Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

SYN-340 independent release preparation review

Reviewed source preparation at 8b8e72720bea1eaef37490bb671ef168f7e816fe, followed by the author’s exact originating-HEAD correction e2960ea4c447e879d1415d4c00e0fbb855589d99. The reviewer changed no production implementation. The review worktree is independent of the author’s checkout.

Result: PASS for the reviewed source preparation and controlled boundaries. This does not approve a tag or release and does not replace the pending external gates. No remote references, public releases or user identity were changed.

Observed defect and correction

The original mirror selected an artifact’s valid tag and commit without comparing that commit to the authenticated originating workflow_run.head_sha. A controlled artifact from source A could therefore authorize selection for unrelated run B. The pristine focused test ran and failed one typed assertion: selection returned 0 instead of refusing to emit outputs. The other eight independent workflow checks passed after fixture setup was corrected. This was a P2 run-correlation defect, not proof of signature forgery or unauthenticated asset publication.

The unchanged test was committed in cc02d5fa7dad3dc93a84f32fb5dcc49cfcb988c2. The author adopted it unchanged, passed GitHub’s originating HEAD through the workflow into select --expected-commit, and compares the validated receipt before opening the output file. Both control scripts now run in CI. Independent replay passed all 22 methods. Removing either the comparison or its workflow argument produced the original relevant assertion failure against the unchanged nine-method workflow suite.

Review and adversarial scope

  • The tagged version, lockfile root package and first unique reviewed changelog section agree. The stated range independently contains 73 commits after 1.4.0 and zero breaking commit markers. The additive 1.5.0 candidate remains subject to final integration and public-contract review.
  • Tag input validation and quoted environment transport constrain dynamic shell values. Actual validator controls reject mismatched or uncommitted inputs.
  • Manual source release dispatch must use the selected tag as the workflow ref. Checking out a tag does not rewrite the running workflow’s identity; GitHub exposes the workflow ref and workflow SHA separately from source selection. GitHub OIDC reference.
  • The privileged mirror reads the selected run’s artifact, validates its source binding and later checks source notes, exact asset inventory, hashes and original tagged workflow signature arguments. workflow_run can grant a later workflow secrets/write authority, so artifact data needs validation. GitHub workflow event documentation.
  • The originating artifact staging gate rejects unexpected directories before copying, including an extra artifact containing a duplicate archive basename.
  • Both publication bodies use create after an explicit absent-release control. Existing releases and API failures deny publication. There is no delete, force-tag, asset-clobber or source-main write in these paths. The source release also requests an existing tag through --verify-tag; the mirror intentionally uses a distribution reference rather than claiming private source history. GitHub CLI release-create reference.

Executed challenges

The original frozen 13-method suite was run against 17 independent production mutants: 11 assertion kills and 6 survivors. The survivor set exposed coverage gaps for a valid-but-uncommitted input and workflow-only boundaries. Those results are retained unchanged. Six identical patches were then replayed against the added focused controls; all six were killed by the relevant assertion. The separate corrective campaign removed the new binding comparison and its composition argument one at a time; both were assertion-killed with the tests frozen.

The report preserves exact patches, test hashes before/after, private log hashes, commands and verdicts. An early standalone publication fixture omitted the copied validator in the runner directory; that missing-file setup attempt is INVALID, not product RED. Six early strengthened patch applications used the wrong path strip and ran zero tests; they are separately INVALID. The same patches were then applied correctly. Neither invalid setup is counted as a mutation kill.

Final gates and limits

The final restored source passed 13 validator methods in 5.760 seconds and 9 actual workflow shell methods in 5.799 seconds, with zero failures, errors or skips. gh, cosign and cargo are controlled executables for these tests. The actual Python validator, Git fixtures and extracted shell bodies execute. No real Rust build, cryptographic signature verification, GitHub Actions run, remote tag or publication is claimed. Synthetic archive fixtures do not prove archive contents or platform behavior.

SYN-339 exact-source CI including MSRV, final integrated notes regeneration, actual four-platform production builds, authentic signing/verification and owner publication approval remain required. Historical public mirror releases remain untouched. Raw logs and xcresult are not published; this review creates no native artifacts. The adjacent evidence.json is an allowlisted review receipt.