Skip to content

release: activate governed npm Trusted Publishing and verify v1.15.4 candidate #58

Open
Open
release: activate governed npm Trusted Publishing and verify v1.15.4 candidate#58

Description

@Kucell
Kucell
opened on Oct 10, 2026

Scope

Prepare the now-merged Cortex Agent governed npm Trusted Publishing automation for a future real publication, without claiming v1.15.4 is already live. Exact merged source baseline: product main@a386e79a5471747b119220346436b5142b66c677, root version 1.15.4. PRs #48 (CLI hotfix), #55 (governed publish), #51 (metadata + changelog) were squash-merged in order by explicit owner chat instruction on 2026-10-10.

Verified post-merge technical evidence

  • Automatic Preflight on final main: GitHub Actions job SUCCESS on exact final main. Real logs: 22/22 release contract cases, 271/271 M-040 product cases, 9/9 real top-level reconcile CLI tests, npm pack dry run successful.
  • Root package.json version 1.15.4, version-parity conformance installed. Product .agent gitlink remains 6d44b489f31dbee9bf42ec73bb406ffb5063f3ea.
  • v1.15.4 Git tag was NOT_FOUND after merge. npm Registry latest/version NOT independently verified. No npm workflow publish publish=true run took place.
  • Existing npm-release.yml remains GitHub Actions Trusted Publishing / OIDC and exact filename. npm-release-preflight.yml is read-only and does not publish on merge. The release workflow supports manual workflow_dispatch and event-based owner command, both guarded by the same release verifier.

One-time activation checklist

  • Verify npm Trusted Publisher settings for package cortex-agent: GitHub owner Kucell, repo cortex-agent, workflow file npm-release.yml; verify OIDC in a controlled release run. Do not set npm write token.
  • Configure GitHub repo secret CORTEX_GOVERNANCE_READ_TOKEN with minimal read-only private governance repo access to Kucell/cortex-agent-agent decisions/ and waitpoints/; use renewable GitHub App credentials where supported. Record source/scope/expiry but never raw credential value.
  • Configure repository variable CORTEX_AUTO_RELEASE_ENABLED=true only after authority and reviewer policy checks; keep it unset/false until then.
  • Verify authoritative sole Owner, Lease/Fencing and canonical GovernanceStore revision; create exact-final-main release:cortex-agent@<actual SHA> Decision approved by interactive-user plus matching owner-released Waitpoint (cannot synthesize them from a PR comment).
  • Resolve independent Reviewer eligibility. The merged PR chore(release): prepare v1.15.4 version parity and release notes #51 has only same-author COMMENTED reviews, no different-account APPROVED. The shipped verifier intentionally REJECTS this situation, even though an owner instructed merging in chat. Therefore a release triggered today will BLOCK at reviewer gate. Options: create a fresh strictly scoped, independently reviewed, last-merged release-prep PR and issue new exact-head Decision/Waitpoint; or propose and formally approve a resource-scoped review waiver policy as a separate security proposal, with explicit verifier test coverage. Do not falsify past review history or bypass the gate.
  • Validate npm Registry cortex-agent@1.15.4 not already published and v1.15.4 tag missing or matches exact candidate before any write.
  • Run existing npm Release workflow on main with release_type=current, dist_tag=latest, publish=false to obtain a real full dry-run; read-only preflight PASS is not identical to the release workflow's own dry-run.
  • On valid authorization and review, publish through existing npm OIDC workflow only. Manual publish=true needs release_pr, expected_sha, decision_id, waitpoint_id; owner-comment path needs exact /cortex-release publish v1.15.4 decision=<ID> waitpoint=<ID> on the merged authorized release-prep PR.
  • Verify npm Registry exact cortex-agent@1.15.4, intended dist-tag, Git Tag v1.15.4, GitHub Release, Actions run/job, and package integrity. If a step fails, use workflow's documented current safe resume and new resource-bound approval if HEAD changed.
  • Track separately the checkout post-cleanup error No url found for submodule path '.agent' in .gitmodules as Issue #49.

Status

MERGED / AUTOMATIC_PREFLIGHT_PASS / AUTO_PUBLISH_OPT_IN_NOT_VERIFIED / INDEPENDENT_REVIEW_GATE_BLOCKED / NPM_PUBLISH_NOT_RUN. The current main is not an approved release simply because the owner asked to merge PRs.

Activity

  1. Kucell commented on Oct 10, 2026

    @Kucell
    Kucell
    on Oct 10, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Release activation status — user reports configuration completed (2026-10-10)

    The user reports that the GitHub configuration requested for governed publication has been completed. This is a user-reported setup status, not tool-verified secret/variable state. This GitHub connector cannot read repository Actions Secrets or Variables metadata (these endpoints are unavailable to its fetch capability); we did not read, expose or copy the credential.

    Verified after the report:

    • Product main: a386e79.
    • Root package.json version: 1.15.4.
    • Automatic npm Release Preflight on exact main #38019939127: success (22/22 release contracts, 271/271 M040, 9/9 real CLI, npm pack dry-run).
    • Git tag v1.15.4: not found; GitHub Release v1.15.4: not published.
    • Latest GitHub Release found: v1.15.0.
    • Do not claim npm publication or activated release.

    Remaining verifiable gates:

    1. Confirm repository secret CORTEX_GOVERNANCE_READ_TOKEN has the intended read-only access to private Kucell/cortex-agent-agent and repository variable CORTEX_AUTO_RELEASE_ENABLED remains false until checks are complete.
    2. Complete a read-only credential handshake in an approved workflow without logging or exposing the token. Existing publish=false dry run skips private governance authorization, so it CANNOT prove the token works.
    3. Existing merged release-prep PR chore(release): prepare v1.15.4 version parity and release notes #51 has no independent different-author APPROVED review. The installed automated release verifier fails closed, including for manual publish=true. A reviewed, exact-final-main release candidate and canonical release Decision + matching owner-released Waitpoint are still needed, or an approved and tested change to reviewer policy (never a fabricated review).
    4. Once real authorization is established, use the existing npm-release.yml OIDC trusted-publisher flow and verify actual npm version, Git Tag, GitHub Release and workflow evidence.

    Do not enable automatic publishing or post a publish command merely to test whether the secret exists.

  2. Kucell commented on Oct 10, 2026

    @Kucell
    Kucell
    on Oct 10, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    PR #59 merged — real governance credential proof PASS (2026-10-10)

    User explicitly approved merging PR #59, which was successfully squash-merged as product main commit 92ec58c9b05391c0b46d285cfe05618a56f8719d.

    Actual GitHub Actions run 38027297424, on this exact main SHA:

    • contract-tests SUCCESS.
    • verify-private-read SUCCESS. Job 114140780847 printed only: “Private governance read access verified for 2 records; auto publish remains disabled.”
    • This confirms the product repository workflow can use its configured Secret to read two existing historical Decision/Waitpoint records from private governance main. No credential value or private record contents were printed; no npm publication/Tag/Release performed.
    • The probe enforces CORTEX_AUTO_RELEASE_ENABLED=false (confirmed by its success in the GitHub runner). Keep disabled until remaining release approvals are complete.
    • Limitation: successful reads do not demonstrate that the credential cannot write; its least-privilege scope must be confirmed in GitHub's Token/App configuration separately.
    • Remaining: official v1.15.4 exact-head canonical release Decision + owner-released Waitpoint, distinct qualified reviewer issue for the already-merged release-prep PR chore(release): prepare v1.15.4 version parity and release notes #51, npm Trusted Publisher settings and controlled dry-run/publication. Do not automatically set the switch to true or send owner publication command now.

    Status: CREDENTIAL_READ_VERIFIED / AUTO_RELEASE_DISABLED / NPM_1_15_4_NOT_PUBLISHED.

  3. Kucell commented on Oct 10, 2026

    @Kucell
    Kucell
    on Oct 10, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    v1.15.4 single-maintainer release deadlock remediation — 2026-10-10

    The user explicitly approved the single-maintainer release policy direction. Concrete GitHub work:

    • Product PR #60 merged successfully as d59bb2c48c74d89f0694656276b6c1209aec2b33; this is the currently observed product main commit and candidate version remains 1.15.4.
    • Exact PR head 18dd3b4f223d5df7a08b8e4fd411a92efb077378: Automatic Preflight #38027736150 PASS: gate/contract tests 25/25, M040 271/271, real reconcile CLI 9/9, npm pack; M040 validation #38027736086 PASS.
    • Release-prep PR chore(release): prepare v1.15.4 version parity and release notes #51 actual merge SHA a386e79a5471747b119220346436b5142b66c677 is a verified ancestor of current product main. New verifier no longer requires it to equal current main only when a real approved, resource-bound Decision explicitly selects approve-single-maintainer for v1.15.4. All other release paths retain independent review and current-source validity. Any outstanding CHANGES_REQUESTED still blocks publication.
    • Private governance read-only token probe on product main succeeded previously in run 38027297424. Existing auto-release repository variable was confirmed false by that runner.
    • No GitHub v1.15.4 tag, Release, npm publish or successful full npm Release run has been observed. Never label this version published based on code merging.

    Final release prerequisites:

    1. The actual current main SHA d59bb2c48c74d89f0694656276b6c1209aec2b33 must be verified as frozen/validated. Run existing npm Release dry-run via workflow_dispatch on main with release_type=current, dist_tag=latest, publish=false (still safe/does not need release Decision).
    2. Real governance /release Owner must create an open Decision and Waitpoint bound to exactly release:cortex-agent@d59bb2c48c74d89f0694656276b6c1209aec2b33, record the user's informed version-specific decision using selected option approve-single-maintainer and explicit rationale, then release matching Waitpoint via the owning workflow after verifying live Owner/Lease. Do not fabricate these with PR comments or replay v1.15.0 approvals.
    3. To trigger automatic comment-based publication, the user must set CORTEX_AUTO_RELEASE_ENABLED=true only after the above, and the repo owner must post the exact /cortex-release publish v1.15.4 decision=D-... waitpoint=WP-... on merged release-prep PR chore(release): prepare v1.15.4 version parity and release notes #51. Runner rechecks current main, file allowlist, ancestry, user-approved governance and tag before npm OIDC publish.
    4. If the user chooses manual workflow_dispatch publish=true, supply release_pr=51, expected_sha=d59bb2c48c74d89f0694656276b6c1209aec2b33 and the exact approved Decision/Waitpoint IDs; same authority Gate applies.
    5. Verify npm registry cortex-agent@1.15.4, npm latest dist-tag, v1.15.4 Git Tag and GitHub Release and log their real run IDs.

    This update is coordination / release candidate evidence, not itself an authoritative Decision/Waitpoint/Owner/Lease write or npm effect. Current connected GitHub API supports PR/commit/issue operations but does NOT expose GitHub Actions workflow_dispatch trigger; that is an execution limitation, not evidence of publication.

  4. Kucell commented on Oct 10, 2026

    @Kucell
    Kucell
    on Oct 10, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    v1.15.4 — actual full npm Release dry-run PASS (2026-10-10)

    Verified user-linked workflow run 38028994572 / job 114145784562 through GitHub API and job logs.

    • Exact product main SHA: d59bb2c; event workflow_dispatch; completed/success.
    • Logged inputs: release_type=current, target=1.15.4, dist_tag=latest, publish=false.
    • Frozen install, architecture guard, M040 271/271, shipped real reconcile CLI 9/9, npm pack --dry-run and release state check all succeeded.
    • Publish-related steps (authorization for publish, Git tag, npm publish, GitHub Release) SKIPPED deliberately. No official v1.15.4 publication claimed.
    • Existing checkout cleanup gitlink warning persists separately as Issue fix(ci): reconcile .agent gitlink with missing .gitmodules metadata #49.

    NEXT: a real verified Governance Owner must bind an approved release Decision selecting the explicitly permitted approve-single-maintainer option, with v1.15.4-specific rationale and matched owner-released Waitpoint for release:cortex-agent@d59bb2c. A chat message/issue comment is not canonical governance authority.

    Once the formal gate exists, the existing npm-release.yml OIDC workflow can run from main: release_type=current; dist_tag=latest; publish=true; release_pr=51; expected_sha=d59bb2c48c74d89f0694656276b6c1209aec2b33; decision_id and waitpoint_id from real private governance records. Do not use an ad hoc npm token or skip the verifier. The auto-release repo flag remains disabled until actual approval is completed.

    State: DRY_RUN_PASS / CANONICAL_RELEASE_GATE_PENDING / NPM_PUBLISH_NOT_RUN. Direct npm registry status could not be independently checked from this runtime; tag/release absent at inspection.

  5. Kucell commented on Oct 10, 2026

    @Kucell
    Kucell
    on Oct 10, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    EXPLICIT USER RELEASE REQUEST — cortex-agent@1.15.4 latest

    The user explicitly instructs: “发布”. This refers to the already validated cortex-agent@1.15.4 release candidate on product main d59bb2c and npm dist-tag latest. Previous user approval explicitly covers the single-maintainer path, but this comment is only durable evidence of user intent, NOT a canonical Decision or released Waitpoint.

    Live verification: main SHA unchanged, npm Release dry-run #38028994572 on that exact SHA PASSED with current/latest/publish=false. No v1.15.4 tag or GitHub Release; no successful publish=true workflow run. Existing owner-comment runs are SKIPPED because auto-release is disabled as requested.

    BLOCKERS to perform the real effects: canonical Owner /release must register a new resource-bound v1.15.4 Decision with selected option approve-single-maintainer and an owner-released matching Waitpoint for release:cortex-agent@d59bb2c. The ChatGPT GitHub connector exposes no GitHub Actions workflow_dispatch operation, so it cannot directly start publish=true, even once the Decision is available. Do NOT fabricate approval IDs, publish via PAT/CLI outside OIDC, or flip auto-release variable without explicit activation gate.

    Once authoritative records exist, start existing npm-release.yml from main: release_type=current; dist_tag=latest; publish=true; release_pr=51; expected_sha=d59bb2c48c74d89f0694656276b6c1209aec2b33; decision_id=; waitpoint_id=. Verify registry, tag, release and exact run before marking done.

    Recommended owning action: complete the /release Decision/Waitpoint in an authorized governance environment, run the OIDC workflow, post proof here. User should not be asked to redo already passed tests or reconfigure the confirmed private read-only secret.

  6. Kucell commented on Oct 10, 2026

    @Kucell
    Kucell
    on Oct 10, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Simplified owner release implementation MERGED — user approved (2026-10-10)

    • Governance repo PR chore(m042): sync reconciled M-041 before revalidation #20 squash merged: 5efad952e6ca64b96807c5172e730606b12a6628.
    • Product repo PR feat(release): one-click owner npm publishing with auditable authorization #62 squash merged: ea360b6 (confirmed product main).
    • Exact PR feat(release): one-click owner npm publishing with auditable authorization #62 head a8a117c passed release/security 29/29, M040 275/275 and CLI 9/9 checks on two green workflows.
    • main workflow_dispatch form inspected after merge: ONLY publish boolean, default false. Current commit/package/version is detected by the runner; manual mode requires actual GitHub Owner and GITHUB_TRIGGERING_ACTOR owner, bind exact main, and saves GitHub-native receipt. Automatic issue_comment path keeps canonical GovernanceStore Decision/Waitpoint and is opt-in; no forgery of those records.
    • Workflow file name unchanged: .github/workflows/npm-release.yml; npm OIDC still used. The existing release workflow reruns frozen install, architecture, product and CLI tests and confirms registry/tag state before any writes.
    • v1.15.4 tag was absent after merge. No npm publish=true run is observed. Do NOT mark published until a real GitHub run succeeds and npm registry, tag and release are confirmed.

    NEXT OWNER INTERACTION: Open https://github.com/Kucell/cortex-agent/actions/workflows/npm-release.yml, select main, check Publish the prepared current version, Run workflow. No PR number, exact SHA, Decision/Waitpoint fields. Check workflow/job status, npm registry v1.15.4 latest dist-tag, Git tag, GitHub Release. A full safe un-checked dry-run on new main may be used first but publish run itself re-validates everything.

    Remaining unrelated issue: GitHub Actions checkout post-job cleanup .agent gitlink missing .gitmodules warning tracked at #49; previous CI checks still concluded success.

  7. Kucell commented on Oct 10, 2026

    @Kucell
    Kucell
    on Oct 10, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    v1.15.4 — REAL npm OIDC PUBLICATION SUCCESS (2026-10-10)

    Verified the user-reported publication from exact GitHub Actions evidence:

    • npm Release workflow run #38031238351 on product main ea360b6697ecac9a37090e7b40df14b8a3585d8f completed SUCCESS; real job 114152442848 completed SUCCESS.
    • Owner-dispatch authorization succeeded 3 times (before validation, before Git tag, before npm effect). GitHub action actor was verified as authenticated owner in the job. CORTEX_AUTO_RELEASE_ENABLED is not needed for explicit manual one-click path.
    • M-040 275/275 and shipped CLI entrypoint regression 9/9 PASS; tag/main immutability, release state and OIDC npm publishing steps all SUCCESS.
    • Actual npm publish output in release job log, not just a step label: npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access, then + cortex-agent@1.15.4 at 2026-10-10T06:32:17Z. This proves registry accepted the upload. Independent public Registry endpoint check was unavailable in this chat runtime due DNS/network restrictions; this is distinguished from the successful npm CLI receipt.
    • Git Tag v1.15.4 exists; annotated tag object 439fcc7048b341286c0ac1d72c743e216ac1b7dd points to exact product main ea360b6697ecac9a37090e7b40df14b8a3585d8f.
    • GitHub Release v1.15.4 is public, published at 2026-10-10T06:32:18Z, not Draft/Prerelease.

    STATUS: PUBLISHED / GITHUB_OIDC_JOB_PASS / GIT_TAG_VERIFIED / RELEASE_VERIFIED / AUDIT_RECEIPT. The user no longer needs to configure Token or rerun publication. One-click owner-release path is operational. Automatic comment-triggered publishing remains opt-in and is not implied enabled by this manual release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions