Repository navigation
chore(release): prepare v1.2.0 candidate - #315
Conversation
|
Ready for review only, not merge. The dependency blocker remains: merge preparation LAST after the six scoped PRs, update to final main and repeat exact-head gates. The updated local combined rehearsal at 1a71218065903f0405ef2f2c30f7f409d21ab07e includes PR311 wake fix f812a0f and preparation follow-up 5030b92: 1,219 Python tests pass (19 skips), distribution 41 pass (3 PowerShell skips), reproducible wheel/sdist rebuilds and isolated installed-artifact smoke pass. PR311 fix is still under separate independent review and has not yet been pushed; these local results do not replace final-main CI, trusted workflow assets or human publication approval. No main merge/tag/release/workflow dispatch/publication performed. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Latest pre-merge rehearsal is clean local d0151c2a4efd482e15431722629eb5dde2735eed, combining six scoped PRs (PR311 current cca3808) plus preparation5030b92. Full Python1241 OK/19skips, docs/generator/hash checks, distribution41 OK/3PowerShellskips, byte-identical two builds and isolated wheel/sdist installs/pipcheck pass. The previous local asyncio shutdown diagnostic did not recur; it and the distinct prior CI139 remain unresolved monitoring in #316, not claimed fixed. PR311 current-head CI28 succeeds; current-head reviews are still pending. All local rehearsal assets are non-publishable. After owner authorization, update/review/CI each branch as main advances; preparation315 merges last and final protected-main CI/workflow assets/human pypi approval are still mandatory. No public main merge/tag/draft release/workflow dispatch/publication or operations change. |
|
Owner selected metadata-only discovery option1. PR311 current1272b80 now blocks ambiguous ordinary macOS preferences before SQLite without any Codex/version query, and gives cause/operator guidance without empty-success or DB fallback. New legacy/modern/diagnostic/no-native regressions pass; latest local combined5e536883567d9453b619acd18394a3533e055b3f has1256 tests pass/19skips, reproducible wheel/sdist builds and isolated installs pass. Dual independent CLI review of ba884e6 and exact1272b80 completed; coordinator checked conditional source questions. Current1272b80 CI/Code/Security Reviews remain pending. Preparation315 still merges LAST after six scoped PRs only upon owner approval, with final updated-head/main/workflow-asset/human-environment gates. No main merge/tag/release/publication or operational change. |
|
Pre-merge readiness updated: all seven scoped current PR heads (#305/#311/#310/#308/#313/#314/#315) are OPEN/ready with28 successful checks each and auto-merge disabled. PR311 exact1272b80 Code Review and Security Review completed with no new findings; unresolved threads0. Owner-selected metadata-only discovery policy and safe error guidance are implemented/tested. Local combined1256 tests/19skips, reproducible builds and isolated installs passed. Holding for owner approval; intended order305→311→310→308→313→314→315(last), with fresh branch/current-head checks as main advances. Public main remains f3993bf, v1.2.0 tag absent, no main merge/release/publication/operations change. Native acceptance issues remain OPEN and #316 remains cause-unresolved monitoring. Final protected-main/workflow-assets/human pypi approval gates are NOT pre-completed. |
Update the 2026-10-16 preparation based on 5030b92 while sequential feature integration is pending. Preserve the unpublished candidate and final-main review and publication gates.
|
@codex security review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
Prepares the unpublished Python v1.2.0 candidate against protected main
21a0be0c0c5bcb8bca214d90a873b7479d7ba97a. Published stable remains v1.1.2. Plugin and companion skill versions are independent and unchanged.The owner-authorized feature/evidence PRs were merged normally, in order #305 → #311 → #310 → #308 → #313 → #314. Exact merge SHAs are recorded in all four candidate notes. This preparation PR is updated LAST and remains OPEN for the owner's review; it is not authorization to merge #315 or publish a release.
Exact candidate validation
Preparation head:
da01511082c129d3ef553af2081b5f851b990132.beb7bf4and firstda01511full runs emitted asyncioServer._attachassertion and unraisable socket/transport destructorResourceWarningdiagnostics. The final quiet run had no such diagnostic, destroyed task or fatal-error output. test(relay): investigate intermittent native CI crash and shutdown diagnostics #316 stays OPEN; a clean repeat does not establish a cause, relationship or fix for earlier CI139. No exit139 occurred in these local runs.b260223full run failed 17 cases plus one error under severe host load; a 114-test focused rerun andbeb7bf4full run passed. The firstda01511full run failed two handoff fixtures (original Codex pre-probe refusal before corrupted-response assertions; SIGINT result 1 instead of 130). Both cases then passed separately, in the related 80-test suite and the final full run without source changes. Original logs are retained. Timing/environment sensitivity is evidence, not a proven root cause or repair. No assertions, deadlines or gates were weakened; one controlled quiet full repeat was performed, not an unlimited retry-until-green loop.python -Ipurelib/version/help/fixture-list/missing-DB checks, optional imports and pip check. Both final installed METADATA descriptions contain the publication-neutral source version and dated checkpoint, not the old timeless unpublished claim.Independent review
Same-input non-interactive initial review of
beb7bf4: Claude Code 2.1.301, response-confirmedclaude-opus-5-5; Codex CLI 0.163.0, isolated default model (actual name unexposed). Both parallel processes exited 0 with complete final responses, no reviewer tool/test/network/write execution. Input SHA256ef8aaf15fd3ba697ea633b38e62280a8e1c5943490897f4007e8a95294d32a78remained unchanged.Both identified stale proposed-scope wording in the four documentation indexes. The coordinator verified and corrected it, strengthened locale-specific assertions, and addressed the immutable PyPI README metadata risk with publication-neutral text before the final build. Diagnostic terminology and seven-asset inclusion were clarified; no new runtime logic or weaker tests were introduced.
Bounded final-revision follow-up on
da01511082c129d3ef553af2081b5f851b990132used unchanged input SHA256ff61415560e3da91f7e947d75dad7d559cb89c3536cb4492042d1696175bbb30and the same verified CLI/model profiles, parallel/no tools. Both exited 0 with valid final responses and no mandatory defect. Codex accepted the publication-neutral and dated-record boundaries; Claude additionally recommended stricter past-tense labels for archived preparation status in bundled docs. These remain explicitly dated preparation records, not publication evidence; any actual publication gets a separate record. Reviewers independently reviewed source text, not execution results or live/platform behavior. Current-head GitHub CI/code/security review remains a separate gate.Final current-head gate check (2026-10-16)
Exact head
da01511082c129d3ef553af2081b5f851b990132: all 28 checks SUCCESS, including CI 38898548934. Codex Code Review completed at 12:12:48 UTC with no major issues; Codex Security Review completed at 12:13:29 UTC with no security findings, both explicitly naming this head. Unresolved review threads: 0. PR remains OPEN/Ready, merge state CLEAN, auto-merge disabled; no #315 merge or publication action was taken. Earlier intermittent local failures and #316 remain disclosed above, not declared fixed by these green checks.Approval and publication boundaries
No merge of #315, tag/draft creation, preparation/publish workflow dispatch, package publication, global installation or operational change is performed by this preparation. Keep #315 OPEN for explicit owner approval.
After an authorized #315 merge, require green exact protected-main CI and an authorized workflow rebuild; verify exactly seven immutable assets (including checksums and provenance) and authenticated attestations before publication, then obtain the human pypi environment approval. Record actual publication separately; never rebuild/replace immutable assets to change their frozen metadata.
The owner explicitly omitted the current private PyPI Trusted Publisher binding recheck: OMITTED BY OWNER, NOT VERIFIED. No new login request was made; environment approval/source/asset/audit gates are not waived. Current read-only checks confirmed immutable releases enabled and active v* update/deletion protection without bypass actors. v1.2.0 tag and PyPI 1.2.0 returned 404 at preparation time; recheck at publication.
The dated public baseline was independently rechecked on 2026-10-16: GitHub Latest v1.1.2 is stable/non-draft (published 2026-10-13 06:39:11 UTC); PyPI v1.1.2 JSON lists non-yanked wheel/sdist uploaded at 06:41:32/06:41:34 UTC, and public PyPI latest is 1.1.2. This does not verify the private publisher binding.
Refs #180, #181, #268, #304, #306, #307, #316.