From 08115721e94745bae067100bea9d3b969047b82c Mon Sep 17 00:00:00 2001 From: Leif Date: Sun, 20 Sep 2026 10:23:40 -0600 Subject: [PATCH 1/5] Chore: pin Trust 1.2.1 --- .github/workflows/trust.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trust.yml b/.github/workflows/trust.yml index 82c0cf5e..cc4ea4d7 100644 --- a/.github/workflows/trust.yml +++ b/.github/workflows/trust.yml @@ -48,7 +48,7 @@ jobs: # exercising the pull-request binary as the immutable contract gate. - name: CorvidLabs Trust gate id: trust - uses: CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5 # v1.2.0 + uses: CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc # v1.2.1 with: specsync-version: "6.0.0" specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror From a9d3774e743257d97721ec32ae344e2b197ef48e Mon Sep 17 00:00:00 2001 From: 0xLeif Date: Sat, 26 Sep 2026 09:49:56 -0600 Subject: [PATCH 2/5] Add: change record for the Trust 1.2.1 pin Covers .github/workflows/trust.yml with a no-spec-change operations change so the lifecycle audit in trust and Lifecycle gate stops failing closed on #792. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01V3ZZAEiUP7xRJPozhZb6rL --- .../approvals.json | 4 ++ .../pin-the-trust-gate-to-1-2-1/change.md | 24 ++++++++++ .../pin-the-trust-gate-to-1-2-1/context.md | 46 +++++++++++++++++++ .../pin-the-trust-gate-to-1-2-1/plan.md | 29 ++++++++++++ .../pin-the-trust-gate-to-1-2-1/state.json | 33 +++++++++++++ .../pin-the-trust-gate-to-1-2-1/testing.md | 45 ++++++++++++++++++ 6 files changed, 181 insertions(+) create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/change.md create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/context.md create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/plan.md create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/state.json create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/testing.md diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json new file mode 100644 index 00000000..87b9bafb --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json @@ -0,0 +1,4 @@ +{ + "approvals": [], + "reopenings": [] +} diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md b/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md new file mode 100644 index 00000000..db30e8c8 --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md @@ -0,0 +1,24 @@ +--- +id: pin-the-trust-gate-to-1-2-1 +state: draft +type: operations +base_commit: cddc39e478dcc1f111940a3cfb02134bba9804cc +--- + +# Pin the Trust gate to 1.2.1 + +## Intent + +Pin the Trust gate to 1.2.1 + +## Affected Canonical Specs + +- None + +## Acceptance Criteria + +- The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes. + +## No-spec Rationale + +This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected. diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/context.md b/.specsync/changes/pin-the-trust-gate-to-1-2-1/context.md new file mode 100644 index 00000000..22e6aff0 --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/context.md @@ -0,0 +1,46 @@ +--- +change: pin-the-trust-gate-to-1-2-1 +artifact: context +--- + +# Context + +## What led here + +This repository's own Trust gate was pinned to +`CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5` (`v1.2.0`). Trust +1.2.0 nests Augur and Attest at tips that, when run inside Trust, looked for +their release assets in the calling action's repository rather than in +`CorvidLabs/augur` and `CorvidLabs/attest`. `gh release download` then missed +`augur-linux-x86_64` and `attest-linux-x86_64`, and both tools fell back to +compiling Swift from source on every hosted `trust` run. + +Trust `v1.2.1` (`dd52a7a90ffbc1d2b1030e37007c18274f3d96bc`, the peeled commit of +the annotated tag object `25f18128`) re-pins the nested actions to +`CorvidLabs/augur@108a2ff4` and `CorvidLabs/attest@2182cae4`, which set +`RELEASE_REPO` to their own repository and download the prebuilt Linux +binaries. That is the only runtime change between `v1.2.0` and `v1.2.1` +(`action.yml`: two `uses:` lines). + +PR #792 carried the one-line pin but failed `trust` and `Lifecycle gate` +because `.github/workflows/trust.yml` is a meaningful path and no active change +covered it. This change record covers it. + +## Constraints a session picking this up needs to know + +The Trust step here is not a normal consumer pin. The workflow builds the pull +request's own SpecSync binary, packages it as a checksum-protected runner-local +mirror under `${RUNNER_TEMP}`, and passes +`specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror`, +so Trust gates on the pull request's binary rather than on a published release. +`scripts/trust_cli.py`, which resolves and downloads that mirror, is the same +blob (`a82229c5`) at `v1.2.0` and `v1.2.1`, so the mirror path is unchanged. + +## Ruled out + +Trust `v1.2.2`. Its only runtime change re-pins Augur to a tip that reports a +failed prebuilt download on Darwin/arm64 accurately; it does not affect the +Linux runner this workflow uses. Moving to it is a separate change. + +Changing `specsync-version`, the mirror packaging steps, or the +`specsync change audit --strict` preflight. None is stale. diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/plan.md b/.specsync/changes/pin-the-trust-gate-to-1-2-1/plan.md new file mode 100644 index 00000000..a23a7ab5 --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/plan.md @@ -0,0 +1,29 @@ +--- +change: pin-the-trust-gate-to-1-2-1 +artifact: plan +--- + +# Plan + +Single edit, one file, one line. + +1. In `.github/workflows/trust.yml`, change the `uses:` ref on the + `CorvidLabs Trust gate` step from + `CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5 # v1.2.0` + to + `CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc # v1.2.1`. + + The SHA is the peeled commit of the annotated `v1.2.1` tag, not the tag + object. The SHA-plus-comment pin style is kept, and the pin stays immutable + rather than moving to the `@v1` major channel. + +2. Leave every other line of the step untouched, specifically + `specsync-version: "6.0.0"` and + `specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror`. + +## Explicitly out of scope + +No spec text changes, which is why this change was opened with +`--no-spec-change`. No module contract, public API, or runtime behavior of the +published `specsync` binary or the published Action is affected. This is the +configuration of the gate that runs on this repository's own pull requests. diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json new file mode 100644 index 00000000..fad3c729 --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json @@ -0,0 +1,33 @@ +{ + "schema_version": 1, + "workflow_version": 2, + "workflow_origin_version": 2, + "id": "pin-the-trust-gate-to-1-2-1", + "slug": "pin-the-trust-gate-to-1-2-1", + "title": "Pin the Trust gate to 1.2.1", + "description": "Pin the Trust gate to 1.2.1", + "kind": "operations", + "state": "draft", + "base_commit": "cddc39e478dcc1f111940a3cfb02134bba9804cc", + "created_at": 1790437668, + "updated_at": 1790437718, + "affected_specs": [], + "affected_paths": [ + ".github/workflows/trust.yml" + ], + "no_spec_change": true, + "no_spec_change_rationale": "This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected.", + "acceptance_criteria": [ + "The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes." + ], + "selected_artifacts": [ + "context", + "plan", + "testing" + ], + "dependencies": [], + "answers": { + "architecture_risk": "no", + "public_contract": "no" + } +} diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/testing.md b/.specsync/changes/pin-the-trust-gate-to-1-2-1/testing.md new file mode 100644 index 00000000..7e1818f8 --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/testing.md @@ -0,0 +1,45 @@ +--- +change: pin-the-trust-gate-to-1-2-1 +artifact: testing +--- + +# Testing + +There is no unit test for a CI pin. Verification is a source comparison of the +two Trust revisions plus the hosted run itself. + +## Verified before the ref was changed + +- `gh api repos/CorvidLabs/trust/commits/v1.2.1` resolves to + `dd52a7a90ffbc1d2b1030e37007c18274f3d96bc`; the `v1.2.1` ref points at tag + object `25f18128`, which peels to that commit. +- `gh api repos/CorvidLabs/trust/compare/fcc889f5...dd52a7a9`: the only + `action.yml` change is the nested Augur pin (`25ef9339` to `108a2ff4`) and + the nested Attest pin (`e8a2d928` to `2182cae4`). +- `scripts/trust_cli.py` has the same blob SHA (`a82229c5`) at both + revisions, so the `file://` SpecSync mirror resolution, checksum + revalidation, and `specsync-download-base-url` input are unchanged. +- `action.yml` at `CorvidLabs/augur@108a2ff4` and + `CorvidLabs/attest@2182cae4` sets `RELEASE_REPO` to its own repository and + selects `augur-linux-x86_64` / `attest-linux-x86_64` on x86_64 Linux, + falling back to `swift build` only when that download fails. + +## Verified locally on the committed tree + +- `.github/workflows/trust.yml` still parses as YAML. +- The product diff against `main` is one changed line in one file. +- `fledge lanes run pre-push` passes. + +## Verified on the hosted run + +The pull request's own `trust` check is the real test. A passing run proves +that Trust 1.2.1 resolved, installed SpecSync 6.0.0 from the `file://` mirror, +accepted the locally built archive's checksum, and ran the contract, risk, and +provenance stages. Its log should show `Installed augur (augur-linux-x86_64, +1.0.0)` and `Installed attest (attest-linux-x86_64, 1.0.0)` with no Swift +source build. + +Both `trust` and `Lifecycle gate` run `specsync change audit --strict` before +the gate itself, which is why this change record exists: +`.github/workflows/trust.yml` is a meaningful path and the audit fails closed +when no active change covers it. From 038180bd8f7e6a6dee4e15fdb7e6694af38fe0a8 Mon Sep 17 00:00:00 2001 From: 0xLeif Date: Sat, 26 Sep 2026 11:17:52 -0600 Subject: [PATCH 3/5] chore(lifecycle): materialize pin-the-trust-gate-to-1-2-1 --- .../approvals.json | 33 ++++++++++++++++++- .../pin-the-trust-gate-to-1-2-1/change.md | 2 +- .../pin-the-trust-gate-to-1-2-1/state.json | 5 +-- .../verification-attempts.json | 21 ++++++++++++ .../verification.json | 16 +++++++++ 5 files changed, 73 insertions(+), 4 deletions(-) create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json create mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json index 87b9bafb..60f5d187 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json @@ -1,4 +1,35 @@ { - "approvals": [], + "approvals": [ + { + "gate": "definition", + "actor": "user:0xLeif", + "timestamp": 1790443064, + "digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "note": "Approved by Leif in the orc session, 2026-09-26: spec-sync #792", + "approved_scope": { + "schema_version": 1, + "change_id": "pin-the-trust-gate-to-1-2-1", + "title": "Pin the Trust gate to 1.2.1", + "description": "Pin the Trust gate to 1.2.1", + "kind": "operations", + "affected_specs": [], + "affected_paths": [ + ".github/workflows/trust.yml" + ], + "no_spec_change": true, + "no_spec_change_rationale": "This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected.", + "acceptance_criteria": [ + "The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes." + ], + "dependencies": [], + "supersedes": [], + "answers": { + "architecture_risk": "no", + "public_contract": "no" + } + }, + "approved_delta_digests": {} + } + ], "reopenings": [] } diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md b/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md index db30e8c8..0b7c6f8d 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md @@ -1,6 +1,6 @@ --- id: pin-the-trust-gate-to-1-2-1 -state: draft +state: implementing type: operations base_commit: cddc39e478dcc1f111940a3cfb02134bba9804cc --- diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json index fad3c729..8176785b 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json @@ -7,10 +7,11 @@ "title": "Pin the Trust gate to 1.2.1", "description": "Pin the Trust gate to 1.2.1", "kind": "operations", - "state": "draft", + "state": "verifying", + "canonical_applied": true, "base_commit": "cddc39e478dcc1f111940a3cfb02134bba9804cc", "created_at": 1790437668, - "updated_at": 1790437718, + "updated_at": 1790443071, "affected_specs": [], "affected_paths": [ ".github/workflows/trust.yml" diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json new file mode 100644 index 00000000..0458d6ec --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json @@ -0,0 +1,21 @@ +{ + "schema_version": 1, + "attempts": [ + { + "timestamp": 1790443069, + "commit": "a9d3774e743257d97721ec32ae344e2b197ef48e", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "passed": true, + "commands": [ + { + "command": "specsync check (no spec in scope)", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [] + } + ] +} diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json new file mode 100644 index 00000000..5cd8964d --- /dev/null +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json @@ -0,0 +1,16 @@ +{ + "timestamp": 1790443069, + "commit": "a9d3774e743257d97721ec32ae344e2b197ef48e", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "passed": true, + "commands": [ + { + "command": "specsync check (no spec in scope)", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [] +} From c656982771a869edc29ff8f8e95d2d7aff95d6ca Mon Sep 17 00:00:00 2001 From: 0xLeif Date: Sat, 26 Sep 2026 11:17:59 -0600 Subject: [PATCH 4/5] chore(lifecycle): record pin-the-trust-gate-to-1-2-1 verification --- .../pin-the-trust-gate-to-1-2-1/state.json | 2 +- .../verification-attempts.json | 16 ++++++++++++++++ .../verification.json | 4 ++-- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json index 8176785b..e30524c4 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json @@ -11,7 +11,7 @@ "canonical_applied": true, "base_commit": "cddc39e478dcc1f111940a3cfb02134bba9804cc", "created_at": 1790437668, - "updated_at": 1790443071, + "updated_at": 1790443078, "affected_specs": [], "affected_paths": [ ".github/workflows/trust.yml" diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json index 0458d6ec..f843de8e 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json @@ -16,6 +16,22 @@ } ], "requirement_ids": [] + }, + { + "timestamp": 1790443076, + "commit": "038180bd8f7e6a6dee4e15fdb7e6694af38fe0a8", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "passed": true, + "commands": [ + { + "command": "specsync check (no spec in scope)", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [] } ] } diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json index 5cd8964d..2ab6b440 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json +++ b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json @@ -1,6 +1,6 @@ { - "timestamp": 1790443069, - "commit": "a9d3774e743257d97721ec32ae344e2b197ef48e", + "timestamp": 1790443076, + "commit": "038180bd8f7e6a6dee4e15fdb7e6694af38fe0a8", "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", From d5a1f49bc0dd40179587d960de4510fc469cdc6a Mon Sep 17 00:00:00 2001 From: 0xLeif Date: Sat, 26 Sep 2026 11:41:03 -0600 Subject: [PATCH 5/5] chore(lifecycle): archive pin-the-trust-gate-to-1-2-1 --- .../accepted-state.json | 34 ++++++ .../approvals.json | 7 ++ .../change.md | 2 +- .../context.md | 0 .../finalization.json | 12 ++ .../lesson-bundle.md | 108 ++++++++++++++++++ .../plan.md | 0 .../review-attempts.json | 21 ++++ .../review.json | 16 +++ .../state.json | 4 +- .../testing.md | 0 .../verification-attempts.json | 32 ++++++ .../verification.json | 32 ++++++ .../verification.json | 16 --- 14 files changed, 265 insertions(+), 19 deletions(-) create mode 100644 .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/accepted-state.json rename .specsync/{changes/pin-the-trust-gate-to-1-2-1 => archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1}/approvals.json (87%) rename .specsync/{changes/pin-the-trust-gate-to-1-2-1 => archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1}/change.md (98%) rename .specsync/{changes/pin-the-trust-gate-to-1-2-1 => archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1}/context.md (100%) create mode 100644 .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/finalization.json create mode 100644 .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/lesson-bundle.md rename .specsync/{changes/pin-the-trust-gate-to-1-2-1 => archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1}/plan.md (100%) create mode 100644 .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review-attempts.json create mode 100644 .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review.json rename .specsync/{changes/pin-the-trust-gate-to-1-2-1 => archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1}/state.json (96%) rename .specsync/{changes/pin-the-trust-gate-to-1-2-1 => archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1}/testing.md (100%) rename .specsync/{changes/pin-the-trust-gate-to-1-2-1 => archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1}/verification-attempts.json (50%) create mode 100644 .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/verification.json delete mode 100644 .specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json diff --git a/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/accepted-state.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/accepted-state.json new file mode 100644 index 00000000..ff16ed4d --- /dev/null +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/accepted-state.json @@ -0,0 +1,34 @@ +{ + "schema_version": 1, + "workflow_version": 2, + "workflow_origin_version": 2, + "id": "pin-the-trust-gate-to-1-2-1", + "slug": "pin-the-trust-gate-to-1-2-1", + "title": "Pin the Trust gate to 1.2.1", + "description": "Pin the Trust gate to 1.2.1", + "kind": "operations", + "state": "accepted", + "canonical_applied": true, + "base_commit": "cddc39e478dcc1f111940a3cfb02134bba9804cc", + "created_at": 1790437668, + "updated_at": 1790443749, + "affected_specs": [], + "affected_paths": [ + ".github/workflows/trust.yml" + ], + "no_spec_change": true, + "no_spec_change_rationale": "This changes only the pinned ref of the Trust action in CI. No canonical spec text changes because no module contract, public API, or behavior is affected.", + "acceptance_criteria": [ + "The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes." + ], + "selected_artifacts": [ + "context", + "plan", + "testing" + ], + "dependencies": [], + "answers": { + "architecture_risk": "no", + "public_contract": "no" + } +} diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/approvals.json similarity index 87% rename from .specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json rename to .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/approvals.json index 60f5d187..0226f313 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/approvals.json +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/approvals.json @@ -29,6 +29,13 @@ } }, "approved_delta_digests": {} + }, + { + "gate": "finalization", + "actor": "specsync:finalization", + "timestamp": 1790443748, + "digest": "bd1be37cd849d4b4911800ccd13fe57adae33d4d2212200c37f5c2f8ae5b3bf3", + "note": "Same-PR finalization closing digest" } ], "reopenings": [] diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/change.md similarity index 98% rename from .specsync/changes/pin-the-trust-gate-to-1-2-1/change.md rename to .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/change.md index 0b7c6f8d..1ee24122 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/change.md +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/change.md @@ -1,6 +1,6 @@ --- id: pin-the-trust-gate-to-1-2-1 -state: implementing +state: archived type: operations base_commit: cddc39e478dcc1f111940a3cfb02134bba9804cc --- diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/context.md b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/context.md similarity index 100% rename from .specsync/changes/pin-the-trust-gate-to-1-2-1/context.md rename to .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/context.md diff --git a/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/finalization.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/finalization.json new file mode 100644 index 00000000..8aaf2f74 --- /dev/null +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/finalization.json @@ -0,0 +1,12 @@ +{ + "schema_version": 2, + "change_id": "pin-the-trust-gate-to-1-2-1", + "implementation_commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca", + "implementation_tree": "1812691b2c90bee15ccd9d87cc2260905cf26d4c", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "closing_digest": "bd1be37cd849d4b4911800ccd13fe57adae33d4d2212200c37f5c2f8ae5b3bf3", + "review_digest": "424a5d19c89fd6d767a7c8619b81caacabff6085ed431d636c9e1acf88df48a7", + "finalization_digest": "305e09ae9021efef99a33e580fa73c15217694ba647df49ca333079133f72911", + "timestamp": 1790443749 +} diff --git a/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/lesson-bundle.md b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/lesson-bundle.md new file mode 100644 index 00000000..9321a2f3 --- /dev/null +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/lesson-bundle.md @@ -0,0 +1,108 @@ +# Lesson bundle — pin-the-trust-gate-to-1-2-1 + +Material for folding this change's lessons into the affected specs' `context.md`. +Synthesise from what actually happened below; do not restate the change description. + +## What this change was + +- **Title**: Pin the Trust gate to 1.2.1 +- **Kind**: Operations +- **Paths**: .github/workflows/trust.yml +- **Acceptance**: The Trust gate step in .github/workflows/trust.yml resolves CorvidLabs/trust@dd52a7a90ffbc1d2b1030e37007c18274f3d96bc (v1.2.1, the peeled commit of the annotated v1.2.1 tag) instead of fcc889f54d8b4892a81af463c5a0250e2be66fc5 (v1.2.0). The runner-local file:// SpecSync mirror still works unchanged: Trust downloads specsync-linux-x86_64.tar.gz and its .sha256 from specsync-download-base-url, revalidates the checksum, and gates on the pull request's own freshly built binary. specsync-version stays 6.0.0. Nested Augur and Attest install their prebuilt Linux binaries (augur-linux-x86_64, attest-linux-x86_64) instead of building Swift from source, and the hosted trust check passes. + +## Evidence + +- Verification commit: `c656982771a869edc29ff8f8e95d2d7aff95d6ca` +- Base commit: `cddc39e478dcc1f111940a3cfb02134bba9804cc` +- Verified by: `specsync check (no spec in scope)` + +## From the change's context.md + +# Context + +## What led here + +This repository's own Trust gate was pinned to +`CorvidLabs/trust@fcc889f54d8b4892a81af463c5a0250e2be66fc5` (`v1.2.0`). Trust +1.2.0 nests Augur and Attest at tips that, when run inside Trust, looked for +their release assets in the calling action's repository rather than in +`CorvidLabs/augur` and `CorvidLabs/attest`. `gh release download` then missed +`augur-linux-x86_64` and `attest-linux-x86_64`, and both tools fell back to +compiling Swift from source on every hosted `trust` run. + +Trust `v1.2.1` (`dd52a7a90ffbc1d2b1030e37007c18274f3d96bc`, the peeled commit of +the annotated tag object `25f18128`) re-pins the nested actions to +`CorvidLabs/augur@108a2ff4` and `CorvidLabs/attest@2182cae4`, which set +`RELEASE_REPO` to their own repository and download the prebuilt Linux +binaries. That is the only runtime change between `v1.2.0` and `v1.2.1` +(`action.yml`: two `uses:` lines). + +PR #792 carried the one-line pin but failed `trust` and `Lifecycle gate` +because `.github/workflows/trust.yml` is a meaningful path and no active change +covered it. This change record covers it. + +## Constraints a session picking this up needs to know + +The Trust step here is not a normal consumer pin. The workflow builds the pull +request's own SpecSync binary, packages it as a checksum-protected runner-local +mirror under `${RUNNER_TEMP}`, and passes +`specsync-download-base-url: file://${{ runner.temp }}/specsync-trust-mirror`, +so Trust gates on the pull request's binary rather than on a published release. +`scripts/trust_cli.py`, which resolves and downloads that mirror, is the same +blob (`a82229c5`) at `v1.2.0` and `v1.2.1`, so the mirror path is unchanged. + +## Ruled out + +Trust `v1.2.2`. Its only runtime change re-pins Augur to a tip that reports a +failed prebuilt download on Darwin/arm64 accurately; it does not affect the +Linux runner this workflow uses. Moving to it is a separate change. + +Changing `specsync-version`, the mirror packaging steps, or the +`specsync change audit --strict` preflight. None is stale. + +## From the change's testing.md + +# Testing + +There is no unit test for a CI pin. Verification is a source comparison of the +two Trust revisions plus the hosted run itself. + +## Verified before the ref was changed + +- `gh api repos/CorvidLabs/trust/commits/v1.2.1` resolves to + `dd52a7a90ffbc1d2b1030e37007c18274f3d96bc`; the `v1.2.1` ref points at tag + object `25f18128`, which peels to that commit. +- `gh api repos/CorvidLabs/trust/compare/fcc889f5...dd52a7a9`: the only + `action.yml` change is the nested Augur pin (`25ef9339` to `108a2ff4`) and + the nested Attest pin (`e8a2d928` to `2182cae4`). +- `scripts/trust_cli.py` has the same blob SHA (`a82229c5`) at both + revisions, so the `file://` SpecSync mirror resolution, checksum + revalidation, and `specsync-download-base-url` input are unchanged. +- `action.yml` at `CorvidLabs/augur@108a2ff4` and + `CorvidLabs/attest@2182cae4` sets `RELEASE_REPO` to its own repository and + selects `augur-linux-x86_64` / `attest-linux-x86_64` on x86_64 Linux, + falling back to `swift build` only when that download fails. + +## Verified locally on the committed tree + +- `.github/workflows/trust.yml` still parses as YAML. +- The product diff against `main` is one changed line in one file. +- `fledge lanes run pre-push` passes. + +## Verified on the hosted run + +The pull request's own `trust` check is the real test. A passing run proves +that Trust 1.2.1 resolved, installed SpecSync 6.0.0 from the `file://` mirror, +accepted the locally built archive's checksum, and ran the contract, risk, and +provenance stages. Its log should show `Installed augur (augur-linux-x86_64, +1.0.0)` and `Installed attest (attest-linux-x86_64, 1.0.0)` with no Swift +source build. + +Both `trust` and `Lifecycle gate` run `specsync change audit --strict` before +the gate itself, which is why this change record exists: +`.github/workflows/trust.yml` is a meaningful path and the audit fails closed +when no active change covers it. + +## Where these lessons go + +This change declared no affected specs, so there is no module context to fold into. diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/plan.md b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/plan.md similarity index 100% rename from .specsync/changes/pin-the-trust-gate-to-1-2-1/plan.md rename to .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/plan.md diff --git a/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review-attempts.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review-attempts.json new file mode 100644 index 00000000..b56d999b --- /dev/null +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review-attempts.json @@ -0,0 +1,21 @@ +{ + "schema_version": 1, + "reviews": [ + { + "schema_version": 2, + "change_id": "pin-the-trust-gate-to-1-2-1", + "reviewer": "user:0xLeif", + "provenance": { + "schema_version": 1, + "provider": "github_actions_check", + "required_check": "SpecSync scoped review" + }, + "verdict": "pass", + "implementation_commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "timestamp": 1790443689 + } + ] +} diff --git a/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review.json new file mode 100644 index 00000000..6a7e97ce --- /dev/null +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/review.json @@ -0,0 +1,16 @@ +{ + "schema_version": 2, + "change_id": "pin-the-trust-gate-to-1-2-1", + "reviewer": "user:0xLeif", + "provenance": { + "schema_version": 1, + "provider": "github_actions_check", + "required_check": "SpecSync scoped review" + }, + "verdict": "pass", + "implementation_commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "timestamp": 1790443689 +} diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/state.json similarity index 96% rename from .specsync/changes/pin-the-trust-gate-to-1-2-1/state.json rename to .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/state.json index e30524c4..bd85a875 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/state.json +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/state.json @@ -7,11 +7,11 @@ "title": "Pin the Trust gate to 1.2.1", "description": "Pin the Trust gate to 1.2.1", "kind": "operations", - "state": "verifying", + "state": "archived", "canonical_applied": true, "base_commit": "cddc39e478dcc1f111940a3cfb02134bba9804cc", "created_at": 1790437668, - "updated_at": 1790443078, + "updated_at": 1790444458, "affected_specs": [], "affected_paths": [ ".github/workflows/trust.yml" diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/testing.md b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/testing.md similarity index 100% rename from .specsync/changes/pin-the-trust-gate-to-1-2-1/testing.md rename to .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/testing.md diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/verification-attempts.json similarity index 50% rename from .specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json rename to .specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/verification-attempts.json index f843de8e..9555f532 100644 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification-attempts.json +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/verification-attempts.json @@ -32,6 +32,38 @@ } ], "requirement_ids": [] + }, + { + "timestamp": 1790443076, + "commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "acceptance_input_digest": "0bb23fcad6aee296deefe24679db3a9c96d781fdc4ea327b19c47e7b8d17b233", + "acceptance_manifest": { + "schema_version": 1, + "entries": [ + { + "path": ".github/workflows/trust.yml", + "kind": "file", + "mode": 33188, + "payload_digest": "d1efe7aa250e7bb3905dd70c65db7c1bdd8e2244adc0ed739a0e537e75f2837d", + "entry_digest": "4ad2f3a6fce2578f9b5a55f0d6d8b627a2f375d27a4a4fefae8ee5f34d83a2dd", + "owners": [ + "@exact:delivery" + ] + } + ] + }, + "passed": true, + "commands": [ + { + "command": "specsync check (no spec in scope)", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [] } ] } diff --git a/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/verification.json b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/verification.json new file mode 100644 index 00000000..b2d6f218 --- /dev/null +++ b/.specsync/archive/changes/2026-09-26-pin-the-trust-gate-to-1-2-1/verification.json @@ -0,0 +1,32 @@ +{ + "timestamp": 1790443076, + "commit": "c656982771a869edc29ff8f8e95d2d7aff95d6ca", + "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", + "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", + "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", + "acceptance_input_digest": "0bb23fcad6aee296deefe24679db3a9c96d781fdc4ea327b19c47e7b8d17b233", + "acceptance_manifest": { + "schema_version": 1, + "entries": [ + { + "path": ".github/workflows/trust.yml", + "kind": "file", + "mode": 33188, + "payload_digest": "d1efe7aa250e7bb3905dd70c65db7c1bdd8e2244adc0ed739a0e537e75f2837d", + "entry_digest": "4ad2f3a6fce2578f9b5a55f0d6d8b627a2f375d27a4a4fefae8ee5f34d83a2dd", + "owners": [ + "@exact:delivery" + ] + } + ] + }, + "passed": true, + "commands": [ + { + "command": "specsync check (no spec in scope)", + "success": true, + "exit_code": 0 + } + ], + "requirement_ids": [] +} diff --git a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json b/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json deleted file mode 100644 index 2ab6b440..00000000 --- a/.specsync/changes/pin-the-trust-gate-to-1-2-1/verification.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "timestamp": 1790443076, - "commit": "038180bd8f7e6a6dee4e15fdb7e6694af38fe0a8", - "contract_digest": "58eb157bde5b96fa2e91e96f2e1550de8b5c1b63f6bd10a399179b13875c4107", - "execution_digest": "968e711a9e59b86a68809e44feeb2703adcbe14ca334de7e2bb9294db30c95d2", - "workspace_digest": "69577a876f5631724fc5fe7504066663ea8ae65afac8163cbf1e79770b7716c7", - "passed": true, - "commands": [ - { - "command": "specsync check (no spec in scope)", - "success": true, - "exit_code": 0 - } - ], - "requirement_ids": [] -}