From debb8bd9e3862df17f528c4e2c23c27810f81ef6 Mon Sep 17 00:00:00 2001 From: Brian Anderson Date: Tue, 28 Jul 2026 13:17:11 -0600 Subject: [PATCH] ci: enforce bundle-required in Trust Verify (drop advisory adoption mode) Trust Verify is now a required status check in branch protection, but the workflow still ran with missing-bundle-policy: advisory. A live gate probe on a sibling repo running the identical configuration passed Trust Verify green with no bundle and no exemption. Removing the input inherits the action default (required). Claude-Session: https://claude.ai/code/session_011t2tM3Bu8MVAMQnrovGR6m --- .github/workflows/trust-verify.yml | 1 - delivery/DECLARED | 8 +++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trust-verify.yml b/.github/workflows/trust-verify.yml index 1b6258c..b01d595 100644 --- a/.github/workflows/trust-verify.yml +++ b/.github/workflows/trust-verify.yml @@ -38,4 +38,3 @@ jobs: - uses: kontourai/flow-agents/.github/actions/trust-verify@e5f348b49f8130f9d452e73b104ba328f9916981 # flow-agents @ reports which DECLARED condition failed (#1015) with: verify-command: "npm run verify" - missing-bundle-policy: "advisory" diff --git a/delivery/DECLARED b/delivery/DECLARED index a04c17f..ec3b9cb 100644 --- a/delivery/DECLARED +++ b/delivery/DECLARED @@ -7,7 +7,7 @@ }, { "scope": "author:dependabot[bot] branch-prefix:dependabot/", - "reason": "Dependabot dependency-bump PR; no agent delivery involved, nothing to reconcile. Compound scope binds the platform-set actor identity to the bot's branch namespace per ADR 0022's fork-PR guidance, paired per the 2026-07-03 addendum. Provisioned AT adoption rather than rediscovered by breaking \u2014 flow-agents#1017's three worked examples are why.", + "reason": "Dependabot dependency-bump PR; no agent delivery involved, nothing to reconcile. Compound scope binds the platform-set actor identity to the bot's branch namespace per ADR 0022's fork-PR guidance, paired per the 2026-07-03 addendum. Provisioned AT adoption rather than rediscovered by breaking — flow-agents#1017's three worked examples are why.", "approved_by": "brian.anderson1222 (delegated approval, 2026-07-27 session: scoped-DECLARED-exemption route)", "declared_at": "2026-07-27T21:30:00Z" }, @@ -16,5 +16,11 @@ "reason": "TypeScript 7 with the coupled tsconfig change the bot cannot author: tsgo no longer auto-includes @types/node, so the bump alone fails TS2591 on every node: builtin. Proven on the relay canary (relay#39); full verify green here under the new toolchain. Supersedes the bot's red dev-dependencies PR. Scope paired with author: per the ADR 0022 2026-07-03 addendum.", "approved_by": "brian.anderson1222 (delegated approval, 2026-07-28 session: scoped-DECLARED-exemption route)", "declared_at": "2026-07-28T03:00:00Z" + }, + { + "scope": "author:briananderson1222 branch-prefix:chore/tv-enforce", + "reason": "Removes missing-bundle-policy: advisory from the Trust Verify workflow so it inherits the action default (required). Advisory was the adoption stance; with Trust Verify now a required status check in this repo's branch protection, advisory mode is a hole: a live gate probe on a sibling repo (a PR deliberately carrying no bundle and no exemption) passed Trust Verify green and sat MERGEABLE, and this repo runs the identical configuration. One workflow line, no source or behaviour change, nothing for a bundle to reconcile. Verification in lieu of a bundle: this PR's own CI runs the full verify matrix, and the sibling repo's probe re-run under required mode records the negative proof for the shared configuration. Scope is paired with author: per the ADR 0022 2026-07-03 addendum, since branch-prefix alone resolves against a pusher-controlled ref.", + "approved_by": "brian.anderson1222 (delegated approval, 2026-07-28 session: owner said fine-to-arm pending working-system evidence; this is the evidence loop)", + "declared_at": "2026-07-28T19:45:00Z" } ]