Conversation
ci#50 accepted the module-owned lineage step but did not require it, so a publisher without it (edge-proc, assay) still passed. Every publisher job must now open with the exact release-lineage / release-provenance call; its absence, or placing it after the candidate download, is a `publisher-lineage` finding. The fleet_policy bridge fixtures and the docs' Python publisher example asserted lineage-less publishers as compliant; both now carry the step. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
hseshadr
added a commit
that referenced
this pull request
Sep 26, 2026
Brings in #47 -> #48 -> #50 -> #52 so this PR merges last without conflicts. Their README lines move to the new layout: the consumer list (now with agentic-context-service and agentic-saga), the uncovered-consumer failure and the required-minimum pin floor go to docs/ARCHITECTURE.md "What dagger call fleet checks", with plain one-line versions in the README intro. Publisher lineage and the dagger-args-expression rule are noted there too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
ci#50 made publisher lineage a module function and taught the fleet policy to accept it, but not to require it. A publisher with no lineage step still passed (edge-proc and assay today). This makes the lineage step mandatory: every publisher job must open with the exact
release-lineage/release-provenancecall, and its absence, or placing it after the candidate download, is apublisher-lineagefinding (central lineage step required first).Claim touched: "a publisher only publishes bytes whose candidate run GitHub itself proves came from
main" (#49).Merge order (do not merge early)
Stacked on #50 (
feat/release-lineage-module). Merge only after #50, and after all four consumers have adopted lineage onmain: edgeproc-core#60, privacy-core#49, edge-proc (fix/publish-lineage-module), assay (fix/publish-lineage-module). Merged earlier, the fleet scan goes red for those four on purpose.Evidence
poe gategreen, 97.54% coveragestep is None -> ())mainworkflows under this policypublisher-lineageonly in assay (2 jobs), edge-proc, edgeproc-core, privacy-core; 0 in the other 5 consumersgit merge-treevs #47, #48, #51, mainContract reversal (read this)
Two existing tests asserted lineage-less publishers as compliant:
test_should_accept_pinned_dagger_ingress_and_exact_release_transports(itsPYPI_BRIDGE/NPM_BRIDGEfixtures) andtest_should_document_source_free_official_pypa_boundary(the Python publisher example indocs/dagger-modules.md). Both are updated, not deleted. The fixtures and the docs example now open with the lineage step. The docs' "Not yet enforced" note becomes "Required".The docs example pins the lineage module at #50's head
3de1c4b. Re-pin it to the ci merge SHA after #50 merges.🤖 Generated with Claude Code
https://claude.ai/code/session_015oBArfm762nN1r4F4Fst5a