Skip to content

Influence Operating Framework v1.0.2

Latest
Latest

Choose a tag to compare

View all tags
@BradGroux BradGroux released this 23 Aug 01:02
v1.0.2
This tag was signed with the committer’s verified signature.
BradGroux Brad Groux
SSH Key Fingerprint: EKmFG8TU58Rz+2TGF/Wu4N3PmLu2+zcNFhhKhvI9k3Q
Verified
Learn about vigilant mode.
cc5a25d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Version 1.0.2 removes the two remaining release-integrity caveats from v1.0.1 without changing canonical framework meaning or rewriting prior release history.

Changed

  • Added a dedicated GitHub-registered Ed25519 release-signing identity and tracked only its public allowed-signers entry.
  • Added scripts/validate-release.sh, which requires a clean worktree and complete Git history.
  • Required signed annotated version tags that verify against the tracked public key and resolve exactly to the released commit.
  • Kept ordinary shallow-clone contributor validation useful with explicit partial-history reporting.
  • Updated CI to exercise the full-history release gate and fail closed for shallow release validation.
  • Synchronized VERSION, CITATION.cff, the changelog, governance baseline, charter status, release record, and review records at 1.0.2.

Release identity

  • Signed annotated tag: v1.0.2
  • Tag object: 9aaf9341b88b6e6c5475ba3eb0d9356255d42ed9
  • Released merge commit: cc5a25d3523a33347c75644d4f41920822cb12f5
  • Signing-key fingerprint: SHA256:EKmFG8TU58Rz+2TGF/Wu4N3PmLu2+zcNFhhKhvI9k3Q
  • GitHub signature result: verified and valid

Only the public key is committed. The private key remains outside the repository with restrictive local permissions.

Verification

  • Complete-history release gate passed on the candidate and merged main.
  • Repository checks passed: 37 required files, 59 Markdown documents, 119 local links and anchors, 28 review records, 210 historical citations, and 40 public-history commits after merge.
  • Mermaid rendering passed 8/8.
  • Depth-1 contributor validation passed with explicit partial-history reporting.
  • Depth-1 release validation failed with actionable unshallow guidance.
  • Independent repository-standards review: GO, zero findings.
  • Independent issue-requirements review: GO, zero findings.
  • Pull-request, merged-main, and signed-tag workflows passed.
  • The merged tree exactly matches the PR head tree, and the exact reviewed commit remains reachable.

Compatibility and limits

Open Framework Commons v1.1.0 adoption remains unchanged. This patch affects release stewardship only; it does not change the six concerns, seven practice moves, responsible-practice standard, measurement guidance, glossary, or examples.

Signature verification establishes control of the registered signing key. It does not establish real-world, organizational, legal, ethical, accessibility, professional, or domain validation.

Closes #13.

Assets 2
Loading