feat(gates): enforce the ten release gates as a fail-closed CI audit (SP-GATE-004 / G5) - #54
Merged
Merged
Conversation
…(SP-GATE-004, G5)
The ten release gates ('A SourceOS service is not release-ready unless…', README) were
prose — no CI evaluated them. Now sourceos_service_graph.py has a release_gate_audit that
maps EACH of the ten gates to a fail-closed check (gate-numbered so failures are legible):
manifest, canonical-events(or documented exemption), required/optional/denied caps, app
hermetic launch manifest, incident bundle covering the 5 fault classes, no silent remote
trust, no remote telemetry by default, coalesced expected denials, privacy+causal structure,
DeliveryExcellence metric. New 'release-gates' subcommand + validate-release-gates make target
wired into 'make validate' (blocking). Teeth-verified: dropping any gate field fails that gate.
The bearbrowser example manifest gains a release_gates block so it conforms. NOTE: those new
field names (release_gates.hermetic_launch_manifest, incident_fault_classes, …) are NEW VOCAB
not yet connected to the glossary/ontology — a live instance of the LSA↔LDA divergence the
vocab CI loop (task #13, [[feedback_vocabulary_is_governance_substrate]]) must surface.
There was a problem hiding this comment.
Pull request overview
This PR adds an enforced, fail-closed CI audit for the “ten release gates” by implementing a gate-numbered audit in sourceos_service_graph.py, exposing it via a new release-gates subcommand, and wiring it into make validate so it blocks CI when gates are not satisfied.
Changes:
- Implemented
release_gate_audit()with 10 numbered checks and arelease-gatesCLI subcommand. - Added
validate-release-gatesand made it part of the defaultvalidatetarget. - Updated the
bearbrowserexample manifest to include a conformingrelease_gatesblock.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tools/sourceos_service_graph.py | Adds release gate audit logic and a release-gates subcommand to enforce the ten gates in CI. |
| Makefile | Wires the new release-gates audit into make validate as a blocking step. |
| examples/services/bearbrowser.service.json | Adds the release_gates block so the example service passes the new audit. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+266
to
+281
| def cmd_release_gates(args: argparse.Namespace) -> int: | ||
| services, errors = load_services(args.pattern) | ||
| if errors: | ||
| for error in errors: | ||
| print(error, file=sys.stderr) | ||
| return 1 | ||
| all_fails: list[str] = [] | ||
| for path, service in services: | ||
| all_fails.extend(release_gate_audit(path, service)) | ||
| if all_fails: | ||
| for f in all_fails: | ||
| print(f, file=sys.stderr) | ||
| print(f"release-gate audit: {len(all_fails)} gate failure(s) across {len(services)} service(s)", file=sys.stderr) | ||
| return 1 | ||
| print(f"release-gate audit: all ten gates pass for {len(services)} service manifest(s)") | ||
| return 0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What (SP-GATE-004, closes audit G5)
The ten release gates ('A SourceOS service is not release-ready unless…', README) were prose — no CI evaluated them.
sourceos_service_graph.pynow has arelease_gate_auditmapping each of the ten to a fail-closed, gate-numbered check, plus arelease-gatessubcommand and avalidate-release-gatesmake target wired intomake validate(blocking).Gates: manifest · canonical-events(or documented exemption) · required/optional/denied caps · app hermetic launch manifest · incident bundle covering the 5 fault classes {crashes, denial-storms, wake-anomalies, identity-mismatches, parser-faults} · no silent remote trust · no remote telemetry by default · coalesced expected denials · privacy+causal structure · DeliveryExcellence metric.
Teeth-verified: dropping any gate field fails that numbered gate. The
bearbrowserexample gains a conformingrelease_gatesblock;make validategreen.Dogfood note (vocab loop)
The new field names (
release_gates.hermetic_launch_manifest,incident_fault_classes, …) are new vocabulary not yet connected to the glossary/ontology — a live instance of the LSA↔LDA divergence the vocab CI feedback loop must surface (language = governance substrate). Flagged for that follow-up. Not auto-merging — for review.