsupported source shapes produce review/unknown. Do not pretend current protected-effect extraction is a proof of arbitrary Python program security. Test willingness to pay before expanding the source profile.
This is an execution tracker, not an authorization to merge research experiments into production. As of 2026-10-15, no independent external adopter is recorded in the public pilot registry; maintained consumers/dogfood are not independent adoption. The source profile is executable_advisory, not externally_calibrated_strict. The v1.3.0-rc.1 release/status document has not established live publication, and repo ref-protection must be checked rather than inferred.
14-day operating sprint (October 15–29)
Workstream A — customer discovery and first independent pilot (highest priority)
- Identify 10 plausible design partners with active backend/security workflows and AI-authored PRs; record contact, decision-maker, stack, expected risky-change frequency, and reason for fit. No invented interest or unsolicited public PRs.
- Conduct at least 5 customer/problem conversations and obtain permission for at least 1 genuine external pilot. Distinguish end-user, security reviewer, and budget owner.
- Check qualifying repository/source profile coverage before promising the integration. Pilot must run on the organization's natural, non-selected PR flow.
- Adapt existing issue Run an external advisory-mode pilot #20 for a 14-day advisory deployment using an attributable released SHA/tag (do not pin an unqualified RC); minimum initial evidence: 5 natural PRs, plus all eligible PRs in the period, including failures and unknowns. Small N is feasibility evidence, not a false-negative estimate.
- Collect exact-head/pr-revision identifiers, covered/unsupported input, full raw evidence, reviewer adjudications (blind to preferred outputs where feasible), workflow timing, setup effort, human triage, and concrete repair actions. No automatic merge blocking.
Exit: 1 externally governed repo operating OVK on normal work and a reviewer willing to adjudicate actual findings. If no design partner accepts, document the reasons and revisit the wedge instead of expanding infrastructure.
Workstream B — trustworthy product workflow
- Audit the existing FastAPI authorization profile and the evidence bundle against a reproducible real-world PR. Distinguish what a PASS establishes over the extracted representation from what is known of the actual source.
- Define a single end-to-end pilot acceptance test: natural PR -> extraction/coverage -> bounded check -> evidence + unknowns -> reviewer decision -> report, with no false allow on incomplete/unsupported input.
- Review draft research: predecessor-bound guarantee transport admission (non-controlling) #179 against issue refinement: bind reused PE evidence to durable guarantee claim compatibility #178. Reuse predecessor-bound guarantee continuity if warranted, but keep the new transport eligibility non-controlling pending source-to-model/provenance and policy qualification. Do not turn human-readable changes into a machine theorem.
- Produce a reviewer-readable guarantee diff for one supported claim if existing code allows it. If this needs significant new engineering, implement only after observing actual pilot need; prioritize clarity of scope over a broad dashboard.
Exit: an external reviewer can understand, audit, and disagree with each bounded finding; guarantees and residual unknowns are explicit.
Workstream C — engineering governance, release and research containment
- Classify open PRs into
customer-product,research-valid,historical/superseded,release-blocker, orevaluation. Research drafts experiment: RTK sealed evaluation — post-audit structural consistency record #174–research: prove adaptive checker read-trace locality with negative lookups #215 are not production-release milestones by default. Preserve reproducible historical traces. - Reconcile issue Release blocker: protect main and v* release tags before v1.3.0-rc.1 #25 and Audit the next OVK release candidate #21 with live branch/tag protection, release tag existence, immutable source identity and release ledger. No publication or strict enforcement on undocumented evidence.
- Put all research work behind one question: which single missing theorem/refinement or controlled experiment changes a customer-relevant applicability decision? The current research: bounded Lean semantic-support soundness and historical-certificate oracle #195 read-trace/checker correspondence remains an open scientific obligation, not a dependency for a conservative advisory pilot.
- Preserve blinded/prospective research: independently adjudicated RTK transport experiment — execution gate #177 evaluation eligibility. Development fixtures and known controls are excluded from confirmatory metrics.
Exit: an authoritative status table with product claims, evidence quality, open assumptions, exact live release identity, and one research GO/NO-GO decision.
30 / 60 / 90-day gates (targets, not promises)
| Gate | Customer evidence | Product evidence | Commercial decision |
|---|---|---|---|
| 30 days | 1 external pilot running on natural PRs | End-to-end advisory evidence with adjudicated coverage/unknowns | Problem and buyer mapped |
| 60 days | Aim for 2 genuinely external users/organizations | At least one cross-revision guarantee case independently inspected; empirical triage costs measured | Proposal for a paid continuation |
| 90 days | Repeat usage and engagement, or documented failure | Qualified narrow supported envelope with unresolved cases reported | One paid-pilot decision; pivot wedge if no meaningful use or buyer |
No universal 5% false-positive threshold from a tiny sample; report numerator, denominator, source-profile support coverage, uncertainty and failure modes. Safety release gates are separate from commercial acceptance.
Four leadership metrics (review weekly)
- Actual independent adoption: organizations using OVK in normal engineering work; fraction of real eligible PRs observed.
- Justified decision quality: human-adjudicated relevant findings, unknowns, missed issues discovered through independent review; never treat absence of detected misses as a population safety guarantee.
- Workflow economics: setup effort, per-PR compute, active reviewer minutes, rework from false alarms and review/reverification avoided, paired where possible.
- Paid validation: count of buyer commitments, paid pilots, renewal/expansion decisions (zero until established).
Scope guardrails / stop list
- No generic checker proliferation, new source languages, self-authorizing
VALID, new theorem-only PR without a specified actual-kernel bridge, or dashboards without a real reviewer. - Do not merge the Lean research stack wholesale, infer customer accuracy from in-repo benchmarks, reuse holdout cases during development, or describe conservative unknown as a passing proof.
- Keep clean separation between signed provenance, extracted source-model fidelity, checker result, historical-evidence transport and human relying policy.
Linked work already in progress
- Run an external advisory-mode pilot #20 — external advisory pilot (execution)
- Add one external agent-authored PR fixture #19 — external agent-authored PR fixture (only if legitimately external and appropriately consented)
- refinement: bind reused PE evidence to durable guarantee claim compatibility #178 and draft research: predecessor-bound guarantee transport admission (non-controlling) #179 — durable guarantee compatibility and predecessor-aware transport
- Release blocker: protect main and v* release tags before v1.3.0-rc.1 #25, Audit the next OVK release candidate #21 — release and repository governance
- research: independently adjudicated RTK transport experiment — execution gate #177 — independently adjudicated applicability evaluation
- research: bounded Lean semantic-support soundness and historical-certificate oracle #195, security gate: qualify Lean certificate transport on patched kernels and independent checkers #205 — actual-kernel support and security qualification
- Draft research: prove adaptive checker read-trace locality with negative lookups #215 (stacked on research: extract checked Lean definition closure and independently validate graph consistency #214 → research: observe transitive Lean dependency drift before historical certificate replay #213 ...) — research-only, machine-checked abstract read-trace locality, no proof of real-kernel transport
Ownership and decisions
No individual owner or customer's commitment has been verified. Assign explicit owners for customer discovery, product engineering and research once staffing is confirmed. At the weekly leadership review, update every workstream with evidence / blocker / decision / next action; do not count green research CI as customer-value attainment.
Go: a real team repeatedly uses and values the narrow evidence workflow. Revise: technical signal exists but installation or reviewer workflow fails. Stop/pivot: no willing buyer or persistent external use despite targeted discovery, regardless of research depth.
Activity
fraware commentedon Oct 15, 2026
Product milestone checkpoint — 15 October 2026. Draft PR #218 is stacked on existing non-controlling guarantee transport PR #179, and implements an advisory reviewer record from source/target guarantee assurance snapshots and signed PE evidence. It does not create a new eligibility checker or promote historical evidence reuse to authority. The machine-readable/Markdown outputs separately state (i) recorded current source/target typed-machine-claim status; (ii) conditional historical predecessor-transport eligibility and precise reasons; (iii) unverified Git-manifest authority; (iv) no live expiry/revocation decision; (v) source-semantics refinement unproved; and (vi) production reliance false. Synthetic signed integration scenarios exercise unchanged guarantee, changed statement, changed assumptions, wrong key, unknown target state, and CLI report generation. Pilot demo guide.
Current qualification: exact-head CI at
f05bdf8a67b850b49a79c2f39b01042eccf2d66eis running, not yet claimed green. Treat this as in-progress implementation, not independent customer validation. Still zero independently agreed external pilots. Once code qualifies, the next value gate is an actual-source/profile-coverage dry run on a consented external PR, with an external reviewer judging the report's usefulness and recording time/cost/unknowns. Do not prioritize a new research branch ahead of that external pilot.fraware commentedon Oct 15, 2026
15 October product milestone — qualified advisory reviewer artifact. Draft PR #218, head
93799e4156844d85baa5432ed23c76d21a5fb726, is fully green: six-job CI (2,614 passed, 36 skipped, 13 warnings), Assurance Product Qualification, Native Tier 1, Native Tier 1b. Seven new signed-evidence reviewer integration tests passed, including a real CLI subprocess producing JSON and Markdown.Four-file change, stacked on non-controlling #179, draft/unmerged. It separates recorded typed-machine-claim statuses from conditional historical-evidence transport, shows field-level changes in caller-supplied guarantees (statement vs assumptions), reports gate rejection reasons, and explicitly disclaims live state rechecking, authentic governing Git manifests, expiry/revocation, source-language semantic refinement, and production reliance. No production decision code changed.
Milestone interpretation: Internally reproducible reviewer-interface demonstration COMPLETE. Independent customer problem validation, actual FastAPI source coverage, reviewer adoption, paid interest, and measured engineering savings remain NOT ESTABLISHED. These synthetic development cases are excluded from independent holdout scoring (#177).
Next executive action: recruit a consenting independent repository owner/reviewer under #20, screen supported source profiles on natural PR flow, and evaluate the reviewer report on actual records with time/unknowns/errors retained. Do not let another formal research PR displace this customer-value gate.
fraware commentedon Oct 15, 2026
Strategic launch audit, 2026-10-15. Newly verified release facts and remediation are recorded in #25 (including unprotected main, nonexistent RC tag, unsigned historical annotated tag and non-immutable historical Release, documentation and action install ambiguity). Business reality: GitHub repository public metadata currently reports 1 star and 0 forks; zero independent external pilots and zero verified paying customers. Stacked #179/#218 is fully green but still draft/unmerged, and the new demonstration requires six artifact inputs and a local key, with a script outside package console entrypoints. A marketed ready-to-install app would currently overstate launch maturity.
Proposed product distribution decision: open-source CLI + GitHub Action first; one narrowly supported advisory guarantee diff in real PR flow; private GitHub App only after independent pilots; public Marketplace App/hosted dashboard after repeat usage and security/service hardening. Compete on machine-checkable guarantee continuity with explicit unknowns, not generic AI review or generic security scanning. Public README/installation and license/docs cleanup, exact release attestation, at least one consented real external pilot and honest source-profile coverage precede public launch. Proposed 30/60/90 gates remain in #216; do not merge exploratory research stack just to create marketing inventory.
fraware commentedon Oct 15, 2026
Triple-check readiness audit — 15 October 2026 (live GitHub, exact-code, documentation and outside state of art)
Executive decision: GO for a controlled, consented, non-blocking reviewer demonstration; NO-GO for production reliance, strict required checks, a new public RC release, claims of independent customer efficacy, or broadly sound replay-free certificate transport. Keep those decisions separate.
Verified product code: draft #218 corrected head
9a8b820fa215e7795ca2e11dadcfd58633581766, stacked on draft #179, unmerged. Exact-head CI 38810850715 is successful: all six jobs, 2616 passed, 36 skipped, 13 warnings. Product qualification and Native Backends Tier 1/1b all success. One meaningful audit defect fixed: invalid/inconsistent supplied snapshots could have displayed recordedestablished. The report now showsuntrusted_snapshotwith structural issue codes; two new adversarial tests pass. Transport remains non-controlling. The report consumes caller-selected specifications and HMAC-signed evidence and DOES NOT authenticate actual governing Git manifests, perform current-time revocation/expiry review, independently re-prove source semantics, or authorize production use.Verified repo integrity:
mainbranch object explicitlyprotected=falseandprotection.enabled=false; repository rulesets[]. Existing annotatedv1.2.1tag Git verificationverified=false, reason=unsigned, targeting commita27d5720f4350c00bca34f71d991c31f5a2f38c7; published GitHub release objectimmutable=false. Release assets contain separate signing-related files; their independent cryptographic verification has not been performed in this audit. Neither tag signing nor immutability may be claimed. Nov1.3.0-rc.1Git tag or GitHub release exists; #25 remains a blocking governance issue. Draft correction #219, based onmain, updates README, release notes/status, pilot cases and pilot playbook. The previous docs describedv1.2.1as signed/immutable; the pilot playbook promoted strict following a small under-5%-false-positive rate. Both claims/decision rules are unsafe. #219 exact-head CI/repro qualification must be checked before merger.Key security constraint:
ovk/core/attestation_signing.pyuses HMAC-SHA256; the CLI's--signature-key-filerequires the same secret used by the signer, not a publishable verification key. NEVER put that secret in untrusted pull_request workflows, public artifacts, independent reviewer machines, or disclose it to pilot users. A local trusted-reviewer demo is permitted; production multi-tenant trust needs a separate verifier/signer authority design.Product/market qualification: pilot registry remains 2 maintained consumer fixture reports, one in-repo fixture and a first external adopter row
recruiting. No external buyer, deployment, consent, source-profile coverage on real PRs, independent adjudicator, or paid outcome has been established. FastAPI Protected Effects source extractor is explicitly experimental, with narrow unsupported control flow, local semantic assumptions, and UNKNOWN handling; a signed proof of typed Assurance IR is not a proof of arbitrary Python or English guarantee.Research qualification: #212–#215 provide model-relative theorems and exposed patched-Lean development experiments. #195's real-kernel semantic support/refinement obligation, #177's blinded prospective independent applicability evaluation, and #205's security/checker qualification remain OPEN. Do not count green Lean builds or 3 synthetic replay controls as a population false-reuse estimate, checker equivalence, source refinement, or minimal repair.
State of art, checked against contemporary official docs: GitHub CodeQL performs PR-integrated source scanning; Certora has mature machine-checkable property specs and SMT-based contract verification; AWS Bedrock Automated Reasoning now has policy/source-document fidelity reports and explicitly scopes VALID to translated policy variables; SLSA provenance formalizes artifact/builder/source binding and verifier trust. Lean4Lean already proves typing/equality monotonicity for a specified abstract environment extension. The defensible research wedge is claim-conditioned cross-context applicability + smallest sound revalidation/repair, not generic scanning, evidence graphs or environment monotonicity.
Immediate owners/actions (not assumed assigned): (1) maintainer release admin: enable and live-audit main/tag protection, qualify and cryptographically sign a future exact tag; (2) engineer: review #218/HMAC source-attestation boundary and #219 corrections; (3) product lead: secure one consenting external organization, qualify the supported claim on all naturally arriving PRs, document unknowns/false alarms/missed defects, capture reviewer minutes and setup costs; (4) research lead: refrain from new theorem-only PRs until a real-checker correspondence GO decision and independent cohort are defined.
Audit limitation: GitHub source, diffs, Git-object API, workflow metadata and hosted logs were inspected. I cannot independently run the full repository outside GitHub Actions in this environment because the container cannot resolve GitHub; nor did I verify release asset Sigstore bundles or repository-admin configuration outside the exposed GitHub API. No claims are made beyond those checks.
fraware commentedon Oct 15, 2026
Triple-check addendum (15 Oct 2026): additional defects found and patched, still draft/unmerged.
652e158146a4711bf4f94422efe62c8e8df5772d: the prior circular false-positive estimator is removed, and a second hidden path that auto-consumedexternal_pilot_report.jsonfrom downloaded artifacts is also removed. Such embedded files must never supply error rates orstrict_enabledwithout explicit separate selection. A selected--reportnow rejects mismatchedrepositoryinstead of overwriting the CLI's authoritative--repo; new tests exercise embedded forged metrics, cross-repository spoofing and the matching legitimate case. Pilot workflow examples now pin full historical OVK Action SHA and full audited checkout/upload-artifact action SHAs, while documenting unpinned transitive dependencies. Exact-head CI/Repro pending. A manually selected self-report is still self-reported, not independently ground truth.9a8b820fa215e7795ca2e11dadcfd58633581766: structural invalidity of source or target guarantee snapshots forces displayeduntrusted_snapshot, instead of merely showing a forgedestablishedstate while the underlying gate rejects it. Fully green: 2,616 tests passed / 36 skipped / 13 warnings and dedicated product/native workflows. HMAC signing and checking use the same shared secret; never copy it into untrusted PR jobs/reviewer artifacts. Still synthetic and non-controlling.795811a624e0db9889e975a1be51d5a6409f6fec: corrects historical Git-tag unsigned/unprotected-release docs, installer examples and integration-guide misuse of “signed”v1.2.1; README now points first-time adopters to the controlled advisory pilot instead of the unpublished strict RC consumer template. PR docs: correct unsigned release-tag claims and unsafe pilot promotion guidance #219 intentionally does not duplicate PR fix(pilot): prevent circular false-positive metrics and unsafe strict promotion #217's playbook rewrite. Exact-head CI/Repro pending.Leadership gate: No merge, strict enforcement, public new release, or claimed independent calibration on green draft research CI alone. Product owner and independent reviewer recruitment under #20 is still the real next milestone; #25 branch/tag rules remain unprotected and block attributable release.
fraware commentedon Oct 15, 2026
Developer-first launch execution checkpoint — October 15, 2026. Draft PR #220 is stacked directly on main, with current review head
525a854df31c604215c8ea2c5f96654f609c8ef3. The work hardens explicitly requested Action installation to fail closed, adds executable negative-path tests, restores the full Apache-2.0 license and copyright NOTICE, corrects release/security provenance, replaces the unusable strict external-consumer example with a least-privilege advisory-only example, and removes active pilot workflow references to the nonexistent RC tag. The oldv1.2.1Action still has fallback behavior; the docs now disclose this instead of attributing PR #220 safety changes retroactively. Launch acceptance checklist and developer activation issue #221 translate this to a first-user and repeat-use gate.An earlier commit's CI run 38812801585 passed 2,601 Python tests, 36 skipped, 13 warnings and all six original installer-contract tests; it is NOT final-head qualification. Current CI 38815434102 and six-cell Repro 38815434088 are still queued as of this note. All final-head checks must pass before merge.
Value roadmap: one reproducible, safely scoped real-PR report → consenting external review (#20) → demonstrably repeated installs → authorized OSS preview and shareable evidence receipt. No paid users, independent customer deployment, verified release, strict profile, or production historical-proof transport is claimed. Administrator action on protected branch and release tags remains blocked under #25. Do not launch a public hosted app or GitHub Marketplace App until actual user demand and security operations justify it.
fraware commentedon Oct 15, 2026
New release-bound provenance obligation found during first-user audit (15 Oct 2026): issue #222 documents the real
pull_requestevent distinction between PR head SHA and synthetic merge-preview SHA. Inaction.ymlthe default diff compares base with PR head, while later evidence and GitHub check paths usegithub.sha(merge-preview SHA). No exploit or confirmed false acceptance is claimed; this is a source-/evidence-subject correspondence gap to resolve with precise identifiers and adversarial tests before distributing portable "verified PR" receipts or enabling strict checks.Latest launch-hardening head: draft PR #220 at
525a854df31c604215c8ea2c5f96654f609c8ef3, still unmerged and awaiting GitHub Actions runners. CI 38815434102 and Repro 38815434088 remain queued, so old green runs do not qualify this head. The existing publishedv1.2.1Action retains the old fallback; docs now disclose it.Priorities: preserve one frozen exact-head PR until runner-backed tests finish; independently verify #25 protection administration; resolve #222 source/head/merge-binding before PR claim-sharing; and use #221 for a real external first-run with evidence/unknowns and consent under #20. Avoid expanding checker count, hosted app infrastructure, or public marketing before those gates.
fraware commentedon Oct 15, 2026
P0 integration / sequencing decision (2026-10-15). Two launch-critical PRs are intentionally independent drafts against main, not simultaneously releasable:
9d0cfd95ba1f8d002e20d564765a67efe632e6caare pending.Safe merge order once all checks and human reviews qualify:
mainandv*through active administrative rulesets, read back effective settings and permitted bypass roles (Release blocker: protect main and v* release tags before v1.3.0-rc.1 #25).mainSHA, carefully reconcile bothaction.ymlinstall and source-identity changes, and update the copyable external advisory workflow to explicitly check outref: ${{ github.sha }}withfetch-depth: 2for a normal PR. Run all unit, gates, package, Action default/strict dogfood, six-platform Repro, and clean-outside-checkout install tests on that integrated SHA.Do not treat two independently green PRs as proof that their merged diff is safe. Publish the actual integrated release candidate only after cross-PR tests and administrative provenance closure. This sequence prioritizes one safely installable product with real reviewer value over more research PRs.
fraware commentedon Oct 15, 2026
Operating checkpoint — 2026-10-15.
e690b02e68b9866eed55b36bcf01c8ef59de958f: all six CI jobs successful (2,632 passed, 36 skipped, 13 warnings) and six-platform reproducibility successful. Bounded source/diff and installer checks are development-qualified only.9a44ddd290ec5b220ead088a4a8173eaf0110005: reconciles fix(pilot): prevent circular false-positive metrics and unsafe strict promotion #217 pilot evidence integrity, docs: correct unsigned release-tag claims and unsafe pilot promotion guidance #219 release truth, and the dogfood collector/renderer. Old fixture-derived zero false-positive/false-negative claims are corrected tonull/unknownin normalized data and archival interpretation reports, retaining raw historical evidence. Self-reported reviewer claims remain unauthenticated. Exact-head CI/repro queued at this checkpoint; do not count earlier intermediate runs, including known failing development tests, as final qualification.main protected=false, rulesets[], unsigned historical annotatedv1.2.1Git tag,Release.immutable=false, and nov1.3.0-rc.1tag. Issue Release blocker: protect main and v* release tags before v1.3.0-rc.1 #25 remains public-release NO-GO and requires GitHub administration unavailable to this integration.Keep all source and cumulative branches draft/unmerged until independent review and exact-head gates succeed. No tag, release, admin settings, or production reliance changed.
fraware commentedon Oct 16, 2026
Independent advisory pilot prospect screening — 2026-10-15 (public GitHub evidence only)
Screening method: inspected repository metadata and public PRs created 2026-10-01 through 2026-10-15, excluding Dependabot (bot-authored results may still exist). These are uncontacted prospects, not willing partners, and none has undergone a source-profile eligibility or consent review. PR counts below refer to observed human-authored submissions in this period, not verified unique security-relevant changes or forecast future activity.
igorbenav, addressing OAuth, disabled accounts, migrations and auth/session flows; e.g. #56 and #59Down-ranked under the 14-day natural-PR design: ivan-borovets/fastapi-clean-example (strong contextual RBAC technical fit, 1 observed October PR); yezz123/authx (observed recent PRs are automated dependency updates; 0 non-Dependabot in queried window). Both remain possible but do not establish sufficient current natural-PR throughput.
Decision protocol before any outreach or installation:
No external organization was contacted. This is a candidate shortlist and screening evidence for workstream A, not proof of adoption.
fraware commentedon Oct 16, 2026
Product steering checkpoint — distribution + reusability (2026-10-15)
Governing constraints: maximize independent developer-to-developer distribution and cross-repository reuse of source-scoped claims and evidence. Scientific validity, provenance, unsupported coverage and honest relying policy are non-negotiable. A viral but falsely source-bound "PASS" is a negative outcome.
Evidence-driven wedge review:
Immediate contribution: draft #226 closes a real distribution hazard in the Action: caller-selected multi-lane manifests bypass source-binding yet previously emitted PR Checks/comments and
allowoutputs. The new branch prevents public emission, suppresses Action-level allow, refuses strict for unbound manifests, clears stale generated artifacts, and leaves scoped local advisory verification available. Parent draft #225 completed exact-head CI at49a9e910(cross-platform repro still running during this note). #226 exact-head CI/repro are still queued. All are unmerged and no release/strict authority exists.Distribution experiment, once the release/ref gate and consenting source eligibility are satisfied:
No-go conditions: #25 still reports unprotected
mainand unsigned historical tag; no authorized RC; #20 lacks a consenting independent pilot; #195 lacks real source/checker refinement; #177 lacks a separately adjudicated historical-applicability oracle. Draft green CI is development evidence, not a release or a market experiment.Decision: stop widening research features. Qualify the publication boundary, finish release administration, recruit an independent consenting maintainer, and measure reuse/viral adoption on real PRs before investing in a broader public interface or service.
fraware commentedon Oct 16, 2026
Real-PR source-subject correction and distribution feature — Oct 15, 2026
The first read-only job-summary dogfood CI #38830701134 failed for the correct reason: receipt's synthetic merge-preview SHA differed from the OVK EvidenceBundle subject SHA. The artifact review and root cause (event
pull_request.head.shaoverwrote explicitgithub.sha) are preserved in #222.A corrected intermediate implementation passed true GitHub PR dogfood in CI #38839898034, and I downloaded artifact
12021550038to check exact agreement: evaluated checkout = receipt subject = evidence bundle subject =9af58527fa069420392cbb99aaa34b63199acfe8; distinct contributor PR head =b7020afa50db8d6b25d52d7f1c697d2424f01cbd. These are local structurally observed identities, not signed/canonical source-to-model correctness.Final proposed draft head:
5a17d08884bfd8fffd0b3f18db2b82bf64d63391adds real two-parent Git adversarial tests, opt-inovk check --source-bindingvalidation, default caller compatibility, portable standard-library Markdown summary, and explicit limitations. Exact-head CI 38840137045, six-cell Repro 38840137072, Native Tier 1 38840137051 remained queued at checkpoint; Native Tier 1b 38840137188 completed SUCCESS. None of the queued workflows is counted as passing.The next measurable viral/reuse event is one independent consenting maintainer encountering a bounded, accurate, source-identified result in a natural PR and then a second engineer reusing it in a later PR. We have zero qualifying independent maintainer adoptions/second-PR proof. The current historical Action v1.2.1 and unsigned/unprotected refs remain NO-GO for broad outreach or production reliance; admin issue #25 and scientific #195/#177 remain open.
Keep #225, #226 and #227 draft/unmerged pending independent review and governance; no public release or assumed vulnerability-prevention rate.
fraware commentedon Oct 16, 2026
Oct 15 product gate — source-scoped shareability implemented, adoption not yet demonstrated
Qualified upstream: draft #225 exact head
49a9e910, draft #22652ab39d3, and draft #2275a17d088all have completed successful exact-head CI/repro (and #227 both required native backend suites). All are draft/unmerged.Why new draft #228 exists: #227 real Action dogfood generated correctly scoped GitHub job text, but its downloadable artifact omitted that readable summary; the older
ovk-pr-comment.mdstatedMerge recommendation: allowwithout those source/reliance caveats. Draft #228 packages the same validated source/decision-limited text inovk-advisory-pr-summary.md, without raw source excerpts, Check write permissions, or PR comments.Real execution evidence: draft #228's intermediate Action CI #38853750067, artifact id
12026102979, includes the portable 1,367-byte Markdown alongside the evidence and receipt; measured SHA-256 of uploadedovk-evidence.jsonequals the digest printed in the Markdown, and the merge-preview subject agrees with the source receipt. The portable report explicitly refuses whole-PR security certification or merge authority. Further hardening removed.ovk-pr.difffrom the uploader's configured path altogether, so raw PR source need not travel to a third-party reviewer. This changed candidate source; the final #228 exact-head CI/repro/native matrix is still queued and must pass before review.Bottleneck now: administrator-controlled main/tag protection #25 remains absent in live API (unprotected
main, rulesets=[]). I provided exact admin handoff there; the connected GitHub app cannot change repository rulesets. No release or strict reliance.External pilot: zero consenting independent maintainers, zero measured second-PR use or teammate adoption. Maintained consumer repo
fraware/ovk-consumer-fastapi-terraformcurrently has an older workflow pin and write-scopedpull-requests:write/checks:writepermissions; changing it to test this unreleased draft would trigger older PR workflows and could publish misleading historic checks. Do not treat that as independent user demand or install a new unapproved workflow. Test first with consent and governed read-only configuration after ref-release gates.Distribution metric to record prospectively: consented outside-team install → correctly scoped first natural PR observation → independent reviewer reads/cross-checks the portable report → second natural PR → second engineer or repository voluntarily reuses a claim with explicit applicability. Separate supported/unknown PR denominator, reviewer minutes, adjudicated errors, and user willingness to pay; stars/downloads are not validity evidence.
fraware commentedon Oct 16, 2026
Usability/distribution milestone — static public resource explorer (#229)
New draft PR #229 builds a real first frontend for OVK. The repository's
mainhas no frontend or GitHub Pages deployment; this work is an independent site-only draft frommain@79370539ca9b26a0a6b01f6ac6ab6923243f40f4, not a live hosted service or a release of verification code.User value: responsive, restrained UI; curated client-side search of 51 actual repository documents/examples/templates; immediate suggestions, category filters, keyword synonyms (e.g. authentication→authorization), keyboard navigation, zero-result recovery and source links. Two draft-only documents are explicitly marked Development draft and pinned to exact #228 SHA; source links are not fabricated. Readers can discover supported checkers, application/source contracts, evidence applicability research, release limits, and read-only advisory setup from one place.
Technical execution: no backend, login, analytics, external script/font/CDN, secrets, GitHub API requests or hosted state. Search text uses DOM
textContentto avoid HTML injection. The frontend never claims to evaluate uploaded PRs, certify a result, or grant merging authority. The static site can be previewed fromsite/index.htmlwithout installing packages. GitHub Pages is disabled; public deployment must be authorized separately.Tests: desktop 1440px and mobile 320–1440px Chromium smoke locally exercised search, navigation, copy, keyboard, empty states and no JS exceptions; a discovered 320px overflow was corrected. Site-only GitHub Actions workflow runs read-only syntax and indexed-resource/source path contract checks. The precise development candidate remains open/draft; check exact-head workflow conclusions at review time.
North Star impact: turn disconnected formal-verification assets into searchable, approachable, source-linked knowledge that external engineers and agents can reuse. This is an activation/discoverability precursor, not evidence of organic adoption or cross-repository certification. Next product milestone remains an independent consenting maintainer's real PR plus repeat use; site traffic or stars alone are not proof of useful verification. Do not call the user interface a production verification platform until a real evidence backend, authentication, privacy boundaries and independent reliance policy are designed and qualified.
Issue #25 ref governance and verification PR #228 still require independent review. #229 may be reviewed separately without altering the engine or release chain.
fraware commentedon Oct 17, 2026
2026-10-17 North Star execution — full draft inventory and constrained 14-day plan
Live state, confirmed by GitHub API:
main=79370539ca9b26a0a6b01f6ac6ab6923243f40f4,protected=false, repositoryrulesets=[]; latest releasev1.2.1remains associated with an unsigned tag. 85 open PRs, all draft, no verified independent customer in the pilot tracker.Inventory of all 85 PRs (classification by PR number/title/base branch, for triage only; NOT a file-by-file merge/duplication determination):
Candidate precision:
837c931d059f74dcda06432d83f5bde759f53d0a: 104 commits, 49 changed files relative to main. All four exact-head workflows completed SUCCESS, including real GitHub Action dogfood, six-platform reproducibility and native suites; report is an unsigned advisory observation only. Zero independent submitted GitHub reviews verified.59be60c89c1382a9bcc01b73994846d60cac9b23: 20 commits, 9 changed files relative to main, site-quality/CI/Repro all SUCCESS. Frontend is a static curated search of 51 linked resources, not a live guarantee/evidence dashboard. Zero independent submitted reviews, and GitHub Pages off.LICENSE(replaces short Apache reference with standard full license text) and addsNOTICE; both need ownership/third-party attribution review, not just runtime CI.Single accountable launch-review workstream: #230 records four required independent roles (source security, UX/accessibility, release/provenance, outside pilot). No approvals or named reviewers have been fabricated. Do not request external PRs or consent on their behalf.
14-day actions, October 17–31:
mainandv*protections per Release blocker: protect main and v* release tags before v1.3.0-rc.1 #25. Review Launch gate: independent security, UX, provenance and external-pilot reviewers #230 acceptance protocols, including source-profile partial-YAML uncertainty from Run an external advisory-mode pilot #20. Record review outcomes, not only checkmarks.Product decision rules: The first useful artifact must be a correctly scoped claim/revision/evidence record understandable by another engineer, with an actionable next step. Organic distribution success is second natural PR + second developer reuse, not a shareable green badge or GitHub stars. The scientific moat remains independently justified evidence applicability with minimal sound repair (#177, #195), not additional unsupported checker families. Avoid creating more feature PRs until the review/first-user bottleneck is resolved.
NO-GO remains: no merges, new strict reliance, claimed signed production proof, unreviewed public rollout or retroactive v1.2.1 trust assertions. Issue #230 is a gate, not review success.