Repository navigation
ci: stage frozen Go27 bridge authority - #1024
Merged
Merged
Conversation
Bind the independently reviewed five-file bridge without adopting executable code. Preserve existing active and unrelated staged contexts; adoption and promotion remain separate changes.
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stage the independently reviewed Go 1.27.1 policy bridge. This is the first
authority-only transition in a twelve-PR rollout, not executable adoption.
action rows, fifty command rows and two executable rows.
at
667a58a396b7c80af0ae7fb7bbb3a0b1c8b0c95e.staged contexts, empty secret policy and every current executable byte.
Adoption of the exact five frozen files and promotion of the realized pair
are separate subsequent PRs. No scanner, runner, permission, secret, release
configuration or source-module change is included here.
Verification
The trusted predecessor scanner accepts the candidate's eleven workflows.
Policytool tests, differential lint, actionlint and diff checks pass locally.
The frozen guard's complete tests and actual stage/adopt/promote chain pass
on macOS and nonroot Linux with the original harness retained.
The unchanged original full harness reproduces the approved synthetic fixture
failure,
authority manifest may contain at most one staged bundle. Theexternal repaired harness passes against the real staged candidate with event
variables unset. It is not installed by this PR.
Exact-candidate native Go 1.27.1 analysis requests/extracts all fourteen modules
with complete package coverage, twelve without failure diagnostics and only
the two approved conformance metadata errors. Its 61 finding occurrences match
the approved baseline; scanner and reporter both retain exit 1. The separate
scoped gate exits 0, while strict mode still exits 1 for the actual errors.
Source bytes, modes, clean SHA and owned-container cleanup are verified.
Fresh external original-input staged, adopted and promoted full harnesses,
trusted staged-adoption scans and paired promotion scans all exit 0 on macOS
and registered nonroot Linux. Every input's bytes, modes, status and index are
preserved; the original harness remains installed in all three states. The
fixtures are external synthetic clones executing the real policy/parser/guard,
not production adoption. Linux isolation and owned-container cleanup are
verified. Independent exact-head production review found no blocking issues.
Hosted checks and review remain required before merge. No hosted-green claim
is made here.
Bootstrap Constraints
The approved exceptions are limited to the two named existing harness fixture
causes, unchanged existing vulnerability findings, fourteen exact hosted
Go 1.26.2/minimum 1.26.5 analysis errors, and two exact native conformance
metadata errors backed by complete extraction and independent Go 1.27.1
provenance. Unmatched errors or new findings block. The harness exception
expires when the scheduled repair is adopted; both scanner exceptions expire
after the final rollout receipt and cannot carry into source changes.
Doc-reconciliation: clean (authority-only diff; later adoption explicitly
identified).