docs(release): record verified rc1 artifact set by bioedca · Pull Request #236 · bioedca/tether

bioedca · 2026-07-27T01:15:33Z

Summary

Closes #165.

This change records the retained v1.0.0-rc1 rehearsal in the existing release guide:

lists all 13 project-uploaded assets with their exact GitHub-reported byte counts and distinguishes the two on-demand GitHub source archives that make 15 visible downloads;
documents that SHA256SUMS.txt covers the other 12 uploaded assets, not itself or the generated source archives;
provides Linux, macOS, and Windows checksum verification plus workflow/tag/commit-constrained GitHub attestation verification for all four installers;
records the unsigned Windows/macOS state and Linux integrity model;
records that the installer bundles Tether's GPL license but RC1 did not stage/package Tether's root NOTICE; neither is a standalone RC1 upload;
uses standard Markdown headings and fenced blocks that render correctly under the pinned MkDocs configuration; and
records intentional prerelease retention and the absence of a prerelease docs.yml publication.

No workflow, tag, Release, signing setting, repository setting, dependency, or file outside docs/release.md changes.

Linked tracking

Closes: docs(release): record the verified v1.0.0-rc1 artifact set #165
Milestone: M9 — Packaging & docs
FR: n/a — release documentation evidence
Review path (may only increase): high
Risk rationale: the diff is prose-only, but it records release artifact integrity, signing state, and publication behavior; release judgment is material.
Base SHA at PR creation: 02a66a3bd8b64e698a3fb794fdca906ca84afbb2
Current exact head SHA: 7e85788f68f10d30de211dbd950bbf927e38f0e9
Optional Copilot state: quota-exhausted in review 4783056297 (automatic/best-effort; non-blocking)
Prior qualifying review: substantive CodeRabbit review 4783271042, run 1ec6bb54-3436-460c-a230-d0c74590a1a2, on superseded head 7103527728e509143976a9d93b00b117def831a7; all two major findings and the review-body nitpick were validated and addressed.
Required independent review result: complete — substantive CodeRabbit full review run 183f928f-9863-4471-9aed-87ca313d1063 was triggered by coordinator comment 5087157203, completed in reply 5087157697, reviewed the exact range 02a66a3bd8b64e698a3fb794fdca906ca84afbb2…7e85788f68f10d30de211dbd950bbf927e38f0e9, and reported zero actionable findings.
Current CodeRabbit status: qualifying full review complete on the exact current head; the separate green status context is non-qualifying by itself, and no worker review trigger was sent.
Human/domain state: complete - the authenticated maintainer approved exact head 7e85788f68f10d30de211dbd950bbf927e38f0e9 for qualified release/domain judgment; durable coordinator record: comment 5092624432.
Review conversations: all four pre-existing inline threads were evidence-replied and resolved on the current head.
Author-side final diff review: complete on 7e85788f68f10d30de211dbd950bbf927e38f0e9; no remaining actionable findings.

Evidence

Retained prerelease: v1.0.0-rc1, published 2026-07-21, still present and marked prerelease.
Live GitHub Release API recheck on 2026-07-27: exactly 13 uploaded assets; every documented filename and byte count matched.
GitHub's current official release documentation confirms ZIP and tarball source archives are generated on demand; these account for the 15 visible downloads.
Downloaded SHA256SUMS.txt (1,112 bytes, SHA-256 b54b05de939945185a933ea86d73cdf328038e138b267a13245b83fe7822ae54) lists exactly the other 12 uploaded assets and excludes the generated archives.
Live attestation API queries for each installer digest returned the same four-subject provenance statement. Its certificate/source claims bind .github/workflows/release.yml, refs/tags/v1.0.0-rc1, and commit 1ba112683a0f2a5ba842e39893fd757bff2d18b3.
GitHub CLI 2.95.0 help and the current official CLI manual confirm the documented --signer-workflow, --source-ref, and --source-digest constraints.
RC1 tag-source audit confirmed only LICENSE is staged as the constructor license_file; the root NOTICE is not packaged.
Pinned MkDocs rendering reproduced the unsupported raw tab markers before the fix and semantic headings/language code blocks after it.
Default markdownlint-cli2 0.18.1 independently reproduced four MD046 findings before the fix and zero afterward; the repository itself has no markdownlint config/gate.
Release run 29791767414: tag verification, all four build+sign jobs, and publish release concluded successfully.
docs.yml history still contains only the two 2026-07-15 manual dispatches; no RC publication run exists.
Maintainer evidence: issue comment 5029161546.

Type of change

feat — new capability
fix — bug fix
docs / chore / ci / build / refactor / test / perf
! / BREAKING CHANGE: — a deliberate schema-version bump

Self-review checklist (PRD §12.4)

Testing

Current-head local evidence:

Live Release/document semantic audit — 13/13 filenames and byte counts matched, the combined manifest matched the other 12 uploads, all required corrected wording was present, and docs/release.md was the only changed file.
pytest -p no:cacheprovider tests/test_marker_contract.py -q — 27 passed.
pre-commit run --all-files --show-diff-on-failure — passed.
QT_QPA_PLATFORM=offscreen pytest -p no:cacheprovider -m "not large and not sidecar and not deep" -q — 2,551 passed, 6 skipped, 34 deselected.
UV_SYSTEM_CERTS=true uvx --with-requirements requirements-docs.txt mkdocs build --strict — passed.
rendered HTML audit — semantic platform headings/fenced code blocks; no raw === tab markers.
markdownlint-cli2 0.18.1 focused audit — zero MD046 findings.
git diff --check — passed.

Current-head hosted evidence:

All 14 CI/security checks are green, including Windows/macOS/Linux tests, docs-build, pre-commit, lint, schema-guard, sidecar parity, lock verification, secret scan, commitlint, and both CodeQL analyses.
The separate CodeRabbit status check is non-qualifying by itself; qualifying full review run 183f928f-9863-4471-9aed-87ca313d1063 completed on the exact current range with zero actionable findings.

Author-side final diff review completed at 7e85788f68f10d30de211dbd950bbf927e38f0e9; no remaining actionable findings.

Summary by CodeRabbit

Documentation
- Added release-candidate documentation covering archived project assets and their reported sizes.
- Added platform-specific installer checksum verification instructions.
- Added guidance for validating installer build provenance.
- Documented unsigned RC installer status and clarified documentation publishing behavior for prereleases.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-07-27T01:15:41Z

📝 Walkthrough

Walkthrough

Adds documentation for the retained v1.0.0-rc1 release assets, platform-specific installer integrity checks, GitHub attestation verification, signing status, and prerelease documentation publishing behavior.

Changes

Release documentation

Layer / File(s)	Summary
Recorded RC asset set `docs/release.md`	Records the 13 published assets, their byte sizes, the historical absence of `deep-conda-lock.yml`, and license and notice delivery details.
Installer verification and release status `docs/release.md`	Documents Linux, macOS, and Windows checksum commands, GitHub attestation verification, unsigned installer status, retained prerelease evidence, and stable-release documentation publishing.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

bioedca/tether#146: Updates release documentation for installer integrity, provenance verification, and signing behavior.
bioedca/tether#230: Covers release artifact handling and installer verification context.

Suggested labels: area:packaging

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The diff matches `#165` by updating only docs/release.md with the RC1 asset list, verification steps, retention note, and docs publication status.
Out of Scope Changes check	✅ Passed	No out-of-scope changes are evident; the PR touches only docs/release.md and stays within the linked documentation task.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title is concise, conventional, and accurately summarizes the main docs/release evidence update.
Description check	✅ Passed	The description largely follows the template and fills the required summary, tracking, change type, checklist, and testing sections.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7103527728

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

bioedca · 2026-07-27T01:28:29Z

Automated Codex coordinator queue record for the required final-head CodeRabbit walkthrough. This records provider state only; it is not a review or merge approval.

bioedca · 2026-07-27T01:31:47Z

@coderabbitai review

coderabbitai · 2026-07-27T01:31:52Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

bioedca · 2026-07-27T02:35:13Z

@coderabbitai review

coderabbitai · 2026-07-27T02:35:19Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

docs/release.md (1)
71-96: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Resolve the MD046 warnings for the installer examples.

markdownlint-cli2 reports the four indented code blocks at Lines [73], [79], [85], and [91]. Convert them to fenced blocks compatible with the MkDocs tab syntax, or add a narrowly scoped lint exception.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/release.md` around lines 71 - 96, Update the four installer examples
under the Linux, macOS (Apple silicon), macOS (Intel), and Windows PowerShell
tabs to use fenced code blocks compatible with the existing MkDocs tab syntax,
eliminating the MD046 warnings while preserving each command and language
designation.
Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/release.md`:
- Around line 36-57: Update the “What a published Release contains” section to
distinguish the 13 uploaded project assets from the release’s 15 total assets,
explicitly identifying the two omitted GitHub-generated source archives. Clarify
that SHA256SUMS.txt covers the uploaded project assets and excludes those
generated archives, while preserving the existing 13-asset inventory and
recorded sizes.
- Around line 101-109: Update the attestation verification command in the
release documentation to include filters for the claimed workflow, tag, and
commit using --signer-workflow, --source-ref, and --source-digest. Ensure the
documented check accurately covers all four installers; otherwise explicitly
scope it to the Linux installer instead of implying coverage of all artifacts.

---

Nitpick comments:
In `@docs/release.md`:
- Around line 71-96: Update the four installer examples under the Linux, macOS
(Apple silicon), macOS (Intel), and Windows PowerShell tabs to use fenced code
blocks compatible with the existing MkDocs tab syntax, eliminating the MD046
warnings while preserving each command and language designation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 1ec6bb54-3436-460c-a230-d0c74590a1a2

📥 Commits

Reviewing files that changed from the base of the PR and between 02a66a3 and 7103527.

📒 Files selected for processing (1)

docs/release.md

bioedca · 2026-07-27T03:03:22Z

Review-body MD046 nitpick validation for signed head 7e85788f68f10d30de211dbd950bbf927e38f0e9:

The repository has no markdownlint configuration or markdownlint pre-commit/CI gate, but the report was independently reproducible with cached markdownlint-cli2 0.18.1 (markdownlint 0.38.0): the prior page produced exactly four MD046 findings at the four installer blocks.
The rendering defect was independently confirmed with the pinned docs toolchain (mkdocs==1.6.1, mkdocs-material==9.7.7): the unsupported tab markers rendered as literal <p>=== "Linux"</p> text and the indented fences rendered literally inside <pre><code>.
The new head uses standard level-five headings and top-level fenced blocks. The same markdownlint invocation now reports zero MD046 findings, and mkdocs build --strict renders semantic headings and language-classed code blocks with no raw tab markers.

This evidence addresses the review-body nitpick; the overlapping Codex tab thread was replied to and resolved. No external review was triggered by this comment.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e85788f68

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

bioedca · 2026-07-27T04:09:19Z

@coderabbitai full review

coderabbitai · 2026-07-27T04:09:25Z

✅ Action performed

Full review finished.

bioedca · 2026-07-27T14:30:04Z

Qualified release/domain review attestation (swarm-20260727T000627Z-1093f8): the authenticated maintainer approved exact PR head 7e85788f68f10d30de211dbd950bbf927e38f0e9 in the coordinator run channel after being asked to attest the release-documentation judgment. Scope: the verified v1.0.0-rc1 artifact-set release documentation. Base binding when recorded: main@02a66a3bd8b64e698a3fb794fdca906ca84afbb2. This attestation is exact-head-bound; any head change invalidates it. The coordinator will still independently revalidate every required gate immediately before merge.

docs(release): record verified rc1 artifact set

7103527

Copilot AI review requested due to automatic review settings July 27, 2026 01:15

Copilot AI reviewed Jul 27, 2026

chatgpt-codex-connector Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread docs/release.md Outdated

Comment thread docs/release.md Outdated

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread docs/release.md

Comment thread docs/release.md Outdated

docs(release): address verified rc1 review findings

7e85788

chatgpt-codex-connector Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread docs/release.md

bioedca mentioned this pull request Jul 27, 2026

docs(release): correct stale stability release status #240

Closed

3 of 9 tasks

bioedca merged commit bc61113 into main Jul 27, 2026
15 checks passed

bioedca deleted the docs/issue-165-verified-rc1-artifact-set branch July 27, 2026 14:42

Conversation

bioedca commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked tracking

Evidence

Type of change

Self-review checklist (PRD §12.4)

Testing

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

bioedca commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bioedca commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bioedca commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bioedca commented Jul 27, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

bioedca commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bioedca commented Jul 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bioedca commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

bioedca commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading