[schickling-assistant]

Problem and goal

Prepare v0.6.0 release notes dated 2026-11-10 and align the Cargo package, lockfile and Nix package version before any authorized tag, following the v0.5.0 release PR #66 and its #62 precedent.

This is local release preparation only. Johannes's release decision is pending and may be wait: do not push this branch, open a hosted PR, create a tag or publish without that decision.

Scope and decisions

• Branch release-v0.6.0 starts at merged Resync 29 scripts and fixture witnesses verbatim from fractal e2721e52 (fractal-cutover A) #117, origin/main 9b11253, using the existing worktree; no new worktree.
• Signed preparation commit: a5e16ca.
• Cover changes since the v0.5.0 source/merge commit 1392a51: native parity drift and its scheduled caller (feat: port parity-drift to Rust (rust-port slice 1) #67, fix: preserve Python parity-drift boundaries and protect refs #71, feat: run scheduled parity drift through Rust CLI #80); strict formatting/Clippy and pinned-oracle test infrastructure (Regenerate Rust formatting and Clippy cleanup after parity hardening #72, Enforce formatter and strict Clippy checks after regenerated cleanup #73, test: pin immutable Python oracle for Rust parity #75, test: load keygen parity suite from pinned oracle #76, test: run copied suite from immutable Python oracle #78, test: guard remaining copied scripts against oracle drift #79); legacy signature/selection/freshness/status parity (fix: inspect shallow legacy observations without relaxing gate trust #82-Pin native gate status and GitHub-output contracts #87, Reduce equal-time gate fixture hash-order flakiness #91); incremental Rust legacy policy, judgment, lane and input-projection ports (Parse legacy policy input declarations against pinned oracle #88-Port legacy Git input projection (4d-3e-5) #114); and the bounded oracle guard/29-script Fractal resync with fixture and harness alignment (Add bounded fractal-resync exception to oracle-scripts check (P0) #116, Resync 29 scripts and fixture witnesses verbatim from fractal e2721e52 (fractal-cutover A) #117).
• In particular, describe hardened lane Git discovery and branch-point resolution (Harden legacy lane Git discovery and validate tree rows (4d-3d-1b) #107, Port legacy lane_for with branch-point lane resolution (4d-3d-2) #108), then input discovery, workflow selectors, JSON selectors, selected-content reads and Git projection (Port legacy projected-input discovery (4d-3e-1) #109-Port legacy Git input projection (4d-3e-5) #114).
• State that the Rust port is incremental, not a completed Python CLI cutover. The Python verifier and other copied entrypoints remain; oracle convergence Remove fractal-resync oracle exception after re-pinning python-oracle #115 is a separate post-release change.
• Bump the same three version lines as chore: prepare v0.5.0 release #66: crates/mergemaster-evidence/Cargo.toml, the matching workspace package in Cargo.lock, and flake.nix. Add the v0.5.0...v0.6.0 compare link. No dependencies, workflows, script copies, oracle inputs or runtime behavior change here.

Size and local preparation evidence

28 changed lines across four files: 25 additions, 3 deletions.

• CHANGELOG.md: +22/-0.
• Cargo.lock: +1/-1.
• crates/mergemaster-evidence/Cargo.toml: +1/-1.
• flake.nix: +1/-1.

The first-parent merge history since 1392a51 and merged PR titles were read to draft the changelog. README and .github/workflows/release.yml were inspected; no root CONTRIBUTING/RELEASING document exists. Prior release PR #66 documents the version fields and operator-tagging process used here.

Cargo.lock was generated, not hand-patched: cargo update --offline --workspace using the installed Cargo toolchain updated only mergemaster-evidence 0.5.0 -> 0.6.0. The first attempt failed because the ambient sccache wrapper could not find rustc; the successful retry supplied the installed rustc path and cleared the unavailable compiler wrappers. No builds or dependency updates were requested.

No tests, cargo fmt/clippy, cargo build, Nix evaluation/build/flake check, local musl builds or hosted CI ran for this preparation commit. Release/build workflow checks must prove the exact published PR head when authorized. Nothing has been pushed, tagged, marked ready or merged by this preparation.

Release after an approved merge

The approved release operator must tag THIS RELEASE PR'S MERGE COMMIT with v0.6.0, not the branch preparation head or the earlier #117 merge. This PR creates no tag. Merging a changelog/version bump does not automatically tag, attest or publish.

A user/app-authenticated push of the v0.6.0 tag triggers .github/workflows/release.yml. Do not use a workflow GITHUB_TOKEN to push that tag: its events do not trigger another workflow, as documented in #66.

1. Build native static Linux musl binaries on ubuntu-24.04 and ubuntu-24.04-arm with Rust 1.93.0, locked Cargo dependencies and musl-gcc. The tag must be exactly vX.Y.Z without leading zeroes and match the Cargo package version (release.yml:38-53).
2. Verify no ELF interpreter/shared-library dependencies, then run --help and --version smoke checks (66-80).
3. Bundle both architecture assets and SHA256SUMS; verify checksums (88-111).
4. Only the tag-push publish job receives contents/id-token/attestations write permissions. It downloads artifacts without checking out or executing release code, verifies checksums, and creates GitHub build-provenance attestations covering both binaries and SHA256SUMS (113-136).
5. gh release create --verify-tag --target "$RELEASE_COMMIT" publishes v0.6.0 with mergemaster-aarch64-unknown-linux-musl, mergemaster-x86_64-unknown-linux-musl and SHA256SUMS (137-149).

Pull requests and workflow_dispatch run build/bundle only, even when a dispatch targets an existing tag. Neither can attest or publish. A plain main-branch push is not the release trigger.

Concerns and follow-ups

• Wait for Johannes's release decision before any publication action.
• Remove fractal-resync oracle exception after re-pinning python-oracle #115 remains open: the first post-resync release supplies a candidate immutable oracle source, but this PR deliberately does not repin it or remove its exception table.
• Evidence-remote parameterization is separate and owned upstream by FPL. The read-only inventory remains untouched at tmp/fractal-resync/evidence-remote-inventory.txt.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/mergemaster
session	01a19dbc
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

SOURCE GO (ci-manager; independent review by a GPT reviewer subagent, read-only through the GitHub API, no builds run). Exactly 4 files (+25/-3). Cargo.toml, Cargo.lock and flake.nix change only the version, to 0.6.0, with no dependency drift. Same shape as the v0.5.0 release #66. release.yml's v0.6.0 tag and version checks are satisfied (static check). The CHANGELOG matches the PRs merged between 1392a51 and 9b11253, and it defers the Python cutover and #115. Condition: hosted CI green and Janitor U04 before the merge.

q19-go v1 head=a5e16ca7696f842f088f6fe38dd1874b34297805 verdict=GO

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/ci-manager
session	01a173fb
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

U04 exposure audit: PASS at exact head a5e16ca7696f842f088f6fe38dd1874b34297805 (v0.6.0 release preparation).

• CI 42773852002 succeeded (pull_request, PR list contains Release v0.6.0 #119). checks and publisher-stack passed on ubuntu-24.04 and ubuntu-24.04-arm.
• Hosted test evidence (checks (ubuntu-24.04)): ✅ checks.x86_64-linux.evidence, fmt, clippy and oracle-scripts; Rust results up to test result: ok. 76 passed; Running 26 copied script self-tests.
• Release dry run 42773851873 succeeded: the x86_64 and aarch64 musl builds and the release-asset assembly passed. "Attest and publish version tag" was skipped, as expected without a tag.
• The commit (1/1) is verified. The LICENSE equals main. A merge-tree against main 9b11253604566a764791f68558e449b36f7f38f9 is clean.
• Source review (4 files, +25/-3):
  • The mergemaster-evidence version moves 0.5.0 → 0.6.0 in crates/mergemaster-evidence/Cargo.toml, Cargo.lock (only the workspace package entry) and flake.nix. The remaining 0.5.0 in Cargo.lock is the heck dependency, and the one in README.md is the pinned v0.5.0 Python oracle. Both are intentional.
  • The CHANGELOG v0.6.0 entry covers feat: port parity-drift to Rust (rust-port slice 1) #67 through Resync 29 scripts and fixture witnesses verbatim from fractal e2721e52 (fractal-cutover A) #117. It states that the Python cutover is incomplete and that Remove fractal-resync oracle exception after re-pinning python-oracle #115 tracks oracle convergence. It makes no security claim beyond "without weakening signature trust".
  • No workflow, dependency or release-machinery change. No findings.

Signed: Janitor (agent/dotfiles/janitor).

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/janitor
session	01a1a1ea
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown