Skip to content

v0.3.1 — complete the register policy diff

Choose a tag to compare

View all tags
@mikim mikim released this 19 Jul 01:20
v0.3.1
48c5b53
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Completes the register policy diff so a base-branch, human-reviewed assurance item cannot silently disappear regardless of the form the change takes — deletion, whole-register removal, or a status that closes it out. From a fourth external review of v0.3.0. No schema changes; existing adopters see only stricter drift-job findings, and only on pull requests that actually remove reviewed assurance. See CHANGELOG.md.

Canonical pin for adopters: v0.3.1 @ 48c5b53214c3710f0f22492302044a7ece96fcdc (this tag's commit).

Fixed — register policy diff completeness

  • Whole-register removal is now caught (was fail-open). The diff skipped a register entirely when the head branch lacked it, so deleting an optional register file (e.g. INVARIANTS.yaml under the core profile, where it is not required) erased every reviewed entry with no finding. A base register absent on the head is now a "register removed" finding listing the former IDs; an unreadable head register fails closed.
  • Closing dispositions are now caught. A residual moved to RESOLVED, a defeater moved to MITIGATED/RESOLVED/WITHDRAWN, and a recorded CONTRADICTED status cleared (moving away from CONTRADICTED) each retire a tracked concern without deleting its ID; now findings, under the same stage-proportional acknowledgment. Re-opening and recording a new contradiction remain non-findings.
  • Claim basis removal is now caught. Removing a claim's evidence, supporting invariants, or limitations items is flagged — stripping a claim's basis is a mechanism change, not a wording change.

Security

  • The drift job's assurance-diff step runs git with --literal-pathspecs, screens pull-request-controlled paths: values through an in-tree containment check (matching the validator's accept-set) before using them as pathspecs or write targets, and fails closed if git diff errors instead of proceeding with an empty diff.

Upgrade actions when re-pinning

Update upstream.version, upstream.commit, and the caller's @ reference to the SHA above in the same change; the pull-request description needs an Assurance policy change: <why> line. The caller must pin the workflow by full SHA (unchanged from v0.3.0).

Assets 2
Loading